Effective Date: September 23, 2013
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Each PORT Health program must comply with a variety of State and Federal laws, some of which will be more restrictive than HIPAA. In those cases, the program would generally comply with the most restrictive law.
PORT Health knows that information we collect about you and your health is private. PORT Health is legally required to protect this information also known as “Protected Health Information” and referred in this notice as PHI.
The Notice of Privacy Practices will tell you how PORT Health may use or disclose information about you. Not all situations will be described. We are required to give you a notice of our privacy practices for the information we collect and keep about you. We are required to follow the terms of the notice currently in effect. We reserve the right to change the terms of this Notice in the future and make the new notice effective for all PHI we maintain. A copy of our current Notice is posted on our website at https://www.porthealthservices.org, is available at your request, and is posted in the waiting areas of our offices.
The rest of the Notice will:
- Discuss how we may use and disclose your PHI.
- Explain your rights with respect to your PHI.
- Describe how and where you may file a complaint.
PORT HEALTH MAY USE AND DISCLOSE INFORMATION ABOUT YOU IN SEVERAL CIRCUMSTANCES:
- We may use or disclose your PHI to provide health care treatment to you and to manage and coordinate your health care.
Example: Jane is a patient at PORT Health. The receptionist may use Jane’s PHI when setting up an appointment. The nurse practitioner will likely use Jane’s PHI when reviewing Jane’s condition and ordering a blood test. The laboratory technician will likely use Jane’s PHI when processing or reviewing her blood test results. If, after reviewing the results of the blood test, the nurse practitioner concludes that Jane should be referred to a specialist, the nurse may disclose Jane’s PHI to the specialist to assist the specialist in providing appropriate care to Jane in coordination with Jane.
- We may use or disclose information so that we can bill for the services you receive from us and can collect payment from you, an insurance plan, or a third party. We also may disclose your PHI to others (such as collection agencies, and consumer reporting agencies). In some instances, we may disclose your PHI to an insurance plan before you receive certain health care services because, for example, we may want to know whether the insurance plan will pay for a particular service.
Example: Jane is a patient at PORT Health and she has a private insurance. During an appointment with a nurse practitioner, the nurse practitioner ordered a blood test. The PORT Health billing clerk will use Jane’s PHI when he prepares a bill for the services provided at the appointment and the blood test. Jane’s PHI will be disclosed to her insurance company when the billing clerk sends in the bill.
For Health Care Operations:
We may use or disclose information in order to manage our programs and activities. Some examples of how we may use or disclose your PHI for heath care operations are:
- Reviewing and evaluating the skills, qualifications, and performance of health care providers taking care of you.
- Providing training programs for trainees, health care providers or non-health care professionals to help them practice or improve their skills.
- Cooperating with outside organizations that evaluate, certify or license health care providers, staff or facilities in a particular field or specialty.
- Reviewing and improving the quality, efficiency and cost of care that we provide to our patients.
- Improving health care and lowering costs for groups of people who have similar health problems and helping manage and coordinate the care for these groups of people.
- Cooperating with outside organizations that assess the quality of the care others and we provide, including government agencies and private organizations.
- Planning for our organization’s future operations.
- Resolving grievances within our organization.
- Reviewing our activities and using or disclosing PHI in the event that control of our organization significantly changes.
- Working with others (such as lawyers, accountants and other providers) who assist us to comply with this Notice and other applicable laws.
- We may use and/or disclose your PHI to send you reminders about your appointment.
- With permission, we may use photographs and/or your PHI to demonstrate successful outcomes to be published by agency councils.
Persons involved in your care:
- We may disclose your PHI to a relative, close personal friend or any other person you identify if that person is involved in your care and the information is relevant to your care. If the patient is a minor, we may disclose the minor’s PHI to a parent, guardian or other person responsible for the minor except in limited circumstances. For more information on the privacy of minors’ information, contact the Privacy Official listed in this notice. We may also use or disclose your PHI to a disaster relief organization (such as the Red Cross) if we need to notify someone about your location or condition.You may ask us at any time not to disclose your PHI to persons involved in your care. We will agree to your request and not disclose the information except in certain limited circumstances (such as emergencies) or if the patient is a minor. If the patient is a minor, we may or may not be able to agree to your request.
Uses and Disclosures Required By Law:
- There are many state and federal laws that require us to use and disclose PHI. When permitted by law, we may use or disclose your PHI without your permission as follows:
- Threat to health or safety: We may use or disclose your PHI if we believe it is necessary to prevent or lessen a serious threat to health or safety.
- Public health activities: We may use or disclose your PHI for public health activities such as activities related to investigating diseases, reporting child abuse and neglect or domestic violence, monitoring drugs or devices regulated by the Food and Drug Administration, and monitoring work-related illnesses or injuries. For example, if you have been exposed to a communicable disease (such as a sexually transmitted disease), we may report it to the State and take other actions to prevent the spread of the disease.
- Abuse, neglect or domestic violence: We may disclose your PHI about you to a government authority (such as the Department of Social Services) if you are an adult and we reasonably believe that you may be a victim of abuse, neglect or domestic violence.
- Health oversight activities: We may disclose your PHI to a health oversight agency which is basically an agency responsible for overseeing the health care system or certain government programs. For example, a government agency may request information from us while they are investigating possible insurance fraud.
- Court proceedings: We may disclose your PHI to a court or an officer of the court (such as an attorney) when we get a court order, warrant, subpoena or other legal process. For example, we would disclose your PHI to a court if a judge orders us to do so.
- Law enforcement: We may disclose your PHI to a law enforcement official for specific law enforcement purposes. For example, we may disclose limited PHI about you to a police officer if the officer needs the information to help find or identify a missing person.
- Coroners and others: We may disclose your PHI to a coroner, medical examiner, or funeral director or to organizations that help with organ, eye and tissue transplants.
- Workers’ compensation: We may disclose your PHI in order to comply with workers’ compensation laws.
- Research organizations: We may use or disclose your PHI to research organizations if the organization has satisfied certain conditions about protecting the privacy of medical information.
- Certain government functions: We may use or disclose your PHI for certain government functions, including but not limited to military and veterans’ activities and national security and intelligence activities. We may also use or disclose your PHI to a correctional institution in some circumstances.
Other Uses or Disclosures:
- Business Associates: We may disclose PHI to our business associates who perform functions on our behalf or provide us with services if the PHI is necessary for those functions or services. For example, we may use a software firm’s services or medical transcription services. All of our business associates are obligated, under contract with PORT Health, to protect the privacy and ensure the security of your PHI.
- Fundraising Activities: We may use or disclose your PHI, as necessary, in order to contact you for fundraising activities. You have the right to opt out of receiving such communications and you may request so by submitting a written request to the Privacy Official listed in this notice.
- For publicly-funded patients–NC Treatment Outcomes and Program Performance System (NC-TOPPS): We may disclose your PHI to NC-TOPPS which is the program by which NC Division of Mental Health, Developmental Disabilities and Substance Abuse Services (DMH/DD/SAS) measures the quality of substance abuse and mental health services and their impact on an individual’s life.
Your written consent will be required for the following:
- Marketing: We are not permitted to provide your PHI to others for marketing to you of any products or services. However, if the communication describes your prescription drug or biologic and the payment received by us is reasonably related to our cost for making the communication, we are permitted to send such communication to you with your authorization. Our business associate may also send such communication to you on our behalf.
- Sale of PHI: We are not permitted to receive payments for the sale of your PHI. This prohibition does not apply for (a) public health purposes; (b) research when price charged is cost-based fee; (c) health care operations related to the sale, merger, or consolidation of PORT Health; (d) performance of services by a business associate on our behalf; (d) your treatment; (e) providing you with a copy of your PHI; (f) other reasons as required by law.
- For most uses and disclosures of psychotherapy notes
- Other uses and disclosure of PHI not described in this notice will be made only with your written authorization or the written authorization of your personal representative.
If you sign a written authorization allowing us to disclose your PHI, you may later revoke or cancel your authorization in writing (except in very limited circumstances related to obtaining insurance coverage). If you would like to revoke your authorization, you may write us a letter revoking your authorization or fill out an Authorization Revocation Form. Authorization Revocation Forms are available at the front office in all PORT locations. If you revoke your authorization, we will follow your instructions except to the extent that we have already relied upon your authorization and taken some action.
- Following the discovery of a breach of unsecured PHI, we are required to notify you if we reasonably believe that your PHI has been accessed, acquired, used, or disclosed as a result of such breach.
YOU HAVE RIGHTS WITH RESPECT TO YOUR PHI
You have several rights regarding your PHI and this section of the Notice will briefly mention each of these rights.
Right to a copy of this Notice
- You have a right to have a paper copy of our Notice of Privacy Practices at any time from our Patient Relations Representative or Privacy Official. Reasonable accommodations shall be made for persons served with special needs such as visual impairment, reading comprehensive level, or non-English speaking.
Right to request to see and copy your PHI
- You have the right to see or review and receive a copy of your PHI that we maintain in certain groups of records, except for psychotherapy notes, information compiled for legal proceedings, and health information maintained by us that is prohibited by law to be accessed by you. Your request must be in writing and you may fill out an Access Request Form, which is available at the clinic’s front desk.
We may deny your request in certain circumstances. If we deny your request, we will explain our reason for doing so in writing and describe any rights you may have to request a review of our denial.
If you request a copy of the information in an electronic or hard copy format, if it is readily available, we may charge you a fee to cover the costs of the copy or we may be able to provide you with a summary or explanation of the information. This includes copying from any type of medium that is applicable to the request.
Right to have your PHI amended
- You have the right to have us amend (which means correct or supplement) your PHI that we maintain in certain groups of records. If you believe that we have information that is either inaccurate or incomplete, we may amend the information to indicate the problem and notify others who have copies of the inaccurate or incomplete information. If you would like us to amend information, you must provide us with a request in writing and explain why you would like us to amend the information.
We may deny your request in certain circumstances. If we deny your request, we will explain our reason for doing so in writing. You will have the opportunity to send us a statement explaining why you disagree with our decision to deny your amendment request and we will share your statement whenever we disclose the information in the future.
Right to an accounting of disclosures we have made
- You have the right to receive an accounting (a detail listing) of disclosures of your PHI that we have made in the 6 years from the date of your request. We will not provide an accounting of disclosures prior to July 18, 2004. Your request for an accounting of disclosures must be in writing and include the time period of the disclosures. We may charge you a fee to cover the cost of the copy. The accounting will not include several types of disclosures, including disclosures for treatment, payment or health care operations.
If we use electronic health records (EHR) for your PHI, you have the right to receive an accounting of disclosures including all disclosures for payment, treatment and health care operations over the past 3 years. We started using EHR in January 2011.
Right to request restrictions on uses and disclosures
- You have the right to request restrictions on certain uses and disclosures of your PHI for treatment, payment and health care operations or limit disclosures to family or other persons involved in your care. We will make every attempt to honor your request but are not required to agree to such request. If we do agree, we must follow your restrictions (unless the information is necessary for emergency treatment). Your request must be in writing and specify restriction requested and to whom you want the restriction to apply. You may cancel the restrictions in writing at any time. In addition, we may cancel a restriction at any time as long as we notify you of the cancellation and continue to apply the restriction to information collected before the cancellation. We must agree to your request to restrict disclosure of your PHI to a health plan if the PHI pertains solely to a health care item or service for which you have paid us out-of-pocket and in full.
Right to request an alternative method of contact
- You have the right to request to be contacted at a different location or by a different method. For example, you may prefer to have all written information mailed to your work address rather than to your home address. We will agree to any reasonable request for alternative methods of contact. Your request must be in writing.
HOW TO FILE A COMPLAINT OR REPORT A PROBLEM
If you believe we have violated your privacy rights, or if you want to file a complaint regarding our privacy practices, you may file a written complaint or may bring your complaint to the Privacy Official at the following address:
You also may send a written complaint to the Secretary of the US Department of Health and Human Services at
Attn: Compliance & Privacy Professional (Privacy Official)
154 Beacon Drive, Suite I
Winterville, NC 28590-7860
US Department of Health and Human Services
Office for Civil Rights
61 Forsyth Street, S.W. – Suite 3B70
Atlanta, GA 30323
Voice Phone: 404-562-7886
If you file a complaint, we will not take any action against you and we will continue to make all efforts to constantly improve the quality of treatment and services we provide.
CONFIDENTIALITY OF ALCOHOL AND DRUG ABUSE PATIENT RECORDS
The confidentiality of alcohol and drug abuse patient records maintained by the program in which the patient will be admitted is protected by Federal law and regulations. Generally, the program may not say to a person outside the program that a patient attends the program, or disclose any information identifying a patient as an alcohol or drug abuser unless:
- The patient consents in writing
- The disclosure is allowed by a court order OR
- The disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluation.
Violation of the Federal law and regulations by a program is a crime. Suspected violations may be reported to appropriate authorities in accordance with Federal regulations.
Federal law and regulations do not protect any information about a crime committed by a patient either at the program or against any person who works for the program or about any threat to commit such a crime.
Federal laws and regulations do not protect any information about suspected child abuse or neglect from being reported under State law to appropriate State or local authorities.