NOTICE OF PRIVACY PRACTICES
This Notice describes how medical information about you may be used, disclosed, restricted and how you can get access to this information.
PLEASE READ THIS CAREFULLY.
At Oak Orchard*, we care about your privacy. The following outlines how we handle confidential information about you.
This Notice of Privacy Practices applies to your health care and accounts record. Oak Orchard considers personal information to be confidential. We protect the privacy of that information in accordance with federal and state privacy laws, as well as our own company privacy policies.
This Notice describes how we may use and disclose your protected health information (PHI). It explains your legal rights regarding this health information.
When we use the term "Personal information," we mean financial, health and other information about you that is nonpublic, and that we obtain so that we can treat you and receive payment for our services. By "health information," we mean information that identifies you and relates to your medical, vision, and dental history (for example, the health care you receive or the amounts paid for that care).
This Notice becomes effective on April 14, 2003.
How Oak Orchard Uses and Discloses Personal Information
In order to provide you with health care treatment, you will need to sign consent. We will also need personal information about you, and we obtain that from many different sources. We obtain personal information from you, your family, past health care providers, specialists, hospitals, nursing homes, pharmacies, etc. In order for us to treat you and receive payment from you or your insurer you must sign a consent form. We will use and disclose personal information about you in various ways, including:
Treatment: We may disclose information to doctors, dentists, pharmacies, hospitals, nursing homes, schools, day cares, and other health care providers who take care of you. For example school nurses, pharmacies or specialists may request medical information from us to supplement their own records, disease, and case management and care coordination. We may also use the information to provide health guidance for individual and group programs for our patients with specific conditions such as cardiovascular disease, diabetes or asthma.
Payment: To help pay for your care and treatment we may use and disclose personal information in a number of ways. We may need to include your health information in our claim to your insurance company, in order to receive payment for services provided to you. We may also disclose your health information to other health care providers so that they can receive payment for their services. We do family billing.
Health Care Operations: We may use and disclose personal information during the course of running our health care business. During operational activities such as quality assurance, utilization review, licensing, credentialing, accreditation; regulatory reviews, performance measurement, outcomes assessment and health services research. We are also involved in preventive health care initiatives and other general administrative activities, including data and information systems management, analysis, and customer service.
Additional Reasons for Disclosure of Your Personal Information:
We may use or disclose health information about you for treatment, payment and health care operations.
Business Associates - to persons who provide services to you and us and assure us they will protect the information we give them. **Business Associates must also comply with HITECH Privacy & Security Rules in safeguarding your PHI.
Organized Health Care Arrangements - to health care professionals that have clinical privileges at hospitals and nursing homes, but are not employees of that organization. That organization will be known as an Organized Health Care Arrangement (OHCA).
Family and/or Your Close Personal Friend Involved in Your Care - We may disclose your personal health information including payment/billing information to an authorized person, of your choosing, who is involved in your care or payment for that care.
Schools and Day Care Centers - to share information with school nurses, school counselors or day care officials. Routine information shared is immunization records, recent physicals, permission forms to return to school or daycare, clarification of medication administration and verification of appointments.
NYS Immunization Information System (NYSIIS) – to share your immunizationinformation with a state wide registry.
Use and Disclosure of Personal Health Information as Required by Law
We will disclose your personal health information without your consent when required by law to do so. For example:
Disaster Relief. We may disclose your Protected Health Information to an organization assisting in a disaster relief effort.
Public Health Activities. We may disclose your Protected Health Information for public health activities including the reporting of communicable diseases, injury, vital events, and public health surveillance, investigation and/or intervention, for example venereal diseases, Tuberculosis, dog bites, etc.
Health Oversight Activities. We may disclose your Protected Health Information to health oversight agencies authorized by law to conduct audits, investigations, inspections and licensure actions or other legal proceedings. These agencies provide oversight for the Medicare and Medicaid programs, among others.
Reporting Victims of Child Abuse, Neglect or Domestic Violence. If we have reason to believe that your child may have been a victim of abuse, neglect or domestic violence, we are mandated reporters of child abuse and neglect and must disclose the child's Protected Health Information to notify a government authority as required or authorized by law.
Judicial and Administrative Proceedings. We may disclose your Protected Health Information in the course of certain judicial or administrative proceedings, for example in response to subpoenas, workers compensation or disability hearings.
Coroners, Medical Examiners, Funeral Directors, Organ Procurement Agencies We may release your health information to a coroner, medical examiners, and funeral director or, if you are an organ donor, to an organization involved in the donation of organs and tissue.
To Avert a Serious Threat to Health or Safety. We may use and disclose your Protected Health Information when necessary to prevent a serious threat to your health or safety or the health or safety of the public or another person. However, any disclosure would be made only to someone able to help prevent the threat, for example violence, homicide, suicide, lead poisoning, etc.
Military and Veterans. If you are a member of the armed forces, we may use and disclose your Protected Health Information as required by military command authorities. We may also use and disclose Protected Health Information about foreign military personnel as required by the appropriate foreign military authority.
Workers’ Compensation. We will use or disclose your Protected Health Information to comply with laws relating to workers’ compensation or similar programs.
Use and Disclosure of Personal Health Information with Your Specific Authorization
We will use and disclose your personal health information other than for treatment, payment and operations, as described in this Notice or required by law only with your written authorization. You may change or revoke your authorization to use or disclose protected health information in writing, at any time. To amend or revoke your authorization, contact the Health Information Management (HIM) staff at 585-637-3905 ext. 210. If you revoke your authorization, we will no longer use or disclose your personal health information for the purposed covered by the authorization, except where we have already relied on the authorization. For example:
Researchers - provided measures are taken to protect your privacy. We would request that you sign a written authorization before using your Individual Protected Health Information or disclosing it to others for research purposes. However, we may use or disclose unidentified health information for research purposes provided that the research has been reviewed and approved by a special Research Review Committee or Institutional Review Board.
Fundraising - The Oak Orchard Community Health Center staff might contact you or your personal representative to raise money. You must provide us with your written authorization for our use of your information for fundraising. There would be a mechanism for you to have the opportunity to **opt out or restrict your receiving fundraising communications from the health center.
Disclosure to Others Involved in Your Health Care:
Unless you object, we may disclose health information about you to a relative (s), or close personal friend or person you have identified, provided the information is directly relevant to the person's involvement with your health care.
If you are a minor, you also may have the right to block parental access to your health information in certain circumstance, if permitted by law. An example of this in New York State would be regarding reproductive health, substance abuse and behavioral or mental health.
**If you are deceased, we can disclose PHI to your family members and others who were involved in the care or payment for care of you prior to your death unless you had expressed a preference to us.
Use and Disclosure Requiring Your Written Authorization
In all situations for other than treatment, payment and operations as described above, we will ask for your written authorization before using or disclosing personal information about you. **This includes fundraising, marketing, sale of PHI and other uses and disclosures not described in your Notice of Privacy Practices. If you have given us a specific authorization or restriction, you may revoke it at any time, if we have not already acted on it. If you have questions, please contact our Privacy Officer at 585-637-3905 extension 209.
Your Legal Rights
The federal privacy regulations give you the right to make certain requests regarding health information about you. You may ask us to:
Communicate with you in a certain way or at a certain location. For example, if you are covered as an adult dependent you might want us to send health information to a different address from that of your guarantor/subscriber. We will accommodate reasonable requests.
Restrict the way (1) we use or disclose health information about you in connection with health care treatment, payment and operations. We will consider, but may not agree to, such requests. (2) You also have the right to ask us to restrict disclosures to persons involved in your health care. We will comply with your restriction except in the case of an emergency or if law requires the use or disclosure. (3) **You can restrict certain disclosure of PHI to a health plan where you have paid out of pocket in full for the health care item or service.
Obtain a copy of health information that is contained in a "designated record set" (medical records and other records maintained and used in providing treatment, making payments, filing claims and other decisions). We will ask you to make your request in writing, We can charge a reasonable fee for producing and mailing the copies and in certain case, may deny the request. **You can also request that the health information be given to you in electronic format such as a CD.
Amend health information that is in a "designated record set". Your request must be in writing and must include the reason for the request. We will usually respond within 60 days, but will notify you within 60 days if we need additional time to respond, the reason for the delay and when you can expect our response. We may deny your request for amendment, and if we do so, we will give you a written denial including the reasons for the denial and an explanation of your right to submit a written statement disagreeing with the denial. If we deny the request you may file a written statement of disagreement.
Provide a list of disclosures we have made about you, such as disclosures of health information to government agencies that license us. Your request must be in writing. If you request such an accounting more than one in a 12-month period, we may charge a reasonable fee.
**Notify of a breach of unsecured PHI
We will notify you if ever there is a breach of your health information.
You may make any of the requests described above, or may request a paper copy of this Notice, by calling 585-637-3095 ext. 209.
If you believe that your privacy rights have been violated, you may file a complaint in writing with us or with the Office of Civil Rights in the U.S. Department of Health and Human Services. To file a complaint with the Oak Orchard Health, contact our Privacy Officer, who is responsible for handling complaints. The Privacy Officer can be reached by calling (585) 637-3905 extension 209 or you may leave a message at the Oak Orchard Compliance Hotline number by calling (585) 637-3905 extension 220. No one will retaliate or take action against you for filing a complaint.
This Notice is Subject to Change
We will promptly revise and distribute this Notice whenever there is a material change to the uses or disclosures, your individual rights, our legal duties, or other privacy practices stated in this Notice. We reserve the right to change this Notice and to make the revised or new Notice provisions effective for all Protected Health Information already received and maintained by the Oak Orchard Health as well as for all Protected Health Information we receive in the future. We will post a copy of the current Notice in the Oak Orchard Health. In addition, we will provide a copy of the revised Notice to all patients by giving a hard copy to them or their personal representatives.
FOR FURTHER INFORMATION
If you have any questions about this Notice or would like further information concerning your privacy rights, please contact the Privacy Officer at (585) 637-3905 extension 209.
*For purposes of this Notice, "Oak Orchard Health" and the pronouns," "us" and "our" refer to all of the Oak Orchard sites and services including WIC and Outreach. These entities have been designated as a single covered entity for federal purposes.
**Additions to the Notice of Privacy Practice due to the New HIPAA Omnibus Rule that took effect 3/26/2013.