Notice of Privacy Practices

Highlands Health System
Highlands Regional Medical Center

THIS NOTICE DESCRIBES HOW INFORMATION ABOUT YOU MAY BE USED OR DISCLOSED AND HOW YOU MAY GET ACCESS TO THIS INFORMATION. PLEASE READ IT CAREFULLY.

Highlands Health System and Highlands Regional Medical Center (HHS/HRMC), their professionals, employees, and volunteers, are responsible for protecting the privacy of patient information. This Notice states the privacy practices followed by HHS/HRMC. It explains how we may use and disclose protected health information about you and informs you of your rights and our duties to maintain your privacy.

HHS/HRMC strives to keep private protected health information about you. Protected health information (PHI) includes any health information about you that identifies you or that reasonably could be used to identify you. This Notice often uses the phrase “medical information” to describe the protected health information that is covered by this Notice.

This Notice was developed to comply with the Health Insurance Portability and Accountability Act of 1996, (HIPAA), as the law has been modified from time to time. Read this Notice carefully and if you have any questions please contact the Privacy Officer, whose contact information is located at the end of this Notice.

HOW WE MAY USE OR DISCLOSE YOUR MEDICAL INFORMATION
We use and disclose medical information about you for many different purposes. Most uses or discloses of medical information about you will require your written permission. However, we may use or disclose medical information about you without your permission for the following purposes:

For Treatment

We may use medical information about you to provide, coordinate or manage your health care and related services. We may disclose medical information about you to doctors, nurses, hospitals and other health care professionals or facilities who become involved in your care. We may consult with other health care providers concerning you and as part of the consultation share your medical information with them. Similarly, we may refer you to another health care provider and as part of the referral share medical information about you with that provider. For example, we may conclude you need to receive services from a physician with a particular specialty. When we refer you to that physician, we also will contact that physician’s office and provide medical information about you to them so they have information they need to provide services for you.

For Payment

We may use and disclose medical information about you so we can be paid for the services we provide to you. This can include billing you, your insurance company, or a third party. For example, we may need to give your insurance company information about the health care services we provide to you so your insurance company will pay us for those services or reimburse you for amounts you have paid. We may need to provide your insurance company or a government program, such as Medicare or Medicaid, with information about your medical condition and the health care you need to receive to determine if those health care services are covered by insurance or a government program. Also, we may disclose your medical information to your other health care providers to assist those providers in obtaining payment from your insurance company or a third party.

For Health Care Operations

We may use and disclose medical information about you for routine health care operations necessary for us to operate HHS/HRMC and to maintain quality health care for our patients. Health care operations at HHS/HRMC include, but are not limited to, training and education programs; reviewing the quality of care provided by professionals and employees; obtaining health insurance; conducting legal or auditing services; conducting business planning and development activities; conducting risk management activities and investigations; and managing our organization.

For Appointments, Treatment Alternatives, and Health-Related Benefits and Services

We may use and disclose medical information about you to contact you with appointment reminders, treatment alternatives, and health-related benefits and services that may be of interest to you.

For Research

Under certain circumstances, we may use or disclose medical information about you for research. Before we disclose medical information for research, the research will have been approved through an approval process that evaluates the needs of the research project with your needs for privacy of your medical information. We may, however, disclose medical information about you to a person who is preparing to conduct research to permit them to prepare for the project, but no medical information will leave HHS/HRMC during that person’s review of the information.

For Our Hospital Directory

We may include certain limited information about you in the Highlands Regional Medical Center patient list while you are a patient at the hospital. This information may include your name, location in the hospital and your religious affiliation. The information, except for your religious affiliation, may also be released to people who ask for you by name. Your religious affiliation may be given to a member of the clergy even if they don’t ask for you by name. This is so your family, friends and clergy can visit you in the hospital. If you don’t wish to be included on our patient list, please notify the unit manager or his/her designee.

To Individuals Involved in Your Care

We may disclose to a family member, other relative, a close personal friend, or any other person identified by you, medical information about you that is directly relevant to that person’s involvement with your care or for payment related to your care. We also may use or disclose medical information about you to notify, or assist in notifying, those persons of your location, general condition, or death.
You may object to us disclosing medical information about you in this circumstance. However, if you are unable to agree or object to such a disclosure we may use or disclose medical information about you in a manner that is in your best interest based upon our professional judgment.

For Disaster Relief

We may use or disclose medical information about you to a public or private entity authorized by law or by its charter to assist in disaster relief efforts. If we are able to do so, you will be given an opportunity to agree or object to such a disclosure. The use or disclosure of medical information about you will be done to coordinate with those entities in notifying a family member, other relative, close personal friend, or other person identified by you of your location, general condition or death.

You may object to us disclosing medical information about you in this circumstance. However, if you are unable to agree or object to such a disclosure we may use or disclose medical information about you in a manner that is in your best interest based upon our professional judgment.

Required by Law

We may use or disclose medical information about you when we are required to do so by law.

Public Health Activities

We may disclose medical information about you for public health activities and purposes as required by law. This includes reporting medical information to a public health authority for purposes of preventing or controlling disease or, to a public health agency authorized to receive reports of child abuse and neglect. It also includes reporting activities related to the quality, safety or effectiveness of a United States Food and Drug Administration regulated product or activity.

Victims of Abuse, Neglect or Domestic Violence

We may disclose medical information about you to a government authority authorized by law to receive reports of abuse, neglect, or domestic violence, if we believe you are a victim of abuse, neglect, or domestic violence. This will occur to the extent the disclosure is (a) required by law; (b) agreed to by you; or (c) authorized by law and we believe the disclosure is necessary to prevent serious harm to you or to other potential victims. If you are incapacitated, certain other conditions are met, and law enforcement or other public official represents that immediate enforcement activity depends on the disclosure, we may disclose medical information about you.

Health Oversight Activities

We may disclose medical information about you to a health oversight agency for activities authorized by law, including audits, investigations, inspections, licensure or disciplinary actions.

Judicial and Administrative Proceedings

We may disclose medical information about you in the course of any judicial or administrative proceeding in response to an order of the court or administrative tribunal. We also may disclose medical information about you in response to a subpoena, discovery request, or other legal process but only if efforts have been made to tell you about the request or to obtain an order protecting the information to be disclosed.

Disclosures for Law Enforcement Purposes

We may disclose medical information about you to law enforcement officials for law enforcement purposes:
a) As required by law;
b) In response to a court, grand jury or administrative order, warrant or subpoena;
c) To identify or locate a suspect, fugitive, material witness or missing person;
d) About an actual or suspected victim of a crime and that person agrees to the disclosure. If we are unable to obtain that person’s agreement, in limited circumstances, the information may still be disclosed;
e) To alert law enforcement officials to a death if we suspect the death may have resulted from criminal conduct;
f) About a crime in the event one occurs at our facility; or
g) To report a crime in emergency circumstances

Coroners, Medical Examiners and Funeral Directors

We may disclose medical information about you to a coroner or medical examiner for purposes such as identifying a deceased person and determining cause of death. We may disclose medical information about you to funeral directors as necessary for them to carry out their duties.

Organ, Eye or Tissue Donation

To facilitate organ, eye or tissue donation and transplantation, we may disclose medical information about you to organ procurement organizations or other entities engaged in the procurement, banking or transplantation of organs, eyes or tissue.

To Avert Serious Threat to Health or Safety

We may use or disclose protected health information about you if we believe the use or disclosure is necessary to prevent or lessen a serious or imminent threat to the health or safety of a person or the public. We also may release information about you if we believe the disclosure is necessary for law enforcement authorities to identify or apprehend an individual who admitted participation in a violent crime or who is an escapee from a correctional institution or from lawful custody.

Military and Veterans

If you are, or were, a member of the United States Armed Forces, we may use and disclose medical information about you for activities deemed necessary by the appropriate military command authorities to assure the proper execution of the military mission. We may also release information about foreign military personnel to the appropriate foreign military authority for the same purposes.

For Security and Intelligence Functions

We may disclose medical information about you to authorized federal officials for the conduct of intelligence, counter-intelligence, and other national security activities authorized by law or to provide protection to the President of the United States or other governmental officials.

Inmates and Persons in Governmental Custody

We may disclose medical information about you to a correctional institution or law enforcement official having custody of you. The disclosure will be made if the disclosure is necessary (a) to provide health care to you; (b) for the health and safety of others; or (c) for the safety, security and good order of the correctional institution.

Workers Compensation

We may disclose medical information about you to the extent necessary to comply with workers’ compensation and similar laws that provide benefits for work-related injuries or illness without regard to fault.

Mental Health or Chemical Dependency Records

If we receive health information about you from a health care provider, we will not re-disclose or otherwise reveal any mental health or chemical dependency records contained in that information beyond the purpose of the disclosure to us, without first obtaining your written authorization or as required by law.

Breach Notification Purposes

We may use or disclose medical information about you to provide legally required notices concerning a breach of your unsecured medical information.

Fundraising

We may disclose medical information about you to HHS/HRMC affiliated entities that raise money for us to benefit the mission of HHS/HRMC. If we do so, we will only use or disclose your demographic information, such as your name and address, and the dates you received treatment or services from us.
You have the right to opt-out of such communications by notifying the Privacy Officer in writing using the contact information at the end of the Notice.

How We Will Contact You

Unless you tell us otherwise in writing, we may contact you by telephone, email or by mail at your home or workplace. At any authorized location we may leave messages for you on the answering machine or voice mail. If you want to request a restriction in the method or location in which we communicate to you please see the Section of this Notice titled “Right to Receive Confidential Communications.”

YOUR RIGHTS CONCERNING MEDICAL INFORMATION ABOUT YOU

You have certain rights with respect to medical information that we maintain about you, including the following:

Right to a Paper Copy of this Notice

You have the right to obtain a paper copy of our Notice of Privacy Practices. You may also obtain a copy of our Notice of Privacy Practices online at www.hrmc.org/privacy or you may request a copy of our Notice of Privacy Practices by contacting the Privacy Officer using the contact information at the end of this Notice.

Right to Inspect and Copy Medical Information about You

With a few limited exceptions, such as psychotherapy notes, you have the right to inspect and obtain a copy of medical information about you. This right includes electronic records we may maintain. We will act on your request within thirty (30) calendar days after we receive your request.

Copies. To request a copy of medical information about you we require you to make your request in writing. Your written request should state specifically what medical information you want to copy. Send your written request to the Director of the Medical Records Department, whose contact information is located at the end of this Notice. We may charge a fee for any copying costs and, if applicable, any mailing costs.

Inspection. To inspect medical information about you, you must submit your request in writing. Your request should state specifically what medical information you want to inspect. Send your written request to the Director of the Medical Records Department, whose contact information is located at the end of this Notice. We do not charge a fee for inspecting your medical information, but there may be a fee if you want copies of any records.
We may deny your request to inspect and copy medical information under certain circumstances. If we deny your request, we will inform you of the basis for the denial. We will explain how you may have our denial reviewed and how you may complain. If you request a review of our denial, it will be conducted by a person designated by us who was not directly involved in the denial.

Right to Receive Confidential Communications

You have the right to request that we communicate medical information about you to you in a certain way or at a certain location. For example, you may ask that we only contact you by mail or at work. We will not require you to tell us why you are asking for the confidential communication. If you want to request confidential communication, you must do so in writing to the Privacy Officer using the contact information at the end of this Notice.

Your written request must state how or where you can be contacted. We will accommodate your request if it is reasonable. However, we may, when appropriate, require information from you concerning how payment will be handled. We may also require an alternate address or other method to contact you. If we are unable to accommodate your request, we will inform you of the basis for the denial.

Right to Request Restrictions

You have the right to request certain restrictions in the way we use or disclosure of medical information about you. For example, you may request that we not share medical information about you to a family member, other relative, a close personal friend or any other person identified by you. We will attempt to accommodate any reasonable request, but we are not required to agree to all restrictions.

To request a restriction we require you to make your request in writing to the Privacy Officer, whose contact information is located at the end of this Notice. Your written request must explain: (a) what medical information you want to limit; and (b) to whom you want the limits to apply (for example, you do not want us to disclose medical information to your spouse).

Out-of-Pocket Payments. If you paid us “out-of-pocket” for a health care item or service you have the right to ask us to restrict the use and disclosure of medical information to a health plan for payment or health care operation purposes. We will agree to such restriction only if your request pertains solely to the health care item or service for which you have paid us “out-of-pocket” in full. If we agree to your request for restriction we will follow that restriction, except in circumstances when emergency treatment is provided. A requested restriction may be terminated at any time by either you or us upon written notice.

Right to Amend

You have the right to ask us to amend medical information about you to correct incomplete or incorrect information. You have this right for so long as the medical information is maintained by us. To amend your medical information we require you to make your request in writing. Your written request must state the amendment desired and explain the reason for the amendment. We will act on your request within sixty (60) calendar days after we receive your written request. Send your written request to the Privacy Officer, whose contact information is located at the end of this Notice.

We may deny your request to amend medical information about you if you do not explain the reason for the amendment or if we determine that an amendment is not appropriate for any reason, including:
a) The amendment pertains to medical information that was not created by us, unless you prove that the person or entity that created the information is no longer available to act on the requested amendment;
b) The amendment pertains to medical information that is not maintained by us;
c) The amendment pertains to medical information that would not be available for you to inspect or copy; or
d) The amendment pertains to medical information that we determine is accurate and complete.
If we deny your amendment request, we will inform you of the basis for the denial. If you disagree with our denial, you have the right to state your objection in writing and your written disagreement will be included in, or linked to, the medical information you seek to amend. We may prepare a written rebuttal to your written disagreement and also include it in, or link to, the medical information you seek to amend. If the medical information you seek to amend is later disclosed, then your written disagreement and our rebuttal will be included with the disclosure. We may also include a summary of this information.

Right to an Accounting of Disclosures

You have the right to receive an accounting of disclosures of medical information about you. To request an accounting of disclosures we require you to make your request in writing to the Privacy Officer, whose contact information is located at the end of the Notice.
The accounting may extend no longer than six (6) years prior to the date of your request. Usually, we will act on your request within sixty (60) calendar days after we receive your request. Within that time, we will either provide the accounting of disclosures to you or give you a written statement of when we will provide the accounting and why the delay is necessary.
Certain instances are not included in such an accounting, including disclosures:
a) To carry out treatment, payment and health care operations;
b) Of your medical information made to you;
c) That are incident to another use or disclosure;
d) That you have authorized;
e) To persons involved in your care;
f) For disaster relief purposes, unless you have previously rejected or restricted the disclosure for this purpose;
g) For national security or intelligence purposes;
h) To correctional institutions or law enforcement officials having custody of you;
i) That are part of a limited data set for purposes of research, public health, or health care operations (a limited data set is where things that would directly identify you have been removed); and
j) Made prior to April 14, 2003

Under certain circumstances your right to an accounting of disclosures to a law enforcement official or a health oversight agency may be suspended. Should you request an accounting during the period of time your right is suspended, the accounting would not include disclosures to a law enforcement official or to a health oversight agency.

There is no charge for the first accounting we provide to you in any twelve (12) month period. For additional accountings, we may charge you for the cost of providing the list. If there will be a charge, we will notify you of the cost involved and give you an opportunity to withdraw or modify your request to avoid or reduce the fee.

Right to Notice in the Event of a Breach

You have the right to be notified in the event that unsecured medical information about you is breached.

OUR DUTIES

Generally

We are required by law to maintain the privacy of medical information about you and to provide individuals with notice of our legal duties and privacy practices with respect to medical information. We are required to abide by the terms of our Notice of Privacy Practices in effect.

Our Right to Change Notice of Privacy Practices

We reserve the right to change this Notice of Privacy Practices. We reserve the right to make the new notice’s provisions effective for all medical information that we maintain, including that created or received by us prior to the effective date of the new notice.

Breach Notification

We will promptly notify you if unsecured medical information about you is breached.

Availability of Notice of Privacy Practices

A copy of our current Notice of Privacy Practices will be posted in HHS/HRMC facilities. You may obtain a copy of our Notice of Privacy Practices at our web site: www.hrmc.org/privacy or you may obtain a paper copy of this Notice by contacting the Privacy Officer whose contact information is located at the end of this Notice.

Effective Date of Notice

The effective date of the notice is stated on the first page of the notice.

Complaints

To file a complaint with us, contact the Privacy Officer in writing at the contact information located at the end of this Notice.

You may also complain to the United States Secretary of Health and Human Services if you believe your privacy rights have been violated by us. To file a complaint with the United States Secretary of Health and Human Services, send your complaint to Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201 or call them at 1-877-696-6775, or visit www.hhs.gov/ocr/privacy/hipaa/complaints/. You will not be retaliated against for filing a complaint.

QUESTIONS AND INFORMATION

If you have any questions or want more information concerning this Notice of Privacy Practices, please contact the Privacy Officer at the following contact information:
Privacy Officer
Public Relations Office
5000 KY RT. 321
P.O. Box 668
Prestonsburg, Kentucky 41653
Telephone (606) 886-7586