Effective Date 01/1/2016
THIS NOTICE DESCRIBES HOW MEDICAL/HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.
We are required by law to maintain the privacy of your health information; to provide you this detailed Notice of our legal duties and privacy practices relating to your health information; and to abide by the terms of the Notice that are currently in effect.
WHAT HEALTH INFORMATION IS PROTECTED
We are committed to protecting the privacy of information we gather about you while providing health-related services. Some examples of protected health information include information indicating that you are a resident of Brookhaven or receiving health-related services from our facilities, information about your health condition, genetic information, or information about your health care benefits under an insurance plan, each when combined with identifying information, such as your name, address, social security number or phone number.
REQUIREMENT FOR WRITTEN AUTHORIZATION
Generally, we will obtain your written authorization before using your health information or sharing it with others outside of Brookhaven. There are certain situations where we must obtain your written authorization before using your health information or sharing it, including:
Marketing. We may not disclose any of your health information for marketing purposes if Brookhaven will receive direct or indirect financial remuneration not reasonably related to our medical group’s cost of making the communication.
Sale of Protected Health Information. We will not sell your protected health information to third parties. The sale of protected health information, however, does not include a disclosure for public health purposes, for research purposes where Brookhaven will only receive remuneration for our costs to prepare and transmit the health information, for treatment and payment purposes, for the sale, transfer, merger or consolidation of all or part of Brookhaven, for a business associate or its subcontractor to perform health care functions on Brookhaven’s behalf, or for other purposes as required and permitted by law.
If you provide us with written authorization, you may revoke that written authorization at any time, except to the extent that we have already relied upon it. To revoke a written authorization, please write to the Chief Executive Officer/President at Brookhaven. You may also initiate the transfer of your records to another person by completing a written authorization form.
I. USES AND DISCLOSURES FOR TREATMENT, PAYMENT AND HEALTH CARE OPERATIONS.
The following lists various ways in which we may use or disclose your health information for treatment, payment and health care operations purposes without your prior written authorization.
For Treatment. We will use and disclose your health information in providing you with treatment and services and coordinating your care and may disclose information to other providers involved in your care. Your health information may be used by doctors involved in your care and by nurses and home health aides, as well as by physical therapists, pharmacists, suppliers of medical equipment or other persons involved in your care. For example, we will contact your physician to discuss your plan of care.
For Payment. We may use and disclose your health information for billing and payment purposes. We may disclose your health information to an insurance or managed care company, Medicare, Medicaid or another third party payor. For example, we may contact Medicare or your health plan to confirm your coverage or to request prior approval for services that will be provided to you.
For Health Care Operations. We may use and disclose your health information as necessary for health care operations, such as management, personnel evaluation, education and training and to monitor our quality of care. We may disclose your health information to another entity with which you have or had a relationship if that entity requests your information for certain of its health care operations or health care fraud and abuse detection or compliance activities. For example, we may want to compare the medical information of many residents with similar health issues to assess the overall quality of care we provide for residents with those issues or to assess health outcomes.
Appointment Reminders, Treatment Alternatives, Benefits and Services. In the course of providing treatment to you, we may use your health information to contact you with a reminder that you have an appointment for treatment, services or refills or in order to recommend possible treatment alternatives or health-related benefits and services that may be of interest to you.
Business Associates. In order to provide or arrange for your treatment, secure payment or carry on our health care operations, we may disclose your health information to vendors and others with whom we contract (although only to the extent that your health information is necessary to complete these activities). Our Business Associates will be required to agree, in a written business associate agreement in accordance with 45 CFR § 164.314, to maintain the confidentiality of the health information to which they are provided access and to notify us in the event of a breach of your unsecured health information or personal information. If our business associate discloses your health information to a subcontractor or vendor, the business associate will have a written contract to ensure that the subcontractor or vendor also protects the privacy of the information in accordance with current regulations.
II. SPECIFIC USES AND DISCLOSURES OF YOUR HEALTH INFORMATION THAT DO NOT REQUIRE YOUR PRIOR WRITTEN AUTHORIZATION
The following lists various additional ways in which we may use or disclose your health information without your prior written authorization.
Facility Directory. Unless you object, we will include certain limited information about you in our facility directory. This information may include your name, your location in the facility, and your telephone number. Our directory does not include specific medical information about you. We may release information in our directory to people who ask for you by name.
Individuals Involved in Your Care or Payment for Your Care. We may use or disclose your health information to a family member, other relative, or any other person identified by you when you are present for, or otherwise available prior to the disclosure, including following your death, if we (1) obtain your agreement; (2) provide you with the opportunity to object to the disclosure and you do not object; or (3) reasonably infer that you do not object to the disclosure. If you are not present or unable to agree or object due to an emergency situation or incapacity cannot, we may exercise our professional judgment to determine whether a disclosure is in your best interest. If we disclose information to a family member, other relative or a close personal friend, we would disclose only the information that we believe is directly relevant to that person’s involvement with your health care or payment related to your health care. We may also disclose your health information in order to notify (or assist in notifying) a relative, friend or caregiver of your location, general condition or death.
Emergencies or as Required By Law. We may use or disclose your health information if you need emergency treatment or if we are required by law to treat you. We may use or disclose your health information if we are required by law to do so, and we will notify you of these uses and disclosures if notice is required by law.
Proof of Immunization. We may disclose proof a child’s immunization to a school, about a child who is a student or prospective student of the school, as required by State or other law, if a parent, guardian, other person acting in loco parentis, or an emancipated minor, authorizes us to do so, but we do not need written authorization.
Public Health Activities. We may disclose your health information for public health activities. These activities may include, for example, reporting to a public health authority for preventing or controlling disease, injury or disability; reporting abuse or neglect; or reporting deaths.
Reporting Victims of Abuse, Neglect or Domestic Violence. If we believe that you have been a victim of abuse, neglect or domestic violence, we may use and disclose your health information to notify a government authority, if authorized by law or if you agree to the report.
Lawsuits And Disputes. We may disclose your health information if we are ordered to do so by a court or administrative tribunal that is handling a lawsuit or other dispute. We may also disclose your information in response to a subpoena, discovery request, or other lawful request by someone else involved in the dispute, but only if required judicial or other approval or necessary authorization is obtained.
Health Oversight Activities. We may disclose your health information to a health oversight agency for activities authorized by law, such as audits, investigations, inspections and licensure actions or for activities involving government oversight of the health care system.
To Avert a Serious Threat to Health and Safety. When necessary to prevent a serious threat to your health or safety or the health or safety of the public or another person, we may use or disclose health information, limiting disclosures to someone able to help lessen or prevent the threatened harm.
Judicial and Administrative Proceedings. We may disclose your health information in response to a valid court or administrative order. We also may disclose information in response to an appropriate subpoena, discovery request or other lawful process if you are a party in a lawsuit. In this type of situation, we must make efforts to contact you about the request in order to allow you the opportunity to seek an order or agreement protecting the information.
Law Enforcement. We may disclose your health information for certain law enforcement purposes, including, for example, to comply with reporting requirements; to comply with a court order, warrant or similar legal process; or to answer certain requests for information concerning crimes.
Research. We may use or disclose your health information for research purposes if the privacy aspects of the research have been reviewed and approved by a special committee, if the researcher is collecting information in preparing a research proposal, if the research occurs after your death or if you authorize the use or disclosure in writing.
Coroners, Medical Examiners, Funeral Directors, Organ Procurement Organizations. We may release your health information to a coroner, medical examiner, or funeral director to help identify you, determine the cause of your death or assist these individuals in completing their duties. If you are an organ donor, we may release your health information to an organization involved in the donation of organs and tissue.
Disaster Relief. We may disclose health information about you to a disaster relief organization to help others know of your location and general condition.
National Security And Intelligence Activities Or Protective Services. We may disclose your health information to authorized federal officials who are conducting national security and intelligence activities or providing protective services to the President or other important officials.
Military, Veterans, and Other Specific Government Functions. If you are a member of the armed forces, we may use and disclose your health care information as required by military command authorities. We may disclose health information for national security purposes or as needed to protect the President of the United States or certain other officials or to conduct certain special investigations.
Inmates And Correctional Institutions. If you are an inmate or you are detained by a law enforcement officer, we may disclose your health information to the prison officers or law enforcement officers if necessary to provide you with health care, or to maintain safety, security and good order at the place where you are confined. This includes sharing information that is necessary to protect the health and safety of other inmates or persons involved in supervising or transporting inmates.
Workers’ Compensation. We may use or disclose your health information to comply with laws relating to workers’ compensation or similar programs.
Fundraising Activities. We may use or disclose your demographic information, including, name, address, other contact information, age, gender, and date of birth, dates of health service information, department of service information, treating physician, outcome information, and health insurance status for fundraising purposes. With each fundraising communication made to you, you will have the opportunity to opt-out of receiving any further fundraising communications. We will also provide you with an opportunity to opt back in to receive such communications if you should choose to do so.
Completely De-identified Or Partially De-identified Information. We may use and disclose your health information if we have removed any information that has the potential to identify you so that the health information is “completely de-identified.” We may also use and disclose “partially de-identified” health information about you if the person who will receive the information signs an agreement to protect the privacy of the information as required by federal and state law. Partially de-identified health information will not contain any information that would directly identify you (such as your name, street address, social security number, phone number, fax number, electronic mail address, website address, or license number).
Incidental Disclosures. While we will take reasonable steps to safeguard the privacy of your health information, certain disclosures of your health information may occur during or as an unavoidable result of our otherwise permissible uses or disclosures of your health information. For example, during the course of a treatment session, other residents in the treatment area may see, or overhear discussion of, your health information.
Treatment Alternatives and Health-Related Benefits and Services. We may use or disclose your health information to inform you about treatment alternatives and health-related benefits and services that may be of interest to you.
III. USES AND DISCLOSURES WITH YOUR AUTHORIZATION
Except as described above in this Notice, we will use and disclose your health information only with your prior written Authorization. You may revoke an Authorization in writing at any time. If you revoke an Authorization, we will no longer use or disclose your health information for the purposes covered by that Authorization, except where we have already relied on the Authorization. You should understand that once we release your medical information based on an Authorization, we may no longer be able to control how the person to whom the information was sent handles that information and it may no longer be subject to certain privacy protections.
Uses and Disclosures of Your Highly Confidential Information. Federal and state law require special privacy protections for certain highly confidential information about you (“Highly Confidential Information”), including but not limited to: (1) your HIV/AIDS status; (2) genetic testing information; (3) confidential communications with a psychotherapist, psychologist, social worker, allied mental health professional, or human services professional; (4) substance abuse (alcohol or drug) treatment or rehabilitation information; (5) sexually transmitted disease information; and (6) mammography records. In order for us to disclose your Highly Confidential Information for a purpose unrelated to treatment, payment, or health care operations, we will obtain your separate, specific written consent unless we are otherwise permitted by law to make such disclosure.
IV. YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION
Listed below are your rights regarding your health information. These rights may be exercised by submitting a request to the Facility. Each of these rights is subject to certain requirements, limitations and exceptions. At your request, the Facility will supply you with the appropriate form to complete. You have the right to:
Request Restrictions. You have the right to request restrictions on our use or disclosure of your health information for treatment, payment or health care operations purposes. You have the right to request that your health information not be disclosed to a health plan if you have paid for the service in full, and the disclosure is not otherwise required by law. The request for restriction will only be applicable to that particular service. You will have to request a restriction for each service thereafter. You also have the right to restrict the personal health information we disclose about you to a family member, friend or other person who is involved in your care or the payment for your care. We are required to agree to your requested restrictions with respect to the release of your health information to individuals outside the Facility unless you are being transferred to another health care institution, the release of records is required by law, to obtain third party payment or to provide you with emergency care.
Access To Personal Health Information. You have the right to request, either orally or in writing, to see or to obtain written or electronic copies of your medical or billing records or other information that may be used to make decisions about your care. We must allow you to inspect your records within thirty (30) days of your request. If you would like an electronic copy of your health information, we will provide you a copy in electronic form and format as requested as long as we can readily produce such information in the form requested. Otherwise, we will cooperate with you to provide a readable electronic form and format as agreed. If you request copies of the records, we must provide you with copies within two working days of that request. We may charge a reasonable fee consistent with state law for our costs in copying and mailing, or for the electronic media, of your requested information. In limited circumstances, we may deny your request to see or copy your records. If we deny your request, you have the right to request a review of that denial.
Request Amendment. You have the right to request an amendment of your health information maintained by the Facility for as long as the information is kept by or for the Facility. Your request must be made in writing and must state the reason for the requested amendment.
We may deny your request for amendment if the information (a) was not created by the Facility, unless the originator of the information is no longer available to act on your request; (b) is not part of the health information maintained by or for the Facility; (c) is not part of the information to which you have a right of access; or (d) is already accurate and complete, as determined by the Facility.
If we deny your request for amendment, we will give you a written denial including the reasons for the denial and the right to submit a written statement disagreeing with the denial. Your written statement and any response which we prepare will be included in your medical or billing records.
Request an Accounting of Disclosures. You have the right to request an “accounting” of certain disclosures of your health information. This is a listing of disclosures made by the Facility or by others on our behalf, including business associates.
To request an accounting of disclosures, you must submit a request in writing or electronically, stating a time period beginning after April 13, 2003 that is within six years from the date of your request. The first accounting provided within a 12-month period will be free; for further requests we may charge you our costs if you request an accounting of your electronic record.
Request a Paper Copy of This Notice. You have the right to obtain a paper copy of this Notice, even if you previously have agreed to receive this notice electronically. You may request a written or electronic copy of this Notice at any time.
Receive Notification in the Event of a Breach. You have the right to be notified if there is a probable compromise of your Unsecured protected health information or Unsecured personal information within sixty (60) days of the discovery of the breach. The notice will include: a) a brief description of what happened, including the date of the breach and the discovery of the breach; b) a description of the type of Unsecured protected health information or personal information that was involved in the breach; c) any steps you should take to protect yourself from potential harm resulting from the breach; d) a brief description of the investigation into the breach, mitigation of harm to you and protection against further breaches; and e) contact procedures to answer your questions.
Right To Request Confidential Communications. You have the right to request that we contact you about your medical matters in a more confidential way, such as calling you at work instead of at home, by notifying the registration associate who is assisting you. We will not ask you the reason for your request, and we will try to accommodate all reasonable requests.
Right To Have Someone Act On Your Behalf. You have the right to name a personal representative who may act on your behalf to control the privacy of your health information. Parents and guardians will generally have the right to control the privacy of health information about minors unless the minors are permitted by law to act on their own behalf.
V. FOR FURTHER INFORMATION OR TO FILE A COMPLAINT
If you have any questions about this Notice or would like further information concerning your privacy rights, please contact James Freehling, Chief Executive Officer/President or Cathy Woodward, Sr. VP/Chief Compliance Officer at (781) 863-9660.
If you believe that your privacy rights have been violated, you may file a complaint in writing with the Facility or with the Office for Civil Rights in the U.S. Department of Health and Human Services. We will not retaliate against you if you file a complaint.
To file a complaint with the Facility, contact James Freehling, Chief Executive Officer/President (781) 863-9660. To file a complaint with the Office of Civil Rights, send a written statement to Office for Civil Rights-Region I, U.S. Department of Health and Human Services, JFK Federal Building Room 1875, Government Center, Boston, MA 02203.
VI. CHANGES TO THIS NOTICE
We reserve the right to change this Notice and to make the revised or new Notice provisions effective for all health information already received and maintained by the Facility as well as for all health information we receive in the future. We will post a copy of the current Notice in the Facility. We will provide a copy of the revised Notice to you upon request. A copy of the current Notice also will appear on our website at www.brookhavenatlexington.org.
Effective Date 01/1/2016