Notice of Privacy Practices
GRAND VIEW HOSPITAL
THIS NOTICE OF PRIVACY PRACTICES DESCRIBES HOW MEDICAL INFORMATION MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
I. WHO PRESENTS THIS NOTICE
This Notice describes how Grand View Hospital (including the centers and practices Grand View operates), the members of Grand View Medical Staff, and other healthcare providers involved in your care at the Hospital, will use and disclose your protected health information. This Notice only applies to the protected health information created or obtained in connection with care provided to you in or by the Hospital. It also describes the practices of all Grand View employees, staff, students, volunteers, and other personnel working at Grand View Hospital sites.
This Notice does not describe the practices regarding protected health information in your physician’s office, with the exception of the Grand View Medical Practices Offices. The physicians who practice at Grand View Hospital (the Medical Staff members), with the exception of the Grand View Medical Practices personnel, are neither employees, nor agents of the Hospital. If you have not previously visited your physician’s office, upon your next visit you should receive that physician’s Notice of Privacy Practices as it relates to his or her own office practice.
This Notice of Privacy Practices is effective as of March 1, 2013. If you have any questions about this Notice, please contact Grand View Hospital Privacy Officer at 215-453-4000.
Grand View Hospital (“Grand View”) is required to give you this Notice to comply with the regulations (the “Privacy Rule”) established under federal laws called the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule and the Health Information Technology for Economic and Clinical Health Act (“HITECH”). Grand View is committed to protecting your medical information, including health information protected by HIPAA and other federal and state laws, and using that information appropriately.
This Notice is intended to describe your rights, and to inform you about ways in which Grand View may use and disclose your protected health information (“PHI”), and the obligations Grand View has when using and disclosing your PHI. Your personal physician or any other provider of your health care services may have different policies or Notices regarding their use and disclosure of your PHI which is created in that provider’s office.
II. HOW WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION
A. The Privacy Rule allows Grand View to use and disclose your PHI for purposes of treatment, payment, and Grand View health care operations. Any uses or disclosures for payment or health care operations must be limited to the minimum necessary to accomplish the purpose of the use or disclosure.
1. Treatment. Grand View may use your PHI to provide you with medical treatment or services, to coordinate or manage your health care services, and to facilitate consultation or referrals as part of your treatment. For example, if you are being treated for a knee injury, Grand View may disclose your PHI to the physical rehabilitation department in order to coordinate your care. Different departments of Grand View also may share your medical records in order to coordinate your treatment and care, such as prescriptions, lab and x-ray tests. Also, Grand View may disclose your medical records to people outside of Grand View after you leave a Grand View facility, including family members, clergy, or other health care providers such as nursing homes or home health agencies.
2. Payment. Grand View may use and disclose your PHI to send bills and collect payment from you, your insurance company or other third parties, for the treatment and services provided to you by Grand View. For example, Grand View may provide portions of your PHI to our billing department and your health plan to get paid for the health care services Grand View provided to you. Grand View may also provide your PHI to our business associates, such as billing companies, claims processing companies, and others that process our health care claims.
3. Health Care Operations. Grand View may use and disclose your PHI you for Grand View health care operations. These uses and disclosures are necessary to provide quality care to all patients as well as to facilitate the functioning of Grand View, including among other things:
a. Quality assessment and improvement activities;
b. Protocol development;
c. Care management, coordination, and related functions;
d. Competency assessments and performance reviews of Grand View employees;
e. Training, accreditation, certification, licensing, credentialing or other related activities;
f. Insurance related activities;
g. Internal patient complaint or grievance resolution; and
h. Activities relating to improving health or reducing health care costs.
Additional examples of how Grand View may use and disclose your PHI include:
i. Use medical records to review its treatment and services as well as to evaluate the performance of its staff in caring for you;
j. Combine medical records about many Grand View patients to decide what additional services Grand View should offer, what services are not needed, and to study the safety and effectiveness of treatments;
k. Disclose information to doctors, nurses, and other Grand View personnel for training purposes;
l. Remove information that identifies you from a set of medical records so that others may use it to study health care and health care delivery without learning who the specific patients are; or
m. Use and disclose medical records to contact you by telephone or in writing as a reminder that you have an appointment for a test or procedure, or to see your doctor.
4. Hospital and Facility Directory. Grand View may list certain information about you in the hospital directory while you are an inpatient at Grand View. This information may include your name, where you are in Grand View, a general description about your condition (e.g., fair, stable) and your religious affiliation. Unless you opt out, Grand View can disclose this information, except for your religious affiliation, to people who ask for you by name. Your religious affiliation may be given to members of the clergy even if they do not ask for you by name. This information is released so that your family, friends, and clergy can call and visit you in the hospital and generally know how you are doing and so that you can receive flowers, cards, or gifts sent to you during your hospital stay. If you choose to opt out, please call the Patient Registration at (215)453-4319 and ask them to remove you from the Hospital Directory.
5. Persons Involved in Your Care or Payment for Your Care. Grand View may release PHI about you to a family member, friend, or someone you designate who is involved in your care or payment of medical bills. Grand View may also disclose your PHI to an entity authorized to assist in disaster relief so that those who care for you can receive information about your location or health status.
6. Fundraising Activities. Grand View may solicit contributions to support the expansion and improvement of services and programs we provide to the community. In connection with our fundraising efforts, we may disclose to our employees or business associates, demographic information about you (e.g., your name, address and phone number), dates on which we provided health care to you, health insurance status, department of service, treating physician and general outcome information. You have the right to opt out of any fundraising activities. If you do not wish to receive any fundraising requests in the future, you may contact the Grand View Hospital Health Foundation at 215-513-3935 or respond via one of the methods identified in the fundraising correspondence that you may receive in the future.
7. Treatment Options. Grand View may use or disclose your PHI to tell you about or recommend possible treatment options or alternatives that may be beneficial to you. For example, your name, address, and electronic mail address may be used so we can send you newsletters or health care bulletins about Grand View and the services we provide. We may also send you information about health-related products or services that we or others make available and that we think may be useful or of interest to you. You may write to Grand View Hospital PR/Marketing Department, 700 Lawn Avenue, Sellersville, PA 18960 or contact them via email at firstname.lastname@example.org as notification that you do not wish to receive any of our newsletters or other information.
8. Research. Under certain circumstances, Grand View may use and disclose your PHI for research purposes. Before they begin, all research projects that are conducted at Grand View are carefully reviewed. This process evaluates the proposed project’s use of your PHI, trying to balance the needs of medical research with your need for privacy. Before we use or disclose your PHI for research, the project will have been approved through Grand View’s research approval process, but we may disclose your PHI to people preparing to conduct the research project (e.g., to help the researchers look for patients with specific medical conditions or needs) as long as they do not remove or take a copy of any of your PHI.
9. Client/Patient Satisfaction Surveys. Grand View may conduct client/patient satisfaction surveys to understand how we can improve our services to patients and their families or friends. For example: A client or patient may receive a survey from a patient satisfaction research organization, asking for comment on the services provided.
10. Business Associates. There are some services at Grand View that may be provided through contracts with business associates. Examples include but are not limited to certain laboratory tests and a copy service that we may use to make copies of your health record. When these services are contracted, we may disclose your PHI to our business associate so that they can perform the job we’ve asked them to do. To protect your health information, however, we require the business associate to appropriately safeguard the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract with the business associate.
11. Health Information Exchange: Grand View may make your PHI available electronically through a local, state, or national Health Information Exchange (“HIE”). An HIE is an organization that allows health care providers to share patient information so that each provider has as complete a picture as possible about a patient’s health. HIEs can also prevent the duplication of services by allowing physicians at one location to access the results of tests (such as x-rays) performed at another location.
Grand View will not disclose your information related to treatment for mental health, development disabilities, alcoholism, substance abuse or drug dependency, venereal disease, genetic information, or information concerning the presence of HIV, antigen or non-antigenic products of HIV or an antibody to HIV, without in each case obtaining your authorization unless otherwise permitted or required by the applicable state or federal law.
B. Certain Uses and Disclosures Do Not Require Your Consent. The Privacy Rule and Pennsylvania law (as applicable) allow Grand View to use or disclose your PHI/patient health care records without your authorization or informed consent for a number of special functions and activities, described below.
1. As Required by Law. Grand View is permitted to disclose your PHI when required to do so by international, federal, state, or local law.
2. Public Health. Grand View may use and disclose your PHI for public health activities. These activities generally include the following:
a. To prevent or control disease, injury, or disability, to report vital statistics such as births and deaths, and for public health surveillance or interventions;
b. To report births and deaths;
c. To report abuse or neglect of children, elders, and dependent adults;
d. To the Federal Drug Administration (FDA), to report reactions to medications or problems with products, to track products, to enable product recalls, or to conduct post-market surveillance as required by the FDA;
e. To notify people of recalls of products they may be using; and
f. To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.
3. Victims of Abuse, Neglect, or Domestic Violence. The Privacy Rule authorizes Grand View to notify the appropriate government authority if Grand View believes a patient or resident has been a victim of abuse, neglect, or domestic violence. Grand View will only make this disclosure if you agree or when required or authorized by law.
4. Health Oversight Activities. Grand View is permitted to disclose a person’s PHI to a health oversight agency for activities authorized by law, including audits, investigations, inspections, licensure or disciplinary activities, and other similar proceedings. Grand View may not disclose the PHI of a person who is the subject of an investigation that is not directly related to that person’s receipt of health care or public benefits.
5. To Avert a Serious Threat to Health or Safety. Grand View may use and disclose a person’s PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.
6. Funeral Directors, Medical Examiners, and Coroners. Sometimes, Grand View may deem it necessary to release a person’s PHI to funeral directors, so that they can carry out their duties appropriately. Sometimes, when there are concerns about identification of a patient, or determining what caused a death, we will release a person’s PHI to medical examiners or coroners.
7. Organ and Tissue Donation. If you are an organ donor, Grand View may release your PHI to the organizations responsible for organ or tissue transplantation in order to help with the process.
8. Workers Compensation. Grand View may release your PHI to insurers, government administrators, and employers for workers’ compensation or similar programs. This relates to care provided for work-related injuries or illness.
9. Specialized Government Functions. In certain circumstances, the Privacy Rule authorizes Grand View to use or disclose your PHI to facilitate specified government functions to include:
a. Medical Suitability and Intelligence Activities. Grand View may disclose your PHI to the Department of State for use in making suitable determinations.
b. Inmates and Correctional Institutions. Should you be an inmate of a correctional institution or under the custody of law enforcement official, Grand View may release your PHI to the correctional institution or law enforcement official, where necessary 1) for the correctional institution or official to provide you with health care; 2) to protect your health and safety or health and safety of others; or for the safety and security of the correctional institution. An inmate does not have a right to the Notice.
c. Active Duty Military Personnel. If you are a member of the armed forces, Grand View may release your PHI as required by military command authorities. Grand View may also release PHI of foreign military personnel to the appropriate foreign military authority.
d. Government Security, Intelligence and Bioterrorism: Grand View may release your PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law. Grand View may disclose your PHI to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.
10. Disputes, Lawsuits, Administrative Proceedings. If you are involved in a lawsuit or dispute, the Privacy Rule allows Grand View to disclose your PHI in response to a court or administrative order. Grand View may disclose your PHI in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested if that is required by law.
11. Law Enforcement. Grand View may release your PHI if asked to do so by a law enforcement official:
a. In response to a court order, subpoena, warrant, summons, or similar process;
b. To identify or locate a suspect, fugitive, material witness, or missing person;
c. About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement;
d. About a death Grand View believe may be the result of criminal conduct;
e. About criminal conduct at Grand View; and
f. In emergency circumstances to report a crime; the location of the crime or victims, or the identity, description or location of the person who committed the crime.
g. Pennsylvania law generally requires a court order for the release of patient health care records in these circumstances, and may be considered more protective of your privacy that the Privacy Rule. However, Pennsylvania law does allow the release of confidential patient health care records when a crime occurs on Grand View’s premises and a victim is threatened with bodily harm. Pennsylvania law also requires that gunshot wounds or other suspicious wounds, including burns, that are reasonably believed to have occurred as the result of a crime must be reported to the local police or sheriff. The report must include the nature of the wound and the patient’s name.
12. Date Breach Notification Purposes. Grand View may use or disclose your PHI to provide legally required notices of unauthorized access to or disclosure of your PHI.
13. Other Uses of Medical Information. Other uses and disclosures of your PHI not covered by this Notice or the laws that apply to us will be made only with your written permission. If you provide us permission to use or disclose your PHI, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose your PHI for the reasons covered in your authorization. You understand that we are unable to take back any disclosure that Grand View has already made with your permission, and that we are required to retain our records of the care that we provided to you.
A. Grand View will notify affected individuals, Department of Health and Human Services, and the media, as applicable, of any Breach of unsecured PHI that compromises the security or privacy of the PHI. All suspected Breaches will be investigated and all necessary notifications will be sent, in accordance with Grand View’s policy. Examples of unsecured PHI include but are not limited to:
1. Medical record left unattended in a public location (e.g., cafeteria or office waiting room);
2. Misdirected e-mail to an external group that includes a listing of patients’ accounts that have addresses, social security numbers, dates of birth, or medical diagnoses; and
3. Intentional and non-work related access by a Grand View’s workforce member or its business associate of your PHI.
B. “Breach” means the unauthorized acquisition, access, use, or disclosure of PHI in a manner not permitted under the Privacy Rule which compromises the security or privacy of the PHI, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information.
IV. USES AND DISCLOSURES THAT REQUIRE GRAND VIEW TO GIVE YOU AN OPPORTUNITY TO OBJECT AND OPT-OUT
A. Individuals Involved in Your Care or Payment for Your Care. Unless you object, Grand View may disclose to a member of your family, a relative, a close friend or any other person you identify, your PHI that directly relates to that person’s involvement in your health care. If you are unable to agree or object to such a disclosure, Grand View may disclose such information as necessary if it determines that it is in your best interest based on their professional judgment.
B. Disaster Relief. Grand View may disclose your PHI to disaster relief organizations that seek your PHI to coordinate your care, or notify family and friends of your location or condition in a disaster. Grand View will provide you with an opportunity to agree or object to such a disclosure whenever it practically can do so.
V. USES AND DISCLOSURES THAT REQUIRE YOUR WRITTEN AUTHORIZATION
A. The following uses and disclosures of your PHI will be made only with your written authorization:
1. Uses and disclosures of PHI for marketing purposes; and
2. Disclosures that constitute a sale of your PHI
3. Other uses and disclosures of PHI not covered by this Notice or the laws that apply to Grand View will be made only with your written authorization. If you do give Grand View an authorization, you may revoke it at any time by submitting a written revocation to its Privacy Officer and Grand View will no longer disclose PHI under the authorization. But disclosure that Grand View made in reliance on your authorization before you revoked it will not be affected by the revocation.
B. In addition, to the extent Grand View maintains any psychotherapy notes, most uses and disclosures of those notes require your written authorization. Psychotherapy notes are private notes of a mental health professional kept separately from your medical records.
VI. YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION
A. You have several rights with regard to the PHI that Grand View maintains about you. If you wish to exercise any of the following rights, please contact the Grand View Hospital Privacy Officer, 700 Lawn Avenue, Sellersville, PA 18960; Phone # 215-453-4000.
1. Right to Request Restrictions. You have the right to request restrictions or limitations on Grand View’s uses or disclosures of PHI about you for treatment, payment or health care operations. You also have the right to request a limit on your PHI that we disclose to someone involved in your care or the payment for your care, like a family member or friend. For example, you could ask that Grand View not share information about a particular diagnosis or treatment with your spouse. Grand View is not required to agree to your request unless you are asking it to restrict the use and disclosure of your PHI to a health plan for payment or health care operation purposes and such information you wish to restrict pertains solely to a health care item or service for which you have paid Grand View “out-of-pocket” in full. If Grand View does agree, it will comply with your request unless the information is needed to provide you emergency treatment. A request for restrictions must be in writing, directed to the Grand View Hospital Privacy Officer listed in this notice, and should include (1) the name and address of where services were received; (2) what information you want to limit; (3) whether you want to limit its use, disclosure or both; and (4) to whom you want the limits to apply.
2. Right to Request Confidential Communications. You have the right to request that Grand View communicate with you about medical matters through specific channels, that is, in a certain way or at a certain location. For example, you can ask that Grand View only contact you at work, or only at home, or only by mail. To request confidential communications, you must make a request in writing to the Grand View Hospital Health Information Management Department at the address in the first sentence of Section VI above, and your request must specifically and clearly state how or where you want to be contacted. Grand View will not ask you the reason for your request, and will attempt to accommodate all reasonable requests.
3. Right to Inspect and Copy. You have the right to inspect and copy a designated set of your medical records. This designated set typically includes medical and billing records, but may not include psychotherapy notes. Please note that a request to inspect your medical records means that you may examine them at a mutually convenient time or place. If you request a copy of the information, your request must be in writing and must be submitted to the Grand View Hospital Health Information Management Department at the address in the first sentence of Section VI above. Grand View may charge a reasonable fee for the costs of copying, mailing or other supplies associated with your request. Grand View may deny your request to inspect and copy in certain circumstances. If you are denied access to your medical records, you may have the denial reviewed by a licensed health care professional chosen by Grand View. The person conducting the review will not be the person who denied your request. Grand View will comply with the outcome of the review.
4. Right to an Electronic Copy of Electronic Medical Records.
If your PHI is maintained in an electronic format (known as an electronic medical record or an electronic health record), you have the right to request that an electronic copy of your record be given to you or transmitted to another individual or entity. Grand View will make every effort to provide access to your PHI in the form or format you request, if it is readily producible in such form or format. If the PHI is not readily producible in the form or format you request your record will be provided in either its standard electronic format or if you do not want this form or format, a readable hard copy form. Grand View may charge you a reasonable, cost-based fee for the labor associated with transmitting the electronic medical record.
5. Right to Amend. If, in your opinion, your medical records are incorrect or incomplete, you may request that Grand View amend your records. You have the right to request an amendment for as long as the information is kept by or for Grand View. A request to amend your medical records must give the reasons for the amendment. Grand View may deny your request for an amendment if it is not in writing or does not include a reason Grand View may also deny your request for amendment if it covers medical records that:
a. Were not created by Grand View, unless the person who actually created the information is no longer available to make the amendment;
b. Are not part of the medical records kept by or for Grand View;
c. Are not part of the information which you would be permitted to inspect and copy, as discussed above; or
d. Are accurate and complete.
6. Right to an Accounting of Disclosures. You have the right to request an accounting of certain disclosures of PHI by Grand View. A request for accounting of disclosures must specify a time period, which may not be longer than six years, and which may not include dates of service before April 14, 2003. A request for accounting of disclosures must be in writing and must be submitted to the Grand View Hospital Health Information Management Department at the address in the first sentence of Section VI above. Your written request should indicate in what form you want the disclosure (for example, on paper). The first accounting within a 12-month period will be free; for additional accountings, Grand View may charge for its costs after notifying you of the cost involved and giving you the opportunity to withdraw or modify your request before any costs are incurred.
7. Right to Complain. If you believe your privacy rights have been violated, you may file a complaint with Grand View and/or with the federal Department of Health and Human Services (DHHS). A patient can send a letter to DHHS at:
Office for Civil Rights
U.S. Department of Health and Human Services
150 S. Independence Mall West
Suite 372, Public Ledger Building
Philadelphia, PA 19106-9111
8. Grand View cannot require you to waive your right to complain in order for you to receive treatment at Grand View. To file a complaint with Grand View you must submit your complaint, in writing, to the Grand View Hospital Privacy Officer, 700 Lawn Avenue, Sellersville, PA 18960. You will not be penalized for filing a complaint. If you have any questions about this notice, please contact the Privacy Officer at 215-453-4000.
9. Right to a Paper Copy of this Notice. You have the right to a paper copy of this Notice. You may ask us to give you a copy of this notice at any time. You may also obtain a copy of the current version of Grand View Hospital of Privacy Practices at our Web site, www.gvh.org.
10. Right to Breach Notification. You have a right to receive written notification when a Breach of any of your unsecured PHI has occurred. Notification of the Breach will be sent to you without unreasonable delay but no later than 60 days after the Breach has been discovered.
11. Right to Out-of –Pocket Payments. If you paid out-of-pocket (or in other words, you have requested that we not bill your health plan) in full for a specific item or service, you have the right to ask that your PHI with respect to that item or service not be disclosed to a health plan for purposes of payment or health care operations, and Grand View will honor that request.
VII. AMENDMENTS TO THIS NOTICE
Grand View reserves the right to amend this Notice at any time. In addition, Grand View is required to amend this Notice as made necessary by changes in the Privacy Rule. Each version of the Notice will have an effective date on the first page. Grand View reserves the right to make the amended Notice effective for PHI at the time the amendment is made, as well as for any PHI that Grand View may receive or create in the future. Grand View will post a copy of the current Notice on the Grand View Hospital website, www.gvh.org as well as in the registration area of Grand View facilities, when substantial changes are made.
VIII. GRAND VIEW’S DUTIES
Grand View is required by the Privacy Rule to maintain the privacy of your PHI. The Privacy Rule requires that Grand View provide notice of its privacy practices to all of its patients or clients. Grand View’s obligations to maintain your privacy, and the situations and circumstances, in which your PHI may be used or disclosed, are described in more detail in this Notice of its legal duties and privacy practices. Grand View is required to comply with the terms and conditions of this Notice, and may not amend this Notice except as set forth above.