THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION
ABOUT YOU MAY BE USED AND DISCLOSED
AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.
WHO THIS NOTICE APPLIES TO
This Notice applies to all of Mount St. Mary’s:
- Service locations, including: all outpatient practices and clinics operated by the Hospital.
- All health care professionals, employees, students, volunteers and other personnel from these facilities authorized to access your medical record.
- Independent health care providers not employed by Mount St. Mary’s who are involved in your care while practicing in one or more of our facilities (such as physicians).
- Other entities that provide health care services to you in a way that is integrated with our services at one or more of our facilities and their health care professionals, employees, students, volunteers and other personnel.
Mount St. Mary’s takes the privacy of the health information entrusted to us seriously, as both an ethical and a legal obligation. We are required by law to:
- Maintain the privacy of health information.
- Provide you with this Notice of Privacy Practices ("Notice"), which tells you about our duties and practices with respect to protecting health information.
- Abide by the terms of the Notice that is currently in effect.
- Notify you following a breach of unsecured health information that affects you.
HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION
The following categories describe different ways Mount St. Mary’s may use and disclose your health information without your written authorization. Health information is most often used and disclosed to provide treatment, to obtain payment for treatment, or for health care operations. We will provide an example of the types of uses covered by these categories. Not every use or disclosure in a category will be listed. References to "you" and "your" information include your child's information, when appropriate.
- For Treatment. Mount St. Mary’s may use and disclose health information to provide treatment, health care or other related services. Health information may be used by or disclosed to doctors, nurses, aides, or other healthcare providers who are involved in taking care of you. Additionally, Mount St. Mary’s may use or disclose health information to manage or coordinate treatment, health care or other related services. For example, we may use or disclose health information about you for treatment purposes such as when you are referred to a specialist for care or when we send a prescription to a pharmacy to be filled for you.
- For Payment. Mount St. Mary’s may use and disclose health information to bill and collect for the treatment and services we provide to you. We may send health information to your insurance company or other third party payer for payment purposes. For example, we may use and disclose health information about you for payment purposes such as when we send claims to your HMO for payment or to find out whether proposed treatment is covered.
- For Health Care Operations. Mount St. Mary’s may use and disclose health information for health care operations. These uses and disclosures are necessary to run Mount St. Mary’s and to maintain and improve the quality of health care we provide. For example, we may use and disclose health information about you for health care operations purposes such as accreditation renewals, quality improvement activities, and teaching purposes.
- Hospital Directory. Mount St. Mary’s may include limited information about you in the hospital directory while you are a patient at Mount St. Mary’s. This information includes your name, location in the hospital, your general condition (e.g., fair, stable, etc.) and your religious affiliation. The directory information may be disclosed to people who ask for you by name, except for your religious affiliation, which may only be disclosed to clergy members. You have the right to not have your information included in the hospital directory ("opt-out"). To opt-out of the hospital directory, we ask that you make this request during patient registration.
- Individuals Involved in Your Care or Payment for Your Care. Mount St. Mary’s may disclose to your family member, relative, close personal friend or other person identified by you, health information that is directly relevant to that person’s involvement with your care or payment for your care. Mount St. Mary’s will not share this information with these individuals if we are aware of your desire not to have this information shared.
Appointment Reminders and Health-Related Benefits or Services. We may use health information to provide you appointment reminders, information about treatment alternatives, or information about other health care services or benefits we offer.
Business Associates. We may disclose your health information to contractors, agents and other associates who need information to assist us in carrying out our business operations. Our contracts with them require that they protect the privacy of your health information.
Fundraising. We may use or disclose health information for the purpose of raising funds to help support Mount St. Mary’s mission. Any fundraising communications you receive will include information on how to elect not to receive further fundraising contacts, or you may call 716-298-2166 at any time to opt out of fundraising communications.
Research. Under certain circumstances, Mount St. Mary’s may use and disclose health information for research purposes. For example, a research project may involve comparing the health and recovery of all individuals who receive one medication to those who receive another. All research projects are subject to a special approval process.
- Immunization Records. Mount St. Mary’s may disclose immunization records to a school where you are or will be a student, if the school is required by law to have proof of immunizations for admission purposes. Mount St. Mary’s will first obtain your verbal or written permission to make this disclosure.
- Personal Representatives. Mount St. Mary’s may disclose your health information to your personal representative who has authority to act on your behalf under applicable law.
- Electronic Health Care Records. Some or all of your medical information may be created and/or stored in an electronic format. When permissible for valid purposes (e.g. providing treatment or billing for services) your health care providers may access your medical information electronically. Other healthcare providers outside Mount St, Mary’s and others caring for you may also receive access to your electronic health records for the purposes outlined above.
- For Public Health Purposes. Mount St. Mary’s may disclose health information for public health activities. For example, public health activities include: preventing and controlling disease, injury or disability; reporting births and deaths; and reporting defective medical devices or problems with medications.
- About Victims of Abuse. Mount St. Mary’s may disclose your health information to notify the appropriate government authority if we believe you have been the victim of abuse, neglect or domestic violence. We will only make this disclosure if you agree, or when required or authorized by law.
Health Oversight Activities. Mount St. Mary’s may disclose health information to a health oversight agency for health oversight activities authorized by law. These activities include audits, investigations, licensure and disciplinary actions, and related activities to monitor the health care system, governmental benefit programs, and compliance with civil rights laws.
- Judicial and Administrative Proceedings. Mount St. Mary’s may disclose health information in response to a subpoena, court order, or administrative order, if certain requirements are met.
- Law Enforcement. Mount St. Mary’s may release health information to law enforcement if the disclosure is required by law, necessary to identify or locate a suspect or missing person, about criminal conduct at Mount St. Mary’s, about a victim of crime under certain circumstances, and in certain emergency situations.
- To Avert a Serious Threat to Health or Safety. Mount St. Mary’s may use and disclose health information when Mount St. Mary’s believes it is necessary to prevent a serious threat to the individual's health and safety or the health and safety of the public or another person. Any disclosure would only be to someone able to help prevent or lessen the threat, or to law enforcement authorities.
- Coroner, Medical Examiners, and Funeral Directors. Mount St. Mary’s may disclose health information to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties authorized by law. Mount St. Mary’s may disclose health information to a funeral director, consistent with law, to permit the funeral director to carry out his/her duties.
- Organ Donation Purposes. Mount St. Mary’s may disclose health information to organ procurement organizations and others engaged in procurement, banking or transplantation of cadaveric organs, eyes, or tissue, for the purposes of facilitating organ donation and transplantation.
- Military and Veterans. If you are a member of the armed forces, we may release your health information as required by military command authorities. We may also release health information about foreign military personnel to the appropriate foreign military authority.
- National Security and Intelligence Activities. Mount St. Mary’s may release health information to authorized federal officials for intelligence, counterintelligence and other national security activities as authorized by law.
- Protective Services for the President and Others. Mount St. Mary’s may disclose health information to authorized federal officials so they may provide protection to the President or other authorized persons, or for the conduct of special investigations authorized by law.
- Inmates. If you are an inmate or in the custody of a correctional institution or law enforcement, Mount St. Mary’s may disclose health information to the correctional institution or law enforcement official for treatment and safety purposes.
- Worker’s Compensation. Mount St. Mary’s may disclose health information as authorized by and to the extent necessary to comply with worker’s compensation laws or laws relating to similar programs.
- As Required by Law. Mount St. Mary’s will disclose health information when required to do so by federal, state or local law.
HEALTH INFORMATION EXCHANGE
Mount St. Mary’s participates in HEALTHeLINK™, a health information exchange organization (“HIE”) that permits computer-based transfer of health information directly between healthcare providers at different locations and institutions to facilitate your care and treatment. If you previously consented to participate in HEALTHeLINK™ and you wish to withdrawal consent, you can do so by completing the HEALTHeLINK™ form: Withdrawal of Consent to Participate in HEALTHeLINK Health Information Exchange available at http://wnyhealthelink.com.
SPECIAL RESTRICTIONS UNDER STATE AND OTHER FEDERAL LAWS
We will also comply with all other applicable state and federal laws. For example, under state law, there are more limits on when HIV and AIDS information may be disclosed. Under other federal law, there are more limits on when drug or alcohol abuse treatment information may be disclosed. We abide by all applicable state and federal laws.
OTHER USES AND DISCLOSURES
Any other uses and disclosures of health information not covered by this Notice or the laws that apply to us will be made only with your Authorization.
DISCLOSURES THAT REQUIRE YOUR AUTHORIZATION
An Authorization is a special written permission from you that grants authority to Mount St. Mary’s to use or disclose your health information.
- We must obtain your written Authorization before we may use or disclose your psychotherapy notes, except for: use by the originator of the psychotherapy notes for treatment; use or disclosure by Covered Entity for its own mental health training programs; or use or disclosure by Mount St. Mary’s to defend itself in a legal action or other proceeding brought by the individual.
- We must obtain your written Authorization before we may use or disclose your PHI for marketing purposes, except for face-to-face communications made by us to you or a promotional gift of nominal value provided by us to you.
- We must obtain your written Authorization for disclosures that constitute the sale of medical information.
- If you provide us an Authorization to use or disclose your health information, you may revoke that Authorization, in writing, at any time. If you revoke your Authorization, we will o longer use or disclose health information about you for the reasons covered by your Authorization.
YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION
You have the following rights regarding health information we maintain about you:
- Right to Request Restrictions. You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment or health care operations. In most cases, we are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment. We must agree to your request if you have paid for the care out-of-pocket, in-full and you are asking us not to submit information about that care to your health plan.
- Right to Request Confidential Communications. Typically, we communicate with you regarding your health care either by calling your home phone or sending mail to your home address. You have the right to request that we communicate with you in an alternative way or at a certain location. To request confidential communications, we ask that you make your request in writing. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.
- Right to Inspect and Receive Copies. You may ask to inspect and to receive copies of medical information that may be used to make decisions about your care, including your medical and billing records.
Upon your request or your personal representative’s request, the laboratory may provide you or your personal representative, and those persons specified under 45 CFR 164.524(c)(3)(ii), as applicable, with access to completed test reports that, using the laboratory’s authentication process, can be identified as belonging to you.
To inspect or receive copies of your medical information, submit your request in writing to the Health Information Management (Medical Records) Department. We may charge a fee for the costs of copying, mailing or other supplies associated with your request for copies. You may not be denied a copy if you are unable to pay. You may request the copy of your health information be provided in a summary format. You may also request the copy be provided on paper ("hard copy"). You may request an electronic copy of your record and it will be provided in an electronic format if it is readily producible; otherwise you will be provided with a printed copy. Mount St. Mary’s will also transmit a copy of your health information to another person designated by you in writing.
We may deny your request to inspect or receive copies in certain limited circumstances. If your request is denied, you may ask that the denial be reviewed. Another licensed health care professional who we choose will review your request and the denial. The person conducting the review will not be the person who denied your request. You have additional rights to appeal a denial to the New York State Department of Health.
- Right to Request Amendments. You have the right to ask us to amend your health information. To request an amendment, we ask that your request be made in writing. In addition, you must provide a reason that supports your request. We may deny your request in certain circumstances, such as if the information was not created by us, or we believe the information is already accurate and complete. If we deny your request, you may appeal the denial.
- Right to a Listing of Persons Receiving Your Medical Information. You may request an "accounting of disclosures” of medical information released about you. An accounting of disclosures does not include disclosures made:
• to you or your personal representative;
• with your written authorization;
• for treatment, payment or health care operations;
• from the patient directory;
• to your family or friends involved in your care or payment for your care;
• incidental to permissible uses or disclosures; or
• about inmates to correctional institutions or law enforcement officers.
To request this list, submit your request in writing to the Health Information Management Department. Your request must state a time period, which may not be longer than six years and may not include dates before April 14, 2003. The first list you request within a 12-month period will be free. We may charge you for the costs of providing additional lists. We will notify you of the cost involved and you may withdraw or change your request before you are charged any fees.
- Right to Notification of a Breach. Mount St. Mary’s must notify you if your unsecured protected health information has been the subject of a breach.
- Right to a Paper Copy of this Notice. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of this Notice. You may also obtain a copy of this Notice at our web site at www.msmh.org
CHANGES TO THIS NOTICE
We reserve the right to make changes to this Notice. We reserve the right to make the revised Notice effective for health information we already have, as well as any information we receive or create in the future. The Notice will contain the current effective date. We will post a copy of the current Notice in our locations and on our website. The Notice is also available to you upon request.
If you believe your privacy rights have been violated, you may file a complaint with Mount St. Mary’s or with the Secretary of the Department of Health and Human Services. To file a complaint with Mount St. Mary’s, contact our Privacy Officer. You will not be penalized for filing a complaint. To ensure we have sufficient information, we ask that complaints be submitted in writing. If you have any questions about this Notice, please contact:
Mount St. Mary's Hospital and Health Center
5300 Military Road
Lewiston, New York 14092
Attn: Privacy Officer
This Notice effective January 2015.