NOTICE OF PRIVACY PRACTICES
This Notice describes how medical information about you may be used and disclosed, and how you may get access to this information. Please review it carefully.
UNDERSTANDING YOUR HEALTH INFORMATION
Each time you visit a hospital, physician, or other healthcare provider, a record of your visit is made in order to manage the care you receive. Rock Regional Hospital (RRH) understands that the medical information that is recorded about you and your health is personal. The confidentiality of your health information is also protected under both state and federal law.
This Notice of Privacy Practices describes how RRH may use and disclose your information and the rights that you have regarding your health information. This notice applies to all RRH healthcare facilities (both inpatient and outpatient). It also applies to physicians and allied health professionals with staff privileges at RRH. Rock Regional Hospital has an electronic health record and will not use or disclose your health information without written authorization, except as described in this notice.
YOUR HEALTH INFORMATION RIGHTS
Although your health information is the physical property of the facility or practitioner that compiled it, the information belongs to you, and you have certain rights over that information. You have the right to:
- Request, in writing, a restriction on certain uses and disclosures of your health information. However, agreement with the request is not required by law, such as when it is determined that compliance with the restriction cannot be guaranteed. In addition, you have the right to request, in writing, a restriction on disclosures of health information to a health plan with respect to treatment services for which you have paid out of pocket in full. In this case, we will honor the request. It will be your responsibility to notify any other providers of this restriction;
- Inspect or obtain a copy of your health record as provided by law;
- Request, in writing, that your health record be amended as provided by law, if you feel the health information we have about you is incorrect or incomplete. You will be notified if the request cannot be granted;
- Request that we communicate with you about your health information in a specific way or at a specific location. Reasonable requests will be accommodated;
- Request, in writing, to obtain an accounting of disclosures of your health information as provided by law;
- Obtain a paper copy of this Notice of Privacy Practices on request.
You may exercise these rights by directing a request to the Privacy Officer Contact listed on this Notice.
OUR RESPONSIBILITIES
RRH has certain responsibilities regarding your health information, including the requirement to:
- Maintain the privacy of your healthinformation;
- Provide you with this Notice that describes RRH legal duties and privacy practices regarding the information that we maintain aboutyou;
- Abide by the terms of the Notice currently in
- Inform you that the hospital must keep your medical records for a time required by law and then may dispose of them as permitted by
RRH entities reserve the right to change these information privacy policies and practices and to make the changes applicable to any health information that we maintain. If changes are made, the revised Notice of Privacy Practices will be made available at RRH facility and will be supplied whenrequested.
Uses and Disclosures of Health Information with Authorization
When you obtain services from RRH, certain uses and disclosures of your health information are necessary and permitted by law in order to treat you, to process payments for your treatment and to support the operations of the entity and other involved providers. These following categories describe ways that RRH use or disclose your information, and some representative examples are provided in each category. All of the ways your health information is used or disclosed should fall within one of these categories.
Your health information will be used for treatment.
For example: Disclosures of medical information about you may be made to doctors, nurses, technicians, medical residents or others who are involved in taking care of you at RRH. This information may be disclosed to other physicians who are treating you or to other healthcare facilities involved in your care. Information may be shared with pharmacies, laboratories or radiology centers for the coordination of different treatments.
Your health information will be used for payment.
For example: Health information about you may be disclosed so that services provided to you may be billed to an insurance company or a third party. Information may be provided to your health plan about treatment you are going to receive in order to obtain prior approval or to determine if your health plan will cover the treatment.
Breach Notification
In certain instances, you have the right to be notified if we discover an inappropriate use or disclose of your health information. Notice of any such use or disclosure will be made as required by state and federal law.
Required Uses and Disclosures
Under the law we must make disclosures when required by the Kansas Department of Health and Environment to investigate or determine our compliance with federal privacy law.
Uses and Disclosure Requiring Authorization
Any other uses or disclosures of your health information not addressed in this Notice or otherwise required by law will be made only with your written authorization. You may revoke such authorization at any time.
Privacy Complaints
You have the right to file a complaint if you believe your privacy rights have been violated. This complaint may be addressed to the Privacy Contact listed in this Notice, or to the Kansas Department of Health and Environment. There will be no retaliation for registering a complaint.
Privacy Contact
Address any question about this Notice, or how to exercise your privacy rights, with the Privacy Officer at 316-425-2416. Your health information will be used for health care operations.
For example: The information in your health record may be used to evaluate and improve the quality of the care and services we provide. Students, volunteers, trainees may have access to your health information for training and treatment purposes as they participate in continuing education, training, internships, and residency programs.
Business Associates: There are some services that we provide through contracts with third party business associates. Examples include external laboratories, transcription agencies and copying services. To protect your health information, PHR require these business associates to appropriately protect your information.
Directory: Unless you give notice of an objection, you name, location in the facility, general condition and religious affiliation will be used for patient directories, in those entities where such directories are maintained. This information may be provided to members of the clergy. This information, except for religious affiliation, may also be provided to other people who ask for you by name.
Continuity of Care: In order to provide for the continuity of your care once you are discharged from one of our facilities, your information may be shared with other healthcare providers such as home health agencies. Information about you may be disclosed to community services agencies in order to obtain their service on your behalf.
Disclosures Requiring Verbal Agreement
Unless you give notice of an objection, and in accordance with your authorization to Verbally Release Health Information, medical information may be released to a family member or other person who is involved in your medical care or who helps pay for your care. Information about you may also be disclosed to notify your family member, legally authorized representative or other person responsible for your care about your location and general condition. This may include disclosures of information about you to an organization assisting in a disaster relief effort, such as the American Red Cross, so that your family can be notified about your condition. You will be given an opportunity to agree or object to these disclosures except as due to your incapacity or in emergency circumstances.
Disclosures for public health activities.
We may disclose your health information to a government agency authorized (a) to collect data for the purpose of preventing or control disease, injury, or disability; or (b) to receive reports of child abuse or neglect. We also may disclose such information to a person who may have been exposed to a communicable disease if permitted by law.
Disclosures about victims of abuse, neglect, or domestic violence. Hospital may disclose your health information to a government authority if we reasonably believe you are a victim of abuse, neglect, or domestic violence.
Disclosures for judicial and administrative proceedings. Your protected health information may be disclosed in response to a court order or in response to a subpoena, discovery request, or other lawful process if certain legal requirements are satisfied.
Disclosures Required by Law or otherwise Allowed without Authorization or Notification.
The following disclosures of health information may be made according to state and federal law without your written authorization or verbal agreement:
- When disclosure is required by federal, state, and local law, judicial or administrative proceedings, or for law enforcement. Examples would be reporting gunshot wounds or child abuse, or responding to court orders;
- For public health purposes, such as reporting information about births, deaths, and various diseases, or disclosures to the FDA regarding adverse events related to food, medications, or devices;
- For health oversight activities, such as audits, inspections or licensure investigations;
- To organ procurement organizations for the purpose of tissue donation and transplant;
- For research purposes, when the research has been approved by an institutional review board;
- To coroners, medical examiners, and funeral directors for purpose of identification, the determination of the cause of death or to perform their duties as authorized by law;
- To avoid a serious threat to the health and safety of a person or the public;
- For specific governmental purposes, such as protection of the President;
- For workers’ compensation purposes;
- To military command authorities as required for members of the armed forces;
- To authorized federal officials for national security and intelligence activities as authorized by law;
- To correctional institutions or law enforcement officials concerning the health information of inmates, as authorize by
Other Allowable Uses and Disclosures Without Authorization
Other uses or disclosures of your health information that may be made include:
- Contacting you to provide appointment reminders for treatment or medical care, as well as to recommend treatment alternatives;
- Notifying you of health-related benefits and services that may be of interest to you;
- Use of your health information for the purposes of fundraising for RRH. You will have the opportunity to opt out of any future communications. Contact the Privacy Officer on this Notice for instructions on option.
Your Rights Regarding Electronic Health Information Exchange
As explained above, health care providers and health plans may use and disclose your health information without your written authorization for purposes of treatment, payment, and health care operations. Until now, providers and health plans have exchanged this information directly by hand-delivery, mail, facsimile, or e-mail. This process is time consuming, expensive, not secure, and often unreliable.
Electronic health information exchange, or HIE, changes this process. New technology allows a provider or a health plan to submit a single request through a health information organization, or HIO, to obtain electronic records for a specific patient from other HIE participants.
An organization known as the Kansas Health Information Exchange, or KHIE, regulates HIOs operating in Kansas. Only properly authorized individuals may access information through an HIO operating in Kansas, and only for purposes of treatment, payment, or health care operations.
Under Kansas law, you have the right to decide whether providers and health plans can access your health information through an HIO. You have two choices. First, you can permit authorized individuals to access your electronic health information through an HIO for treatment, payment, or health care operations only. If you choose this option, you do not have to do anything.
Second, you can restrict access to all of your electronic health information through any HIO operating in Kansas with the exception of access by properly authorized individuals as needed to report specific information as required by law (for example, reporting of certain communicable diseases or suspected incidents of abuse).
If you wish to restrict access, you must complete and submit the required form to KHIE. You must provide specific information needed to put your requested restrictions in place. The form is available at http://www.khie.org. You cannot request restrictions on access to certain information and permit access to all other information; your choice is to permit access to all of your information or restrict access to all of your information.
For your protection, each request is subject to verification procedures which may take several days to complete. Your failure to provide all information on the required form may result in additional delay.
Once your request has been processed, your electronic health information no longer will be available through HIOs operating in Kansas except for mandatory reporting requirements. You may change your mind at any time and permit access by submitting another request to KHIE.
Please understand your decision to restrict access to your electronic health information through an HIO will limit your health care providers’ ability to provide the most effective care for you. By submitting a request for restrictions, you accept the risks associated with that decision.
If you have questions regarding electronic health information exchange or HIOs, please visit http://www.khie.org for additional information.
Your decision to restrict access to your electronic health information through an HIO does not impact other disclosures of your health information. Providers and health plans may continue to share your information directly through other means (such as by facsimile or secure e-mail) without your specific written authorization.