Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

​

City-County Health District is required by law to maintain the privacy of protected health information and to provide you with notice of its duties and privacy practices.  City-County Health District must abide by the terms of the notice currently in effect. City-County Health District may change the terms of our notice, at any time.  The new notice will be effective for all protected health information that we maintain at that time. Upon your request, we will provide you with any revised Notice of Privacy Practices by mail or hand delivery.

           

This Notice of Privacy Practices describes how we, our Business Associates, and their subcontractors may use and disclose your protected health information to carry out treatment, payment or health care operations and for other purposes that are permitted or required by law.  It also describes your rights to access and control your protected health information.   “Protected Health Information” (PHI) is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related health care services.

 

USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION

The following section describes different ways that we use and disclose medical information.  We will not use or disclose your medical information for any purpose not listed below, without your specific authorization.  Any specific written authorization you provide may be revoked at any time by writing to us.

 

Treatment - We will use and disclose your protected health information to provide, coordinate, or manage your health care and any related services.  This includes any coordination or management of your health care with other agencies that have your permission to have access to your protected health information.  This may include family members and other caregivers who are part of your plan of care.

 

Payment – Your protected health information will be used as needed to obtain payment for your health care services. This may include your insurance company, self-funded or third party health plan, Medicare, Medicaid, or any other person or entity that may be responsible for paying or processing for payment any portion of your bill for services.

 

Healthcare Operations – We may use or disclose, as needed, your protected health information in order to support the business activities of City-County Health District and to comply with regulations affecting this agency’s operations.    These activities include but are not limited to: quality assessment, employee review, licensing accrediting bodies and training activities. We may also call you by name in the waiting room when your health care professional is ready to see you. We may contact you to remind you of appointments or inform you of other health activities we provide. If we use or disclose your protected health information for fundraising activities, we will provide you the choice to opt out of those activities. You may also choose to opt back in.

 

Required by law – We may use or disclose your protected health information to the extent that law requires the use or disclosure. The use of disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law.

 

Public Health – We may disclose your protected health information to a public health authority that is permitted by law to collect or receive the information. The disclosure will be made for the purpose of controlling disease, injury, or disability.  The disclosure may be made to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, to enable product recalls, repairs or replacements to track products, or to conduct activities required by the Food and Drug Administration.  We may also disclose your protected health information, if authorized by law, to the person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.

 

Abuse and neglect – We may disclose your protected health information to a public health authority that is authorized by law to receive reports of child abuse or neglect.  We may disclose your protected health information if we believe that you have been a victim of abuse, neglect or domestic violence to the government entity or agency authorized to receive such information.

 

Health oversight – We may disclose protected health information to an agency providing health oversight for oversight activities authorized by law, including audits, licensure, inspections and investigations.

 

Legal proceedings – We may disclose health information in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal, subpoena discovery request on other lawful process.

 

Law Enforcement – We may disclose protected health information to a law enforcement official concerning the medical information of a suspect, fugitive, material witness, and crime victim or missing person.  We may share the medical information of an inmate or other person in lawful custody with a law enforcement official or correctional institution under certain circumstances.

 

Coroners, Funeral Directors and Organ Donations – We may disclose protected health information to a coroner or medical examiner for identification purposes for determination of death or for the coroner or medical examiner to perform other duties authorized by law.  We may disclose information to a funeral director as authorized by law, in order to permit them to carry out their duties.   We may disclose such information in reasonable anticipation of death.   Protected health information may be used and disclosed for cadaver organ, eye or tissue donation purposes.

 

Criminal activity - We may disclose your protected health information if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

 

Military Activity and National Security – When the appropriate conditions apply, we may use or disclose protected health information of individuals who are Armed Forces personnel:

1. For activities deemed necessary by appropriate military command authorities.

2. For the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits.To foreign military authority if you are a member of that foreign military service.

3. We may also disclose your protected health information to authorized federal officials for conducting national security and intelligence activities, including for the provision of protective services to the President or other legally authorized.

 

Workers Compensation - Your protected health information may be disclosed as authorized to comply with workers compensation laws and other similar programs.

 

Research – We may disclose your protected health information to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your protected health information.

 

Opportunity to agree to or prohibit – This agency is permitted to use or disclose information about you without consent or authorization provided you are informed in advance and given the opportunity to agree to or prohibit the disclosure in the following circumstances. If you are not present or able to agree or object to the use or disclosure, then your health care provider may, using professional judgment, determine whether the disclosure is in your best interest.

• The use of a directory of individuals served by City-County Health District.

• To a family member, relative, friend, or other identified person, the information relevant to such person’s involvement in your care or payment for care.

• Disaster relief – we may disclose medical information about you to an entity assisting in disaster relief.

 

Uses and Disclosures of Protected Health Information Based on Your Written Authorization – Other uses and disclosures of your protected health information will be made only with your written authorization, unless otherwise permitted or required by law as described below. You may revoke this authorization, at any time, in writing except in limited situations.  Without your authorization, we are prohibited to use or disclose your protected health information for marketing purposes. We may not sell your protected health information without your authorization. We may not use or disclose most psychotherapy notes contained in your protected health information. We will not use or disclose any of your protected health information that contains genetic information that will be used for underwriting purposes.  You may revoke the authorization at any time in writing, except to the extent that the agency has taken action in reliance on the use or disclosure indicated in the authorization.

 

YOUR RIGHTS AND HOW TO EXERCISE THEM

The following are statements of your rights with respect to your protected health information.

 

You have the right to access, to inspect and copy your Protected Health Information (fees may apply). Upon written request, you have the right to inspect or copy your protected health information whether in paper or electronic format. This request must be in writing and include records in the “Designated Record Set”. The Designated Record Set consists of your medical and billing file. This information may be given to you in summary form.  According to N.D. CENTURY  CODE SECTION 23-12-14, upon request for medical records with the signed authorization of the patient, a health care provider shall provide medical records at a charge of no more than:

• $20 for the first 25 pages

• $.75 per page after 25

• This charge includes any administration fee, retrieval fee, and postage expense.

 

You have the right to request a restriction of your Protected Health Information.  You may ask us not to use or disclose any part of your protected health information for the purposes of treatment, payment or healthcare operations.  You may request that any part of your information not be disclosed to family members or friends who may be involved in your care or for notification purposes.  The request must state the specific restriction requested. City-County Health District is not required to agree to the restriction, except if you request that City-County Health District not disclose protected health information to your health plan with respect to healthcare for which you have paid in full, out of pocket, at the time of service. You may request a restriction by completing the Request of Restriction of Protected Health Information. This form can be obtained from City-County Health District.

 

You have the right to request to receive confidential communication from us by alternative means or at alternative location.  City-County Health District will accommodate reasonable requests.  You may request this by completing the Request for Confidential Communication of Protected Health Information form.  This form can be obtained from City-County Health District.

 

You have the right to request an amendment to your Protected Health Information.   If you believe that medical information is incorrect or incomplete you may request an amendment.  You may ask for an amendment to information about you in a set for as long as we maintain this information.  We may deny your request.  If we deny your request, we will provide you a written explanation. If we deny the request, you may respond with a statement of disagreement that will be added to the information you wanted changed.  To request an amendment, you need to complete a Request for Amendment of Protected Health Information form. This form can be obtained from City-County Health District.

 

You have the right to receive an “Accounting of Certain Disclosures” we have made of your protected health information. This right applies to disclosures for purposes other than treatment, payment or healthcare operations.   It excludes disclosures we may have made to you, for a facility directory, to family members, or friends involved in your care or for notification purposes.  It does not include uses and disclosures for which you gave us written authorization.  You may request this accounting by completing the Request for Accounting of Disclosures form about Disclosures made after 4-14-2003. You may obtain this form from City-County Health District.

 

You have the right to obtain a paper copy of this notice from us, even if you have agreed to accept this notice electronically. You may obtain a copy of this notice at our Website, www.citycountyhealth.org.

​

You have a right to receive a notice of a breach.  We will notify you if your protected health information has been breached.

 

MINIMUM NECESSARY RULE

Our staff will not use or access your PHI unless it is needed to do their jobs All Public Health staff are trained in HIPAA Privacy and Security rules and sign a Confidentiality Policy with regards to keeping your PHI private. Also, we disclose to outside entities only as much of your PHI as needed to accomplish the recipient’s lawful purposes.

 

INCIDENTAL DISCLOSURE RULE

We will take reasonable administrative, technical and security safeguards to ensure the privacy of your PHI when we use or disclose it. In the event that there is a breach in protecting your PHI, we will follow Federal Guidelines to HIPAA Omnibus Rule Standards to first evaluate the breach situation using the Omnibus Rule, 4-Factor Formula for Breach Assessment. Then we will document the situation, retain copies of the situation on file, and report all breaches (other than low probability, as prescribed by the Omnibus Rule) to the U.S. Department of Health and Human Services at: http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brinstruction.html.

 

CHANGES TO PRIVACY POLICY

We reserve the right to change our privacy practices at any time as authorized by law. The changes will be considered immediate and will apply to all PHI we create or receive in the future. If we make changes, we will post the changed Notice on our website and in our office. Upon request, you will be given a copy of our current Notice.

 

FAXING, EMAILING, AND TEXTING RULES

You may request us to fax your protected health information. Providing us with the fax contact information, guarantees that you have sole access to the fax. We are not responsible for protected health information viewed by others if it is a shared fax. We will include a cover sheet to the message. Some email addresses are encrypted, so information could be shared this way if the email address provided is currently or could be encrypted by our IT department. Text messages are currently not encrypted and therefore there is risk of unlawful disclosure when communicating via text message. If you request to receive communication via email, we may be able to accommodate this request. We will not be able to accommodate text messaging requests and another format must be chosen.

 

MARKETING RULES

Marketing is defined as communication about a product or service that encourages recipients to purchase or use the product or service. The HIPAA Privacy Rule expressly requires an authorization for uses or disclosures of protected health information for all marketing communications, except in two circumstances:

1. When the communication occurs in a face-to-face encounter between the covered entity and the individual; or

2. The communication involves a promotional gift of nominal value.

If marketing communications other than the circumstance listed above are utilized, we will obtain your authorization first via the City-County Health District Authorization Form.

 

FUNDRAISING RULES

We generally do not participate in fundraising efforts using our patient information. If the Department were to participate in fundraising activity, you will be provided with an opportunity to opt-out of participating in fundraising efforts.

 

AUTHORIZATIONS RELATED TO RESEARCH

We may seek authorizations from you for the use of your PHI for future research. However, we would make clear the purpose of the research.

 

COMPLAINTS

You may complain to City-County Health District and the Secretary of the U.S. Department of Health and Human Services if you believe that your privacy rights have been violated.   There will be no retaliation against you for filing a complaint.   The complaint should be filed in writing and with City-County Health District and should state the specific incidents(s) in terms of subject, date, and other relevant matters.  A complaint to the Secretary must comply with the standards set out in 45 CFR 160.306.

 

For further information regarding filing complaints with the City-County Health District, contact CCHD HIPAA Privacy Officer at 845-8518. This notice is effective beginning April 14, 2003 and remains in effect until amended.