Joint Notice of Privacy Practices
Effective Date: September 23, 2013
At The Regional Cancer Center, we are committed to protecting the privacy of your “protected health information,” as federal and state laws require. When we say “protected health information,” we mean health, treatment, or payment information that identifies you. Attached is The Regional Cancer Center’s “Joint Notice of Privacy Practices.” The Joint Notice explains how we meet this commitment. The Joint Notice also explains your legal rights about what is in your health record. All people and places that make up The Regional Cancer Center must follow the Joint Notice. However, this does not include The Regional Cancer Center as an employer. This Summary tells you in brief what the Joint Notice says. THIS SUMMARY IS NOT A COMPLETE LISTING OF HOW WE WILL USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION. IF YOU HAVE A QUESTION ABOUT ANY OF THE INFORMATION IN THIS SUMMARY, YOU SHOULD REVIEWTHE FULL JOINT NOTICE OF PRIVACY PRACTICES ORASKA REGIONAL CANCER CENTER STAFF MEMBER FOR MORE INFORMATION. THE REGIONAL CANCER HAS THE RIGHT TO CHANGE THIS SUMMARY AND THE JOINT NOTICE WITHOUT FIRST NOTIFYING YOU.
How The Regional Cancer Center may use and disclose your protected health information
Without your consent, The Regional Cancer Center can use and disclose your protected health information to:
- Provide you with medical treatment and other services
- Receive payment from you, an insurance company, or someone else for services we provide to you
- Coordinate your care, which may include such things as giving you appointment reminders and telling you about other treatment options
- Contact you for certain marketing and fund-raising activities unless otherwise indicated by you
- Comply with the law
- Meet special situations as described in the Notice, such as public health, safety, and research
- Exception: This does not include behavioral health, drug and alcohol, and AIDS/HIV information.
Unless you object, The Regional Cancer Center can disclose your protected health information with a family member or a close friend. All other uses and sharing of your health information will be done only with your specific written permission or as required by law.
Your legal rights about your protected health information
- Right to ask to see and copy your medical record
- Right to ask that incorrect or incomplete information in your medical record be corrected
- Right to ask for a list of all people and organizations who The Regional Cancer Center disclosed your protected health information to, subject to limits permitted by law
- Right to ask The Regional Cancer Center to limit how we use and disclose your protected health information without your consent
- Right to ask for confidential communications
- Right to ask for a paper copy of the Joint Notice of Privacy Practices
Violation of privacy rights
If you believe your privacy rights have been violated, you have a right to file a complaint. Please see The Regional Cancer Center’s Joint Notice of Privacy Practices for more details.
In the event that a breach of your unsecured protected health information occurs by The Regional Cancer Center or by one of its Business Associates, you will be provided written notification as required by law.
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED (SHARED) AND HOW YOU CAN GET ACCESS TO (SEE AND COPY) THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.
A federal regulation known as the “HIPAA Privacy Rule” requires us to maintain the privacy of your “protected health information” and to provide you with this detailed written notice of our legal duties and privacy practices concerning your protected health information. Your protected health information includes any information which (a) relates to your past, present or future physical or mental health or condition, the provision of health care to you, or payment for health care provided to you; and (b) individually identifies you or can be reasonably used to identify you. Your protected health information also includes information about your medical care that we receive from doctors and medical facilities that are not part of The Regional Cancer Center.
This notice applies to The Regional Cancer Center, including our staff, employees and volunteers, and to the physicians, nurses, diagnostic imaging technologists and other health care professionals who provide services to patients at our facilities. The Regional Cancer Center and all of the health care professionals who provide services at our facilities are participating as an organized health care arrangement in a clinically integrated care setting under the provisions of the HIPAA Privacy Rule. As an organized health care arrangement, The Regional Cancer Center and each of the other providers of health care services will disclose your protected health information with each other, as necessary, to carry out treatment, payment and health care operations at The Regional Cancer Center, 2500 West 12th Street, Erie, Pennsylvania, 16505.
Whenever the words “we”, “us” and “our” are used in this notice, they are intended to include the employees of The Regional Cancer Center and each of the other providers of health care services at The Regional Cancer Center.
Our Duty to Protect Your Health Information
We are required by law to:
- Make sure that information that identifies you is kept private.
- Make available to you this Notice that describes the ways we use and share your health information as well as your rights under the law about your health information.
- Follow the Notice that is currently in effect.
How We May Use and Disclose Your Health Information with Others
The law permits us to use and share your health information in certain ways. When we share this information with others outside of The Regional Cancer Center, we will share what is reasonably necessary. When we act in response to your written permission, share information to help treat you, or are directed by the law, we will share all information that you, your health care provider, or the law permits or requires. The list below tells you about different ways that we may use your health information and share it with others. We have also provided you with examples of what we mean. Every possible example of how we may use or share information is not listed below. However, all of the ways we are permitted to use and share information fall into one of the groups below. When possible, we will use health information that does not identify you.
A. Ways We Are Allowed to Use and Share Your Health Information With Others Without Your Consent or as The Regional Cancer Center General Consent for Treatment, Payment, and Health Care Operations Provides:
- Treatment. We may use your protected health information to give you medical treatment or services. We may disclose (release) your protected health information with people and places that provide treatment to you. Treatment includes the provision, coordination, and management of health care services provided to you by one or more health care providers. Treatment also includes consultations with other health care providers. Some examples of treatment uses and disclosures include disclosure of your protected health information to a home health agency, hospital or other health care facility that provides services to you.
- Payment. We may use and disclose (release) your protected health information for the purpose of allowing us to secure payment for the health care provided to you. We may also disclose your protected health information to another health care provider for the payment activities of that health care provider. Some examples of payment uses and disclosures include disclosing information to your health insurer to determine whether you are eligible for coverage or whether proposed treatment is a covered service or medically necessary. Another example would be submitting a claim form to your health insurer for payment.
- Health Care Operations. We may use and disclose your protected health information for conducting our health care operations. If another health care provider, company or health plan that is required to comply with the HIPAA Privacy Rule has, or has had, a relationship with you, we may disclose protected health information about you for certain health care operations of that health care provider, company or health plan. Some examples of our health care operations include: quality assessment activities to assist us in determining how to improve medical treatment we have provided others; legal, accounting and auditing functions; peer review activities including reviewing the competence, qualifications, and performance of health care professionals; training programs for students, trainees, health care providers or business personnel; accreditation, certification, licensing, and credentialing activities; and taking patient photographs for identification purposes.
- Business Associates. We may disclose your protected health information with others called “Business Associates”, who perform services on our behalf. The Business Associate must agree in writing to protect the confidentiality of the information. For example, we may disclose your health information with an accounting or law firm.
- Appointment Reminders. We may use and disclose your protected health information to remind you of your appointment for treatment or medical care. For example, if your doctor has sent you for a test, the place where the testing will be done may call you to remind you of the date you are scheduled.
- Appointment Confirmations. We may use and share your health information to confirm the time, place, and attendance of your appointment for treatment with third-party transportation services.
- Treatment Options and Other Health-Related Benefits and Services. We may use and share your health information to tell you about possible treatment options and other health-related benefits and services that may interest you. For example, if you suffer from an illness or condition, we may tell you about a special treatment or research study that is being offered.
- Fund-Raising Activities. We may use and disclose with a Business Associate or a foundation that is related to us your name, address, phone number and other such information (called “demographic information”) the dates that health care was provided to you, general department information regarding the department where services were rendered, the name of your treating physician and outcome information. You may then be asked for a donation to The Regional Cancer Center. For example, you may receive a letter from a foundation asking for a donation to support enhanced patient care, treatment, education or research at The Regional Cancer Center. Any fund-raising materials will explain how you can tell us, a Business Associate or a foundation that you do not want to be contacted in the future.
- Marketing Activities. We may use or disclose your health information for marketing purposes without your permission when we discuss such products or services with you face to face or to provide you with an inexpensive promotional gift related to the product or service. For example, you may receive samples of products or drugs during a visit to any of The Regional Cancer Center’s facilities. For other types of marketing activities we will obtain your written permission before using or sharing your protected health information. We will not sell your name or any identifiable health information to others without your authorization.
- Newsletters and Other Communications. We may use your protected health information in order to communicate to you via newsletters, mailings, or other means regarding treatment options, health related information, disease management programs, wellness programs or other community based initiatives in which The Regional Cancer Center is participating.
- Research. We may use and disclose protected health information for research purposes under certain limited circumstances. We must obtain a written authorization to use and disclose protected health information for research purposes, except in situations where a research project meets specific criteria established by the HIPAA Privacy Rule to ensure the privacy of protected health information. For example, your protected health information may be used or disclosed without your authorization if an Institutional Review Board or a Privacy Board reviews a research proposal and approves a waiver of authorization for disclosure, or if the information does not directly identify you as the source of the information. We may also exclude certain direct identifiers in your protected health information to create information known as “limited data set” to be used or disclosed for the purpose of research, health care operations or public health activities.
- Creation of De-Identified Information/Limited Data Set. We may use protected health information in the process of deidentifying that information so that the de-identified information can be disclosed to a third party without your authorization. When we “de-identify” information we remove information that identifies you as the source of the information.
- Special Situations. In the following situations, the law either permits or requires us to use or share your health information with others. Pennsylvania law may further limit these disclosures; for example, in cases of behavioral health information, drug and alcohol treatment information, and HIV status:
- As Required By Law. We will share your health information when federal, state, or local law requires us to do so.
- If we believe that you have been a victim of abuse, neglect (except child abuse or neglect), or domestic violence, we may share your health information with an authorized government agency. We will do so either if you agree to our sharing this information or if the law allows us to do so and we believe that we need to share the information in order to protect you or someone else. If we decide to share your health information for this purpose, we will tell you unless we believe that telling you would put you at risk of harm, or you are a personal representative of the victim and may be involved in the abuse, neglect, or injury.
- We may share your health information in response to an administrative or court order, a subpoena, a discovery request, or other legal process if we are advised that you have been made aware of the request or we receive notice either that you agree or, if you disagree with the request, that you are taking action to prevent the disclosure.
- We may share your health information with a law enforcement official or authorized individuals 1) to comply with laws, including laws that require the reporting of injury or death suspected to have been caused by criminal means; 2) in response to a court order, warrant, subpoena, or summons; 3) or in emergency situations.
- If asked to do so by a law enforcement official, we may share your health information if you are an adult victim of a crime and, in certain limited cases, we are unable to obtain your permission and the law enforcement official meets certain conditions described by law.
- To Prevent a Serious Threat to Health or Safety. We may use and share your health information with persons who may be able to prevent or lessen the threat or help the potential victim of the threat when doing so is necessary to prevent a serious threat to the health and safety of you, the public, or another person. Pennsylvania law may require such disclosure when an individual or group has been specifically identified as the target or potential victim.
- *Organ and Tissue Donation.*If you are an organ donor, we may use and disclose protected health information to entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue in order to facilitate transplantation.
- Special Government Purposes. We may use and share your health information with certain government agencies, such as:
- Military and Veterans. We may share your health information with military authorities as the law permits if you are a member of the armed forces (of either the United States or a foreign government).
- National Security and Intelligence. We may share your health information with authorized federal officials for intelligence, counter-intelligence, and other national security activities authorized by law.
- Protective Services for the President and Others. We may share your health information with authorized federal officials to protect the President of the United States, other authorized persons, or foreign heads of state. We may also share your health information for purposes of conducting special investigations as authorized by law.
- Workers’ Compensation. We may share your health information for workers’ compensation or similar programs that provide benefits for work-related injuries or illness.
- Public Health. We may share your health information with public health authorities for public health purposes to prevent or control disease, injury, or disability. This includes, but is not limited to, reporting disease, injury, and important events such as birth or death, and conducting public health monitoring, investigations, or activities. For example, we may share your health information to 1) report child abuse or neglect; 2) collect and report on the quality, safety, and effectiveness of products and activities regulated by the Food and Drug Administration (FDA) (such as drugs and medical equipment, and could include product recalls, repairs, and monitoring); or 3) notify a person who may have been exposed to or is at risk of spreading a disease.
- Health Oversight. We may share your health information with a health oversight agency for purposes of 1) monitoring the health care system; 2) determining benefit eligibility for Medicare, Medicaid, and other government benefit programs; and 3) monitoring compliance with government regulations and civil rights laws.
- Coroners, Medical Examiners, and Funeral Directors. We may share your health information with a coroner or medical examiner in order to identify a deceased person, determine the cause of death, or for other reasons allowed by law. We also may share your health information with funeral directors, as necessary, so they can carry out their duties.
- Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may share your health information with the correctional institution or law enforcement official. This would be necessary 1) for the institution to provide you with health care; 2) to protect your health and safety or the health and safety of others; or 3) for the safety and security of the correctional institution.
- As Required By Law. We will share your health information when federal, state, or local law requires us to do so.
- People Involved in Your Care or Payment for Your Care. We may disclose your protected health information to a friend, family member or another person identified by you who is involved in your medical care or the payment of your medical care. We may disclose your health information with these persons if you are present or available before we disclose your health information with them and you do not object to our disclosing your health information with them, or we reasonably believe that you would not object to this. If you are not present and certain circumstances indicate to us that it would be in your best interests to do so, we will disclose protected health information with a friend or family member or someone else identified by you, to the extent necessary. This could include sharing information with your family or friend so that they could pick up filled prescriptions, medical supply, x-rays or other things that contain protected health information about you. We may tell your family or friends that you are at The Regional Cancer Center and your general condition. We may disclose medical information about you with an organization assisting in a disaster relief effort.
B. In All Other Ways, We Will Require Your Written Permission Before Your Protected Health Information Is Used or Disclosed With Others
- Other. Except as stated in Section A, your written permission is required before we can use or disclose your protected health information with anyone outside of The Regional Cancer Center. This permission is provided through an authorization form. If you give us permission to use or disclose protected health information about you, you may cancel that permission, in writing, at any time. If you cancel your permission, we will no longer use or disclose your health information for the reasons you have given us in your written permission. However, we are unable to take back any information already disclosed with your permission.
- Confidentiality of Certain Medical Records. The confidentiality of drugs and alcohol treatment records, HIV related information, sexual assault counseling records and mental health records maintained by us are specially protected by Pennsylvania law. We will only disclose such information if you consent in writing, or if the disclosure is allowed by a court order, or if other limited circumstances apply.
Your Rights Concerning Your Health Information
The law gives you the following rights about your health information:
- Right to Ask to See and Request a Copy. You have the right to ask to see and request a copy of the protected health information that we used to make decisions about your care. This includes your right to request a copy of your electronic medical record in electronic form. Your request must be in writing and given to your doctor or the Health Information Management Department. You can call the Health Information Management Department to find out how to do this. If you ask to see or request a copy of your protected health information for personal use, you may have to pay fees as permitted by law. We may tell you that you cannot see nor have a copy of some or all of your health information. If we tell you this, you may ask that someone else at The Regional Cancer Center review this decision. A licensed health care professional chosen by The Regional Cancer Center will review those that can be reviewed. This person will not be the same person who refused your request. We will do whatever this person decides.
- Right to Ask for a Correction. If you feel that health information we have about you is incorrect or incomplete, you may ask us to correct the information. You have the right to ask for a correction for as long as the information is kept by or for The Regional Cancer Center. You must put your request in writing and give it to your doctor or the place where you received care. If you do not ask in writing or give your reasons in writing, we may tell you that we will not do as you have asked. We have the right to refuse your request if you ask us to correct information that 1) was not made by us, unless the person or place that originally made the information is no longer available to make the correction; 2) is not part of the health information kept by or for The Regional Cancer Center; 3) is not part of the information you are permitted by law to see and copy; or 4) we decide is correct and complete.
- Right to Ask for an “Accounting of Disclosures.”
- Generally. You have the right to ask us for an “accounting of disclosures.” This is a list of those people and organizations who have received or have accessed your health information. This right does not include information made available for treatment, payment, or health care operations, or made available when you have provided us with permission to do so. You must put your request in writing and give it to your doctor or the place where you received care. You can call your doctor’s office or the place where you received care to find out how to ask for the list. You must include in your written request how far back in time you want us to go, which may not be longer than six years.
- Information That Is Maintained Electronically. Subject to a schedule established by federal law, if we maintain your health information electronically (in our computer), you have the right to ask for an accounting of disclosures of where The Regional Cancer Center disclosed your health information. In accord with federal law, you may request an accounting for a period of three years prior to the date the accounting is requested. You also have the right to ask our business associates for an accounting of their disclosures. We will post a list of all of our business associates and how to contact them on the website (www.trcc.org).
- Right to Ask for Limits on Use and Sharing.
- Generally. You have the right to ask us to limit the health information we use or share with others about you for treatment, payment, or health care operations. You also have the right to ask us to limit health information that we share with someone who is involved in your care or payment for your care, like a family member or friend. You can call your doctor’s office or the place where you received your care to get instructions on how to submit such a request. In your request, you must tell us 1) what information you want to limit; 2) whether you want to limit our use, disclosure or both; and 3) the person or institution the limits apply to (for example, your spouse). For example, you could ask that we not use or share information about a surgery you had. You must put your request in writing and give it to your doctor or the place where you received your care. We are not required to agree to your request. If we do agree to your request, we still may provide information, as necessary, to give you emergency treatment.
- Services Paid For by You. Where you have paid for your services out of pocket in full, at your request, we will not share information about those services with a health plan for purposes of payment or health care operations. “Health plan” means an organization that pays for your medical care.
- Right to Ask for Confidential Communications. You have the right to ask that we contact you about your health information in a certain way or at a certain location that you believe provides you with greater privacy. For example, you can ask that we contact you at work or by mail. Your request must state how or where you wish to be contacted. You must make your request in writing to your doctor or the place where you received care. You do not need to provide a reason for your request. We will comply with all reasonable requests.
- Right to Ask for a Paper Copy of This Notice. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this Notice electronically (for example, through the computer), you still have the right to a paper copy of this Notice. You can get a copy of this Notice at the website www.trcc.org. To obtain a paper copy of this Notice, please contact the Health Information Manager.
- A Health Plan is prohibited from requesting, requiring or purchasing genetic information with respect to any individual prior to such individual’s enrollment in a health plan, and from using genetic information for underwriting purposes.
Violation of Privacy Rights
In the event that a breach of your unsecured protected health information occurs by The Regional Cancer Center or by one of its Business Associates, you will be provided with written notification as required by law. Unsecured protected health information is information that is not secured through the use of a technology of methodology identified by the Secretary of the U. S. Department of Health and Human Services to render such information unusable, unreadable and undecipherable to unauthorized users.
If you believe your privacy has been violated by us, you may file a confidential complaint directly with us. You can do this by contacting the Privacy Officer at 412-235-1029 or by calling the Compliance HelpLine at 1-877-983-8442.
You also may file a complaint with the Secretary of the U.S. Department of Health and Human Services. To file a complaint with the Secretary of Health and Human Services, you must 1) name The Regional Cancer Center or the person that you believe violated your privacy rights and describe how that place or person violated your privacy rights; and 2) file the complaint within 180 days of when you knew or should have known that the violation occurred. All complaints to the Secretary of the U.S. Department of Health and Human Services must be in writing and addressed to:
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, DC 20201
You will not be penalized for filing a complaint.
Changes to This Notice
We reserve (have) the right to change this Notice. We reserve (have) the right to make the revised or changed Notice effective for protected health information we already have about you and for any future protected health information. We will post a copy of the revised Notice in our reception area. The Notice will contain the effective date on the first page, in the top right-hand corner. We will provide to you, if you ask us, a copy of the Notice that is currently in effect each time you register at The Regional Cancer Center.
Legal Effect of This Notice
This Notice is not intended to create contractual or other rights independent of those created in the HIPAA Privacy Rule.
If You Have Questions About This Notice
If you have any questions or would like additional information about this notice, you may telephone 814-838-9000 and ask for the Health Information Manager or dial 412-235-1029 and ask for the Privacy Officer.