Notice of Privacy Practices - Olathe Health System, Inc.
This notice describes how medical information about you may be used and disclosed and how you can get access to this information.
PLEASE REVIEW IT CAREFULLY!
Effective Date: April 14, 2003
Revised Date: August 13, 2013
This “Notice” describes Olathe Health System’s privacy practices and how we may use and disclose your protected health information. Olathe Health System is defined as Olathe Health System, Inc., Olathe Medical Center, Inc., Miami County Medical Center, Inc., Olathe Medical Services, Inc., Pharmacy Express and its medical staff members participating in the Organized Health Care Arrangement.
This Notice describes our responsibilities required by law and your rights to access and control your protected health information. “Protected health information” (PHI) is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related health care services. An explanation of this information and how it is used and disclosed is provided on the following pages.
Responsibilities of Olathe Health System
Olathe Health System is required by law to:
- Keep your health information private and only disclose it when required to do so by law;
- Provide you with this notice that explains our legal duties and privacy practices in connection with your health records; and
- Obey the rules found in this notice.
Olathe Health System, members of its workforce and medical professionals serving on the medical staff may have access to and share medical information for treatment, payment and health care operations described in this notice. We will not use or disclose your health information without your written authorization, except as explained in this notice or as required by law. Certain laws may require that we disclose your health information without your written authorization and we are obligated to follow those laws.
If you see a physician or other health care provider in their private office, different policies or practices may apply. You may want to ask them for a copy of their notice of privacy practices.
How We May Use and Disclose Medical Information About You
FOR TREATMENT: We may use health information about you to provide you with medical treatment or services. We may disclose (release) health information about you to your doctors, nurses, technicians, therapists, students, other staff or personnel who are involved in taking care of you. For example, a doctor treating you for a broken bone may need to know if you have diabetes because diabetes may slow the healing process. Health care providers also may share health information about you in order to coordinate the different services you need, such as prescriptions, lab work and x-rays. We may disclose health information about you to people outside our organization in order to make arrangements for your continued medical care or support services.
FOR PAYMENT: Your PHI may be used and disclosed as needed to bill for or receive payment for treatment and services provided. This may include, but is not limited to, communication with insurance companies, medical review organizations and other health care providers. For example, we may use and disclose your information so that the treatment and services you receive may be billed to and payment may be collected from you, an insurance company or a third-party payer. We may also tell your health plan about a treatment you are going to receive in order to obtain prior approval or to determine whether your plan will cover the treatment.
FOR HEALTHCARE OPERATIONS: We may use or disclose your PHI in order to support business activities that are considered necessary to run health care operations. Additionally, the information may be used to review our services in order to improve the quality and effectiveness of the care we provide. For example, we may use your health information to review our treatment and services and to evaluate the performance of our staff in caring for you. We may share your information with business associates that perform various activities on our behalf, such as accreditation programs, patient satisfaction inquiries, legal services and others.
INDIVIDUALS INVOLVED IN YOUR CARE OR PAYMENT FOR YOUR CARE: We may disclose your health information to your family or friends or any other person identified by you when they are involved in your care or payment for your care. We will only disclose the health information directly related to their involvement in your care or payment. We may also use or disclose your health information to notify or assist in the notification of a family member, personal representative, or another person responsible for your care, of your location, general condition or death. If you are available, we will give you an opportunity to object to these disclosures, and we will not make these disclosures if you object. If you are not available, we will determine whether a disclosure to your family or friends is in your best interest and we will disclose only the information that is directly related to their involvement in your care. When permitted to do so by law, we may coordinate our uses and disclosures of your health information with public or private entities authorized to assist in disaster relief efforts.
PATIENT INFORMATION DIRECTORY: If you are a patient in one of our hospitals, we may provide some general information (your location and your general condition) to people who ask for you by name. We may also share your religious affiliation with a member of the clergy. This information is the “Patient Information Directory.” If you do not want to be included in this directory you must tell the Registration Clerk when you check in.
APPOINTMENT REMINDERS AND TREATMENT COMMUNICATIONS: We may contact you by phone, mail, or electronic means as a reminder that you have an appointment for treatment or services. We may also contact you by phone, mail, or electronic means regarding test results, reminders that your prescriptions are ready to be picked up, or other treatment information. We may leave a brief message unless you tell us not to. See also Right to Request Alternative Communications in this notice.
TREATMENT ALTERNATIVES AND HEALTH-RELATED BENEFITS AND SERVICES: We may use your health information to tell you about or recommend new treatment alternatives or other health-related services that may be of interest to you.
FUNDRAISING ACTIVITIES: Olathe Medical Center Charitable Foundation (OMCCF) may contact you in an effort to raise money for the organization and its operations. You have the right to opt out of receiving further fundraising materials.
RESEARCH: We may use and disclose health information about you for research purposes. Generally, we will only use and disclose information about you with your written authorization. However, in limited circumstances, we may use and disclose information without your written authorization if this use or disclosure has been approved through a special approval process. We may also disclose health information about you to people preparing to conduct a research project, for example, to help them look for patients with specific health needs, so long as the health information they review is not removed from our facility.
AS REQUIRED BY LAW: We will disclose health information about you when required to do so by federal, state or local law.
TO AVERT A SERIOUS THREAT TO HEALTH OR SAFETY: We may use and disclose health information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to prevent the threat.
Special Situations (Other uses and disclosures that do not require authorization)
ORGAN AND TISSUE DONATION: We may release health information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.
MILITARY AND VETERANS: If you are a member of the armed forces, we may release health information about you as required by military command authorities. We may also release health information about foreign military personnel to the appropriate foreign military authority.
EMPLOYERS: We may release health information about you to your employer if we provide health care services to you at the request of your employer, and the health care services are provided either to conduct an evaluation relating to medical surveillance of the workplace. Any other disclosures to your employer will be made only if you execute a specific authorization for the release of that information to your employer.
WORKERS’ COMPENSATION: We may release health information about you for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.
PUBLIC HEALTH ACTIVITIES: We may disclose health information about you for public health activities. These activities generally include the following:
- To prevent or control disease, injury or disability (e.g. disease or trauma registries);
- To report births and deaths;
- To report abuse or neglect;
- To report reactions to medications or problems with products;
- To notify people of recalls of products they may be using;
- To notify a person who may have been exposed to a disease or condition;
- To provide PHI to medical device manufacturers (if a medical device is required for your care) who may need to contact you about the device.
HEALTH OVERSIGHT ACTIVITIES: We may disclose health information to a government health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, licensing functions, and compliance with civil rights laws.
JUDICIAL AND ADMINISTRATIVE PROCEEDINGS: We may disclose health information about you in response to a court or administrative order. We may also disclose health information about you in response to a subpoena, discovery request or other lawful process, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.
LAW ENFORCEMENT: We may release health information if asked to do so by a law enforcement official:
- In response to a court order, subpoena, warrant, summons or similar process;
- To identify or locate a suspect, fugitive, material witness, or missing person;
- About the victim of a crime under certain limited circumstances;
- About a death we believe may be the result of criminal conduct; and
- About criminal conduct on our premises.
CORONERS, MEDICAL EXAMINERS AND FUNERAL DIRECTORS: We may release health information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release health information about patients to funeral directors as necessary to carry out their duties.
NATIONAL SECURITY AND INTELLIGENCE ACTIVITIES: We may release health information about you to authorized federal officials for intelligence, counterintelligence and other national security activities authorized by law.
PROTECTIVE SERVICES FOR THE PRESIDENT AND OTHERS: We may disclose health information about you to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or to conduct special investigations.
INMATES: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release health information about you to the correctional institution or the law enforcement official. This release would be necessary 1) for the institution to provide you with health care; 2) to protect your health and safety or the health and safety of others; or 3) for the safety and security of the correctional institution.
Other Uses and Disclosures
Other uses and disclosures of your health information not covered in the previous sections of this notice will only be made with your written permission or authorization. For example, if we would directly or indirectly receive a financial benefit from a use or disclosure of your PHI for some marketing purposes or sale of your PHI, a written authorization is required from you.
If you have given us permission to use or disclose your health information you may also revoke that authorization, in writing, at any time. Once you revoke your authorization, we will no longer use or disclose the information about you for the reasons covered by that authorization, but we cannot take back any uses or disclosures already made with your permission.
Although your health record is the physical property of the hospital or provider that created it, the information belongs to you. You have the following rights regarding the health information we maintain:
RIGHT TO REQUEST RESTRICTIONS: You have the right to request a restriction (limitation) on the health information we use or disclose about you for your treatment, payment or healthcare operations. To request restrictions, you must complete, in writing, a Request for Privacy Restrictions and Alternative Communications form, and return it to the Privacy Contact. We are not required to agree to your request, except as described below. If we do agree, we will notify you in writing and comply with your request unless the information is needed to provide you with emergency treatment or is required by law.
RIGHT TO RESTRICT CERTAIN DISCLOSURES OF PHI TO HEALTH PLANS: You have the right to restrict certain disclosures of PHI to a health plan when you have paid, in full, for the health care item or service you wish you to restrict. To request this restriction, you must complete, in writing a Request for Privacy Restrictions and Alternative Communications form. We will honor this request except under certain circumstances including when the disclosure is required by law.
RIGHT TO REQUEST ALTERNATIVE COMMUNICATIONS: You have the right to request that we communicate with you about medical matters or billing information in a certain way or location. If you choose to request alternative communications, you may do so in writing, using the Request for Privacy Restrictions and Alternative Communications form to specify how or where you wish to be contacted. We will not ask for the reason for your request but we may ask for clarification. We will accommodate your request if it is reasonable for us to do so.
RIGHT TO REVIEW AND OBTAIN A COPY: You have the right to review and obtain a copy of your medical information that we use for making decisions about your care. Usually, this includes medical records, prescription records, and billing records.
To review and obtain a copy of your medical records you must submit your request in writing to either the Director of Health Information Management or the Privacy Contact, using the Authorization to Release Information form. We may charge a fee that including, but not limited to, costs for copying, labor and supplies, and the cost of postage.
We may deny your request to review or obtain a copy your records in certain, limited circumstances. If your request is denied, you will be told in writing. In some instances, you may request that the denial be reviewed. We will comply with the outcome of the review and you will be advised in writing of the reviewing official’s decision.
RIGHT TO AMEND YOUR RECORDS: If you feel that health information we have recorded about you is incorrect or incomplete, you may ask us to amend or change the information (for as long as it is maintained by the Olathe Health System). To request an amendment, you must submit the request in writing, using the Request for Amendment of the Designated Record Set form, to the Director or Health Information Management, your designated Privacy Contact or the Director of Pharmacy Express as applicable. You must state specifically the reason that supports your request. We may deny your request for an amendment if these criteria are not met. In addition, we may deny your request if you ask us to amend information that:
- Was not created by the Olathe Health System, unless the person or entity that created the information is no longer available to make the amendment;
- Is not part of the health information kept by or for the Olathe Health System;
- Is not part of the information which you would be permitted to inspect and copy; or
- Is accurate and complete.
RIGHT TO ACCOUNTING OF DISCLOSURES: You have the right to request an “accounting of disclosures.” This is a list that includes disclosures of your PHI for purposes other than treatment, payment and health care operations. To request this list, you must complete, in writing, the Request for Accounting of Disclosures form, and return it to the Privacy Contact. You may be charged for the cost of providing the list. Once notified of the cost, you may withdraw or modify your request before any costs are incurred.
RIGHT TO RECEIVE BREACH OF PHI NOTIFICATION: You have a right to be notified if we determine that there has been a breach of your PHI.
YOUR RIGHTS REGARDING ELECTRONIC HEALTH INFORMATION TECHNOLOGY: Olathe Health System participates in electronic health information technology (HIT). This technology allows a provider or a health plan to make a single request through a health information organization (HIO) to obtain electronic records for a specific patient from other HIT participants for purposes of treatment, payment, or health care operations. HIOs are required to use appropriate safeguards to prevent unauthorized uses and disclosures.
You have two options with respect to HIT. First, you may permit authorized individuals to access your electronic health information through an HIO. If you choose this option, you do not have to do anything. Second, you may restrict access to all of your information through an HIO (except as required by law). If you wish to restrict access, you must submit the required information either online at http://www.KanHIT.org or by completing and mailing a form. This form is available at http://www.KanHIT.org. You cannot restrict access to certain information only; your choice is to permit or restrict access to all of your information. If you have questions regarding HIT or HIOs, please visit http://www.KanHIT.org for additional information. If you receive health care services in a state other than Kansas, different rules may apply regarding restrictions on access to your electronic health information. Please communicate directly with your out-of-state health care provider regarding those rules.
RIGHT TO A PAPER COPY OF THIS NOTICE: You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice through email, you are still entitled to a paper copy of this notice. To obtain a paper copy of this notice, you may call or write to the Privacy Officer or visit our website at www.olathehealth.org.
We are committed to protecting the privacy and confidentiality of your personal health information. If you believe that your privacy rights have been violated, you may call our Privacy Contact at the phone number below or file a written complaint with the Chief Privacy Officer, Olathe Medical Center, 20333 West 151st Street, Olathe, KS 66061. You may also send your complaint to the Secretary of the U.S. Department of Health and Human Services. You will not be penalized for filing a complaint.
Changes to this Notice
We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for health information we already have about you as well as any information we receive in the future. Copies of the current notice are posted in our facilities. You will find the date the notice became effective on the first page. You may request a copy of the notice currently in effect.
For information on how to submit your written requests or if you have any questions about this notice or our privacy practices, you may call us at 913-791-3548 or our toll-free number at 1-855-340-4200
OHSI No. 1284.2