Notice of Privacy Practices – Health Services of Southern Illinois
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
I. Who We Are
This Notice describes the privacy practices of Health Services of Southern Illinois (HSSI). It also applies to independent health care providers while providing services in our facilities, such as physicians, who are not employed by us but who attend patients in our facilities. This Notice, however, does not govern the privacy practices of these other health care providers for services they provide outside of our facilities.
II. Our Privacy Obligations
We are required by law to maintain the privacy and security of your individually identifiable health information Protected Health Information, or (“PHI”), and to provide you with this Notice of our legal duties and privacy practices with respect to your Protected Health Information. PHI is individually identifiable under HIPAA if it includes your name, address, zip code, geographical codes, dates of birth, other elements of dates, telephone or fax numbers, email address, social security number, insurance information, medical record number, member or account number, certificate/license number, voice or finger prints, photos or any other unique identifying numbers, characteristics or codes of you. When we use or disclose your PHI, we are required to abide by the terms of this Notice (or other notice in effect at the time of the use or disclosure).
III. How We Typically Use Or Share Your Health Information Without Your Written Authorization
In certain situations, which we will describe in Section IV below, we must obtain your written authorization in order to use and/or disclose your PHI. However, we do not need any type of authorization from you for the following uses and disclosures:
A. Treatment. We can use your protected health information and share it with other healthcare professionals so we can treat and provide health care related services to you–for example, to diagnose and treat your injury or illness. In addition, we may contact you to provide appointment reminders or other health-related benefits and services that may be of interest to you.
B. Payment. We can use and share your protected health information to bill and get payment for the services that you received from us or our healthcare team; for example, to send your insurance a bill so they can pay us for the services we provided to you. We may also use and share your information to a third party who provides collection services on behalf of Health Services of Southern Illinois.
C. Health Care Operations. We can use and share your protected health information for our health care operations, which include various activities that improve the quality and cost effectiveness of the care that we deliver to you. For example, we may use and share your protected health information, such as your e-mail address, to contact you through a survey to ask your opinion about the quality of the services we provided to you.
D. Use or Disclosure for Directory of Individuals in one of Health Services of Southern Illinois’s facilities. We may include your name, your location in the Health Services of Southern Illinois system, general health condition and religious affiliation in a patient directory. If you do not object, information in the directory can be shared to anyone who asks for you by name. Religious affiliation will only be shared to members of the clergy.
E. Disclosure to Relatives, Close Friends and Other Caregivers. We may use and share your protected health information to a family member, other relative, a close personal friend or any other person identified by you, if we 1) obtain your agreement; 2) provide you with the opportunity to object to the disclosure and you do not object.
If you are not present, or the opportunity to agree or object to a use or sharing of your protected health information cannot practicably be provided because of your incapacity or an emergency circumstance, we may exercise our professional judgment to determine whether sharing your information to a family member, other relative or close personal friend is in your best interest. We may also share your protected health information in order to notify (or assist in notifying) such persons of your location, general condition or death.
F. Fundraising Communications. We may contact you to request a tax-deductible contribution to support important activities of Health Services of Southern Illinois. In connection with any fundraising, we may only share to our fundraising staff demographic protected health information about you (e.g., your name, address, phone number, age and gender), dates on which we provided health care to you, the department that treated you, the names of your treating physicians, and information regarding the outcome of your treatment and your health insurance status.
G. Public Health Activities. We may share your protected health information for the following public health activities: 1) to report health information to public health authorities for the purpose of preventing or controlling disease, injury or disability; 2) to report child abuse and neglect to government authorities authorized by law to receive such reports; 3) to report information about products and services to the U.S. Food and Drug Administration; 4) to alert a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition; and 5) to report information to your employer as required under laws involving work-related illnesses and injuries or workplace medical surveillance.
H. Victims of Abuse, Neglect or Domestic Violence. If we reasonably believe you are a victim of abuse, neglect or domestic violence, we can share your protected health information to a governmental authority, including a social service or protective services agency, authorized by law to receive reports of such abuse, neglect, or domestic violence.
I. Health Oversight Activities. We can share your protected health information to a health oversight agency for ensuring compliance with the rules of government health programs such as Medicare or Medicaid.
J. Judicial and Administrative Proceedings. We can share your protected health information in response to a court or administrative order, or in response to a subpoena.
K. Law Enforcement Officials. We can share your protected health information to the police or other law enforcement officials as required or permitted by law or in compliance with a court order or subpoena.
L. Decedents. We can share protected health information to a coroner, medical examiner or funeral director when an individual dies.
M. Organ and Tissue Procurement. We can share your protected health information to organizations that facilitate organ, eye or tissue procurement.
N. Research. We can use or share your protected health information without your consent or authorization if our Institutional Review Board approves a waiver of authorization for disclosure.
O. Health or Safety. We can use or share your protected health information to prevent or lessen a serious and imminent threat to a person’s or the public’s health or safety.
P. Specialized Government Functions. We can use and share your protected health information to units of the government with special functions, such as the U.S. military or the U.S. Department of State under certain circumstances.
Q. Workers’ Compensation. We can share your protected health information relating to workers’ compensation claims.
R. As required by law. We can use and share your protected health information when required to do so by any other law not already referred to in the preceding categories.
S. Health Information Exchanges and Network. We may use and share your PHI without your consent or authorization to a health information exchange (HIE) or network such as Epic Care Everywhere. We use this system as a way of electronically sharing your health information to healthcare providers involved in your care. The purpose of sharing your information via this system is to give participating providers faster access to your health information that will facilitate safer, timelier, and efficient patient-centered care. For example, if you have healthcare services at a St Louis area healthcare provider, that provider may have access to your HSSI electronic health information.
If you do not want your health information maintained by Health Services of Southern Illinois to be accessible to authorized health care providers through a health information exchange or network, you may opt out by completing and sending a non-participation (opt-out) form to the Privacy Officer. If you decide to opt-out of the health information exchange and/or network, doctors, nurses and other healthcare providers will not be able to obtain and use your HSSI health information when providing treatment to you. For further information about HIE and/or Epic Care Everywhere and/or to obtain an opt-out form please contact the Privacy Officer at the address found in Section VII.
IV. Uses and Disclosures Requiring Your Written Authorization
A. Use or Disclosure with Your Authorization. For any purpose other than the ones described above in Section III, we can only use or share your protected health information when you grant us your written authorization. For instance, you will need to complete an authorization form before we can send your protected health information to your life insurance company or to an attorney.
B. Marketing. We must get your written permission prior to using your protected health information to send you any marketing materials. We can, however, without your permission 1) provide you with marketing materials in a face-to-face encounter; 2) give you a promotional gift of nominal value; 3) provide refill reminders or communicate with you about a drug or biologic that is currently prescribed to you; 4) communicate with you about products or services relating to your treatment, case management or care coordination.
C. Sale of Protection Health Information. We will not sell your protected health information without your written permission.
D. Uses and Disclosures of Your Highly Confidential Information. In addition, federal and Illinois law requires special privacy protections for certain highly confidential information, such as: 1) psychotherapy notes; 2) mental health and developmental disabilities services; 3) alcohol and drug abuse prevention, treatment and referral; 4) HIV/AIDS testing, diagnosis or treatment; 5) venereal disease(s); 6) genetic testing; 7) child abuse and neglect; 8) domestic abuse of an adult with a disability; or 9) sexual assault. In order for us to share your highly confidential information for a purpose other than those permitted by law, we must obtain your written permission.
V. Your Rights Regarding Your Protected Health Information
A. Filing a Complaint. If you feel we have violated your privacy rights. You may contact our Privacy Officer. You may also file a complaint with the Director, Office for Civil Rights of the U.S. Department of Health and Human Services, 200 Independence Avenue, S.W. Washington, D.C. 20201, by visiting www.hhs.gov/hipaa/filing-a-complaint/ or you can contact the Privacy Officer for additional information. We will not retaliate against you if you file a complaint.
B. Right to Request Additional Restrictions. You can ask us not to use or share certain health information for treatment, payment and health care operations. While we will consider all requests for additional restrictions carefully, we are not required to agree to a requested restriction. We are required to say “yes” if you ask us to restrict sharing your protected health information to 1) a health plan for purpose of carrying out payment or health operations; and 2) the PHI pertains solely to a healthcare item or service which has been fully paid out of pocket. If you wish to request additional restrictions, contact our Privacy Officer.
C. Right to Receive Confidential Communications. You can ask us to contact you in a specific way (for example, home or office phone or by mail to a specific address), we will say “yes” to all reasonable requests.
D. Right to Revoke Your Authorization. You may revoke Your Authorization, except to the extent that we have taken action in reliance upon it, by providing a written revocation statement to the Privacy Officer. A form of Written Revocation is available upon request from the Privacy Officer.
E. Right to Inspect and Copy Your Health Information. You can ask to see or get an electronic or paper copy of your medical record, billing record and other health information we have about you. We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable, cost based fee. Under limited circumstances, we may deny you access to a portion of your records. To obtain information about viewing or getting a copy of your protected health information, visit www.HSSI.net, or contact the Health Information Department at the facility where you were a patient.
F. Right to Amend Your Records. You can ask us to correct protected health information about you that is maintained in your medical record or billing record that you think is incorrect or incomplete. To request an amendment to your records, visit www.HSSI.net, or contact the Health Information Department at the facility where you were a patient. We may say “no” to your request if we believe that the information that would be amended is accurate and complete. If we say “no” to your request you have the right to appeal our decision. You will receive our response to your request for a correction to your protected health information in writing and within 60 days.
G. Right to Receive an Accounting of Disclosures. You can ask for a list (accounting) of the times we’ve shared your health information without your authorization for six years prior to the date you ask The accounting list will provide who we shared your health information with and why. We will provide one accounting list a year for free but will charge a reasonable, cost based fee if you ask for another one within 12 months.
H. Breach Notification. We will let you know if a breach occurs that may have compromised the privacy or security of your information.
I. Right to Receive Paper Copy of this Notice. You can ask for a paper copy of this Notice at any time, even if you have agreed to receive the notice electronically.
J. Right to a Personal Representative. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has the authority and can act for you before we take any action.
VI. Effective Date and Duration of This Notice
Effective Date. This Notice is effective on April 14, 2003.
Right to Change Terms of this Notice. We can change the terms of this Notice, and the changes will apply to all information we have about you. If we change this Notice, we will post the new notice in waiting areas around Health Services of Southern Illinois and on our Internet site at www.vitalysis.com. You also may obtain any new notice by contacting the Privacy Officer.
VII. Contact Information for Privacy Officer
You may contact the Privacy Officer at: Health Services of Southern Illinois.
Address: 1239 E Main, Carbondale, IL 62901.
Telephone Number: 800-228-6631