NOTICE OF PRIVACY PRACTICES
Original Effective Date: June 1, 2010
Effective Date of Last Revision: June 1, 2010
I. THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
II. OUR COMMITMENT TO PROTECTING YOUR HEALTH INFORMATION.
Divine Hospice Care Inc. , herewith a.k.a. ( “DHCI” ) are legally required to
protect the privacy of your health information. This information is called “protected health information” or “PHI” and it includes information that can be used to identify you that we have created or received about your past, present or future health or condition, the provision of healthcare to you or the payment of the healthcare. We must provide you or your personal representative with this notice about our privacy practices that explains how, when and why we use and disclose your PHI. With some exceptions, we may not use or disclose any more of your PHI than is necessary to accomplish the purpose of the use or disclosure. We are legally required to follow the privacy practices that are described in this notice.
However, we reserve the right to make changes to this notice at any time and to make such changes effective for all PHI we may already have about you. If and when this notice is changed, we will post a copy in our office in a prominent location. We also will provide you or your personal representative with a copy of the revised notice upon your request made to the Privacy Officer referenced in Section VI below, or you can view a copy of the notice on our website at www.divinehospicecare.com.
III. HOW WE MAY USE AND DISCLOSE YOUR PHI
The following categories describe different ways that we use and disclose your PHI. For each category of uses or disclosures, we will explain what we mean and try to give you some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.
To Provide Treatment. DHCI may use your PHI to coordinate care within
DHCI and with others involved in your care, such as your attending physician,
members of the hospice interdisciplinary team and other healthcare
professionals who have agreed to assist DHCI in coordinating care. For
example, physicians involved in your care will need information about your
symptoms in order to prescribe appropriate medications. DHCI also may
disclose your PHI to individuals outside of DHCI involved in your care including
family members, clergy whom you have designated, pharmacists, suppliers of medical equipment or other healthcare professionals that DHCI uses to
coordinate your care.
To Obtain Payment. DHCI may use and disclose PHI so that we can bill and
collect payment for the treatment and services provided to you. Before providing
treatment or services, we may share details with your health plan concerning the
services you are scheduled to receive. For example, we may ask for payment
approval from your health plan before we provide care or services. We may use
and disclose PHI to find out if your health plan will cover the cost of care and
services we provide. We may use and disclose PHI to confirm you are receiving
the appropriate amount of care to obtain payment for services. We may use and
disclose PHI for billing, claims management, and collection activities. We may
disclose PHI to insurance companies providing you with additional coverage. We
may disclose limited PHI to consumer reporting agencies relating to collection of
payments owed to us. We also may disclose PHI to another healthcare provider
or to a company or health plan required to comply with the HIPAA Privacy Rule
for the payment activities of that health care provider, company, or health plan.
For example, we may allow a health insurance company to review PHI for the
insurance company’s activities to determine the insurance benefits to be paid for
your care.
To Conduct Healthcare Operations. DHCI may use and disclose PHI in
performing business activities which are called Healthcare Operations.
Healthcare Operations include doing things that facilitate the function of DHCI
and allows us to provide quality care to our patients. DHCI subsidiaries may
share PHI with each other for these purposes. Healthcare operations includes
such activities as:
quality assessment and improvement activities;
activities designed to improve health or reduce health care costs;
protocol development, case management and care coordination;
contacting health care providers and patients with information about
treatment alternatives and other related functions that do not include
treatment;
professional review and performance evaluation;
training programs including those in which students, trainees or
practitioners in health care learn under supervision;
training of non-health care professionals;
accreditation, certification, licensing or credentialing activities;
review and auditing, including compliance reviews, medical reviews, legal
services and compliance programs;
business planning and development including cost management and
planning related analyses and formulary development; and business
management and general administrative activities of DHCI.
For example DHCI may use your PHI to evaluate its staff performance,
combine your PHI with other DHCI patients in evaluating how to more
effectively serve all patients, disclose your PHI to DHCI staff and contracted
personnel for training purposes.
To Inform You of Appointment Reminders and Health-related Benefits.
DHCI may contact you to remind you of appointments or staff visits and to
provide you with information about treatment alternatives or other health-related
benefits and services that may be of interest to you.
OTHER USES AND DISCLOSURES WE CAN MAKE WITHOUT YOUR WRITTEN AUTHORIZATION FOR WHICH YOU HAVE THE OPPORTUNITY TO AGREE OR OBJECT.
DHCI may use and disclose PHI about you in some situations where you have the opportunity to agree or object to certain uses and disclosures of PHI about you. If you do not object, then we may make these types of uses and disclosures of PHI.
To individuals Involved in Your Care or Payment for Your Care. DHCI may
disclose PHI about you to your family member, close friend or any other person
identified by you if that information is directly relevant to the person’s
involvement in your care or payment for your care. If you are present and able
to consent or object (or if you are available in advance), then we only may use or
disclose PHI if you do not object after you have been informed of your
opportunity to object. If you are not present or you are unable to consent or
object, we may exercise professional judgment in determining whether the use
or disclosure of PHI is in your best interest. For example, if you are unable to
communicate normally with your physician or the DHCI staff for some reason,
we may find it is in your best interest to give your prescription or other medical
supplies to the caregiver, relative or other individual who is delegated to be
responsible for your healthcare. We also may use and disclose PHI to notify
such persons of your location, general condition or death. We also may
coordinate with disaster relief agencies to make this type of notification, as
necessary. We also may use professional judgment and our experience with
common practice to make reasonable decisions about your best interests in
allowing a person to act on your behalf to pick up filled prescriptions, medical
supplies, x-rays or other items that contain PHI about you.
To Patient Directory. DHCI may include your name, location in the facility,
general condition and religious affiliation in the patient directory of a DHCI
inpatient setting for use by clergy and visitors who ask for you by name, unless
you object in whole or in part.
OTHER USES AND DISCLOSURES WE CAN MAKE WITHOUT YOUR WRITTEN AUTHORIZATION OR OPPORTUNITY TO AGREE OR OBJECT
We may use and disclose PHI about you in the following circumstances without your authorization or opportunity to agree or object, provided that we comply with certain conditions that may apply.
To Business Associates. DHCI may use or disclose certain PHI about you to
business associates. A business associate is an individual or entity under
contract with DHCI to perform or assist DHCI in a function or activity which
necessitates the use or disclosure of PHI. Examples of business associates,
include, but are not limited to, consultants, accountants, lawyers, medical
transcription companies and medical record storage companies. DHCI requires
the business associates to protect the confidentiality of your PHI.
When Legally Required. DHCI will disclose your PHI when it is required to do
so by any Federal, State or local law.
When There Are Risks to Public Health. DHCI may disclose your PHI for
public activities and purposes in order to:
Prevent or control disease, injury or disability, report disease, injury, vital
events such as birth or death and the conduct of public health surveillance, investigations and interventions.
To report adverse events, product defects, to track products or enable
product recalls, repairs and replacements and to conduct post-marketing
surveillance and compliance with requirements of the Food and Drug
Administration.
To notify a person who has been exposed to a communicable disease or
who may be at risk of contracting or spreading a disease.
To an employer about an individual who is a member of the workforce as legally required.
To Report Abuse, Neglect or Domestic Violence. DHCI is allowed to notify
government authorities if DHCI believes a patient is the victim of abuse, neglect
or domestic violence. DHCI will make this disclosure only when specifically
required or authorized by law or when the patient agrees to the disclosure.
To Conduct Health Oversight Activities. DHCI may disclose your PHI to a
health oversight agency for activities including audits, civil, administrative or
criminal investigations, inspections, licensure or disciplinary action. However,
DHCI may not disclose your PHI if you are the subject of an investigation and
your PHI is not directly related to your receipt of healthcare or public benefits.
In Connection with Judicial and Administrative Proceedings. DHCI may
disclose your PHI in the course of any judicial or administrative proceeding in
response to an order of a court or administrative tribunal as expressly authorized
by such order or in response to a subpoena, discovery request or other lawful
process, but only when DHCI makes reasonable efforts to either notify you
about the request or to obtain an order protecting your PHI.
For Law Enforcement Purposes. DHCI may disclose your PHI to a law
enforcement official for law enforcement purposes as follows:
As required by law for reporting of certain types of wounds or other
physical injuries pursuant to the court order, warrant, subpoena or
summons or similar process.
For the purpose of identifying or locating a suspect, fugitive, material
witness or missing person.
Under certain limited circumstances, when you are the victim of a crime.
To a law enforcement official if DHCI has a suspicion that your death
was the result of criminal conduct including criminal conduct by DHCI
staff.
In an emergency to report a crime.
To Coroners and Medical Examiners. DHCI may disclose your PHI to
coroners and medical examiners for purposes of determining your cause of
death or for other duties, as authorized by law.
To Funeral Directors. DHCI may disclose your PHI to funeral directors
consistent with applicable law and, if necessary, to carry out their duties with
respect to your funeral arrangements. If necessary to carry out their duties,
DHCI may disclose your PHI prior to and in reasonable anticipation of your
death.
For Organ, Eye or Tissue Donation. DHCI may use or disclose your PHI to
organ procurement organizations or other entities engaged in the procurement,
banking or transplantation of organs, eyes or tissue for the purpose of facilitating
the donation and transplantation.
For Research Purposes. DHCI may use your PHI for research purposes under
certain limited circumstances. DHCI must obtain a written authorization to use
and disclose PHI about you for research purposes except in situations where a
research project meets specific, detailed criteria established by federal law to
help ensure the privacy of PHI. Before DHCI discloses any of your PHI for such
research purposes, the project will be subject to an extensive approval process.
DHCI may utilize information in your medical record that does not identify you
for conducting clinical and healthcare services research.
In the Event of a Serious Threat to Health or Safety. DHCI may, consistent
with applicable law and ethical standards of conduct, disclose your PHI if DHCI,
in good faith, believes that such disclosure is necessary to prevent or lessen a
serious and imminent threat to your health or safety or to the health and safety of
the public. DHCI may release information regarding a diagnosis of AIDS or
results of Human Immunodeficiency Virus (HIV) tests to the extent permitted by
law.
For Specified Government Functions. In certain circumstances, federal
regulations authorize DHCI use or disclose your PHI to facilitate specified
government functions relating to military and veterans, national security and
intelligence activities, protective services for the President and others, medical
suitability determinations, and inmates and law enforcement custody.
For Worker’s Compensation. DHCI may release your PHI for worker’s
compensation or similar programs.
Other than is stated above, DHCI will not disclose your PHI other than with your
written authorization. If you or your representative authorizes DHCI to use or disclose your PHI, you may revoke that authorization in writing at any time. States may have laws that are more protective than federal law which may require DHCI to obtain an authorization from you for the disclosures listed above.
IV. YOUR RIGHTS WITH RESPECT TO YOUR PHI
You have the following rights regarding your PHI that DHCI maintains:
Right to request restrictions. You may request restrictions on the PHI we use
or disclose about you for treatment, payment or healthcare operations. You
have the right to request a limit on DHCI’s disclosure of your PHI to someone
who is involved in your care or the payment of your care. For example, you may
ask that we do not use or disclose information about a procedure you had.
However, DHCI is not required to agree to your request. If you paid out-of-pocket
for a specific item or service, you have the right to request that PHI with
respect to that item or service not be disclosed to a health plan for purposes of
payment or health care operations, and DHCI is required to honor that request.
If you wish to make a request for restrictions, please send a written request to
the DHCI Medical Records Custodian. The written request should include what
information you want to limit, whether you want to limit our use, disclosure or
both and to whom you want the limits to apply, for example, disclosures to your
spouse.
Right to receive confidential communications. You have the right to request
that DHCI communicate with you in a certain way. For example, you may ask
that DHCI only conduct communications pertaining to your PHI with you by mail
or privately with no other family members present. If you wish to receive
confidential communications, please make a written request to the DHCI
Medical Records Custodian that specifies how and when you wish to be
contacted. DHCI will not request that you provide any reasons for your request
and will attempt to honor your reasonable requests for confidential
communications.
Right to inspect and copy your PHI. You have the right to inspect and copy
your PHI, including billing records. A written request to inspect and copy records
containing your PHI may be made to the DHCI Medical Records Custodian. If
you request a copy of your PHI, DHCI may charge a reasonable fee for copying
and assembling costs associated with your request. If your medical information
is maintained in an electronic health record, you also have the right to request
that an electronic copy of your record be sent to you or to another individual or
entity. DHCI may charge you a reasonable cost based fee limited to the labor
costs associated with transmitting the electronic health record.
Right to amend healthcare information. If you or your representative believes
that your PHI records are incorrect or incomplete, you may request that DHCI
amend the records. That request may be made as long as the information is
maintained by DHCI. A request for an amendment of records must be made in
writing to the DHCI Medical Records Custodian. DHCI may deny the request if
it is not in writing or does not include a reason for the amendment. The request
also may be denied if your PHI records were not created by DHCI, if the records
you are requesting are not part of the DHCI records, if the PHI you wish to
amend is not part of the PHI you or your representative are permitted to inspect
and copy, or if, in DHCI’s opinion, the records containing your PHI are accurate
and complete.
Right to an accounting. You or your representative have the right to request
an accounting of disclosures of your PHI made by DHCI for any reason other
than for treatment, payment or health operations unless the disclosure for
treatment, payment or health operations was in the form of an electronic health
record. The request for an accounting must be made in writing to the DHCI
Medical Records Custodian. The request should specify the time period for the
accounting starting no earlier than June 1, 2010. Accounting requests may not
be made for periods of time in excess of six years. Accounting requests relating
to electronic health record disclosures described above may not be made for
periods of time in excess of three years. DHCI will provide the first accounting
you request during any 12-month period without charge. Subsequent accounting
requests may be subject to a reasonable cost-based fee.
Right to a paper copy of this notice. You or your representative have a right
to a separate paper copy of this notice at any time even if you or your
representative have received this notice previously or even if you previously
requested an electronic copy.
To obtain a separate paper copy, please contact the Privacy Officer as indicated below in Section VI. You or your representative may obtain a copy of the current version of the Notice of Privacy Practices on our website at :
www.divinehospicecare.com.
Right to Receive Notice of a Breach. DHCI is required to notify you by first
class mail or by e-mail (if you have indicated a preference to receive information
by e-mail), of any breaches of Unsecured Protected Health Information as soon
as possible, but in any event, no later than 60 days following the discovery of the
breach. “Unsecured Protected Health Information” is information that is not
secured through the use of a technology or methodology identified by the
Secretary of the U.S. Department of Health and Human Services to render the
PHI unusable, unreadable, and undecipherable to unauthorized users. The
notice is required to include the following information:
a brief description of the breach, including the date of the breach and the date
of its discovery, if known;
a description of the type of Unsecured Protected Health Information involved
in the breach;
steps you should take to protect yourself from potential harm resulting from
the breach;
a brief description of actions we are taking to investigate the breach, mitigate
losses, and protect against further breaches;
contact information, including a toll-free telephone number, e-mail address,
Web site or postal address to permit you to ask questions or obtain additional information.
In the event the breach involves 10 or more patients whose contact information is
out of date, DHCI will post a notice of the breach on the home page of our Web
site or in a major print or broadcast media. If the breach involves more than 500
patients in the state or jurisdiction, DHCI will send notices to prominent media
outlets. If the breach involves more than 500 patients, DHCI is required to
immediately notify the Secretary. DHCI also is required to submit an annual
report to the Secretary of a breach that involved less than 500 patients during the
year and will maintain a written log of breaches involving less than 500 patients.
V. HOW TO COMPLAIN ABOUT OUR PRIVACY PRACTICES
You or your personal representative have the right to express complaints to DHCI and to the U.S. Secretary of Health and Human Services if you or your representative believe that your privacy rights have been violated. Any complaints to DHCI should be made by calling the HIPAA Hotline at 1-888-821-0422. DHCI encourages you to express any concerns you may have regarding the privacy of your PHI. You will not be retaliated against in any way for filing a complaint.
VI. CONTACT PERSON
You may contact DHCI’ Privacy Officer for information regarding patient privacy, the content of this notice and your rights under the Federal privacy standards. The Privacy Officer can be reached at 1-888-821-0422.
