Notice of Privacy Practices
This notice describes how medical information about you, as a patient, may be used and disclosed and how you can get access to your individual, identifiable health information. Please review this notice carefully.
Use and Disclosure of Health Information
We are required by law to maintain the privacy of Protected Health Information (PHI). We are required to provide this Notice of Privacy Practices to you by the privacy regulation issued under the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA). This notice describes how we protect the PHI we have about you that relates to your medical information. PHI is medical and other information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related health care services. This Notice of Privacy Practices describes how we may use and disclose to others your PHI to carry out payment or healthcare operations and for other purposes that are permitted or required by law. It also describes your rights to access and control of your PHI.
How We May Use and Disclose Protected Health Information About You
The following describes the ways we may use and disclose health information that identifies you. Except for the purposes described below, we will use and disclose health information only with your written permission. You may revoke such permission at any time by writing to our Privacy Officer.
To Provide Treatment
The organization may use your PHI to coordinate care within the organization and with others involved in your care, such as your attending physician, members of the organization interdisciplinary group and other health care professionals and volunteers who have agreed to assist the organization in coordinating care. For example, physicians involved in your care will need information about your symptoms in order to prescribe appropriate medications. The organization also may disclose your PHI to individuals outside of the organization involved in your care including family members, clergy whom you have designated, pharmacists, suppliers of medical equipment or supplies and other health care professionals that the organization uses in order to coordinate your care.
To Obtain Payment
The organization may include your PHI in invoices to collect payment from third parties for the care you may receive from the organization. For example, the organization may be required by your health insurer to provide information regarding your health care status so that the insurer will reimburse you or the organization. The organization also may need to obtain prior approval from your insurer and may need to explain to the insurer your need for organization care and the services that will be provided to you.
To Conduct Health Care Operations
The organization may use PHI for its own operations in order to facilitate the function of the organization and as necessary to provide quality care to all of the organization's patients. Health care operations includes such activities as:
- Quality assessment and improvement activities.
- Activities designed to improve health or reduce health care costs.
- Protocol development, case management and care coordination.
- Contacting health care providers and patients with information about treatment alternatives and other related functions that do not include treatment.
- Professional review and performance evaluation.
- Training programs including those in which students, trainees or practitioners in health can learn under supervision.
- Fundraising for the benefit of the organization and certain marketing activities. You have the right to opt out of fundraising communications from the organization and the organization cannot sell your PHI without your permission.
To Contact You
We may use and disclose PHI to contact you to remind you that you have an appointment with us. We also may use and disclose PHI to tell you about treatment alternatives or health-related benefits and services that may be of interest to you.
To Contact Individuals Involved in Your Care
Unless you object, we may share your PHI with a person who is involved with your medical care or payment for your care, such as your family, a close friend or any other person you identify. We also may notify your family about your location or general condition. If you are unable to agree or object to such a disclosure, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgment.
To Conduct Research
Under certain circumstances, we may use and disclose PHI for research. For example, a research project may involve comparing the health of patients who received a treatment to those who received another, for the same condition. We also may permit researchers to look at records to help them identify patients who may be included in their research project or for other similar purposes, as long as they do not remove or take a copy of any PHI.
To Coordinate Services with Business Associates
We may disclose PHI to our business associates that perform functions on our behalf or provide us with services if the information is necessary for such functions and/or services. For example, we may use another company to perform billing services on our behalf. All of our business associates are obligated to protect the privacy of your PHI and are not allowed to use or disclose any information other than as specified in our contract.
To Communicate in Disaster Relief Situations
We may disclose your PHI to disaster relief organizations that seek your PHI to coordinate your care, or notify family and friends of your location or condition in a disaster. We will provide you with an opportunity to agree or object to such a disclosure whenever we practically can do so.
Special Situations
As Required by Law
We will disclose PHI when required to do so by international, federal, state or local law.
For Lawsuits and Disputes
The organization may disclose your PHI if you are involved in a lawsuit or a dispute. We may also disclose PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.
For Law Enforcement Purposes
The organization may disclose your PHI to a law enforcement official for law enforcement purposes as follows: (1) In response to a court order, warrant, subpoena, summons or similar process; (2) Limited information to identify or locate a suspect, fugitive, material witness or missing person; (3) when you are the victim of a crime even if under certain limited circumstances, we are unable to obtain your agreement; (4) About a death we believe may be the result of criminal conduct; and (5) In an emergency to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime.
To Coroners and Medical Examiners
The organization may disclose your PHI to coroners and medical examiners for purposes of determining your cause of death or for other duties, as authorized by laws. This includes disclosure of PHI for the purposes of whole body and organ donation.
To Funeral Directors
The organization may disclose your PHI to funeral directors consistent with applicable laws and if necessary, to carry out their duties with respect to your funeral arrangements. If necessary to carry out their duties, the organization may disclose your PHI prior to and in reasonable anticipation of your death.
In the Event of a Serious Threat to Health or Safety
The organization may, consistent with applicable law and ethical standards of conduct, disclose your PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.
Data Breach Notification Purposes
The organization may use or disclose your PHI to provide legally required notices of unauthorized access to or disclosure of your health information.
Organ and Tissue Donation
The organization may use or release health information to organizations that handle organ procurement or other entities engaged in procurement, banking or transportation of organs, eyes or tissues to facilitate organ, eye or tissue donation and transplantation.
Military and Veterans
The organization may release health information as required by military command authorities if you are a member of the armed forces. We may release health information to the appropriate foreign military authority if you are a member of a foreign military.
Public Health Risks
The organization may disclose PHI for public health activities. These activities generally include disclosures to prevent or control disease, injury or disability; report deaths; report abuse or neglect; report reactions to medications or problems with products; notify people of recalls of products that they may be using; a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; and the appropriate government authority if we believe a patient has been the victim of abuse, neglect, or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.
Health Oversight Activities
The organization may disclose PHI to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
National Security and Intelligence Activities
The organization may release PHI to authorized federal officials for intelligence, counter-intelligence, and other national security activities authorized by law.
Protective Services for the President and Others
The organization may disclose PHI to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or to conduct special investigations.
Inmates or Individuals in Custody
If you are under the custody of law enforcement, we may release your PHI to the correctional institution or law enforcement official. This release would be if necessary: (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) the safety and security of the correctional institution.
For Worker's Compensation
The organization may release your health information for worker's compensation or similar programs.
Authorization to Use or Disclose Health Information
We are required to abide by the terms of this Notice of Privacy Practices. Other than as stated above, the organization will not disclose your PHI, except with your written authorization. Other uses and disclosures of Protected Health Information not covered by this Notice or the laws that apply to us will be made only with your written authorization. If you or your representative authorizes the organization to use or disclose your PHI, you may revoke that authorization in writing at any time. However, disclosures made in reliance on your authorization before you revoked it will not be affected by tee revocation.
Your Rights with Respect to Your Health Information
You have the following rights regarding your PHI that the organization maintains:
Right to Request Restrictions
You have the right to request a restriction or limitation on the PHI we use or disclose for treatment, payment, or health care operations. You may also have the right to request a limit on the PHI we disclose to someone involved in your care or the payment for your care, like a family member or friend. We are not required to agree to your request unless you are asking us to restrict the use and disclosure of your PHI to a health plan for payment or health care operation purposes and such information you wish to restrict pertains solely to a health care item or service for which you have paid us “Out-of-pocket” in full. If we agree, we will comply with your request unless the information is needed to provide you with emergency treatment. If you wish to make a request for restrictions, please contact the Privacy Officer.
Out-of-Pocket Payments
If you paid out-of-pocket (or in other words, you have requested that we not bill your health plan) in full for a specific item or service, you have the right to ask that your PHI with respect to that item or service not be disclosed to a health plan for purposes of payment or health care operations, and we will honor that request.
Right to Receive Confidential Communications
We will accommodate any reasonable request you might make to receive communications of PHI from us by alternative means or at alternative locations. The request for a confidential communication must be received in writing and specify how or where you wish to be contacted. The organization will not request that you provide any reasons for your request and will attempt to honor your reasonable request for confidential communications.
Right to Inspect and Copy Your Health Information
You have the right to inspect and copy your PHI, including billing records. A request to inspect and copy records containing your PHI may be made to the Privacy Officer. If your PHI is maintained in an electronic format (known as an electronic medical record), you have the right to request an electronic copy of your record be given to you or transmitted to another entity. We will make every effort to provide access to your PHI in the form or format you request, if it is readily producible in such form or format. If the PHI is not readily producible in the form or format you request, your record will be provided in either our standard electronic format or if you do not want this form or format, a readable hard copy form. We may charge you a reasonable, cost based fee for the labor associated with copying, assembling, and/or transmitting the PHI associated with your request. We will not charge you a fee if you need the information for a claim for benefits under the Social Security Act or any other state or federal needs-based benefit program. You will be asked to sign a receipt for your PHI. The organization has the right to deny access to PHI in certain specified situations, such as when a health care professional believes access could cause harm to the individual or another. If denied, you have the right to have such denial reviewed by another licensed health care professional who was not directly involved in the denial of your request, for a second opinion.
Right to Get Notice of a Breach
You have the right to be notified upon a breach of any of your unsecured PHI.
Right to Amend Health Care Information
If you or your representative believes that your health information records are incorrect or incomplete, you may request that the organization amend the records. That request may be made as long as the information is maintained by the organization. A request for an amendment of records must be made in writing to the Privacy Officer. The organization may deny the request if it is not in writing or does not include a reason for the amendment. The request also may be denied that PHI was not created by the organization, if the records you are requesting are not part of the organization's records, if the PHI you wish to amend is not part of the PHI you or your representative are permitted to inspect and copy, or if, in the opinion of the organization, the records containing your PHI are accurate and complete.
Right to an Accounting of Disclosures
You or your representative have the right to request an accounting of disclosures of your PHI made by the organization for any reason other than for treatment, payment or health operations for the previous six years if records are maintained in paper form. You have the right to receive an accounting of all disclosures made from the electronic medical record during the three years prior to the date of request. The request for an accounting must be made in writing to the Privacy Officer. The request should specify the time period for the accounting. The organization will provide the first accounting you request during any 12-month period without charge. Subsequent accounting requests may be subject to a reasonable cost-based fee.
Right to a Paper Copy of This Notice
You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. You may obtain a copy of this notice from the website you are reading or by contacting the Privacy Officer.
Change in Notice
We may change the terms of our notice at any time. The new notice will be effective for all PHI that we maintain at that time. This notice may also be revised if there is a material change to the uses or disclosures of PHI, your rights, our legal duties, or other privacy practices stated in this notice. Following a material revision to this notice an updated Notice of Privacy Practices will be posted on our website. Additionally, upon your request, we will provide you with any revised Notice of Privacy Practices by calling the Privacy Officer at 828-466-0466 and requesting that a revised copy be sent to you in the mail. The notice will contain the effective date on the bottom of the last page.
Complaints
If you think that we have violated your privacy rights, you have the right to file a complaint with us or with the Secretary of the US Department of Health and Human Services. The organization will not retaliate against anyone that files a complaint. To file a complaint with us, please contact the Privacy Officer, Carolina Caring, 3975 Robinson Road, Newton, North Carolina 28658. Telephone: 828.466.0466.
Effective Date
This Notice becomes effective September 16, 2013.