HIPAA Privacy Policy

Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

FLOYD MEMORIAL HOSPITAL AND HEALTH SERVICES AND ASSOCIATED HEALTH CARE PRACTITIONERS HAS A LEGAL DUTY TO SAFEGUARD YOUR PROTECTED HEALTH INFORMATION (PHI).

All employees, volunteers, staff, doctors, health professionals and other personnel are legally required to and must abide by the policies set forth in this notice, and to protect the privacy of your health information.

This “protected health information,” or PHI for short, includes information that can be used to identify you. We collect or receive this information about your past, present or future health condition to provide health care to you, or to receive payment for this health care. We must provide you with this notice about our privacy practices that explains how, when and why we use and disclose (release) your PHI. With some exceptions, we may not use or release any more of your PHI than is necessary to accomplish the need for the information.

We reserve the right to change the terms of this notice and our privacy policies at any time. Any changes to this notice will apply to the PHI already in existence. Before we make any change to our policies, we will promptly change this notice and post a new notice in our lobby. You can also request a copy of this notice from the contact person listed at the end of this notice at any time and can view a copy of the notice on our Web site at www.floydmemorial.org.

WE MAY USE AND RELEASE YOUR PROTECTED HEALTH INFORMATION for many different reasons. For some of these reasons, we will need your permission or a specific, signed authorization. Below, we describe the different categories of when we use and release your PHI and give you some examples of each category.

A. WE MAY USE, OR DISCLOSE YOUR PROTECTED HEALTH INFORMATION FOR TREATMENT, PAYMENT, OR HEALTH CARE OPERATIONS.

1. For treatment. We may release your PHI to physicians, nurses, medical students, and other health care personnel and agencies who provide or are involved in your health care. For example, if you are being treated for a knee injury, we may release your PHI to the physical rehabilitation department in order to coordinate your care.

2. To obtain payment for treatment. We may use and release your PHI in order to bill and collect payment for services provided to you. It is important that you provide us with correct and up-todate PHI. For example, we may release portions of your PHI to our billing department and your health plan to get paid for the health care services we provided to you. We may also release your PHI to our business associates, such as attending medical staff, billing companies, claims processing companies and others that process our health care claims.

3. To run our health care business. We may release your PHI in order to operate our facility in compliance with healthcare regulations. For example, we may use your PHI to review the quality of our services and to evaluate the performance of our staff in caring for you.

B. WE ALSO DO NOT REQUIRE YOUR CONSENT TO USE OR RELEASE YOUR PHI:

1. When requested by federal, state, or local law; judicial or administrative proceedings; or law enforcement agencies. We release your PHI when a law requires that we report information to government agencies and law enforcement personnel, for example, about victims of abuse, neglect, or domestic violence; when dealing with gunshot and other wounds; or when ordered in a judicial or administrative proceeding.

2. For public health activities. We report information about births, deaths, and various diseases to government officials in charge of collecting that information and we provide coroners, medical examiners and funeral directors necessary information relating to an individual’s death.

3. For purposes of organ donation. For patients that have previously agreed to organ donation, we may notify organ procurement organizations to assist them in organ, eye or tissue donation and transplants.

4. To avoid harm. In order to avoid a serious threat to health or safety of a person or the public, we may provide your demographic PHI to law enforcement personnel or persons able to prevent or lessen such harm.

5. For worker’s compensation purposes when we release your PHI in order to comply with worker’s compensation laws. If you do not want worker’s compensation notified, alternate insurance or payment information must be supplied.

6. For appointment reminders and health-related benefits and services. We may use your demographic PHI to contact you as a reminder that you have an appointment or to recommend possible treatment options or alternatives that may be of interest to you.

7. For fundraising activities. We may use your demographic PHI to communicate with you to raise funds for our healthcare system. The money raised through these activities is used to expand and support the health care services and educational programs we provide to the community. If you do not wish to be contacted as part of our fundraising efforts, please contact the person listed at the end of this notice.

C. YOU HAVE THE OPPORTUNITY TO AGREE TO OR OBJECT TO THE FOLLOWING:

1. Patient Directories. We may include your name, location in our facility, and your general condition in our patient directory,to direct visitors who ask for you by name. We may also include your religious affiliation for use by clergy, unless you object in whole or in part. Your choice to object may be made at any time.

2. Information shared with family, friends or others. We may release your PHI to a family member, friend, or other person that you indicate is involved in your care or the payment for your health care, unless you object in whole or in part. Your choice to object may be made at any time.

D. YOUR PRIOR WRITTEN AUTHORIZATION IS REQUIRED FOR ANY USES AND DISCLOSURES OF YOUR PROTECTED HEALTH INFORMATION NOT INCLUDED ABOVE. We will ask for your written authorization before using or releasing any of your PHI. If you choose to sign an authorization to release your PHI, you may later cancel that authorization in writing. This will stop any future release of your PHI for the purposes you previously authorized.

YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION

A. You Have the Right to Request Limits on How We Use and Release Your PHI. If we accept your request, we will put any limits in writing and abide by them except in emergency situations. You may not limit PHI that we are legally required or allowed to release.

B. You Have the Right to Choose How We Communicate PHI to You. All of our communications to you are considered confidential. You have the right to ask that we send information to you to an alternative address (for example, sending information to your work address rather than your home address) or by alternative means (for example, e-mail instead of regular mail). We must agree to your request so long as we can easily provide it in the format you requested. Any additional expenses will be passed onto you for payment.

C. You Have the Right to See and Get Copies of Your PHI. You must make the request in writing. We will respond to you within 30 days after receiving your written request. In certain situations, we may deny your request. If we do, we will tell you, in writing, why we denied your request. You have the right to have the denial reviewed. We will choose another licensed healthcare professional to review your request and the denial. The person conducting the review will not be the person who denied your first request. You can request a summary or a copy of the entire medical record as long as you agree to the cost in advance. If your request to see the medical information is approved, we will arrange this in accordance with established hospital policy. Please submit all requests for this information to: Health Information Management Department – 812-949-5993

D. You Have the Right to Get a List of Instances of When and to Whom We Have Disclosed Your PHI. This list will not include uses you have already authorized, or those for treatment payment or operations. This list will not include uses made for national security purposes, to corrections or law enforcement personnel, or made before April 15, 2003. We will respond within 60 days of receiving your request. The list we provide will include the last six years of activity unless you request a shorter time. The list will include dates when your PHI was released and why, with whom your PHI was released (including their address if known), and a description of the information released. The first list you request within a 12-month period will be free. You will be charged a reasonable fee for additional lists within that time frame. Please submit all requests for this information to: Health Information Management Department – 812-949-5993

E. You Have the Right to Correct or Update Your PHI. If you believe that there is a mistake in your PHI or that a piece of important information is missing, you have the right to request that we correct the existing or add the missing information. We can do this for as long as the information is retained by your facility. You must provide the request and your reason for the request in writing. We will respond within 60 days of receiving your request. If we deny your request, our written denial will state our reasons and explain your right to file a written statement of disagreement. If you do not file a written statement of disagreement, you have the right to request that your request and our denial be attached to all future uses or releases of you PHI. If we approve your request, we will make the change to your PHI, tell you that we have done it, and tell others that need to know about the change or amendment to your PHI. Please submit all requests for this information to: Health Information Management Department – 812-949-5993

F. You Have the Right to Request a Copy of This Privacy Notice. Even if you have agreed to receive notice via e-mail, you also have the right to request a paper copy of this notice. Please submit this request to: Risk Manager, Administrative Office – 812-949-5500

HOW TO VOICE YOUR CONCERNS ABOUT OUR PRIVACY PRACTICES: If you think that we may have violated your privacy rights, or you disagree with a decision we made about access to your PHI, you may file a complaint with the person listed at the end of this notice. You also may send a written complaint to the Secretary of the Department of Health and Human Services at 200 Independence Avenue, SW Washington, D.C. 20201 You will not be penalized for filing a complaint.

PERSON TO CONTACT FOR INFORMATION ABOUT THIS NOTICE OR TO VOICE YOUR CONCERNS ABOUT OUR PRIVACY PRACTICES: Risk Manager Administrative Office 812-949-5500

EFFECTIVE DATE OF THIS NOTICE This notice is effective as of April 15, 2003