Effective Date: September 23, 2013
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
About Us
This Notice of Privacy Practices (Notice) describes the privacy practices of Upland Hills Health, Inc., (“Upland Hills Health”) including the hospital and all of its programs and departments and its affiliated clinics.
This Notice also describes the privacy practices of an Organized Health Care Arrangement (OHCA) between Upland Hills Health and its medical staff and other health care professionals authorized to enter information into your medical record at Upland Hills Health. Because Upland Hills Health functions as a clinically-integrated care setting, our patients typically receive health care from more than one health care provider. These entities, individuals, and locations, collectively referred to herein as the “Organization,” will follow the terms of this Notice and may share medical information with each other for treatment, payment, or operations relating to the OHCA. The OHCA does not cover the information practices of non-affiliated practitioners or their employees in their private offices or at other locations where they may practice.
In this Notice, we use terms like “we,” “us,” or “our” to refer to the Organization, its employees, staff, and other workforce members.
Purpose
This Notice describes how we may use and disclose your medical information to carry out treatment, payment, or health care operations and for other purposes that are permitted or required by law. This Notice also describes your rights regarding your medical information and our legal obligations to protect your medical information. Your medical information includes your individually identifiable demographic, medical and payment/insurance information. For example, it includes information about your diagnosis, medications, insurance status and policy number, medical claims history, address and social security number. The Organization is committed to protecting the privacy of patient information as required by federal law and the laws of the State of Wisconsin.
Our Responsibilities
The Organization is required by law to maintain the privacy of your medical information and to provide you notice of our legal duties and privacy practices with respect to your medical information. The Organization is required to comply with terms and conditions of this Notice. Further, the Organization is required to notify you following a breach of your unsecured protected health information. We will provide such notification without unreasonable delay but in no case later than 60 days after we discover the breach.
Uses and Disclosures of your Medical Information Without Authorization
The following categories describe examples of the way we use and disclose your medical information without your written authorization. Where Wisconsin or federal law restricts one of the described uses or disclosures, we follow the requirements of such Wisconsin or federal law. These are general descriptions only. They do not cover every example of use or disclosure within a category.
Treatment: The Organization may use and disclose medical information about you to provide you with medical treatment or services. For example, your medical records may be disclosed to physicians, nurses, or other health care providers who are involved in your care to coordinate or manage your health care services or to facilitate consultations or referrals as part of your treatment.
Payment: The Organization may use and disclose your medical records to send bills and collect payment from you, your insurance company or other third-party payers, for the treatment and other services you may receive during the course of patient care. For example, we may need to give your health insurer or HMO information about your treatment so they can pay the Organization or reimburse you. The Organization may also tell your health insurer or HMO about a treatment you are going to receive in order to obtain prior approval or to determine whether your third-party payer will cover the treatment.
Health Care Operations: The Organization may use and disclose medical information about you for Organization operations. These uses and disclosures are necessary to provide quality care to all Organization patients and to facilitate the functioning of the Organization. For example, we may use your medical information for quality assessment and improvement activities, case management, necessary credentialing, and for other essential activities. We may also disclose your medical information to third party “business associates” that perform various services on our behalf, such as transcription, billing and collection services. In these cases, we will enter into a written agreement with the business associate to ensure they protect the privacy of your medical information. Where allowed by Wisconsin law, the Organization may also furnish other qualified health care organizations with your medical information for their health care operations.
Electronic Health Information Exchange (HIE): In compliance with federal and state laws, we may make your medical information available electronically through one or more electronic health information exchanges (HIEs) in which the Organization participates to other health care providers and health plans that request your information for purposes of treatment, payment, and health care operations, and to public health entities as permitted by law. Participation in an electronic health information exchange also lets us see other providers’ and health plans’ information about you for purposes of treatment, payment, and health care operations. You may have the right to not participate (opt out) of an HIE. You may contact the Organization using the contact information at the end of this Notice for information on how to opt out.
Organizational Directory: Unless you object, the Organization may list your name, where you are in the hospital, a general description of your condition (e.g., fair, stable, etc.), and your religious affiliation in a census directory while you are a patient.
Persons Involved in Your Care or Payment for Your Care: If you verbally agree to the use or disclosure, and in certain other situations, we will make the following uses and disclosures of your medical information. We may disclose to your family, friends, and anyone else whom you identify who is involved in your medical care or who helps pay for your care, medical information relevant to that person’s involvement in your care or paying for your care. We may use or disclose your information to notify or assist in notifying a family member or any other person responsible for your care regarding your physical location, general condition, or death. We may continue to disclose information after your death to a family member or other person who was involved in your care or payment for your care before your death, if relevant to such person’s involvement, unless you have expressed a contrary preference.
As Required by Law: The Organization will disclose your medical records when required to do so by federal, state, or local law. For example, Wisconsin law requires us to report gunshot wounds or other suspicious wounds, including burns, which are reasonably believed to have occurred as the result of a crime to the local police or sheriff.
Public Health Activities: The Organization may disclose your medical records for public health activities, including:
-
To prevent or control disease, injury or disability, to report births and deaths, and for public health surveillance, investigations, or interventions;
-
To report child abuse or neglect;
-
Activities related to the quality, safety or effectiveness of FDA-regulated products;
-
To notify a person who may have been exposed to a communicable disease or may be at risk for contracting or spreading a disease or condition as authorized by law; and
-
To notify an employer of findings concerning work-related illness or injury or general medical surveillance that the employer needs to comply with the law if you are provided notice of such disclosure.
Victims of Abuse, Neglect, or Domestic Violence: The Organization may notify the appropriate government authority if the Organization believes a patient has been the victim of abuse, neglect, or domestic violence. The Organization will only make this disclosure if you agree, or when required or authorized by law.
Health Oversight Activities: The Organization may disclose medical records to a health oversight agency for activities authorized by law, including audits, investigations, inspections, licensure, or disciplinary activities, and other similar proceedings. The Organization may not disclose the medical records of a person who is the subject of an investigation that is not related directly to their receipt of health care or public benefits.
Judicial and Administrative Proceedings: The Organization may disclose confidential medical information in response to a court order if you are involved in a legal proceeding. Under most circumstances when the request is made through a subpoena, a discovery request or involves another type of administrative order, your authorization will be obtained before disclosure is permitted.
Law Enforcement: HIPAA allows the Organization to disclose your medical records, within limitations, to a law enforcement official in the following circumstances:
-
In response to a court order, subpoena, warrant, summons or similar process;
-
To identify or locate a suspect, fugitive, material witness, or missing person;
-
About the victim of a crime if the victim agrees or the Organization is unable to obtain the victim’s agreement;
-
About a death the Organization believes may be the result of criminal conduct;
-
About criminal conduct at the Organization; and
-
To report a crime not occurring on our premises, the nature of a crime, the location of a crime, and the identity, description and location of the individual who committed the crime, in an emergency situation.
However, Wisconsin law may require a court order for the release of confidential medical information in these circumstances. Accordingly, under some limited circumstances we will request your authorization prior to permitting disclosure.
Coroners and Medical Examiners: The Organization may disclose medical records to a coroner or medical examiner to identify a deceased person or determine the cause of death.
Funeral Directors: The Organization may disclose medical information to funeral directors consistent with applicable law, and as necessary to carry out their duties with respect to a deceased person.
Organ and Tissue Donation: The Organization may use and disclose medical records to organizations that handle procurement, transplantation or banking of organs, eyes, or tissues.
Research: Under certain circumstances, the Organization may use and disclose your medical records for research purposes. For example, a research project may involve comparing the health and recovery of all patients who received one medication to those who received another for the same condition. Most research projects, however, are subject to a special approval process. This process evaluates a proposed research project and its use of the medical records, trying to balance the research needs with patients’ need for privacy of their medical records. Your medical records will not be further disclosed to a person not connected with the research and the final research product cannot reveal information that could identify you.
Serious Threat to Health or Safety: If there is a serious threat to your health and safety or the health and safety of the public or another person, the Organization may use and disclose your medical records in a very limited manner to someone able to help prevent the threat.
Specialized Government Functions: In certain circumstances, the Privacy Rules authorize the Organization to use or disclose your medical records to facilitate specified government functions:
-
Military and Veterans. The Organization may disclose the medical records of armed forces personnel as required by military command authorities for the proper execution of a military mission or for the purpose of determining eligibility for benefits. Medical records about foreign military personnel may be disclosed to foreign military authorities.
-
National Security and Intelligence Activities. The Organization may disclose your medical records to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
-
Protective Services for the President and Others. The Organization may disclose your medical records to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.
-
Inmates and Law Enforcement Custody: If you are an inmate of a correctional institution or you are under the custody of a law enforcement official, the Organization may release your medical records to the correctional institution or law enforcement official, where necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
Workers’ Compensation: The Organization may disclose your medical records as authorized by law to comply with laws related to workers’ compensation or similar programs that provide benefits for work-related injuries or illness.
Incidental Uses and Disclosures: There are certain incidental uses or disclosures of your information that occur while we are providing service to you or conducting our business. For example, after surgery the nurse or doctor may need to use your name to identify family members that may be waiting for you in a waiting area. Other individuals in the same area may hear your name called. We will make reasonable efforts to limit these incidental uses and disclosures.
Authorization to Use or Disclose Medical Information
Other uses and disclosures of medical information not covered by this Notice will be made only with your written authorization. Some examples include:
-
Psychotherapy Notes. We usually do not maintain psychotherapy notes about you. If we do, we will only use and disclose them with your written authorization except in limited situations.
-
Marketing. We will not use or disclose your medical information for marketing purposes without your written authorization except as otherwise permitted by law.
-
Sale of Protected Health Information. We will not sell your medical information without your written authorization except as otherwise permitted by law.
If you authorize the Organization to use or disclose your medical information, you may revoke that authorization, in writing, at any time. If you revoke your authorization, the Organization will no longer use or disclose your medical information as specified by the revoked authorization, except to the extent the Organization has taken action in reliance on your authorization.
Fundraising
We may use your demographic information (such as name, contact information, age, gender, and date of birth), the dates you received services from us, the department of your service, your treating physician, outcome information, and health insurance status to contact you in an effort to raise money for the benefit of the Organization. We may also disclose this information to a foundation related to the Organization so that the foundation may contact you to raise money for the Organization. You have the right to opt out of receiving further fundraising communications related to the specific campaign or appeal or all future fundraising communications.
Your Rights Regarding Your Medical Information
This section describes your rights regarding your medical information. All requests or communications to the Organization to exercise your rights discussed below must be submitted in writing to: Upland Hills Health, Attn: Director of Health Information Management, 800 Compassion Way, Dodgeville, WI 53533. We will respond to your request on a timely basis in accordance with our written policies and as required by law.
Right to Request Restrictions: You have the right to request restrictions on the Organization’s uses or disclosures of medical information about you for treatment, payment or health care operations. You also have the right to request a restriction on the Organization’s disclosure of your medical information to someone who is involved in your care or the payment for your care.
The Organization is not required to agree to your request in most circumstances. If the Organization does agree, it will comply with your request unless the information is needed to provide you emergency treatment. The Organization is required to agree to a request that the Organization restrict a disclosure made to a health plan for payment or health care operations purposes that is not otherwise required by law, if you, or someone other than the health plan on your behalf, paid for the service or item in question out-of-pocket in full. Because we are a clinically-integrated care setting, several different providers may provide services to you during a single encounter. You must make a separate request to each independent provider from whom you will receive services that are involved in your request for any type of restriction. Contact the Director of Health Information Management at the address listed above if you have questions regarding which providers will be involved in your care.
Your request must clearly specify the requested restriction, the medical information to which the requested restriction applies (e.g., types of medical information or dates of medical information), and to whom you want the restriction to apply.
Right to Request Confidential Communications: You have the right to request that the Organization communicate with you about the services you receive from the Organization in a certain way or at a certain location. For example, you may ask that the Organization only contact you at work, or only at home, or only by mail. You may request that we communicate with you when family members are not present.
The Organization will not ask you the reason for your request, and will accommodate all reasonable requests.
Right to Inspect and Copy: You have the right to inspect and to receive a copy of your medical information. A request to inspect and to receive a copy of your medical information should be made on a Disclosure Release. You may obtain a copy of the Organization’s Disclosure Release by contacting our Health Information Management Department in person or by telephone (608-930-8000). Please note that a request to inspect your medical information means that you may examine records between the hours of 8 a.m. and 4:30 p.m., Monday through Friday, and you will be supervised at all times while you are examining your medical information. If you request a copy of the information, the Organization may charge a reasonable cost-based fee for the costs of copying, mailing or other supplies associated with your request. The Organization may not be able to provide copies of your information on the day of the request, and will arrange with you a date on which the information will be available.
You may request access to your medical information in a certain electronic form and format if readily producible or, if not readily producible, in a mutually agreeable electronic form and format. Further, you may request in writing that the Organization transmit a copy of your medical information to any person or entity you designate. Your written, signed request must clearly identify such designated person or entity and where you would like the Organization to send the copy.
The Organization may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to your medical information, you may request that the denial be reviewed. The Organization will comply with the outcome of the review.
Right to Amend: If, in your opinion, your medical information is incorrect or incomplete, you may request that the Organization amend your information. You have the right to request an amendment for as long as the information is kept by or for the Organization.
A request to amend your medical information must give the reasons for the amendment. The Organization may deny your request for an amendment if it is not in writing or does not include a reason. The Organization may also deny your request for amendment if it covers medical information that:
Was not created by the Organization, unless you provide a reasonable basis for us to determine that the originator of the information is no longer able to act on your request;
-
Is not part of the designated medical records kept by or for the Organization;
-
Is not available for your inspection by law; or
-
Is accurate and complete.
If we deny your request for amendment, the Organization will notify you in writing of the reason for the denial and give you the opportunity to file a written statement of disagreement with us that will become part of your medical record.
Right to an Accounting of Disclosures: You have the right to request an accounting of certain disclosures the Organization makes of your of medical information. Your request must specify a time period, which may not be longer than six years. The first accounting from the Organization within a 12-month period will be free; for additional accounting(s) in that 12-month period, the Organization may charge you for its costs after notifying you of the cost involved and giving you the opportunity to withdraw or modify your request before any costs are incurred.
Right to a Paper Copy of This Notice: You have the right to a paper copy of this Notice at any time, even if you previously agreed to receive this Notice electronically or have previously received this Notice. To obtain a paper copy of this Notice, pick one up at our main entrance reception desk or contact the Director of Health Information Management in writing at the address above.
A copy of the current version of this Notice of Privacy Practices is available online at www.uplandhillshealth.org.
Amendments to This Notice
The Organization reserves the right to amend this Notice at any time. We may be required to amend this Notice from time to time due to changes in federal or Wisconsin law that affect uses and disclosures of your medical information, your rights under this Notice, or the Organization’s legal duties under this Notice. Each version of the Notice will have an effective date on the first page. The Organization reserves the right to make the amended Notice effective for medical information the Organization has at the time the amendment is made, as well as any medical information the Organization may receive or create in the future.
You may obtain a copy of the revised Notice at any time on our website (www.uplandhillshealth.org) or by speaking to the front-desk representative at any Organization location.
Complaints
If you believe your privacy rights have been violated, you may file a complaint in writing with the Secretary of the Department of Health and Human Services or with the Organization. Complaints to the Organization should be made in writing to the Quality Coordinator/Risk Manager, Upland Hills Health, 800 Compassion Way, Dodgeville, WI 53533. You will not be intimidated, threatened, coerced, discriminated against or otherwise retaliated against for filing a complaint.
Contact Person
If you have questions about this Notice, please contact the Quality Coordinator/Risk Manager at 608-930-7200, Extension.4060, or in writing at Upland Hills Health, 800 Compassion Way, Dodgeville, WI 53533.
