Notice of Privacy Practices
Version No.2 – August 20, 2007
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
I. Who Presents this Notice
This Notice describes the privacy practices of Central Carolina Hospital (the “Hospital”) and members of its workforce, as well as the physician members of the medical staff and allied health professionals who practice at the Hospital. The Hospital and the individual health care providers together are sometimes called "the Hospital and Health Professionals" in this Notice. While the Hospital and Health Professionals engage in many joint activities and provide services in a clinically integrated care setting, the Hospital and Health Professionals each are separate legal entities. This Notice applies to services furnished to you at Central Carolina Hospital’s main campus and The Nautilus Cardiac Rehab site, as a Hospital inpatient or outpatient or any other services provided to you in a Hospital-affiliated program involving the use or disclosure of your health information.
II. Privacy Obligations
The Hospital and Health Professionals each are required by law to maintain the privacy of your health information ("Protected Health Information" or "PHI") and to provide you with this Notice of legal duties and privacy practices with respect to your Protected Health Information. When the Hospital and Health Professionals use or disclose your Protected Health Information, the Hospital and Health Professionals are required to abide by the terms of this Notice (or other notice in effect at the time of the use or disclosure). Special privacy obligations, described in Section IV.D, apply to you if you are admitted to the Hospital’s psychiatric unit or chemical dependency treatment center.
III. Permissible Uses and Disclosures Without Your Written Authorization
In certain situations, which are described in Section IV below, your written authorization must be obtained in order to use and/or disclose your PHI. However, the Hospital and Health Professionals do not need any type of authorization from you for the following uses and disclosures:
A. Uses and Disclosures For Treatment, Payment and Health Care Operations. Your PHI, but not your “Highly Confidential Information” (defined in Section IV.C below), may be used and disclosed to treat you, obtain payment for services provided to you and conduct “health care operations” as detailed below:
· Treatment. Your PHI may be used and disclosed to provide treatment and other services to you--for example, to diagnose and treat your injury or illness. In addition, you may be contacted to provide you appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you. Your PHI also may be disclosed to other providers involved in your treatment.
· Payment. Your PHI may be used and disclosed to obtain payment for services provided to you--for example, disclosures to claim and obtain payment from your health insurer, HMO, or other company that arranges or pays the cost of some or all of your health care (“Your Payor”) to verify that Your Payor will pay for health care.
· Health Care Operations. Your PHI may be used and disclosed for health care operations, which include internal administration and planning and various activities that improve the quality and cost effectiveness of the care delivered to you. For example, PHI may be used to evaluate the quality and competence of physicians, nurses and other health care workers. PHI may be disclosed to the Hospital Privacy Office in order to resolve any complaints you may have and ensure that you have a comfortable visit. If your PHI is disclosed to a private peer review committee, the Hospital and Health Professionals will conform to additional requirements under North Carolina law.
Your PHI also may be disclosed to your other health care providers when such PHI is required for them to treat you, receive payment for services they render to you, or conduct certain health care operations, such as quality assessment and improvement activities, reviewing the quality and competence of health care professionals, or for health care fraud and abuse detection or compliance. In addition, PHI may be shared with business associates who perform treatment, payment and health care operations services on behalf of the Hospital and Health Professionals. Notwithstanding the above, if you are a parent or guardian, your appropriate general consent will be obtained before the PHI of your child will be used or disclosed for Treatment, Payment or Health Care Operations.
B. Use or Disclosure for Directory of Individuals in the Hospital. The Hospital may include your name, location in the Hospital, general health condition and religious affiliation in a patient directory without obtaining your authorization unless you object to inclusion in the directory or are located in a specific ward, wing or unit the identification of which would reveal that you are receiving treatment for (1) mental health and developmental disabilities; (2) alcohol and drug abuse; or (3) HIV/AIDS. Information in the directory may be disclosed to anyone who asks for you by name or members of the clergy; provided, however, that your religious affiliation will only be disclosed to members of the clergy.
C. Disclosure to Relatives, Close Friends and Other Caregivers. Your PHI may be disclosed to a family member, other relative, a close personal friend or any other person identified by you when you are present for, or otherwise available prior to, the disclosure, if (1) your agreement is obtained; (2) you do not object to the disclosure after being provided an opportunity to object; or (3) it can be reasonably inferred that you do not object to the disclosure.
If you are not present, or the opportunity to agree or object to a use or disclosure cannot practicably be provided because of your incapacity or an emergency circumstance, the Hospital and/or Health Professionals may exercise professional judgment to determine whether a disclosure is in your best interests. If information is disclosed to a family member, other relative or a close personal friend, the Hospital and/or Health Professionals would disclose only information believed to be directly relevant to the person’s involvement with your health care or payment related to your health care. Your PHI also may be disclosed in order to notify (or assist in notifying) such persons of your location or general condition.
D. Public Health Activities. Your PHI may be disclosed for the following public health activities: (1) to report health information to public health authorities for the purpose of preventing or controlling disease, injury or disability; (2) to report child abuse and neglect to public health authorities or other government authorities authorized by law to receive such reports; (3) to report information about products and services under the jurisdiction of the U.S. Food and Drug Administration; (4) to alert a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition; (5) to report information to your employer as required under laws addressing work-related illnesses and injuries or workplace medical surveillance; (6) to report spontaneous fetal death within ten (10) days upon the form prescribed by the State Registrar; and (7) to report cases of bullet wounds, gunshot wound, powder burn or any other injury arising from or caused by, or appearing to arise from or be caused by, the discharge of a gun or firearm, every case or illness apparently caused by poisoning, every case of a wound or injury caused, or apparently caused, by a knife or sharp or pointed instrument if it appears to the Hospital physician treating the case that a criminal act was involved, and every case of a wound, injury or illness in which there is grave bodily harm or grave illness if it appears to the Hospital physician treating the case that the wound, injury or illness resulted from a criminal act of violence. Notwithstanding the above, the Hospital and Health Professionals will report the following named diseases, injuries and illnesses to the appropriate North Carolina public health authorities within fifteen (15) days: (i) asbestosis; (ii) silicosis; (iii) elevated blood lead levels for adults; and (iv) serious and preventable injuries caused by tractors, farm equipment or farm machinery that occur while working on a farm.
E. Victims of Abuse, Neglect or Domestic Violence. Your PHI may be disclosed to a governmental authority, including a social service or protective services agency, authorized by law to receive reports of such abuse, neglect, or domestic violence if there is a reasonable belief that you are a victim of abuse, neglect or domestic violence.
F. Health Oversight Activities. Your PHI may be disclosed to the North Carolina Commission for Health Services or another health oversight agency that oversees the health care system and is charged with responsibility for ensuring compliance with the rules of government health programs such as Medicare or Medicaid.
G. Judicial and Administrative Proceedings. Your PHI may be disclosed in the course of a judicial or administrative proceeding in response to a legal order or other lawful process as permitted under North Carolina law.
H. Law Enforcement Officials. Your PHI may be disclosed to the police or other law enforcement officials as required or permitted by law or in compliance with a court order or a grand jury or administrative subpoena.
I. Decedents. Your PHI may be disclosed to a coroner or medical examiner as authorized by law.
J. Organ and Tissue Procurement. Your PHI may be disclosed to organizations that facilitate organ, eye or tissue procurement, banking or transplantation.
K. Research. Your PHI may be used or disclosed without your consent or authorization if an Institutional Review Board approves a waiver of authorization for disclosure or records which pertain to communicable disease or communicable condition research are released and the Hospital and Health Professionals follow other requirements of North Carolina law.
L. Health or Safety. Your PHI may be used or disclosed to prevent or lessen a serious and imminent threat to a person’s or the public’s health or safety as permitted or required under North Carolina law.
M. Specialized Government Functions. Your PHI may be used and disclosed to units of the government with special functions, such as the U.S. military or the U.S. Department of State under certain circumstances.
N. Workers’ Compensation. Your PHI may be disclosed as authorized by and to the extent necessary to comply with North Carolina law relating to workers' compensation or other similar programs.
O. As Required by Law. Your PHI may be used and disclosed when required to do so by any other law not already referred to in the preceding categories.
IV. Uses and Disclosures Requiring Your Written Authorization
A. Use or Disclosure with Your Authorization. For any purpose other than the ones described above in Section III, your PHI may be used or disclosed only when you provide your written authorization on an authorization form (“Your Authorization”). For instance, you will need to execute an authorization form before your PHI can be sent to your life insurance company or to the attorney representing the other party in litigation in which you are involved.
B. Marketing. Your written authorization (“Your Marketing Authorization”) also must be obtained prior to using your PHI to send you any marketing materials. (However, marketing materials can be provided you in a face-to-face encounter without obtaining Your Marketing Authorization. The Hospital and/or Health Professionals are also permitted to give you a promotional gift of nominal value, if they so choose, without obtaining Your Marketing Authorization.) In addition, the Hospital and/or Health Professionals may communicate with you about products or services relating to your treatment, case management or care coordination, or alternative treatments, therapies, providers or care settings without Your Marketing Authorization.
C. Uses and Disclosures of Your Highly Confidential Information. In addition, federal and state law require special privacy protections for certain highly confidential information about you (“Highly Confidential Information”), including the subset of your PHI that: (1) is maintained in psychotherapy notes; (2) is about mental health and developmental disabilities or part of North Carolina Mental Health Programs; (3) is about alcohol and drug abuse prevention, treatment, and referral; (4) is about HIV/AIDS testing, diagnosis or treatment; (5) is any list of names or other information concerning any patient applying for or receiving Medicaid (except for purposes directly connected with the administration of the Medicaid Program); or (6) is PHI that is owned by the Division of Medical Assistance or the county department of social services. In order for your Highly Confidential Information to be disclosed for a purpose other than those permitted by law, your written authorization is required.
For uses or disclosures of your mental health information, such authorization (your “Mental Health Authorization”) shall include: (1) your name; (2) name of facility releasing the information; (3) name of individual or individuals, agency or agencies to whom information is being released; (4) information to be released; (5) purpose for the release; (6) length of time authorization is valid; (7) a statement that the authorization is subject to revocation at any time except to the extent that action has been taken in reliance on the consent; (8) signature of the client or the client's legally responsible person; and (9) date authorization is signed. Except in limited circumstances, such authorization shall be valid for a period not to exceed one year.
D. Use and Disclosure of Information Upon Admission to a Psychiatric Unit or Chemical Dependency Treatment Center. Information regarding your care in the Hospital’s psychiatric unit or chemical dependency treatment center is subject to special protections under North Carolina and federal law. The terms of this Notice shall apply to your PHI unless otherwise described in this Section IV.D.
Psychiatric Treatment. PHI will be disclosed to Hospital personnel involved in your treatment or supervising those involved in your treatment for the purpose of treating you or consulting about your treatment. Your Mental Health Authorization will be obtained prior to disclosing your PHI to other treatment providers except in the event of a medical emergency. Your Mental Health Authorization will be obtained prior to disclosing your PHI to obtain payment for services rendered to you, such as for example, to your insurance company. On occasion, your PHI may be used for health care operations but, to the extent possible, will remove your personally identifiable information. Generally, the Hospital and Health Professionals will not respond to inquiries about your treatment and will not disclose information revealing that you are a patient of the psychiatric unit to unauthorized individuals who call the Hospital to seek information; however, if the Hospital and/or Health Professionals feel that it is in your best interests, the Hospital and/or Health Professionals may disclose the fact of your admission to the Hospital’s psychiatric unit or discharge therefrom to your next of kin. Your PHI will not be disclosed to a family member, relative or any other person seeking information about your care unless your written Mental Health Authorization is obtained. If you are a minor or have a legal representative (such as a guardian or person authorized under a power of attorney), you will be consulted prior to sharing information with such person. The Hospital and Health Professionals will comply with North Carolina laws relating to disclosures of your PHI to your internal client advocate and external client advocate(s). If you refuse to grant permission or are unable to grant permission, information may be shared with your legal representative only to the extent permitted or required by North Carolina law. The Hospital and Health Professionals will comply with North Carolina law in reporting your PHI for public health activities or health oversight activities -- when possible, PHI that does not identify you will be disclosed. If you disclose information related to child abuse or other types of actual or threatened abuse, the Hospital and/or Health Professionals may be required to report such information to governmental authorities responsible to investigate such abuse. If you commit a crime on the premises, your PHI may be used to report the crime. Your PHI will not be released in a judicial or administrative proceeding, unless your Mental Health Authorization is obtained or the court issues an order requesting such information. Pursuant to North Carolina law, your PHI may be disclosed in the course of other judicial or administrative proceedings in limited circumstances. Your PHI will not be used for marketing. You and your legally responsible person are generally permitted to have access to confidential information in your record; however, you and your legally responsible person are not permitted access to information that would be injurious to your physical or mental well-being. You and your legally responsible person are generally permitted to contest the accuracy, completeness or relevancy of information in your record in accordance with North Carolina law and Hospital policies and procedures. As required by North Carolina law: (i) a secure place will be provided for the storage of your mental health records and written policies and procedures shall be developed regarding controlled access to those records; (ii) the Hospital and Health Professionals will ensure that only authorized Hospital employees or other authorized individuals will have access to the records; and (iii) the Hospital and/or Health Professional will ensure that a clinical staff member is present in order to explain and protect the record when you or your legally responsible person comes to the Hospital to review your record.
· Chemical Dependency Treatment. If you are a recipient of chemical dependency treatment, your PHI is protected by federal confidentiality laws (42 U.S.C. 290dd-3, 290ee-3 and 42 CFR Part 2). Violations of these laws is a crime and may be reported to appropriate authorities. Your PHI will be disclosed to Hospital personnel within the chemical dependency treatment program and certain organizations providing services to the program that have a need to know your PHI to perform their job duties or to medical personnel in the event of a medical emergency. Your authorization will be obtained prior to disclosing any PHI to obtain payment for services rendered to you, such as for example, to your insurance company. On occasion, your PHI may be used for health care operations but will remove your identifying information. Generally, the Hospital and Health Professionals will not respond to inquiries about your treatment and will not disclose information revealing that you are a patient of the chemical dependency treatment center to unauthorized individuals who call the Hospital to seek information; however, if the Hospital and/or Health Professionals feel that it is in your best interests, the fact of your admission to the Hospital’s chemical dependency treatment center or discharge therefrom may be disclosed to your next of kin. Your PHI will not be disclosed to a family member, relative or any other person seeking information about your care unless your written Authorization is obtained. If you are a minor or have a legal representative (such as a guardian or person authorized under a power of attorney), you will be consulted prior to sharing information with such person. The Hospital and Health Professionals will comply with North Carolina laws relating to disclosures of your PHI to your internal client advocate and external client advocate(s). If you refuse to grant permission or are unable to grant permission, information may be shared with your legal representative only to the extent permitted or required by North Carolina law. The Hospital and Health Professionals will comply with federal and North Carolina law in reporting your PHI for public health activities or health oversight activities. If you disclose information related to child abuse, the Hospital and/or Health Professionals may be required to report such information to governmental authorities responsible to investigate such abuse. If you commit a crime on the your PHI may be used to report the crime. Your PHI will not be released in a judicial or administrative proceeding, unless your Authorization is obtained or the court issues an order requesting such information. Pursuant to North Carolina law, you PHI may be disclosed in the course of other judicial or administrative proceedings in limited circumstances. Your OHI will not be used for marketing. You and your legally responsible person are generally permitted to have access to confidential information in your record; however, you and your legally responsible person are not permitted access to information that would be injurious to your physical or mental well-being.
V. Your Rights Regarding Your Protected Health Information
A. For Further Information; Complaints. If you desire further information about your privacy rights, are concerned that your privacy rights have been violated or disagree with a decision made about access to your PHI, you may contact the Hospital Privacy Office. You may also file written complaints with the Director, Office for Civil Rights of the U.S. Department of Health and Human Services. Upon request, the Hospital Privacy Office will provide you with the correct address for the Director. The Hospital and Health Professionals will not retaliate against you if you file a complaint with the Hospital Privacy Office or the Director.
B. Right to Request Additional Restrictions. You may request restrictions on the use and disclosure of your PHI (1) for treatment, payment and health care operations, (2) to individuals (such as a family member, other relative, close personal friend or any other person identified by you) involved with your care or with payment related to your care, or (3) to notify or assist in the notification of such individuals regarding your location and general condition. While all requests for additional restrictions will be carefully considered, the Hospital and Health Professionals are not required to agree to a requested restriction. If you wish to request additional restrictions, please obtain a request form from the Hospital Privacy Office and submit the completed form to the Hospital Privacy Office. A written response will be sent to you.
C. Right to Receive Confidential Communications. You may request, and the Hospital and Health Professionals will accommodate, any reasonable written request for you to receive your PHI by alternative means of communication or at alternative locations.
D. Right to Revoke Your Authorization. You may revoke Your Authorization, Your Marketing Authorization or any written authorization obtained in connection with your Highly Confidential Information, except to the extent that the Hospital and Health Professionals have taken action in reliance upon it, by delivering a written revocation statement to the Hospital Privacy Office identified below. A form of written revocation is available upon request from the Hospital Privacy Office.
E. Right to Inspect and Copy Your Health Information. You may request access to your medical record file and billing records maintained by the Hospital and Health Professionals in order to inspect and request copies of the records. Under limited circumstances and for sound medical reason, you may be denied access to a portion of your records. If you desire access to your records, please obtain a record request form from the Hospital Privacy Office and submit the completed form to the Hospital Privacy Office. If you request copies, you will be charged in accordance with federal and state law. You also will be charged for the postage costs, if you request that the copies be mailed to you.
F. Right to Amend Your Records. You have the right to request that PHI maintained in your medical record file or billing records be amended. If you desire to amend your records, please obtain an amendment request form from the Hospital Privacy Office and submit the completed form to the Hospital Privacy Office. Your request will be accommodated unless the Hospital and/or Health Professionals believe that the information that would be amended is accurate and complete or other special circumstances apply.
G. Right to Receive An Accounting of Disclosures. Upon request, you may obtain an accounting of certain disclosures of your PHI made during any period of time prior to the date of your request provided such period does not exceed six years and does not apply to disclosures that occurred prior to April 14, 2003. If you request an accounting more than once during a twelve (12) month period, you will be charged $0.75 per page of the accounting statement.
H. Right to Receive Paper Copy of this Notice. Upon request, you may obtain a paper copy of this Notice, even if you have agreed to receive such notice electronically.
VI. Effective Date and Duration of This Notice
A. Effective Date. This Notice is effective on December 8, 2003.
B. Right to Change Terms of this Notice. The terms of this Notice may be changed at any time. If this Notice is changed, the new notice terms may be made effective for all PHI that the Hospital and Health Professionals maintain, including any information created or received prior to issuing the new notice. If this Notice is changed, the new notice will be posted in waiting areas around the Hospital and on the Hospital’s Internet site at www.centralcarolinahosp.com. You also may obtain any new notice by contacting the Hospital Privacy Office.
VII. Hospital Privacy Office
You may contact the Hospital Privacy Office at:
Hospital Privacy Officer
Central Carolina Hospital
1135 Carthage Street
Sanford, NC 27330
Telephone Number: (919) 774-2100
Email: cch-hipaa@tenethealth.com
Corporate Privacy Office
Tenet HealthSystem
13737 Noel Road, Suite 100
Dallas, Texas 75240
E-mail: PrivacySecurityOffice@tenethealth.com
Ethics Action Line (EAL): 1-800-8-ETHICS