PRIVACY NOTICE
This notice is required by the Privacy Regulations adopted pursuant to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH) and as further amended on January 17, 2013, under the Omnibus Rule of 2013. We have the right to change our privacy practices and the terms of this notice. If we make a material change to our privacy practices, we will provide you with a revised notice at your first visit after the revision or electronically as permitted by applicable law. In all cases, we will post the revised notice on our website www.medctrbarbour.org. We reserve the right to make any revised or changed notice effective for information we already have and for information that we receive in the future. We are required by law to protect the privacy of your health information. We are also required to provide you with this notice, which explains how we may use information about you and when we can give out or “disclose” that information to others. You also have rights regarding your health information that are described in this notice. We are required by law to abide by the terms of this notice. The effective date of this notice was April 14, 2003, and has been revised effective February 4, 2021. The terms “information,” “health information” or “medical information” or “PHI” in this notice include any information that we maintain that reasonably can be used to identify you and that relates to your physical or mental health condition, the provision of health care to you, or the payment for your health care.
Contact Information:
To exercise your rights, restrictions or requests, please direct your written correspondence to the following address and specify the facility or clinic where your information is on file: Medical Center Barbour Attn: HIPAA Privacy Officer 820 West Washington St Eufaula, AL 36027 If you have any questions about this notice or to file a privacy complaint, please contact the Medical Center Barbour Privacy Officer at 334-688-7041.
Who will follow this notice:
This Notice of Privacy Practices describes the privacy practices of all Medical Center Barbour (“MCB”) entities and of MCB’s workforce members, students and volunteers working in its hospitals, clinics, doctors’ offices and service departments. This notice also describes the privacy practices of affiliated providers – who are not employees of MCB – while treating you in a MCB facility, unless they provide you with a notice of their own privacy practices regarding the use and disclosure of your medical information created in the affiliated provider’s office. MCB and members of our medical staff participate in an organized healthcare arrangement in which MCB may share information about patients with each other as necessary to carry out their treatment, payment and healthcare operations related to the organized healthcare arrangement.
Our pledge regarding medical information:
We understand that medical information about your health is personal. We are committed to protecting medical information about you. We create a record of the care and services you receive at MCB. We need this record to provide you with quality care and to comply with certain legal requirements. This notice applies to all of the records of your care created or maintained by MCB, whether made by MCB’s personnel or your personal doctor while at MCB. Your personal doctor and other doctors involved in your care may have different policies or notices regarding the doctor’s use and disclosure of your medical information created in the doctor’s office. This notice will tell you about the ways in which we may use and disclose medical information about you. We will also describe your rights and certain obligations we have regarding the use and disclosure of medical information.
We are required by law to:
Make sure medical information that identifies you is kept private
Give you this notice of our legal duties and privacy practices with respect to medical information about you
Follow the terms of the notice that is currently in effect
How we may use and disclose your medical information:
The following categories describe different ways that we use and disclose medical information. For each category of uses or disclosures, we will explain what we mean and try to give some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of these categories.
1. For treatment. We may use your medical information to provide you with medical treatment or services. We may disclose your medical information to doctors, nurses, technicians or other personnel at MCB (employed or approved by MCB to participate in patient care at MCB) who are involved in taking care of you at MCB. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. In addition, the doctor may need to tell the dietician if you have diabetes so we can arrange for appropriate meals. Different departments at MCB also may share medical information about you in order to coordinate the care you need, such as prescriptions, lab work and X-rays. We may also disclose medical information about you to people outside of MCB who may be involved in your medical care after you leave MCB, such as family members and clergy. We may disclose information about your care to any doctor identified as a provider of medical care to you, even if that doctor is not a direct participant in a given episode of care at MCB. For example, it is routine for MCB to provide information about your care to your primary care provider (PCP). MCB believes that family support is important to your care. Accordingly, at MCB, there are many support service staff workers, such as social workers and chaplains, who are active participants in the care of families at MCB, and these professionals routinely have access to and document in medical records.
2. For payment. We may use and disclose your medical information so that the treatment and services you receive at MCB may be billed and payment may be collected from you, an insurance company or a third party. For example, we may need to give your health plan information about a procedure you received at MCB so your health plan will pay MCB or reimburse you. We also may tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment.
3. For healthcare operations. We may use and disclose your medical information for hospital operations. These uses and disclosures are necessary to run MCB and make sure all of our patients receive quality care. For example, we may use medical information to review our treatment and services and to evaluate the performance of our staff in caring for you. We also may combine medical information about many MCB patients to decide what additional services MCB should offer, what services are not needed, and whether certain new treatments are effective. We also may disclose information to doctors, nurses, technicians, medical students and other MCB personnel for review and learning purposes. We also may combine the medical information we have with medical information from other healthcare providers to compare how we are doing and see where we can make improvements in the care and services we offer. We may remove information that identifies you so others may use the medical information to study healthcare and healthcare delivery. Finally, we may share information about you with clinical managers or clinicians caring for other patients at MCB if this information could be important to these individuals in order to protect other patients at MCB or to comply with the regulations of governmental agencies.
4. With the MCB medical staff. Doctors and other healthcare providers who are members of the MCB Medical Staff work together in an organized healthcare arrangement to provide medical services to patients. These teams may share patient health information with each other to carry out treatment, payment and healthcare operations relating to patients at MCB.
5. Business associates. During the course of providing treatment to you, obtaining payment for your care and conducting normal hospital operations, MCB works with business partners. For example, MCB works with computer software and hardware companies. Though every reasonable attempt will be made by MCB to limit access by business partners to patient information, it is impossible to prevent all such access. Therefore, MCB requires all business partners to enter into contractual agreements that require these business partners to limit their access to patient information to that which is necessary or unavoidable. Furthermore, our contracts with business partners require that all access to patient information that does occur will be managed according to strict principles of confidentiality and privacy. These partners are required to follow the same privacy laws as MCB, including protecting your medical information and taking appropriate measures in the event of a breach.
6. Appointment reminders. MCB may use and disclose medical information to contact you as a reminder that you have an appointment for treatment or medical care at MCB.
7. Treatment alternatives. We may use and disclose medical information to tell you about or recommend possible treatment options or alternatives that our staff have determined to possibly be of benefit to you.
8. MCB services. We may use your medical information to generate notices of additional services available to you at MCB.
9. Marketing activities. We must also obtain your written permission (authorization) prior to using your PHI to send you any marketing materials. We may not sell your PHI without your written authorization. However, we may communicate with you about some products or services related to your treatment, case management, care coordination, alternative treatments, therapies, healthcare providers or care settings without your permission. Marketing activities do not include a communication made to you to provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for you. Communications for activities such as providing information about a generic equivalent of a drug being prescribed to you, as well as adherence communications encouraging you to take your prescribed medication as directed are excluded from marketing activities. In situations where marketing communications involve financial compensation, MCB will obtain a valid authorization from you before using or disclosing PHI for such purposes. The disclosure will indicate that we are receiving financial compensation from a third party. Additionally, where we have an arrangement with a business associate (including a subcontractor) who receives financial compensation from a third party in exchange for making a communication about a product or service, such communication also requires your prior authorization.
10. Fundraising activities. We may use and disclose your medical information to request your support for improving healthcare services that we provide to our community by contributing to MCB’s Hospital Foundation. If you do not want to be contacted for this purpose, you have the right to opt-out of these communications by notifying the MCB Privacy Officer in writing.
11. The MCB directory. We may include certain limited information about you in the MCB directory while you are a patient at MCB. This information may include your name, location in MCB and your religious affiliation. The directory information, except for religious affiliation, also may be released to people who ask for you by name. Your religious affiliation may be given to clergy members, such as a priest or rabbi, even if they do not ask for you by name. This is so your family, friends and clergy can visit you at MCB and so that we may provide appropriate spiritual support to you. If you do not wish for the fact that you are a patient at MCB to be disclosed to someone asking about you, you can be designated as a “privacy patient.” You may do this by simply asking your nurse to place such a designation by your name in the MCB computer system. Locations with the primary purpose of treatment for substance abuse or psychiatric-related concerns will default all patients to “privacy patient” status and information will not be released via the MCB Directory.
12. Members of the media. A one-word condition of you and your location may be released to members of the media only if the inquiry specifically contains your name. No information will be given to a member of the media if a request does not include your name.
13. Individuals involved in your care. We may release medical information about you to a friend or family member who is actively involved in your medical care. We also may release medical information to someone who helps pay for your care. This would be the minimum information necessary to facilitate payment.
14. Disaster relief. We may disclose medical information about you to any entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.
15. Research. Under certain circumstances, we may use and disclose your medical information for research purposes, such as research related to the evaluation of certain treatments or the prevention of disease or disability, if the research study meets privacy law requirements. We always require that researchers honor the confidential nature of your medical information. Finally, it is a requirement of all approved research studies that any publication of results contain full de-identification of the medical information; that is, in no way will a reader of the publication be able to identify you with the medical information disclosed in the publication. Where research involves the use or disclosure of psychotherapy notes, an authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for psychotherapy notes.
16. As required by law. We will disclose your medical information when required to do so by federal, state or local law.
17. To avert a serious threat to health or safety. We may use and disclose your medical information when necessary to prevent a serious threat to your health and safety or to the health and safety of others. Any disclosure, however, would only be to someone able to help prevent the threat. For example, if the Emergency Department of another hospital calls MCB and requires information about you to treat you in an emergency, the necessary information will be released to that emergency department. Special situations:
18. Psychotherapy notes. Psychotherapy notes are notes recorded (in any medium) by a mental health professional for the purpose of documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session involving you and/ or your treatment. Psychotherapy notes are separated from the rest of the your medical record and exclude medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis and progress to date. Psychotherapy notes may not be disclosed without your authorization except in the following limited circumstances: • Use or disclosure in supervised mental health training programs for students, trainees or practitioners • Use or disclosure by the covered entity to defend a legal action or other proceeding brought by the individual • Use or disclosure that is required by law • Use or disclosure that is permitted: — For legal and clinical oversight of the psychotherapist who made the notes — To prevent or lessen a serious and imminent threat to your health and safety and for the health or safety of the public
19. Organ and tissue donation, implants and selected pharmaceutical recipients. If you are an organ donor, we may release medical information to organizations that manage organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation. If you are the recipient of an implant, a selected pharmaceutical or other invasive therapy involved in a safety review, we may release information to organizations, such as governmental agencies or pharmaceutical companies, when it is clearly in the best interest of your health and safety.
20. Military and veterans. If you are a member of the armed forces, we may release your medical information as required by military command authorities. We also may release medical information about foreign military personnel to the appropriate foreign military authorities.
21. Workers’ compensation. We may release your medical information for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.
22. Public health activities. We may disclose your medical information for public health activities. These activities generally include the following: • To prevent or control disease, injury or disability • To report births and deaths • To report reactions to medicines or problems with products • To notify people of recalls of products they may be using • To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition • To notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence. We will only make this disclosure when required or authorized by law.
23. Health oversight activities. We may disclose medical information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections and licensure. These activities are necessary for the government to monitor the healthcare system, government programs and compliance with civil rights laws.
24. Lawsuits and disputes. If you are involved in a lawsuit or a dispute, we may disclose your information in response to a court or administrative order. We also may disclose your medical information in response to a subpoena, search warrant, discovery request or other lawful process by someone else involved in the dispute.
25. Law enforcement. We may release medical information if asked to do so by a law enforcement official: • In response to a court order, subpoena, warrant, summons or similar process • To identify or locate a suspect, fugitive, material witness or missing person • About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement • About a death we believe may be the result of criminal conduct • About criminal conduct at MCB • In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime
26. Coroners, medical examiners and funeral directors. We may release medical information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We also may release medical information about MCB patients to funeral directors as necessary to carry out their duties.
27. National security and intelligence activities. We may release your medical information to authorized federal officials for intelligence, counterintelligence and other national security activities authorized by law.
28. Protective services for the president and others. We may disclose your medical information to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or to conduct special investigations.
29. Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release your medical information to the correctional institution or law enforcement official. This release would be necessary: (1) for the institution to provide you with healthcare; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the individuals housed in the correctional institution.
30. Breaches. In the event of a known or suspected violation of your privacy, we may disclose facts including some patient information to you, investigating authorities, and/or the U.S. Department of Health and Human Services. We may also share information regarding the breach with the news media, but would not provide them with any identifiable information about you.
31. Health information exchange. MCB participates in a regional arrangement of healthcare providers who have agreed to work with each other to make available electronic health information that may be relevant to your care. We may share clinical information with other providers, including your complete medical history, diagnoses, notes, test results, current medications, allergies, immunizations and other clinical information vital to your care. Certain demographic information used to identify you, such as name, birth date and address, might also be shared. We may also receive and maintain medical information about you from other physicians who have provided you with medical care. Providers need access to as much useful information as possible while treating their patients and viewing your medical history helps providers make better decisions about your care. For example, if you are admitted to a hospital on an emergency basis and cannot provide important information about your health condition or that you have been seen by your primary care physician, this regional arrangement will help those who need to treat you at the hospital to see and maintain your health information held by another participating provider. When it is needed, ready access to your health information means better care for you.
Your rights regarding your medical information:
You have the following rights regarding your medical information that we maintain:
1. Right to inspect and copy. You have the right to inspect and obtain a copy of medical information that may be used to make decisions about your care. This includes medical and billing records in physical form or electronic copy. To inspect and/or copy medical information that may be used to make decisions about you, you must submit your request in writing to the manager of Medical Records at MCB (or his/her designee). If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request. We may deny your request to inspect and copy in certain, very limited circumstances. If you are denied access to medical information, you may request that the denial be reviewed. Another licensed healthcare professional chosen by MCB will review your request and the denial. The person conducting the review will not be the person who denied your original request. We will comply with the outcome of the review.
2. Right to request third-party disclosure. You have the right to request that information regarding your care be sent to a third party. Your request must be signed, in writing and must clearly designate the third party to whom MCB should send the requested information. We may charge a fee for the costs of copying, mailing or other supplies associated with your request.
3. Right to amend. If you feel that medical information we have about you is incorrect or incomplete, you may ask us to change the information. You have the right to request a change for as long as the information is kept by or for MCB. To request a change, your request must be made in writing and submitted to the MCB Privacy Officer. Due to the technology used to store information and the laws requiring MCB to retain information in its original text, MCB may not be able to permanently delete information, even if it is identified as incorrect. If MCB decides that it should correct or add information, it will correct or add information to your records and note that the new information takes the place of the old information. The old information may remain in your record. MCB will tell you when the information has been added or corrected. MCB will also tell its business associates that need to know about the change to your protected health information. Your request for amendment must provide a reason to support your request outlining what information needs to be changed and why the information is incorrect. We may deny your request for a change if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that: • Was not created by us, unless the person or entity that created the information is no longer available to make the change • Is not part of the medical information kept by or for MCB • Is not part of the information which you would be permitted to inspect and copy • Is already accurate and complete If your request if denied, MCB will send communication of the denial in writing. The denial will explain why your request was denied and your right to submit a written statement of why you disagree with MCB’s denial. MCB’s denial will also tell you how to submit a complaint to MCB or to the Secretary of the Department of Health and Human Services. If you send MCB a written statement of disagreement with the denial, MCB can file a written reply to your statement. MCB will provide you with a copy of any written reply. If you file a written statement disagreeing with the denial, MCB must include your request for an amendment, the denial, and your written statement of disagreement and any reply when MCB discloses the protected health information that you asked to be changed. Even if you do not send MCB a written statement explaining why you disagree with the denial, you can ask that your request and MCB’s denial be attached to all future disclosures of the protected health information that you wanted changed.
4. Right to an accounting of disclosures. You have the right to request an “accounting of disclosures.” This is a list of the disclosures we made of your medical information. Exceptions: Disclosures as a result of a valid authorization and disclosure to individuals made as part of activities 1 to 17, 23, 25 and 30 above may not be available (every therapist, nurse, etc. involved in your care, every audit of care provided, etc.) and may not, therefore, be included in the accounting of disclosures provided to you. To request this list or accounting of disclosures, you must submit your request in writing to the MCB Privacy Officer. Your request must state a time period, which may not be longer than six years and may not include dates before April 26, 2003. The first list you request within a 12-month period will be free of charge. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost prior to providing the list, and you may choose to withdraw or modify your request at that time before any costs are incurred.
5. Right to request restrictions. You have the right to request a restriction or limitation on the medical information we use or disclose about you. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or who pays for your care, such as a family member or friend. For example, you could ask that we not use or disclose information about a surgery you had to a specific family member who is not a legal guardian. We are not legally required to agree to all of your requests. In particular, we will not agree if we have any concern that this could compromise our ability to provide appropriate care to you. To request restrictions, you must make your request in writing to the MCB Privacy Officer. In your request, you must tell us: (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; (3) to whom you want the limits to apply. We will inform you of our decision. You also have the right to request that we not share certain information with your health plan, if you pay in full, out of pocket, for those health care items or services (to ensure that we don’t automatically bill your health plan for these services or items, you will need to notify MCB’s staff before receiving these services or items if you want this restriction).
6. Right to request confidential communications. You have the right to request that we communicate with you about your medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. We will make reasonable efforts to comply. We reserve the right to take back our agreement should we feel this is necessary to protect you. To request confidential communications, you must make your request in writing to the MCB Privacy Officer. We will not ask you the reason for your request. We will make reasonable efforts to accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.
7. Right to a paper copy of this notice. You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. You may obtain a copy of this notice at our website, www.medctrbarbour.org, or to obtain a paper copy of this notice, contact the MCB Privacy Officer at 334-688-7041.
8. Right to be notified following a breach of unsecured medical information. You have a right to and will receive notifications of breaches affecting your medical information. A breach means the access, use or disclosure of your unsecured protected health information in a manner not permitted under HIPAA. If this occurs, you will be provided information about the breach, information about the steps MCB has taken to minimize harm as a result of the breach and how you can lessen any harm as a result of the breach.
Changes to this notice:
We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for medical information we already have about you, as well as any information we receive in the future. We will post a copy of the current notice at MCB and on our website at www.medctrbarbour.org. In addition, each time you register at or are admitted to MCB for treatment or healthcare services as an inpatient or outpatient, we will offer you a copy of the current notice in effect.
Complaints:
If you believe your privacy rights have been violated, contact a MCB patient representative to assist you in filing a written complaint to the MCB Privacy Officer.
All complaints must be in writing.
You may also send a written complaint to the U.S. Department of Health and Human Services at:
Region IV, Office for Civil Rights, DHHS 61 Forsyth Street, SW, Suite 16T70 Atlanta, GA 30303 FAX 404-562-7881 Complaints filed directly with the Secretary must: (1) be in writing; (2) contain the name of the entity against which the complaint is lodged; (3) describe the relevant problems; and (4) be filed within 180 days of the time you became or should have become aware of the problem. You will not be penalized in any way for filing a complaint.
Other uses of medical information:
Other uses and disclosures of medical information not covered by this notice or state or federal laws that apply to MCB will be made only with your written permission. If you provide us permission to use or disclose your medical information, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose your medical information for the reasons covered by your written authorization. MCB is unable to take back any disclosures we have already made prior to your revocation of permission to disclose.