JOINT HIPAA NOTICE OF PRIVACY PRACTICES FOR CNE MEMBER ORGANIZATIONS
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
I. WHO WE ARE
This Notice describes the privacy practices of Care New England Health System and its affiliates that make up Care New England Health System (“CNE”). The entities that make up CNE include, the CNE hospitals (including, but not limited to Butler Hospital, Kent County Memorial Hospital, The Memorial Hospital d/b/a Memorial Hospital of Rhode Island, Women & Infants Hospital of Rhode Island), and all other direct and indirect CNE affiliated entities (including, but not limited to, the Kent County Visiting Nurse Association d/b/a VNA of Care New England, HealthTouch, Inc., Affinity Physicians, LLC and Women & Infants Health Care Alliance, LLC) (hereinafter may be collectively referred to as “we,” “us” or “our”). This Notice also describes the privacy practices that apply to our employees (including, but not limited to, those employed health care professionals and other employed individuals with access to your medical or billing records), and all other health care professionals (such as doctors and nurses) allowed to enter or access information in your medical record when they are providing services in our facilities. Please know that you may also receive a separate privacy notice from your individual health care provider which may describe the privacy practices of his or her own medical practice.
II. OUR PRIVACY OBLIGATIONS
We are required by law to protect the privacy of your health information (“PHI
”) and we take this obligation very seriously. Additionally, we are required by law to provide you with this Notice of our legal duties and privacy practices with respect to your PHI, and to notify you in the event of a breach of your unsecured PHI. While in certain circumstances we may use and/or disclose your PHI (as detailed in Section III and Section IV of this Notice), generally we may not use and/or disclose any more PHI than is necessary to accomplish our purpose for such use and/or disclosure and we are required to abide by the terms of this Notice. We may change the terms of this Notice at any time. Any change will apply to all of your PHI that we already have and will include any PHI created or received prior to our formally issuing any new Notice setting forth the change. When we change this Notice, we will promptly issue the new Notice by posting the new Notice prominently at the facilities, and on the websites, of each CNE affiliate where health care services are provided and on the CNE website at www.carene.org
. You may also obtain any new Notice by requesting a new Notice from the CNE affiliate where you received services at the address or telephone number listed in Section IX.
III. HOW WE MAY USE AND/OR DISCLOSE YOUR PHI WITHOUT YOUR WRITTEN AUTHORIZATION
We may use and/or disclose your PHI for many different reasons. In certain situations, which are described in Section IV of this Notice, your written authorization must be obtained in order to use and/or disclose your PHI. However, your authorization is not required for the following uses and/or disclosures by us:
A. Use of PHI for treatment, payment and health care operations.
1. For treatment. We may use and/or disclose your PHI with physicians, nurses, medical students, and others who provide you with health care services or are involved in your care. For example, if you are being treated for diabetes, we may disclose your PHI with your primary care physician and/or a nutritionist in order to coordinate your care.
2. For payment. We may use and/or disclose your PHI in order to bill and collect payment for the health care services we provide to you. For example, we may disclose your PHI with your health plan to obtain payment from your health plan for the health care services we provide to you. We may also disclose your PHI to billing companies and companies that process our health care claims or to other health care providers when your PHI is required for them to receive payment for the health care services they provide to you.
3. For health care operations. We may use and/or disclose your PHI in order to operate our organization. For example, we may use your PHI to evaluate the quality of health care services that you receive, or to evaluate the health care professionals who provide health care services to you. We may also disclose your PHI to our accountants, attorneys and others in order to make sure we are complying with applicable laws.
B. Other uses and disclosures of your PHI that do not require your authorization (except with respect to certain Highly Confidential Information as described in Section IV), we may also use and/or disclose your PHI for the following reasons:
1. As required or authorized by law. We may use and/or disclose your PHI (i) when required by any applicable federal, state or local law; (ii) in response to a legal order or other lawful process; or (iii) to a coroner, medical examiner or funeral director as authorized by law.
2. Public health. We may use and/or disclose your PHI to (i) report health information to public authorities for the purpose of preventing or controlling disease, injury or disability; (ii) report child abuse and neglect to the government authority authorized to receive such reports; (iii) report abuse, neglect or domestic violence, if we reasonably believe you are a victim of such acts, to the government authority authorized to receive such reports; (iv) report information about products under the jurisdiction of the U.S. Food and Drug Administration; (v) alert a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition; or (vi) report information to your employer as required under laws addressing work-related illnesses and injuries or workplace medical surveillance.
3. Health oversight. We may use and/or disclose your PHI for the purpose of assisting the government when it investigates or inspects a health care provider or organization.
4. Organ donation. We may use and or disclose your PHI to notify organ banks to assist them in organ, eye, or tissue donation and transplants to the extent permitted by state law.
5. Research. We may use and/or disclose your PHI for research purposes. Depending on the circumstances, state law may require us to obtain your authorization before using and disclosing your PHI for research purposes. If state law requires us to obtain your authorization, we will do so before using or disclosing your PHI for research purposes.
6. To avoid harm. We may use and/or disclose your PHI to law enforcement or other appropriate persons, in order to avoid a serious threat to the health or safety of a person or the public.
7. Other government functions. We may use and/or disclose your PHI for certain military and veterans' activities, national security and intelligence purposes, protective services for the president of the United States, or correctional facility situations.
8. Workers' compensation. We may use and/or disclose your PHI in order to comply with workers' compensation laws.
9. Appointment reminders and health-related benefits or services. We may use your PHI to give you appointment reminders, or to give you information about treatment choices or other health care services or benefits we offer.
10. Fundraising. We may use your PHI to contact you for fundraising purposes. Donations are used to expand and support the health care services and educational programs we provide to the community. If you do not wish to be contacted for fundraising purposes, please notify us by providing us with written notice addressed to the contact person at the location where you received service (addresses for locations are listed in Section IX).
11. For integration with affiliated health care providers. As permitted by law, we may use and/or disclose your PHI with health care providers who are affiliated with CNE and the CNE affiliates may share PHI with each other as necessary to carry out treatment, payment, or health care operations.
IV. HOW WE MAY USE AND/OR DISCLOSE YOUR PHI AFTER OBTAINING YOUR WRITTEN AUTHORIZATION
We must ask for your written authorization for any other use and/or disclosure of your PHI which was not described in Section III. If you authorize us to use and/or disclose your PHI, you can later revoke the authorization and stop any future use or disclosure of your PHI under that prior authorization. You can revoke an authorization by providing a written request of such revocation to the CNE affiliate where you received services at the address listed in Section IX.
A. Highly Confidential Information. Certain state and federal laws require special privacy protections for certain highly confidential information about you, including the subset of your PHI that: (i) is maintained in psychotherapy notes; (ii) is about mental health services at Butler Hospital or the Kent Unit at Butler; (iii) is about services for alcohol or drug abuse or addiction by substance abuse programs operated by us; (iv) is about HIV/AIDS test results; or (v) involves genetic information ("Highly Confidential Information"). We must generally get your authorization to disclose any Highly Confidential Information about you, but may disclose it without first getting your authorization in the following circumstances:
1. Psychotherapy notes. In general, we will not use or disclose information recorded by a mental health professional to document or analyze conversations with you in therapy, unless you authorize us to do so. However, we can use or disclose such PHI without your authorization for the following purposes: (a) the health professional who recorded the information can use it to treat you; (b) in limited situations, we can use or disclose such PHI in connection with mental health counseling training that occurs at one of our facilities; (c) we can use or disclose your psychotherapy notes to defend against any legal proceeding brought by you; and (d) compliance with law, public health, health oversight or to avoid harm (each as described in Section III).
2. Mental health treatment. Information regarding your mental health treatment may be used by or disclosed to those who are providing you with treatment. It may also be disclosed to entities responsible for paying for your care, such as insurance companies, but only the amount of information necessary for payment purposes will be disclosed. If they ask and we think it is in your best interest, we may tell your lawyer, your guardian or conservator (if any), or a member of your family that you are a patient at Butler Hospital or the Kent Unit at Butler, unless you tell us not to. If you are a patient at Butler Hospital or the Kent Unit at Butler, we may tell the mental health advocate your name and when your treatment began, unless you tell us not to. Information regarding your mental health treatment may be disclosed when ordered by a court or otherwise required by law, such as reports of suspected child abuse or reports to the department of health or other regulatory agencies. We may also use or disclose mental health treatment information for purposes of program evaluation or research under limited circumstances. If you are a minor, your mental health treatment records may be released to your parent or guardian under certain circumstances. In an emergency, information regarding your mental health treatment may be used or disclosed in order to prevent someone, (including you) from, being harmed.
3. Drug and alcohol treatment records. The confidentiality of alcohol and drug abuse related PHI which is maintained by the substance abuse programs we may operate is protected by federal law and regulations. In general, we may not tell a person outside the program that you attend the program, or disclose any information identifying you as an alcohol or drug abuser unless: (a) you consent in writing; (b) the disclosure is allowed by a court order; or (c) the disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluation. Violation of the federal law and regulations by a substance abuse program is a crime. Suspected violations may be reported to appropriate authorities in accordance with federal regulations. Federal law and regulations do not protect any information about a crime you may commit either at substance abuse program or against any person who works for the substance abuse program or about any threat to commit such a crime. Federal laws and regulations do not protect any PHI about suspected child abuse or neglect from being reported under state law to appropriate state or local authorities. (See 42 U.S.C. 290dd-3 and 42 U.S.C. 290ee-3 for federal laws and 42 CFR part 2 for Federal regulations.)
4. HIV-related information. Results of your HIV test will generally not be disclosed without your prior written authorization. However, we may disclose test results without your prior authorization under certain circumstances. For example, we may disclose results to health professionals directly involved in your care, to government agencies, such as the State Department of Health or the Department of Children, Youth and Families and in other circumstances where disclosure is permitted or required by law.
B. Marketing. We will not make any disclosure of your PHI for purposes that would constitute marketing without your written authorization. For example, we will not accept any payments from other organizations or individuals in exchange for making communications to you about treatments, therapies, health care providers, settings of care, case management, care coordination, products or services unless you have given us your written authorization or unless the communication is permitted by law. That said, we may (1) provide refill reminders or communicate with you about a drug or biologic that is currently prescribed to you so long as any payment we receive for making the communication is reasonably related to the cost of making the communication; or (2) market to you in a face-to-face encounter and give you promotional gifts of nominal value.
C. Sale of PHI. We will not make any disclosure of your PHI that would constitute a sale of PHI without your written authorization.
V. WHEN YOU MAY OBJECT TO OUR USE AND/OR DISCLOSURE OF YOUR PHI
A. Patient directories. Except for Butler Hospital, the Psychiatric Care Unit at Kent Hospital and the Kent Unit at Butler, we may include your name, room number or unit, general condition, and religious affiliation in the patient directory of our hospital affiliates for use by clergy and visitors who ask for you by name. You may choose not to have this information in our patient directories. If you choose not to have this information in the directory, we cannot tell visitors, callers or delivery people (such as mail or flowers), that you are a patient and, unless you give specific contact information to another person (family member, etc.), you will not receive visitors or telephone calls.
B. Disclosures to family, friends, or others. Except for certain circumstances involving Highly Confidential Information, we may disclose your PHI with a family member, friend, or other person who is involved in your care or the payment for your health care.
VI. YOUR RIGHTS REGARDING YOUR PHI
A. Your right to request limits on our use of PHI. You may ask that we limit how we use and/or disclose your PHI. We will consider your request but are not legally required to agree to your request unless the disclosure is (i) to a health plan for purposes of carrying out payment or health care operations; and (ii) the PHI pertains solely to a health care item or service for which you have paid us out of pocket in full. If we agree to your request, we will follow your limits, except in emergency situations. You cannot limit the uses or disclosures that we are legally required or allowed to make.
B. Your right to choose how we send PHI to you. You may ask that we send information to you at a different address (for example, to your work address rather than your home address) or by different means (for example, by e-mail instead of regular mail). We will agree to your request, as long as we can easily provide it in the way you requested.
C. Your right to view and get a copy of PHI. You may view or obtain a copy of your PHI. However, there are some circumstances in which we may deny your request. Your request must be in writing. If we do not have your PHI, but know who does, we will tell you who has it. We will reply to you within 30 days of your request. If we deny your request, we will tell you, in writing, our reasons for the denial and explain what appeal rights, you have, if any.
If you request a copy of your PHI, we may charge a fee if permitted to do so by law. Instead of providing the PHI you requested, we may offer to give you a summary or explanation of the PHI, as long as you agree to that and to the cost in advance.
D. Your right to receive an accounting of disclosures. You have the right to get a list of the parties to whom we have disclosed your PHI. Some disclosures will not be listed, however. For example, the list will not include disclosures related to treatment, payment, or health care operations; disclosures you have previously authorized; disclosures made directly to you or some disclosures to your family; disclosures in our patient directory; disclosures for national security purposes; disclosures to corrections or law enforcement personnel; or disclosures made before April 14, 2003.
We will respond to your request within 60 days. We will include the disclosures made in the last six years unless you request a shorter time. The list will include the date of each disclosure, the identity of person(s) to whom the disclosure was made, the type of information disclosed, and the reason for the disclosure. We will not charge you for the list. If you make more than one request in the same year, however, we may charge you a fee for each additional request. For a list, you must make a written request to the CNE affiliate where you received services at the address listed in Section IX.
E. Your right to correct or update your PHI. If you feel that there is a mistake in your PHI, or that important information is missing, you may request a correction. Your request must be in writing, include a reason for the request and be addressed to the CNE affiliate where you received services at the address listed in Section IX.
We will respond within 60 days of your request. We may deny your request if the PHI is (i) correct and complete; (ii) not created by us; (iii) not allowed to be shared with you; or (iv) not in our records. If we deny your request, we will inform you of the reason for the denial. You may then file a written statement of disagreement, or you may ask that your original request and our denial be attached to all future disclosures of your PHI. If we agree to honor your request, we will change your PHI, inform you of the change, and tell any others who need to know about the change to your PHI.
F. Your right to a paper copy of this notice. You may ask us for a copy of this Notice at any time even if you have agreed to receive this Notice electronically.
VII. MINORS AND PERSONAL REPRESENTATIVES
In most situations, parents, guardians, and/or others with legal responsibilities for minors (children under 18 years of age) may exercise the rights described in this Notice on behalf of the minor. However, there are situations where minors may themselves exercise the rights described in this Notice and minors' parents or guardians may not.
VIII. TO FILE A COMPLAINT ABOUT OUR PRIVACY PRACTICES
You can complain if you feel we have violated your rights by contacting the CNE affiliate where you received services at the address or telephone number listed in Section IX or by sending a written complaint to the Secretary, U.S. Department of Health and Human Services, 200 Independence Avenue S.W., Washington, D.C. 20201. Your complaint will not alter or affect the care we provide to you.
IX. PERSONS TO CONTACT FOR INFORMATION ABOUT THIS NOTICE
If you have any questions about this Notice or wish to request a new Notice, wish to file a complaint about our privacy practices, feel that we may have violated your privacy rights, disagree with a decision we made about access to your PHI, or wish to provide notice or make a request for any other reason set forth in this Notice, please contact the contact person at the to the CNE affiliate where you received services at the address or telephone number below:
Director of Medical Records
345 Blackstone Blvd.
Providence, RI 02906
Telephone number: 401-455-6413 Kent County Memorial Hospital
Kent Hospital Privacy Officer
455 Toll Gate Road
Warwick, Rhode Island 02886
Telephone number: 401-736-4224
Memorial Hospital of Rhode Island
MHRI Privacy Officer
111 Brewster Street
Pawtucket, Rhode Island 02863
Telephone Number: 401-729-2148
VNA of Care New England and HealthTouch, Inc.
51 Health Lane
Warwick, Rhode Island 02886
Telephone number: 401-737-6050
Women & Infants Hospital
101 Dudley Street
Providence, Rhode Island 02905
Telephone number: 401-274-1100
Any CNE affiliate not listed above
Butler Hospital Campus
Potter Building – Compliance
345 Blackstone Blvd.
Providence, Rhode Island 02906
Telephone number: 401-277-3660
Effective date of this Notice: September 23, 2013