Each time you visit a hospital, physician or other healthcare provider, a record of your visit is made. Typically, this record contains your symptoms, examination and test results, diagnoses, treatment and a plan for future care or treatment. This information, often referred to as your health or medical record, serves as a:
- basis for planning your care and treatment;
- means of communication among the many health professionals who contribute to your care;
- legal document describing the care you received;
- means by which you or a third-party payer can verify that services billed were actually provided;
- a tool in educating health professionals;
- a source of data for medical research;
- a source of information for public health officials charged with improving the health of the nation;
- a source of data for facility planning;
- a tool with which we can assess and continually work to improve the care we render and the outcomes we achieve.
Understanding what is in your record and how your health information is used helps you to:
- ensure its accuracy;
- better understand who, what, when, where and why others may access your health information;
- make more informed decisions when authorizing disclosure to others.
Although your health record is the physical property of the healthcare practitioner or facility that compiled it, the Protected Health Information in it belongs to you. You have the right to:
- inspect and receive a printed or electronic copy of your Protected Health Information. You must make this request in writing. We may charge a fee for the costs of copying, including labor and supplies associated with copying. If you request that we prepare an explanation or summary of your Protected Health Information, we may charge a fee for the costs associated with the preparation of the explanation/summary. We may also charge a fee for postage if you request that the copy or explanation/summary be mailed to you.
- request that we limit the use and/or disclosure of your Protected Health Information for treatment, payment and healthcare operations. Such requests must be made in writing to the contact person designated in this Notice. We are not required to agree to such requests. If we do agree, we will put the agreed-upon limitations in writing and abide by them, unless it becomes necessary to disclose such information to a healthcare provider to provide emergency treatment for you.
- receive breach notifications when your Protected Health Information is insecure or vulnerable.
- request in writing that the healthcare practitioner or facility transmit copies of Protected Health Information to a third person.
- request communications of your Protected Health Information by alternative means or at alternative locations. You must make this request in writing to the contact person designated in this Notice. We will agree to your request as long as we can easily provide it in the format that you requested.
- amend your Protected Health Information if you believe that there is a mistake or missing important information in your record. You must make this request in writing to the contact person designated in this Notice. We may approve or deny your request and will do so in written form to you.
- obtain a list of disclosures of your Protected Health Information, except for those disclosures made (1) for treatment, payment or healthcare operations purposes, (2) directly to you, (3) incident to a permissible or required use/disclosure, (4) pursuant to an authorization, (5) to a correctional institution or law enforcement officials, (6) for the facility directory or to family/friends/other persons involved in your care or payment for services, (7) for national security or intelligence purposes or (8) as part of a limited data set. You must make your request in writing to the contact person designated in this Notice. The accounting provided to you will be limited to those disclosures that occurred within six years prior to the date of the request and will not contain disclosures that occurred prior to April 14, 2003. The first list provided to you in a 12-month period will be at no charge; additional requests within one year may require that you be charged a fee.
- obtain a paper copy of our notice of privacy practices upon request, even if you have agreed to accept this notice electronically. You must make your request in writing to the contact person designated in this Notice.
This organization is required to:
- maintain the privacy of your Protected Health Information;
- provide you with a notice about our legal duties and privacy practices with respect to information we collect and maintain about you;
- abide by the terms of this notice;
- notify you if we are unable to agree to a requested restriction;
- accommodate reasonable requests you may have to communicate health information by alternative means or to alternative locations;
- restrict disclosures of Protected Health Information to a health plan when requested if it pertains to items or services for which you have paid out of pocket in full.
We reserve the right to change our practices and to make the new provisions effective for all Protected Health Information we maintain. Should our information practices change, we will post the changes on our website (www.mercycare.org) and make copies available at each of our sites of service.
We will not use or disclose your Protected Health Information without your authorization, except as described in this notice.
If you have questions and would like additional information, you may contact the Privacy Officer, Mercy Medical Center, 701 10th Street SE, Cedar Rapids, Iowa 52403. Voice Phone (319) 398-6846. If you believe your privacy rights have been violated, you can file a complaint with this individual or with the Region VII, Office for Civil Rights, U.S. Department of Health and Human Services, 601 East 12th Street-Room 248, Kansas City, Missouri 64106. Voice Phone (816) 426-7278. FAX (816) 426-3686. TDD (816) 426-7065. E-mail to: OCRComplaint@hhs.gov. There will be no retaliation for filing a complaint.
We may use and disclose your Protected Health Information without your consent or authorization for treatment, payment and health care operations as follows:
We will use your Protected Health Information for treatment.
We may use or disclose your Protected Health Information to physicians, nurses, medical students and other healthcare personnel who provide you with healthcare services or are involved in your care. For example, your Protected Health Information may be provided to a physician to whom you have been referred or to your family physician if you are seen in the emergency department of the hospital. Another example is that your Protected Health Information, as necessary, would be disclosed to a home health agency that provides care to you following discharge from the hospital.
We will use your Protected Health Information for payment.
We may use or disclose your Protected Health Information as needed for us to bill and collect payment for the healthcare treatment and services provided to you and to assist other covered entities/healthcare providers in obtaining payment. For example, if your health plan requires that you obtain prior approval before you are admitted to Mercy Medical Center, we may disclose your Protected Health Information to your health plan for this purpose. In addition, we may disclose your Protected Health Information to your physicians and other healthcare providers so that they may bill for services they provided to you at a Mercy facility.
We will use your Protected Health Information for regular healthcare operations.
We may use or disclose, as needed, your Protected Health Information internally or to third parties acting on our behalf for healthcare operations purposes. For example, we may engage a consultant to review information in selected medical records to determine what additional services we should offer and what services are not needed. In addition, we may disclose your Protected Health Information to other covered entities for their own limited types of healthcare operations if they have or have had a relationship with you and the Protected Health Information pertains to such relationship. For instance, if you are returning to a nursing home upon discharge from the hospital, we may share your Protected Health Information with the nursing home in order to facilitate coordination of your care. Furthermore, MercyCare Service Corporation and its affiliates and Mercy Medical Center’s medical staff may use and share your Protected Health Information with each other for the purposes of our Organized Health Care Arrangement. For example, members of Mercy Medical Center’s medical staff, the hospital risk manager, the hospital’s quality improvement manager or members of the quality improvement teams may use information in your medical record to assess the care and outcomes in your case and others like it in an effort to continually improve the quality and effectiveness of the health care and services provided.
Directory: We may include your name, location, general condition and religious affiliation in our patient directory for use by clergy and visitors who ask for you by name, unless you object in whole or in part by contacting the Registration Department. In an emergency situation, we may go ahead and use and disclose such information if it is consistent with your prior expressed preference (if known) and if we believe it to be in your best interest, but will still offer you the opportunity to object when it becomes practical to do so.
Communication with family: Unless you object by notifying the contact person designated in this Notice, we may disclose to a family member, other relative, close personal friend or any other person whom you identify, Protected Health Information relevant to that person’s involvement in your care or payment related to your care. We may use or disclose your Protected Health Information to notify or assist in notifying a family member, personal representative or another person responsible for your care, your location, general condition or death. We may also use or disclose your Protected Health Information to an authorized public or private entity to assist in disaster relief efforts. If you are unable to agree or object to such disclosure, health professionals, using their professional judgment, may disclose your Protected Health Information as necessary if it is determined to be in your best interest.
Healthcare Affiliates/Alliances: We participate in a variety of electronic health information data sharing agreements with other healthcare providers, public health organizations, and payors including the Iowa Health Information Network (IHIN). As a participant, we may provide your Protected Health Information to other healthcare providers and health plans that request your information for their treatment, payment and healthcare operations purposes. Participation also permits us to access their information about you for our treatment, payment and healthcare operations.
Appointment reminders and health-related benefits or services: We may use your Protected Health Information to provide appointment reminders, to make pre- and post-visit phone calls, or give you information about treatment alternatives or other healthcare services or benefits we offer.
Incidental Uses and Disclosures: We may use or disclose your Protected Health Information if such use or disclosure is incidental to an otherwise permitted or required use or disclosure. For example, to facilitate our healthcare operations, we may call you by name in the waiting area when it is your turn to be seen. If another person overhears us do so, that is considered an incidental disclosure of your Protected Health Information.
Required by law: We may use or disclose your Protected Health Information to the extent that the law requires its use or disclosure and it will be limited to the relevant requirements of the law. In addition, we must disclosure your Protected Health Information to the Secretary of the Department of Health and Human Services upon request for compliance determination purposes.
Public health: As required by law, we may disclose your Protected Health Information to public health or legal authorities charged with preventing or controlling disease, injury or disability. For example we report information about births, deaths and various diseases.
Communicable diseases: We may disclose your Protected Health Information, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.
Health oversight activities: We may disclose Protected Health Information to a health oversight agency for activities authorized by law. These activities include audits, investigations, inspections and licensure of a healthcare provider or organization.
Abuse or neglect: We may disclose your Protected Health Information to a public health authority that is authorized by law to receive reports of child abuse or neglect or if we believe that you have been a victim of abuse, neglect or domestic violence.
Research: In some instances, your Protected Health Information may be used or disclosed for research purposes. All research projects are subject to a special approval process to ensure the privacy of your information. In many cases, information that identifies you as the patient will be removed.
Food and Drug Administration (FDA): We may disclose to the FDA Protected Health Information relative to adverse events with respect to food, supplements, product and product defects, or post-marketing surveillance information to enable product recalls, repairs or replacement.
To avoid harm: In order to prevent serious threat to your health and safety or the health and safety of the public or another person, we may provide Protected Health Information about you to someone able to help prevent the threat.
Legal proceedings: We may disclose Protected Health Information in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized) in certain conditions in response to a subpoena, discovery request or other lawful process.
Law enforcement: We may disclose Protected Health Information for certain law enforcement purposes, including the reporting of certain types of wounds or injuries, or pursuant to a warrant, subpoena or other legal process, or for the purpose of identifying or locating a subject, fugitive, material witness, missing person or a victim, provided that certain conditions are met.
Funeral directors, coroners and organ donation: We may disclose Protected Health Information to funeral directors, a coroner or medical examiner consistent with applicable law to carry out their duties or to parties associated with cadaver organ, eye or tissue donation purposes.
Psychotherapy Notes:We can use and disclose your Protected Health Information that contains psychotherapy notes without your authorization only as follows: (1) for our own treatment purposes, (2) for our own practitioner-supervised training programs involving students learning counseling skills, (3) to defend legal actions or other proceedings brought against us, (4) to the Secretary of the Department of Health and Human Services as required for compliance purposes, (5) as required by law, (6) for our health oversight activities, (7) to coroners, medical examiners and funeral directors for deceased patients and (8) to avert a serious threat to health or safety.
Workers’ compensation: We may provide Protected Health Information in order to comply with workers’ compensation laws for work-related injuries/illness.
Employment purposes: Under certain circumstances, we may report Protected Health Information to employers who request that we conduct an evaluation relating to medical surveillance of the workplace or to evaluate whether the employee has a work-related condition.
Inmates: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release Protected Health Information about you to the correctional institution or law enforcement official necessary for your health and the health and safety of other individuals.
Military, Veterans and National Security: We may disclose the Protected Health Information of military personnel and veterans in certain situations and we may also disclose Protected Health Information for national security purposes, such as protecting the President or conducting intelligence operations.
Fundraising: Without your authorization, we may use your Protected Health Information to raise funds for our organization. We may also provide certain information to our institutionally-related foundation for the same purpose. The money raised will be used to expand and improve services and programs we provide the community. If you do not wish to receive future fundraising communications, you are allowed to opt out of such communications.
School Immunizations: We may disclose immunization records to a school if the school is required by law to obtain such records prior to admission.
Marketing: Your name and demographic information will not be distributed to anyone who might use it for telemarketing purposes. We do not sell patient lists for marketing purposes. Your authorization is needed for marketing communications.
Psychotherapy Notes: Your authorization must be obtained for the use and disclosure of psychotherapy notes.
Other: All uses and disclosures not previously addressed in this Notice will require your written authorization. At any time you may take back (“revoke”) your authorization to use or disclose Protected Health Information except to the extent that action has already been taken. You must make your request in writing to the contact person designated in this Notice.
