ARCADIA COMMUNITY SERVICES NOTICE OF PRIVACY PRACTICES
Effective Date Of This Notice: February 1, 2015
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION
If you have any questions about this notice, please contact the Arcadia Community Services (ACS) Privacy Officer, who may be reached at 1434 Punahou Street, Honolulu, Hawaii 96822, or by phone, at (808) 941-0941.
OUR PLEDGE REGARDING YOUR HEALTH INFORMATION
We understand that health information about you and your healthcare is personal. We are committed to protecting health information about you. We will create a record of the care and services you receive from us. Your protected health information (PHI) is health information that contains identifiers, such as your name, Social Security Number, address, Medical Record Number, or other information that reveals who you are. For example, your medical record is PHI because it includes your name and other identifiers. This Notice applies to all of the PHI we generate or receive about you, whether we documented the PHI, or another provider forwarded it to us. This Notice explains the ways in which we may use or disclose PHI about you. This Notice also describes your rights to the PHI we keep about you, and describes certain obligations we have regarding the use and disclosure of your PHI.
We are required by law to maintain the privacy of your PHI. The privacy and security provisions of the Health Insurance Portability and Accountability Act (“HIPAA”) require us to keep private PHI that identifies you in accordance with applicable law; to notify you of our legal duties and privacy practices with respect to PHI about you; to notify you in the event there is a breach of your unsecured PHI; and to follow our Notice of Privacy Practices currently in effect.
HOW WE MAY USE AND DISCLOSE PHI ABOUT YOU
The following categories describe different ways that we may use or disclose PHI about you. Unless otherwise noted, each of these uses and disclosures may be made without your permission. For each category of use or disclosure, we will explain what we mean and give some examples. Not every use or disclosure in a category will be listed. However, unless we ask for a separate authorization, all of the ways we are permitted to use and disclose information will fall within one of the categories.
For Treatment. We may use PHI about you to provide healthcare treatment and services to you. We may disclose PHI about you to doctors, nurses, technicians, health students, volunteers or other personnel who are involved in taking care of you. For example, a doctor treating you at another facility may need to know if you have diabetes or other conditions. We may provide that information to a doctor treating you at another facility.
For Payment: We may use and disclose PHI about you so that the services you receive from us may be billed to an insurance company, a state Medicaid agency or another third party and payment may be collected from you. For example, we may need to give your health insurer or Medicare or QUEST information about your office visit so we can be paid for our care or receive prior approval for your care, to assist in payment for your treatment.
For Healthcare Operations: We may use and disclose PHI about you for our healthcare operations, as appropriate to operate our facility and services and to make sure that our residents, clients, participants and members receive quality care. For example, we may use PHI to review our treatment and services, for quality and utilization purposes, to obtain legal advice and/or evaluate the performance of our staff in caring for you.
Facility Directory: Unless you object, we will include certain limited information about you in our facility directory while you are a resident at our facility or while you are participating in programs at or receiving services from one of our facilities. This information may include your name, location in the facility, your general condition (fair, stable, etc.), and your religious affiliation. With the exception of your religious affiliation, the directory information may be released to people who ask for you by name. Your religious affiliation may be given to a member of the clergy, such as a priest, or rabbi, even if they don’t ask for you by name. If you do not want this information listed in the directory, you must notify the Administrator or Resident Services Manager of the ACS facility at which you reside or the Program Administrator/Director or Manager of the ACS program where you receive services or of which you are a member.
Individuals Involved in Your Care or Payment for Your Care and Notification: Unless you object, we may disclose to a member of your family, a relative, a close friend, or any other person you identify, information that directly relates to that person’s involvement in your healthcare. We also may give information to someone who helps pay for your care. We may share PHI with these people to notify them about your location and general condition. If you are not present, we will use our professional judgment to determine whether the disclosure is in your best interests and whether the person may act on your behalf to pick up filled prescriptions, medical supplies, x-rays, or other similar items. Finally, we may disclose PHI about you to disaster relief agencies, such as the Red Cross, so that your family can be notified about your condition, status, and location.
Research. We may want to use and disclose PHI about you for research purposes, for example, comparing the effectiveness of one medication over another. If any research project uses your PHI, we will either obtain an authorization directly from you or ask an Institutional
Review or Privacy Board to waive the authorization requirement, based on assurances that the researchers will adequately protect your PHI.
As Required By Law. We will disclose PHI about you when required to do so by Federal, State, or local law, such as in compliance with a Court order requiring us to do so.
To Avert a Serious Threat to Health or Safety. We may use and disclose PHI about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. For example, if you threaten violence to a family member, we may report this to the police to protect the family member, in accordance with law.
Specialized Government Functions. If you are a member of the armed forces or are separated or discharged from military services, we may release PHI about you as required by military command authorities or Veterans Affairs. We may release information for national security, intelligence activities, foreign military authority requirements, and protective services for the President and others to the extent authorized by law.
Health Oversight Activities. We may disclose PHI to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the healthcare system, government programs, and compliance with civil rights laws.
Public Health Activities. We may disclose PHI about you for public health activities. For example, these activities include prevention or control of disease; reporting births, deaths, child or vulnerable adult abuse or neglect, domestic violence or other violent injuries, reactions to medications or product injuries or recalls; and for organ donation.
Judicial and Administrative Proceedings. If you are involved in a lawsuit or a dispute, we may disclose PHI about you in response to an order issued by a Court or administrative tribunal; or pursuant to a legally authorized request, such as a Subpoena, discovery request, or other lawful process, so long as the person requesting the information has complied with HIPAA requirements to notify you and provide you a reasonable time for objections, or made reasonable efforts to obtain an order protecting the information requested.
Law Enforcement Purposes. We may release PHI if asked to do so by a law enforcement official. For example, this may occur in response to a Court order, Subpoena, Warrant,
Summons or similar process. Such releases of information will be made only after efforts have been made to tell you about the request and you have time to obtain an order protecting the information requested, unless otherwise provided by law.
Coroners, Health Examiners and Funeral Directors. We may release PHI to a coroner or health examiner, for example, if necessary to identify a deceased person or determine the cause of death, or to funeral directors as necessary to carry out their duties.
Correctional Institutions. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release PHI about you to the correctional institution or law enforcement official, such as for the institution to provide you with healthcare, or protect your health and safety or the health and safety of others.
Marketing. Most uses and disclosures of PHI for ACS’s marketing purposes require your written authorization.
Psychotherapy Notes. Most uses and disclosures of psychotherapy notes require your written authorization.
Sale of Your PHI. ACS will not sell the PHI we maintain about you without your written authorization.
Fundraising. We may use certain information (name, address, telephone number, dates of service, age, and gender) to contact you in the future for ACS fundraising. If we do this, we will provide you with a way to opt out of such communications.
YOUR RIGHTS REGARDING YOUR PHI
You have the following rights regarding PHI we maintain about you:
Right to Inspect and Copy: You have certain rights to inspect and copy your PHI that may be used to make decisions about your care (such as health and billing records), to the extent provided by law. This does not include psychotherapy notes or other records covered by a separate legal privilege or other legal protection.
To inspect and copy PHI, your request must be in writing on a form provided by or agreeable to us, and submitted to ACS’s Privacy Officer. We may charge a reasonable fee for the costs of locating, copying, mailing or other supplies and services associated with your request, in accordance with applicable law. For any electronic health records we maintain about you, you may request that we provide the information in paper format or electronic format. We may charge a reasonable fee for the cost of providing electronic information you request, not greater than our labor costs in responding to the request.
We may deny your request to inspect and copy your PHI in certain very limited circumstances. If you are denied access to PHI, you may, in certain instances, request that the denial be reviewed. If we grant a review, we will choose a licensed healthcare professional to review your request and our denial. This reviewer will not be the person who denied your initial request. We will comply with the review outcome, in accordance with applicable law.
Right to Amend. If you believe PHI we keep about you is incorrect or incomplete, you may ask us to amend the information. To request an amendment, your request must be made in writing on a form provided by us and submitted to our Privacy Officer. We may deny your request for an amendment if the information was not created by us, or if the person who created the information is no longer available to make the amendment, or if it is not part of the PHI kept by or for ACS; or if it is not part of the information which you would be permitted to inspect and copy; or if our information is accurate and complete in our professional judgment. Any amendment we make to your PHI will be disclosed to those to who need to know of the amendment, to the extent required by law.
Right to an Accounting of Disclosures. You have the right to request an accounting (a list) of any disclosures of your PHI we have made, except for uses and disclosures for treatment, payment, and health care operations. For any electronic health records we maintain about you, you may also request an accounting of uses and disclosures for treatment, payment and health care operations subject to certain exceptions, restrictions and limitations.
To request this list of disclosures, your request must be in writing on a form that we will provide to you, and must be submitted to our Privacy Officer. Your request must state a time period that may not be longer than six years before the date of your request, and in the event you seek electronic information, this period may be shorter in accordance with applicable law. The first accounting of disclosures you request within a 12-month period will be free; we may charge you for the costs of providing additional accountings. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred. We will mail you an accounting of disclosures in paper form within 30 days of your request, or notify you if we are unable to supply the accounting within that time period and by what date we can supply the accounting, not to exceed a total of 60 days from your request.
Right to Request Restrictions. You have the right to request a restriction or limitation on the PHI we use or disclose about you for treatment, payment, or health care operations, or to request a limit on the PHI we disclose about you to someone who is involved in your care or the payment for your care. While we may accommodate reasonable requests for restrictions, we are not required to do so, for example, if it is not feasible for us to ensure our compliance with the law or we believe it will negatively impact the care we may provide you. If we do agree, we will comply with your request unless the information is needed to provide emergency treatment to you.
To request a restriction, you must make your request in writing on a form that we will provide, or that is agreeable to us, and submit the form to our Privacy Officer. In your request, you must tell us what information you want to limit and to whom you want the limits to apply. You also have the right to request a restriction or limitation on the PHI we use or disclose to your health plan about the care or services you receive from us, so long as you (or anyone other than your health plan) has paid in full for that care or those services at the time services are rendered. We are required to, and will, comply with such a request.
Right to Request Confidential Communications. You have the right to request that we communicate with you about health matters in a certain manner or at a certain location. For example, you can ask that we only contact you at work or by mail to a post office box. During our intake process, we will ask you how you wish to receive communications about your health care or for any other instructions on notifying you about your PHI. We will accommodate all reasonable requests as required by the HIPAA privacy rule.
Right to a Paper Copy of This Notice. You have the right to obtain a paper copy of this Notice at any time upon request, even if you have previously agreed to receive an electronic copy of the Notice. You may also obtain a copy of this Notice at our website at www.arcadia-hi.org.
CHANGES TO THIS NOTICE
We reserve the right to change this Notice and to make the changed Notice effective for PHI we already have about you as well as any information we receive in the future. If we make an important change to our privacy practices, we will promptly change this Notice and the new Notice will be posted at each ACS business office and on our website. A paper or electronic copy of the revised Notice will be distributed to new residents, participants, clients and members at our operations and will be available to you upon request.
If you have a complaint about your privacy rights or our privacy and security practices or breach notification procedures, you may file a complaint with us (contact our Privacy Officer at the address above) or with the Secretary of the Department of Health and Human Services (contact the Office of Civil Rights at the Hubert H. Humphrey Building, 200 Independence Avenue S.W., Washington D.C. 20201. You will not be penalized for filing a complaint.
OTHER USES OF PHI
Other uses and disclosures of your PHI that are not covered by this Notice or the laws that apply to us will be made only with your written permission. If you provide us authorization to use or disclose PHI about you, you may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose PHI about you for the reasons covered by your written authorization. However, you should understand that we are unable to take back any disclosures we have already made, and that we are required to retain the records of the care that we provided to you.