SOUTH DAYTON ACUTE CARE CONSULTANTS, INC.
NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
General Purpose: During your treatment at South Dayton Acute Care Consultants, Inc. (also known as and hereinafter referred to as “SDACC”), doctors, nurses, and other caregivers may gather and/or generate information about your medical history and your current health. This notice will explain how such information may be used and shared with others. It will also explain your privacy rights regarding this kind of information.
Our Duties: SDACC is required by law to take reasonable steps to maintain the privacy of SDACC’s patients’ personally identifiable Protected Health Information (“PHI”) and to inform you regarding SDACC’s legal duties and privacy practices, specifically: (1) SDACC’s uses, disclosures and privacy practices with respect to your PHI; (2) your privacy rights with respect to your PHI; (3) your right to file a complaint with SDACC and/or to the Secretary of the U.S. Department of Health and Human Services (“Secretary”); and (4) the person(s) or office(s) to contact for further information regarding SDACC’s privacy practices.
Definitions: The term “personally identifiable Protected Health Information” or “PHI” is defined to mean and include all individually and personally identifiable personal health information about you transmitted or maintained by SDACC, regardless of form (oral, written, or electronic). The term “Treatment” is defined to mean the provision, coordination or management of health care and related services. It also includes but is not limited to consultations, examinations and testing, and referrals between one or more of your doctors, nurses and/or other health care providers. The term “Payment” includes, but is not limited to, actions to obtain coverage, determinations, and payment, including billing, claims management, subrogation, reviews for medical necessity and appropriateness of care and utilization review and preauthorizations that may be conducted or required by an insurer or third-party health care payor. The term “Designated Record Set” is defined to mean the medical records and billing records about you maintained by or for SDACC; enrollment, payment, billing, claims adjudication and case or medical management record systems maintained about you by or for a health plan; or other information used in whole or in part by or for SDACC to make decisions about you. Information used for quality control or peer review analyses and not used to make decisions about you is not in the designated record set.
Amendment and Receipt of Notice: We shall comply with the terms of this Notice so long as it remains in effect. We reserve the right to change the terms of the Notice of Privacy Practices as we deem necessary and to apply any such changes to any PHI received or maintained by us prior to that date. If a privacy practice is changed, the new version of this notice will be provided to all patients for whom SDACC still maintains PHI by posting it in the offices of SDACC. Any revised version of this notice will be distributed by posting at SDACC’s offices. You may also receive a paper copy of this notice or any amendment thereof at any of our offices during normal business hours upon request. If you agree to receive electronic notices by e-mail, then you may receive an electronic copy of this notice or any amendment thereof by e-mail upon request. Even if you have agreed to receive electronic notice, you may still request to receive a paper copy in the manner set forth above.
Application of Federal Law: PHI use and disclosure by SDACC is regulated by a federal law known as the Health Insurance Portability and Accountability Act (“HIPAA”). You may find the federal rules enacted to enforce the privacy requirements of HIPAA at 45 Code of Federal Regulations Parts 160 and 164. This notice attempts to summarize our duties and your rights under the regulations. The regulations will supersede any discrepancy between the information in this notice and the regulations. This notice and summary is not intended as and should not be treated as legal advice.
Minimum Necessary Standard: When using or disclosing PHI or when requesting PHI from another covered entity, SDACC will make reasonable efforts not to use, disclose or request more than the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure or request, taking into consideration practical and technological limitations. However, the minimum necessary standard will not apply in the following situations:
(a) disclosures to or requests by a health care provider for treatment purposes;
(b) uses or disclosures made to you or authorized by you;
(c) disclosures made to the Secretary of the U.S. Department of Health and Human Services;
(d) uses or disclosures that are required by law; and
(e) uses or disclosures that are required for SDACC’s compliance with the HIPAA legal regulations.
Applicability: This notice does not apply to information that has been de-identified. De-identified information is information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual. Such information is not individually identifiable health information and will not constitute PHI for purposes of this notice.
USES AND DISCLOSURES OF YOUR PERSONAL HEALTH INFORMATION
• Your Authorization. Except for the uses and disclosures outlined below in the following sections, we will not use or disclose your PHI for any purpose unless you have signed a form authorizing the use or disclosure. You have the right to revoke that authorization in writing unless we have taken any action in reliance on the authorization. Such revocation shall not be effective as to prior disclosures or actions taken in reliance upon the authorization and shall not be effective until delivered to and received by SDACC in the manner set forth below. Most uses and disclosures of psychotherapy notes, uses and disclosures of PHI for marketing purposes and disclosures that constitute the sale of PHI require your written authorization.
• Uses and Disclosures for Treatment. We will make uses and disclosures of your PHI without your consent, authorization or opportunity to agree or object, as necessary for your treatment. For instance, doctors, nurses and other professionals involved in your care will use information in your medical record and information that you provide about your symptoms and reactions to plan a course of treatment for you that may include procedures, medications, tests, etc. For instance, if, after you leave the hospital, you are going to receive home health care, we may release your PHI to that home health care agency so that a plan of care can be prepared for you.
• Uses and Disclosures for Payment. Your PHI will be used without your consent, authorization or opportunity to agree or object, as needed, to obtain payment for your healthcare services. This may include certain activities that your health insurance plan or other applicable insurer or third-party health care payor may undertake before it approves or pays for the health care services we recommend for you such as; making a determination of eligibility or coverage for insurance benefits, reviewing services provided to you for medical necessity, and undertaking utilization review activities. For example, obtaining approval for a hospital stay may require that your relevant PHI be disclosed to the health plan to obtain approval for the hospital admission. We may also disclose your PHI, without your consent, authorization or opportunity to agree or object, as needed, to another health care facility, health care professional, or health plan for such things as quality assurance and case management, but only if that facility, professional, or plan also has or had a clinical relationship with you or is about to enter into such relationship with you for which the PHI is necessary for admittance, entrance into or acceptance for treatment.
• Uses and Disclosures for Health Care Operations. We may use or disclose your PHI for our own health care operations such as making sure that our patients receive quality care and cost effective services. For example, we may use PHI to review the quality of our treatment and services, and to evaluate the performance of our staff and employees caring for you. We may also disclose your PHI to another covered entity for health care operations activities of the other covered entity, if the other covered entity either has or had a relationship with you, the PHI pertains to such relationship, and is for the purpose of certain types of health care operations (such as quality assessment or evaluating practitioner performance) or for the purpose of health care fraud and abuse detection or compliance.
• Family and Friends Involved In Your Care; Disaster Relief; Deceased Individuals. With your approval, we may from time to time disclose your PHI to designated family, relatives, friends, and others who are involved in your care or in payment of your care in order to facilitate that person’s involvement in caring for you or paying for your care. In certain circumstances, if you have not objected after notice of our intention to disclose your PHI to a family member, relative, or friend, or if SDACC reasonably can infer based on professional judgment under the circumstances that you do not object to the disclosure, and if the PHI is directly relevant to that person’s involvement with your care or payment for that care, or the PHI is needed for notification purposes, we may disclose your PHI to such person. If you are unavailable, incapacitated, or facing an emergency medical situation and we determine that a limited disclosure may be in your best interest, we may share limited PHI with such individuals without your approval. We may also disclose limited PHI to a public or private entity that is authorized to assist in disaster relief efforts in order for that entity to locate a family member or other persons that may be involved in some aspect of caring for you. If you are deceased, we may disclose to a family member or others involved in your care or payment for care prior to your death, your PHI that is relevant to such person’s involvement, unless doing so is inconsistent with your prior expressed preference that is known to us.
• Personal Representatives. You may exercise your rights through a personal representative. Your personal representative will be required to produce evidence of his/her authority to act on your behalf before that person will be given access to your PHI or allowed to take any action for you. Proof of such authority may take one of the following forms:
(a) a power of attorney for health care purposes, notarized by a notary public;
(b) a court order of appointment of the person as the conservator or guardian of
(c) the individual; or
(d) an individual who is the parent of a minor child.
SDACC retains discretion to deny access to your PHI to a personal representative if we reasonably believe that you have been or may be abused by such person or that it is not in your best interest for us to provide such person access to your PHI (to provide protection to those vulnerable people who depend on others to exercise their rights under these rules and who may be subject to abuse or neglect). This also applies to personal representatives of minors.
• Business Associates. Certain aspects and components of our services are performed through contracts with outside persons or organizations. At times it may be necessary for us to provide certain aspects of your PHI to one or more of these outside persons or organizations who assist us with our health care operations. In all cases, we require these business associates to appropriately safeguard the privacy of your information.
• Appointments, Services and Communications. We may contact you to provide appointment reminders or test results by phone. You have the right to request and we will accommodate reasonable requests by you to receive communications regarding your PHI from us by alternate means. For instance, if you wish appointment reminders not be left on voice mail or sent to a particular address, we will accommodate reasonable requests. Such request for alternative communications must be made in writing to Privacy Officer, SDACC, 33 West Rahn Road, Suite 102, Dayton, Ohio 45429.
Other Uses and Disclosures. We are permitted or required by law to make the following uses and disclosures of your PHI without your consent or authorization, and without an opportunity for you to agree or object:
• We may release your PHI for any purposes required by law;
• We may release your PHI for public health activities, such as required reporting of disease, injury, birth, death, and for required public health investigations. PHI may also be used or disclosed if you have been exposed to a communicable disease or are at risk of spreading a disease or condition, if authorized by law.
• We may release PHI to the government authority, including a social service or protective services agency, authorized by law to receive reports of abuse, neglect or domestic violence, if there exists a reasonable belief that you may be a victim of abuse, neglect or domestic violence and if (i) you agree to the disclosure, (ii) the disclosure is required by law and limited to the relevant requirements of such law or (iii) you are unable to agree because of incapacity and a law enforcement or other public official authorized to receive the report represents that the PHI for which disclosure is sought is not intended to be used against you and that an immediate enforcement activity that depends on the disclosure would be materially and adversely affected by waiting until you are able to agree to the disclosure. In any of the foregoing situations, we will promptly inform you or your personal representative, if applicable, that such a disclosure has been or will be made unless, in the exercise of professional judgment, SDACC believes that notifying you would place you at risk of serious harm or if the personal representative to whom the disclosure would be made is reasonably believed by SDACC to be responsible for the abuse, neglect or other injury and that informing such person would not be in your best interests. For the purpose of reporting child abuse or neglect, it is not necessary to inform the minor that such a disclosure has been or will be made. Disclosure may generally be made to the minor’s parents or other representatives, with the foregoing limitation regarding personal representatives, provided however, that there may be circumstances under federal or state law when the parents or other representatives may not be given notice and/or access to the minor’s PHI.
• We may release your PHI to the Food and Drug Administration, if necessary to report adverse events, to report product defects, to permit product recalls and to conduct post-marketing surveillance;
• We may release your PHI to your employer if all of the following circumstances are met:
(a) We have provided health care to you at the request of your employer; and the PHI is requested by the employer to conduct an evaluation relating to medical surveillance of the workplace or to evaluate whether you have a work-related illness or injury;
(b) The PHI consists of findings concerning a work-related illness or injury or a workplace-related medical surveillance;
(c) The employer needs such findings in order to comply with its obligations under 29 CFR parts 1904 through 1928, 30 CFR parts 50 through 90, or under state law having a similar purpose, to record such illness or injury or to carry out responsibilities for workplace medical surveillance; and
(d) SDACC has provided you with written notice that PHI related to work-related illness or injury or a workplace-related medical surveillance is disclosed to the employer either by giving you a written copy at the time that health care is provided or, if the care is provided on the work site, by posting the notice in a prominent place at the location where the health care is provided.
• We may release your PHI if required by law to a government oversight agency for oversight activities authorized by law including audits, investigations, inspections, licensure or disciplinary actions, or other activities necessary for appropriate oversight of our operations (for example, to investigate complaints against providers); and other activities necessary for appropriate oversight of the health care system, government benefit programs for which health information is relevant to beneficiary eligibility, entities subject to government regulatory programs for which health information is necessary for determining compliance with program standards or entities subject to civil rights laws for which health information is necessary for determining compliance.
• We may release your PHI if required to do so by a court or administrative order, subpoena or discovery request. In most cases, you will have notice of such release. In the event of a court order authorizing and ordering disclosure, SDACC shall only disclose the PHI specifically authorized and ordered. If SDACC receives a request, process or subpoena for PHI that is not accompanied by an appropriate court or administrative order authorizing and ordering the disclosure, SDACC will only make disclosure of your PHI if one of the following three options occurs:
(a) SDACC receives satisfactory assurance from the requesting party that the party has made reasonable efforts to ensure that you have been notified of the request by providing a written statement and accompanying documentation demonstrating that:
(i) said party has made a good faith attempt to provide written notice to you or, if your location is unknown, has mailed a notice to your last known address; and
(ii) the notice provided sufficient information about the litigation or proceeding in which the PHI is requested to permit you to raise an objection; and
(iii) the time for objecting to the court or administrative tribunal has passed and no objections were raised by you and/or any objections were resolved in favor of disclosure by the court or tribunal; or
(b) SDACC receives satisfactory assurance from the requesting party that the party has made reasonable efforts to secure a qualified protective order that meets the HIPAA privacy rules’ requirements by providing a written statement and accompanying documentation demonstrating that either:
(i) the parties to the dispute resulting in the PHI request have agreed to a “qualified protective order” (defined as an order that prohibits the parties from using or disclosing the PHI for any purpose other than the litigation or proceeding for which the PHI was requested and that also requires that the PHI be returned to SDACC or destroyed, including all copies whether electronic or hard copies at the end of the litigation or proceeding) and have presented the order to that applicable court or administrative law judge; or
(ii) the party seeking the PHI has requested a “qualified protective order”, as defined in the preceding subsection, from such court or administrative tribunal; or
(c) SDACC makes reasonable efforts to notify you equivalent to those efforts set forth in subpart (a) above or makes reasonable efforts to seek a “qualified protective order” as defined in subpart (b) above prior to disclosure.
• We may release your PHI to law enforcement officials as required by law to report wounds, injuries and crimes; or as requested by law enforcement to identify and locate a suspect, fugitive, material witness or missing person (limited to name, address, date/place of birth, social security number, ABO blood type and rh factor, type of injury, date and time of treatment, date and time of death, if applicable, and description of physical characteristics but not DNA, DNA analysis, dental records, typing, samples or analysis of body fluids or tissue); or if you are or are suspected to be a victim of crime and either you agree or you are unable to agree to the disclosure and a law enforcement official represents that the information is needed to determine whether a violation of law by a person other than you has occurred, that such information is not intended to be used against you, that immediate enforcement activity that depends on the disclosure would be materially and adversely affected by waiting until you are able to agree to the disclosure, and SDACC determines in its professional judgment that disclosure is in your best interests; to notify law enforcement of your death if SDACC suspects that your death may have resulted from criminal conduct; to notify law enforcement of PHI that SDACC believes in good faith constitutes evidence of criminal conduct that occurred on the premises of SDACC; if SDACC is providing emergency health care in response to an emergency not on the SDACC premises and if disclosure is necessary to alert law enforcement of the commission, nature, location, victims, identity, description and/or location of the perpetrator of a crime (other than abuse, neglect or domestic violence which are discussed above).
• We may release your PHI to organ procurement organizations or other entities engaged in the procurement, banking or transplantation of cadaveric organs, eyes, or tissue for the purpose of facilitating organ, eye or tissue donation and transplantation.
• We may release your PHI to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death or other duties as required by law.
• We may release your PHI to funeral directors consistent with the law, as necessary to carry out their duties with respect to you, if deceased.
• We may release your PHI for research purposes only in the limited circumstances set forth in 45 CFR 164.512(i) which imposes certain formal approval and prerequisite procedures to be met.
• We may release PHI consistent with applicable law and ethical conduct standards, if SDACC, in good faith and/or in reliance upon SDACC’s actual knowledge or a credible representation by a person with apparent knowledge or authority, believes that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and either:
(a) the disclosure is made to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat; or
(b) the disclosure is necessary for law enforcement authorities to identify or apprehend an individual either:
(i) because of a statement by an individual admitting participation in a violent crime that SDACC believes may have caused serious physical harm to the victim which statement was not obtained in the course of treatment, counseling or therapy or a request to initiate or be referred for same to treat the person for the propensity to commit the type of crime admitted; or
(ii) where it appears based on all the circumstances that the individual has escaped from a correctional institution or from lawful custody as those terms are defined in 45 CFR 164.501.
• We may release your PHI if you are a member of the military as required by armed force services consistent with federal law.
• We may release your PHI if necessary for national security or intelligence activities; for protective services for the President; for correctional institutions and other law enforcement custodial situations under limited circumstances if you are in custody and only during such period of custody.
• We may release your PHI to workers’ compensation agencies if necessary for your workers’ compensation benefits and/or determination or if otherwise necessary to comply with workers’ compensation laws.
• We may use and disclosure your PHI if required by the Secretary to investigate or determine SDACC’s compliance with federal privacy regulations.
• We may use and disclose your PHI as necessary to defend against a complaint or litigation filed by you, if applicable.
RIGHTS THAT YOU HAVE
Access to Your PHI. You have the right to receive a copy and/or inspect of much of your PHI contained in a “designated record set” that we retain on your behalf for so long as we retain that PHI. All requests for access must be made in writing and signed by you or your personal representative. There may be a cost-based charge if you request a copy of the information. We will also charge for postage if you request a mailed copy and will charge for preparing a summary of the requested information if you request a summary. You may obtain an access request form from our Privacy Officer at SDACC. You or your personal representative will be required to complete this form in order to obtain access. We will act upon your request within 30 days. A single 30 day extension is allowed if SDACC is unable to comply with the deadline and you will receive a written notice from SDACC stating the reason for the delay and the anticipated date of response. All requests must be made to the Privacy Officer at SDACC. If access to your PHI is denied, you or your personal representative will be provided with a written denial setting forth the basis for the denial in plain language, a description of how you may exercise any applicable review or appeal rights and a description of how you may complain to the Secretary of the U.S. Department of Health and Human Services.
If we maintain the PHI that you request in a designated record set electronically and if you request an electronic copy of the information, we will provide you with access to the PHI in the electronic form and formate that you request, if it is readily producible in such form and format; or, if not, in a readable electronic form and format as agreed to by you and us.
Amendments to Your PHI. You have the right to request in writing that PHI contained in a “designated record set” that we retain on your behalf for so long as we retain that PHI be amended. We are not obligated to make all requested amendments, but we will give each request careful consideration. We may deny your request for amendment if we determine that the PHI or record that relates to your request: (i) was not created by SDACC, (ii) is not part of the designated record set, (iii) would not be available for your inspection under the HIPAA rules, or (iv) is accurate and complete. All amendment requests, in order to be considered by us, must be in writing, signed by you or your representative, and must state the reasons for the amendment requested. All requests for amendment must be delivered to the Privacy Officer at SDACC. If an amendment you request is made by us, we will identify the records in the designated record set that are affected by the change and either provide a reference to and/or append the change to those records, inform you that the amendment is accepted, obtain your agreement to notify relevant persons who must be informed of the amendment, if applicable, and notify any other persons about the amendment within a reasonable time, either if you request it or if we know that such other persons could have relied on the information which is now changed. You may obtain an amendment request form from the Privacy Officer at SDACC and this form is required for all amendment requests. SDACC has 60 days after the request is made to act on the request. A single 30-day extension is allowed if SDACC is unable to comply with the deadline and you will receive a written notice from SDACC stating the reason for the delay and the anticipated date of response. If the request is denied, in whole or part, SDACC must provide you or your personal representative with a written denial that explains the basis for the denial in plain language, a description of how you may submit a written statement disagreeing with the denial (a “Statement of Disagreement”) and have that Statement of Disagreement included with any future disclosures of your PHI or request that a copy of your amendment request be provided with any future PHI disclosures and a description of how you may complain to the Secretary of the U.S. Department of Health and Human Services.
Accounting for Disclosures of Your PHI. You have the right to receive an accounting of certain disclosures made by us of your PHI in the six years prior to the date on which the accounting is requested. Requests must be made in writing and signed by you or your personal representative. Accounting request forms are available from the Privacy Officer at SDACC. The first accounting in any 12-month period is free; you will be charged a cost-based fee for each subsequent accounting you request within the same 12-month period. Such accountings need not and may not include PHI disclosures made: (1) to carry out treatment, payment or health care operations; (2) to you or your personal representative about your own PHI; (3) based on your written authorization; and (4) for certain other purposes. If the accounting cannot be provided within 60 days of your request, an additional 30 days is allowed if you are given a written statement of the reasons for the delay and the date by which the accounting will be provided.
Right to be Notified of a Breach. You have the right to be notified in the event that we (or one of our Business Associates) discovers a breach of unsecured PHI involving your medical information.
The Right to Receive a Paper Copy of this Notice Upon Request. To obtain a paper copy of this Notice, contact the Privacy Officer at SDACC.
Restrictions on Use and Disclosure of Your PHI. You have the right to request restriction on certain uses and disclosures of your PHI for treatment, payment, or health care operations, and disclosures to individuals involved in your care. A restriction request form can be obtained from the Privacy Officer or Clinical Nurse Manager at SDACC. Except as described below, we are not required to agree to your restriction request, but we will attempt to accommodate reasonable requests when appropriate and lawful. If we agree to a restriction, we will not use or disclosure your PHI in violation of the restriction except in an emergency. We retain the right to terminate an agreed to restriction if we believe such termination is appropriate. In the event of a termination by us, we will notify you of such termination prior to use or disclosure where practicable. If a use or disclosure is required by law and is contrary to your requested restriction, then the applicable law will override any agreement to restrict use/disclosure and SDACC will comply with the applicable law without prior notice. SDACC may provide such notice where practicable. You also have the right to terminate, in writing, any agreed to restriction by sending such termination notice to the Privacy Officer or Medical Information Officer at SDACC. We will agree if you request that we restrict disclosure of your PHI to a health plan if: (i) the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and (ii) the PHI pertains solely to a health care item or service for which you, or someone other than a health plan on your behalf, has paid us in full. For example, if you pay for a service completely out of pocket and ask SDACC not to tell your insurance company about it, we will abide by your request.
Complaints. If you believe your privacy rights have been violated, you can file a complaint in writing with the Privacy Officer or Clinical Nurse Manager at 33 West Rahn Road, #102, Dayton, OH 45429. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services in Washington, D.C. in writing. There will be no retaliation for filing a complaint.
Acknowledgment of Receipt of Notice. You may be asked to sign an acknowledgment form that you received this Notice of Privacy Practices.
FOR FURTHER INFORMATION
If you have questions or need further assistance regarding this Notice, you may contact the Privacy Officer at SDACC. Phone: 937-433-8990 Address: 33 West Rahn Road #102, Dayton, OH 45429.
This Notice of Privacy Practices is effective July 10, 2013.