Notice of Privacy Practices
Effective Date: April 14, 2003 Revised: September 1, 2013
THIS NOTICE DESCRIBES THE INFORMATION PRIVACY PRACTICES FOLLOWED BY OUR EMPLOYEES, STAFF AND OTHER OFFICE PERSONNEL. THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
We are required by law to provide you with this notice explaining Shawnee’s privacy practices with regard to your medical information and how we may use and disclose your Protected Health Information (PHI) for treatment, payment, and for health care operations, as well as for other purposes that are permitted or required by law. You have certain rights regarding the privacy of your PHI and we also describe those rights in this notice. Shawnee reserves the right to change the provisions of our Notice and make new provisions effective for all PHI we maintain. If Shawnee makes a material change to our Notice, we will post the changes promptly on our website at www.shawneehealth.com.
What is Protected Health Information (PHI)?
PHI consists of individually identifiable PHI, which may include demographic information we collect from you or create or is received by a health care provider, a health plan, your employer, or a health care clearinghouse and that relates to: (1) your past, present or future physical or mental health or condition; (2) the provision of health care to you; or (3) the past, present or future payment for the provision of health care to you.
Ways in Which We May Use and Disclose Your Protected Health Information (PHI)
Treatment – We will use and disclose PHI about you to provide you with medical treatment or services, coordinate care, manage your health care and any related services. Examples include phoning in prescriptions to your pharmacy, scheduling x-rays, or referrals to other health care providers such as specialists, home health or hospitals.
Payment – We will use and disclose your PHI to obtain payment for the health care services we provide you. For example, we may include information with a bill to a third-party payer that identifies you, your diagnosis, procedures performed, and supplies used in rendering the service. We may also talk with your health plan about a treatment you are going to receive to obtain prior approval or determine whether your plan will cover the treatment.
Health Care Operations – We will use and disclose your PHI to support the business activities of Shawnee. For example, we may use medical information about you to review and evaluate our treatment services or to evaluate our staff’s performance while caring for you. In addition, we may disclose your PHI to third party business associates who perform billing, consulting, transcription or other services for our facility. We may give PHI to other health care entities for their health care operations, for example, to your health insurer for its quality review purposes.
Other Ways We May Use and Disclose Your Protected Health Information (PHI)
Appointment Reminders/Treatment Alternatives/Health Related Benefits and Services – we may use and disclose PHI to contact you to remind you that you have an appointment for health care, or to contact you to tell you about possible treatment options, alternatives or health related services that may be of interest to you. If we call to remind you of an appointment at our health center, we will only leave the name of health center and time of the appointment. Please let us know if you do NOT wish to be called.
As Required by Law – we will use and disclose your PHI about you when required to do so by international, federal, state or local law.
Business Associates – we may disclose PHI to our business associates who perform functions on our behalf or provides us with services if the PHI is necessary for those functions or services. For example, we may use another company to do our laboratory service, billing, transcription or consulting services for us.
Lawsuits and Disputes – if you are involved in a lawsuit or a dispute, we may disclose PHI in response to a court or administrative order, subpoena, discovery request, or other legal process from someone else involved in the dispute. We may also use or disclose your PHI to defend ourselves if you sue us.
Minors – we will disclose PHI of minor children to their parents or guardians unless such disclosure is otherwise prohibited by law.
Family and Friends – we may disclose PHI about you to your family members or friends if we obtain your agreement to do so, or if we give you an opportunity to object to such a disclosure and you do not raise an objection, or if circumstances indicate that you agree to the disclosure. For example, we may assume you agree to our disclosure of your PHI to your family member when you bring your family member with you into the exam room during treatment or while treatment is discussed. In a situation where you are not capable of giving consent (because you are not present or due to your incapacity or medical emergency), we may, using our professional judgment, disclose to your family member or friend if we believe it is in your best interest. In that situation, we will disclose only heath information relevant to the person’s involvement in your care.
Personal Representative – if you have a personal representative, such as a legal guardian or executor or administrator of your estate after your death, we will treat that person as if that person is you with respect to disclosure of your PHI.
Worker’s Compensation – we will use and disclose your PHI for worker’s compensation or similar programs that provide benefits for work-related injuries or illness.
Inmates – we will use and disclose your PHI to a correctional institution or law enforcement official only if you are an inmate of that correctional institution or under the custody of a law enforcement official. This information would be necessary for the institution to provide you with health care; to protect the health and safety of others; or for the safety and security of the correctional institution.
To Avert a Serious Threat to Public Health or Safety – we will use and disclose your PHI when necessary to prevent a serious threat to your health or safety or to the health or safety of others. But we will only disclose the information to someone who may be able to help prevent the threat. Examples include disclosures to (1) a person subject to the jurisdiction of the Food and Drug Administration (FDA) for purposes related to the quality, safety or effectiveness of a FDA regulated product or activity; (2) prevent or control disease, injury or disability, (3) a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition, and (4) the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence and the patient agrees or we are required or authorized by law to make that disclosure.
Law Enforcement – we may release PHI if asked by a law enforcement official for the following reasons: in response to a court order, subpoena, warrant, summons or other similar process; to identify or locate a suspect, fugitive, material witness or missing person, about the victim of a crime if the death may be the result of criminal conduct; about criminal conduct on our premises; and in emergency circumstances to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime.
Military, Veterans, National Security and Intelligence – if you are or were a member of the armed forces, or part of the national security or intelligence communities, we may be required by military command or other government authorities to release PHI about you. We may also release information about foreign military personnel to the appropriate foreign military authority. We may release PHI to authorized federal officials for national security activities authorized by law. For example, we may disclose PHI to those officials so they may protect the President.
Coroners, Medical Examiners and Funeral Directors – we may release PHI to a coroner, medical examiner, or funeral director so they can carry out their duties.
Health Oversight Activities – we may release PHI to a health oversight agency for audits, investigations, inspections or licensing purposes. These disclosures may be necessary for certain state and federal agencies to monitor the health care system, government programs and compliance with civil rights laws.
Psychotherapy Notes – we will not release psychotherapy notes without your authorization. Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes are not medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date; we may use or disclose this PHI.
Marketing – we will not use or disclose your PHI for marketing or fundraising without a written authorization from you.
Research – we may use or disclose your PHI for research purposes, but we will only do that after a special approval process. We may permit researchers to look at PHI to help them prepare for research, for example, to allow them to identify patients who may be included in their research project as long as they do not remove, or take a copy of any PHI. We may use and disclose a limited data set that does not contain specific readily identifiable information about you for research.
Organ Tissue Donation – If you are an organ donor, we may release PHI to organizations that handle organ procurement or transplantation to facilitate organ or tissues donation and transplantation.
Health Information Exchange – Shawnee participates in the Southern Illinois Health Information Exchange (SI HIE). The Health Information Exchange (HIE) is a way of electronically sharing your PHI to healthcare providers involved in your care. The purpose of the HIE is to give participating providers faster access to your PHI that will facilitate safer, more timely, and efficient patient-centered care. For example, if you have an emergency and seek treatment at a Southern Illinois Healthcare hospital Emergency Department, the Emergency Department provider may have access to your electronic PHI from your primary care provider.
Uses or Disclosures that Shawnee gives you the opportunity to object or “opt out”
Southern Illinois Health Information Exchange – If you do not want your PHI maintained by your provider to be accessible to other authorized healthcare providers through the Health Information Exchange (HIE), you may opt out by completing the Opt-out form, which is available at the health center or can be found on www.sihie.org and give it to your healthcare provider. If you decide to opt out of the HIE, doctors, nurses and other healthcare providers will not be able to obtain and use your PHI in the HIE when providing treatment to you.
Special Protections for HIV, Alcohol and Substance Abuse, Mental Health, and Genetic Information
Special privacy protections apply to HIV-related information, alcohol and substance abuse, mental health and genetic information. Unless required by law, Shawnee will not release this information unless you provide written authorization.
Uses or Disclosures Not Covered by this Notice
Uses or disclosures of your PHI not covered by this notice or the laws that apply to us may only be made with your written authorization. You may revoke such authorization in writing at any time and we will no longer disclose PHI about you for the reasons stated in your authorization. Disclosures made prior to the revocation are not affected by the revocation.
Your Rights Regarding Your Protected Health Information (PHI)
Although your health record is the physical property of the facility that compiled it, the information belongs to you. You have the:
Right to Inspect and Copy – You have the right to inspect and copy the PHI that we maintain about you for as long as we maintain that information. This designated record set includes your medical and billing records, as well as any other records we use for making decisions about you. Any psychotherapy notes that may have been included in records we received about you are not available for your inspection or copying, by law. We may charge you a fee for the costs of copying, mailing, or other supplies used in fulfilling your request.
Right to an Electronic Copy of Electronic Medical Records – if your PHI is maintained in an electronic format, you have the right to request that an electronic copy of your record be given to you or transmitted to another individual or entity. We may charge you a reasonable, cost based fee for the labor associated with transmitting the electronic medical record.
Right to Get Notice of a Security Breach – We are required to notify you by first class mail or by e-mail (if you have indicated a preference to receive information by e-mail), of any breach of your Unsecured PHI as soon as possible, but in any event, no later than 60 days after we discover the breach. “Unsecured PHI” is PHI that has not been made unusable, unreadable, and undecipherable to unauthorized users. The notice will give you the following information:
a short description of what happened, the date of the breach and the date it was discovered; the steps you should take to protect yourself from potential harm from the breach; the steps we are taking to investigate the breach, mitigate losses, and protect against further breaches; and contact information where you can ask questions and get additional information.
Right to Request Amendments – you have the right to request that we amend your medical information if you feel that it is incomplete or inaccurate. You must make this request in writing to our Privacy Officer, stating what information is incomplete or inaccurate and the reasoning that supports your request. We are permitted to deny your request if it is not in writing or does not include a reason to support the request. We may also deny your request if the information was not created by us, or the person who created it is no longer available to make the amendment; the information is not part of the record which are permitted to inspect and copy; the information is not part of the designated record set kept by this facility or if it is the opinion of the health care provider that the information is accurate and complete.
Right to an Accounting of Disclosures – You have the right to ask for an “accounting of disclosures,” which is a list of the disclosures we made of your PHI. Shawnee will either: (1) provide you with an accounting of such disclosures it made and all of its business associates disclosures; or (2) provide you with an accounting of the disclosures made by Shawnee and a list of business associates, including their contact information, who will be responsible for providing an accounting of such disclosures upon request. We are not required to list certain disclosures, including (1) disclosures made for treatment, payment, and health care operations purposes, (unless the disclosures were made through an electronic medical record, in which case you have the right to request an accounting of those disclosures that were made during the 3 years before your request), (2) disclosures made with your authorization, (3) disclosures made to create a limited data set, and (4) disclosures made directly to you. You must submit your request in writing to our Privacy Officer. Your request must state a time period which may not be longer than 6 years before your request. Your request should indicate in what form you would like the accounting (for example, on paper or by e-mail). The first accounting of disclosures you request within any 12-month period will be free. For additional requests within the same period, we may charge you for the reasonable costs of providing the accounting.
Right to Request Restrictions – you have the right to request a restriction or limitation on the PHI we use or disclose for treatment, payment or health care operations. You also have the right to request a limit on the PHI we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. If we agree, we will comply with your request unless the information is needed to provide you with emergency treatment.
Right to Receive Care with Out-of-Pocket Payments – if you pay in full for their services out of pocket before the service is provided, you have the right for information regarding the service not be disclosed to the third party payer since no claim is being made against the third party payer.
Right to Confidential Communication – You have the right to request that we communicate with you only in certain ways to preserve your privacy. For example, you may request that we contact you by mail at a special address or call you only at your work number. You must make any such request in writing and you must specify how or where we are to contact you. We will accommodate all reasonable requests.
Right to a Paper Copy of this notice – A copy of our Notice is posted in our health center, on our website shawneehealth.wpengine.com and a paper copy is available at your health center. Please ask a staff member for a copy.
How to Exercise Your Rights Noted Above
To exercise your rights described in this Notice, send your request in writing to our Privacy Officer at the address listed below. We may ask you to fill out a form that we will supply. To exercise your right to inspect and copy your PHI, you may contact your health center directly.
If you believe your privacy rights have been violated, you may file a complaint with Shawnee Health Service or with the Secretary of the United States of Health and Human Resources. To file a complaint with the Secretary, mail it to: Secretary of the U.S. Department of Health and Human Services, 200 Independence Ave, S.W., Washington, D.C. 20201 or call (202) 619-0257, toll free (877) 696-6775.
To file a complaint with us, contact our Privacy Officer at the address listed below. Complaints must be made in writing and should be submitted within 180 days of when you knew or should have known of the suspected violation. There will be no retaliation against you for filing a complaint.
Privacy Officer: Connie Favreau
Address: Shawnee Health Service, 109 California Street, PO Box 577, Carterville, IL 62918-0577
Telephone: 618-956-9506 Fax: 618-985-6860