NOTICE OF PRIVACY PRACTICES
EFFECTIVE DATE IS APRIL 14, 2003
“THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.”
This Notice of Privacy Practices (“Notice”) describes how the Norfolk County Health Plan (“County”) may use and disclose your protected health information (“PHI”) to carry out treatment, payment or health care operations and for other purposes that are permitted or required by law. It also describes your rights to access and control your PHI. PHI is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related health care services.
The County is required by federal law to maintain the privacy of your PHI. To that end, we are required to provide you with this Notice, notice of our other legal duties and our privacy practices with respect to your PHI. Please be aware that some of the uses and disclosures described in this Notice may be limited in certain cases by applicable state laws that are more stringent than the federal standards. For more information about our privacy practices, contact the HIPAA Privacy Officer listed at the end of this document.
USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION
Generally, the County may not use or disclose your PHI except as authorized by you or permitted or required by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule, 45 CFR Parts 160 and 164, subparts A and E, and other applicable federal and state laws.
Required Uses or Disclosures
The County is required to use or disclose your PHI upon request by you or your designated representative, when required by law and when required by the Secretary, Department of Health and Human Services (“HHS”) to investigate or determine compliance with the privacy rule.
Permitted Uses or Disclosures Upon Providing You the Opportunity to Agree to, Prohibit or Restrict Use or Disclosure
The County is permitted to use or disclose your PHI provided we notify you in advance and you are given an opportunity to agree to or prohibit or restrict such use or disclosure or if we believe in our professional judgment that it is in your best interest to provide such use or disclosure under the following circumstances:
Facility Directories: To maintain a directory containing the following information: name, location in facility, general description of your condition and your religious affiliation. The information listed in such directory, except your religious affiliation, may be disclosed to persons who ask for you by name. However, your religious affiliation may be disclosed to clergy.
Involvement in Your Individual Care and Notification: To provide your PHI relevant to your individual care or payment related to your health care to family members, personal representatives or any other individual designated by you. The County is permitted to use or disclose your PHI to notify your designated representatives of your location, general condition or your death and for disaster relief purposes to a public or private entity authorized to assist in disaster relief efforts.
Permitted Uses or Disclosures
The County may use or disclose your PHI without your authorization under a variety of circumstances. Subject to certain requirements, we may use or disclose you PHI without your authorization in situations such as the use of de-identified PHI, for disclosure to business associates, for uses or disclosures incidental to other permitted uses or disclosures, for auditing purposes, subject to agreed upon restrictions and for emergencies. Further, we shall provide information when otherwise required by law. In any other situation, we will ask for your written authorization before using or disclosing your PHI.
The following are circumstances under which the County is permitted or may be required in accordance with HIPAA’s Privacy Rule or other federal or state laws to use or disclose your PHI:
Treatment, Payment and Health Care Operation: We may use or disclose your PHI for treatment, payment and health care operations. For example, we have the right to use or disclose your PHI to obtain payment for treatment, to process claims, for administrative purposes, and to evaluate the quality of care that you receive.
Required By Law: We may use or disclose your PHI to the extent the law requires such use or disclosure. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. You will be notified, as required by law, of any such uses or disclosures.
Public Health: We may disclose your PHI for public health activities and purposes to a public health authority that is permitted by law to collect or receive the information for the purpose of preventing or controlling disease, injury or disability.
Communicable Diseases: We may disclose your PHI, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.
Health Oversight: We may disclose your PHI to a government oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, other government regulatory programs and civil rights laws.
Abuse or Neglect: We may disclose your PHI to a public authority that is authorized by law to receive reports of child abuse or neglect. In addition, we may disclose your PHI if we believe that you have been a victim of abuse, neglect or domestic violence to the governmental entity or agency authorized to receive such information. In this case, the disclosure will be made consistent with the requirements of applicable federal and state laws.
Food and Drug Administration: We may disclose your PHI to a person or company as directed or required by the Food and Drug Administration to report adverse events, product defects or problems or biological product deviations, to track FDA-regulated products, to enable product recalls, repairs or replacement, or lookback and to conduct post-marketing surveillance.
Legal Proceedings: We may disclose your PHI in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), under certain conditions in response to a subpoena, discovery request or other lawful process.
Law Enforcement: We may disclose your PHI for law enforcement purposes, so long as applicable legal requirements are met. These law enforcement purposes include: legal processes and otherwise required by law, limited information requests for identification and location purposes pertaining to victims of a crime, suspicion that death has occurred as a result of criminal conduct, in the event that a crime occurs on the premises of the practice and medical emergency when it is likely that a crime has occurred. Coroners, Funeral Directors, and Organ Donation: We may disclose PHI to a coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose PHI to a funeral director, as authorized by law, in order to permit the funeral director to carry out their duties. Further, your PHI may be disclosed in reasonable anticipation of death and for cadaveric organ, eye or tissue donation purposes.
Research: We may disclose your PHI to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your PHI.
Criminal Activity: Consistent with applicable federal and state laws, we may disclose your PHI if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose your PHI if it is necessary for law enforcement authorities to identify or apprehend an individual.
Military Activity and National Security: When the appropriate conditions apply, we may use or disclose PHI of individuals who are Armed Forces personnel for activities deemed necessary by appropriate military command authorities, for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits or to foreign military authority if you are a member of that foreign military services. We may also disclose your PHI to authorized federal officials for conducting national security and intelligence activities, including for the provision of protective services to the President or others legally authorized.
Workers’ Compensation: Your PHI may be disclosed by us as authorized to comply with workers’ compensation laws and other similar legally-established programs.
Inmates: We may use or disclose your PHI if you are an inmate of a correctional facility and your physician created or received your PHI in the course of providing care to you.
Other uses or disclosures of your PHI will be made only with your written authorization, unless otherwise permitted or required by law. You may revoke an authorization at any time in writing, except to the extent that we have already taken action on the information disclosed or if we are permitted by law to use the information to contest a claim or coverage under our Health Plan.
YOUR RIGHTS REGARDING YOUR MEDICAL INFORMATION
The following is a statement of your rights with respect to your PHI and a brief description of how you may exercise these rights. For questions or further information regarding your rights please contact our HIPAA Privacy Officer.
You Have the Right to Access Your Protected Health Information
You may inspect and obtain a copy of your PHI for as long as we maintain said record. Under federal law, however, you may not inspect or copy the following records: psychotherapy notes, information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding and PHI that is subject to a law that prohibits access to PHI. Your request to inspect and/or obtain a copy of your PHI must be made in writing. Your request shall be allowed, subject to certain circumstances in which your request shall be denied with or without the right to request a review of the denial. We may charge a fee for the costs of producing, copying and mailing your requested information, but we will tell you the cost in advance.
You Have the Right to Request a Restriction of Your Protected Health Information
You may request that we not use or disclose any part of your PHI for the purposes of treatment, payment or healthcare operations. You may also request that any part of your PHI not be disclosed to family members or friends who may be involved in your care or for notification purposes as described above in this Notice. Your request must state the specific restriction requested and to whom you want the restriction to apply. We are not required to agree to a restriction that you may request, but if we do agree to the requested restriction, we may not use or disclose your PHI in violation of that restriction unless it is necessary to provide emergency treatment.
You Have the Right to Request to Receive Confidential Communications from Us by Alternative Means or at an Alternative Location
You are permitted to request to receive confidential communications of your PHI by alternative means or at alternative locations. We shall accommodate reasonable requests to the extent you clearly state that disclosure of all or part of the information could endanger your person. We may also condition this accommodation by asking you for information as to how payment will be handled or specification of an alternative address or other method of contact. We will not request an explanation from you as to the basis for the request. Please make this request in writing to our Privacy Officer.
You Have the Right to Amend Your Protected Health Information.
You have the right to request an amendment of your PHI or a record about you in a designated record set for as long as the PHI is maintained in the record set. In certain cases, we may deny your request for an amendment. If we accept your amendment we must make the appropriate amendment to your PHI or record that is the subject of the request for amendment and inform you, your designated representatives and our business associates of the amendment in a timely fashion. If we deny your request for amendment, you have the right to file a statement of disagreement with us and we may prepare a rebuttal to your statement and will provide you with a copy of any such rebuttal. We will keep records of all requests for amendment and any documents relating to such requests.
You Have the Right to Receive an Accounting of Certain Disclosures
You have the right to receive an accounting of certain disclosures made by us, if any, of your PHI. This right excludes disclosures for purposes of treatment, payment or healthcare operations as described above in this Notice. It also excludes, without limitation, disclosures we may have made to your family members or friends involved in your care, for a facility directory or for notification purposes. You have the right to receive specific information regarding these disclosures that occurred after April 14, 2003. The timeframe you request may not be longer than six years. The right to receive this information is subject to certain exceptions, restrictions and limitations.
You Have a Right to Receive a Paper Copy of This Notice
You have the right to obtain a paper copy of this Notice from us, upon request, even if you have agreed to accept this notice electronically.
You may exercise any of the rights described above by contacting our Privacy Officer listed below. If you believe that your privacy rights have been violated, you may file a complaint with us and/or with HHS. All complaints to us must be made in writing and sent to the Privacy Officer. We will not retaliate against you or penalize you for filing a complaint, nor will we tolerate any of our employees retaliating or penalizing you for filing a complaint.
CHANGES TO THIS NOTICE
We must follow the terms of this Notice while it is in effect, however, we reserve the right to change our policies at any time. Prior to making a significant change in our policies, we will change our Notice and post the new Notice in a clear and prominent location where it is reasonable to expect you will be able to read the Notice. Also, our current Notice will be posted in a clear and prominent location where it is reasonable to expect you will be able to read the Notice. Any time we make a material change to this Notice, we will send you the revised Notice within sixty (60) days of the revision. You will also receive a copy of our Notice at least once every three years. Further, you may also request a copy of our Notice at any time.
HOW TO CONTACT THE PRIVACY OFFICER
If you have any complaints, questions or concerns about this Notice or want to submit a written request as required in any of the previous sections of this Notice, please contact:
HIPAA Privacy Officer
Norfolk County Commissioners
614 High Street PO Box 310
Dedham, MA 02026
Tel: (781) 461-6105
Fax: (781) 326-6480