II. HOW WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION (PHI)
We use and disclose health information for many different reasons. For some of these uses or disclosures, we need your specific authorization. Below, we describe the different categories of our uses and disclosures and give you some examples of each category. We may use and disclose your PHI for the following reasons:
A. Uses and Disclosures Relating to Treatment, Payment or Health Care Operations:
- For treatment. We will use and disclose your PHI to provide, coordinate or manage your health care and any related services. This includes disclosures to physicians, nurses, medical students and other health care facilities (e.g., extended care facilities, skilled nursing facilities or acute rehab) and other health care personnel (e.g., a specialist, pharmacy or laboratory) who provide you with health care services or are involved in your care. For example, your PHI may be provided to a physician to whom you have been referred to ensure that the physician has the necessary information to diagnose or treat you, or your PHI from an emergency room visit may be forwarded to your primary care physician for continuity of care purposes, or occupational health follow-up (for work-related injuries) may be forwarded to worker's compensation.
- To obtain payment for treatment. We may use and disclose your PHI in order to bill and collect payment for the treatment and services provided to you. For example, we may provide portions of your PHI to your health plan, other health insurers or their subcontractors, your employer only for the purpose of obtaining insurance coverage information, our billing department and our business associates who assist in processing our heath care claims.
- For health care operations. We may disclose your PHI in order to assist in the ongoing operation of our health care facilities. For example, we may use sign-in sheets at registration desks and call you by name from waiting rooms. We may use your PHI in order to conduct peer review or quality assessment and improvement activities of the heath care services we provided to you (e.g., national health care studies, benchmarking data, Joint Commission accreditation, performance improvement teams or callbacks to patients inquiring about their care after discharge). We may also provide your PHI to our accountants, attorneys, state and federal surveyors, and consultants to make sure we are complying with appropriate laws, regulations and standards of care. We may disclose your PHI to other business associates (e.g., record storage providers, accreditation agencies) that assist with other business activities. Whenever an arrangement between our hospital and a business associate involves the use or disclosure of PHI, we will implement a written contract that will protect the privacy of your PHI.
- Emergency treatment exception. We may disclose your PHI to others before you may have an opportunity to sign a Conditions of Admission (COA) form or read this privacy notice in certain situations. For example, if you need emergency treatment and are unable to communicate with us (e.g., unconscious or in severe pain), we will provide you with a COA form and a copy of this notice as soon as reasonably practical after treatment.
B. Other Uses and Disclosures.
We may use and disclose your PHI for the following reasons:
- When federal, state or local law; judicial or administrative proceedings, or law enforcement requires a disclosure. For example, we must make disclosures about victims of abuse, neglect or domestic violence; when dealing with gunshot and other wounds; or when ordered in a judicial or administrative proceeding.
- For public health activities. For example, we report information about births, deaths, and communicable diseases to government officials in charge of collecting that information (e.g., California State Department of Health Services, Centers for Disease Control and Prevention, Office of Statewide Health Planning and Development, Department of Motor Vehicles) We provide coroners, medical examiners and funeral directors with necessary information relating to an individual's death.
- For health oversight activities. For example, we will provide information to assist the government when it conducts an investigation or inspection of a health care provider or organization.
- For purposes of organ donation. We may notify organ procurement organizations to assist them in organ, eye or tissue donation and transplants.
- For Food and Drug Administration (FDA) purposes. We may disclose PHI to a person or company required by the FDA to report adverse events, product defects or problems or biologic product deviations or to track products, enable product recalls, make repairs or replacements or conduct post-marketing surveillance, as required.
- For research purposes. In certain circumstances, we may provide PHI to researchers when the research has been approved by an institutional review board that has reviewed the research proposal and has established protocols to ensure the privacy of your protected health information.
- To avoid harm. In order to avoid a serious threat to the health or safety of a person or the public, we may provide PHI to law enforcement personnel or people able to prevent or lessen such harm. For example, we may provide PHI to the police, sheriff or FBI or for involuntary psychiatric placement.
- For specific government functions. We may disclose PHI of military personnel and veterans in certain situations. We may also disclose PHI for national security purposes, such as when conducting intelligence operations.
- For workers' compensation purposes. We may provide PHI in order to comply with workers' compensation laws.
- Appointment reminders and health-related benefits or services. We may use PHI to provide appointment reminders or to give you information about treatment alternatives and other health care services that may be of benefit or interest to you.
- Fundraising and marketing activities. We do not use PHI for fundraising or marketing.
C. Uses and Disclosures That Require You Be Given the Opportunity to Object:
- Patient directories. We may include your name, location in this facility, general condition and religious affiliation in our patient directory for use by clergy and visitors who ask for you by name unless you object in whole or in part. This opportunity to object may be obtained retroactively in emergency situations.
- Disclosures to family, friends or others. We may provide your PHI to a family member, friend or other person that you indicate is involved in your care or the payment for your health care, unless you object in whole or in part. This opportunity to object may be obtained retroactively in emergency situations.
D. Other Uses and Disclosures That Require your Prior Written Authorization:
In any other situation not described in sections II, parts A, B and C above, we will ask for your written authorization before using or disclosing any of your PHI. If you choose to sign an authorization to disclose your PHI, you can later revoke that authorization in writing to stop any future uses and disclosure (to the extent that we have not taken any action relying on the authorization.)
III. WHAT RIGHTS YOU HAVE REGARDING YOUR PHI
A. The Right to Request Limits on Uses and Disclosures of Your PHI
You have the right to request that we limit how we use and disclose your PHI. We will consider your request but are not legally required to accept it. If we accept your request, we will put any limits in writing and abide by them except in emergency situations. You may not limit the uses and disclosures that we are legally required or allowed to make.
B. The Right to Choose How We Send PHI to You
You have the right to ask that we send information to you to an alternate address (e.g., sending information to your work address rather than your home address) or by alternate means (e.g., fax rather than regular mail). We must agree to your request as long as we can easily provide it in the format you requested.
C. The Right to Inspect and Copy Your PHI
In most cases, you have the right to look at or obtain copies (at a nominal fee) of your PHI that is contained in a designated record set for as long as we maintain the PHI. A "designated record set" contains medical, billing and other records that the hospital uses for making decisions about you. You may not inspect or copy psychotherapy notes or PHI compiled in anticipation of a legal proceeding or that is subject to any law that prohibits its access.
All requests must be made in writing. If we do not have your PHI but we know who does, we will tell you how to get it. We will respond to you within 30 days after receiving your written request. In certain situations, we may deny your request. If we do, we will tell you, in writing, our reasons for the denial and explain your right to have the denial reviewed.
D. The Right to Obtain a List of the Disclosures We Have Made
You have the right to request a list of instances in which we have disclosed your PHI. This list will not include uses or disclosures made for treatment, payment, or health care operations, directly to you or that you authorized, to your family, or in our facility directory. The list also will not include uses and disclosures made before April 14, 2003. We will respond within 60 days of receiving your written request. The list we give you will include disclosures made in the last six years unless you request a shorter time. The list will include the date of the disclosure, to whom the PHI was disclosed (including their address, if known), a description of the information disclosed and the reason for the disclosure. We will provide the list to you at no charge, but if you make more than one request in the same year, we will charge you for each additional request.
E. The Right to Correct or Amend Your PHI
If you believe that there is a mistake in your PHI or that a piece of important information is missing, you have the right to request that we correct the existing information or add the missing information to the designated record set. You must provide the request and your reason for the request in writing. We will respond within 60 days of receiving your request. If we approve your request, we will make the change to your PHI, tell you that we have done it and tell others that need to know about the change to your PHI.
We may deny your request in writing if the PHI is (i) correct and complete, (ii) not created by us, (iii) not allowed to be disclosed or (iv) not part of our records. Our written denial will state the reasons for the denial and explain your right to file a written statement of disagreement with the denial. If you do not file one, you have the right to ask that your request and our denial be attached to all future disclosures of your PHI.
IV. HOW TO COMPLAIN ABOUT OUR PRIVACY PRACTICES