HIPAA – Notice of Patient Privacy Practices
Effective date: September 23, 2013
Notice of Privacy Practices as required by the privacy regulations created as a result of the Health Information Portability and Accountability Act of 1996 (HIPAA).
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
Who Will Follow This Notice
This notice describes the privacy practices of Rehoboth McKinley Christian Health Care Services (RMCHCS). Healthcare professionals who care for you, employees who enter information into your healthcare records and all other RMCHCS staff members will follow the rules of this notice. In addition, RMCHCS may share your medical information with each other for treatment, payment or administrative purposes as described in this notice.
Our Pledge Regarding Medical Information:
We understand that your individually identifiable health information (also called protected health information, or PHI) is important, personal and needs to be protected. We are committed to protecting your PHI. In conducting the operations of RMCHCS, we will receive information and create records regarding you and the treatment and services we provide to you. This notice applies to all records containing your PHI that are created or retained by RMCHCS. This notice will tell you about the ways in which we may use and disclose your PHI. It also describes your rights in your PHI and certain obligations we have regarding the use and disclosure of PHI.
The Law requires us to:
- Make sure that medical information that identifies you is kept private
- Give you this notice of our legal duties and privacy practices with respect to medical information about you
- Follow the terms of the notice that is currently in effect
What About Changes to This Notice?
We have the right to change parts of this notice, if needed. Any revision or amendment to the notice will be effective for all of your records that RMCHCS has created or maintained in the past, and for any of your records that we may create or maintain in the future. If we do make changes, we will post a copy of the new notice at RMCHCS. Every time you come in for healthcare services or treatment, we will offer you the latest copy of this notice.
How May We Use and Share Your PHI?
While we will not list all the ways in which we may use and share your PHI below is a list of all the categories in which we are permitted to use and disclose PHI. Within each category, we have provided some examples of how your PHI may be used or shared:
For treatment: Your healthcare team will need to be given your PHI so they can provide you with the right treatment or service. We may disclose PHI about you to such individuals as your doctor, nurse or a technician. Your healthcare team will be adding information about such things as x-rays, laboratory work and medications to your records. Some of this information may need to be shared with family members or with people outside of RMCHCS who may be involved in your medical care.
For payment: We may use and share PHI about you so we can send out our bills. We may use and share information about a treatment you are going to receive to get prior approval or to find out if your insurance plan will pay for the treatment.
Appointment reminders: We may also use your PHI to tell you that you have an appointment for treatment or healthcare services.
Other treatments: We may use or share health information to tell you about treatments that you may like to have as part of your healthcare.
Business associates: There may be instances where your PHI will be shared with an outside organization in order to carry out RMCHCS operations, for example, an entity providing some technological support. In each instance, we will enter into agreements with these organizations, which require these organizations to protect your PHI.
People helping with or paying for your care: We may share your PHI with a friend or family member appointed or who qualifies to be your decision maker under New Mexico law. However, any such disclosure will be subject to legal requirements and our privacy practices.
When you allow us: We may also tell your family or friends about your health or may share minimally necessary amount of PHI about you to someone helping when there is a disaster relief effort so your family can be told about your health status and where you are.
Fundraising: Many RMCHCS patients want information about donations to our non-profit, the RMCHCS Foundation and information about other fundraising opportunities and activities, and we periodically provide such information. When providing such information, we only use contact information, such as your name, address and phone number and the dates you received treatment of services. However, you have the right opt out of any fundraising communications with each solicitation. Additionally, if you do NOT want RMCHCS to give you this information in any instance , please call the RMCHCS Privacy Officer at 505.863.7265u
Research: With special cases, we may use and share minimally necessary PHI about you for research use. All research, however, needs special permission. Before we use or share PHI for research, you must sign an approval of research form.
By law: We will share minimally necessary PHI about you when we must do so because of federal, state or local law.
Health and safety problems: We may use and share a minimal amount of PHI about you as needed to prevent a serious threat to your own health and safety or to the health and safety of the public or another person. We would only share with someone who is able to help prevent the threat.
More restrictive state and federal laws: New Mexico law is sometimes more restrictive than HIPAA in several areas. State law is more restrictive when the patient may be entitled to greater access to records than under HIPAA and when under state law the records are more protected from use of disclosure than under HIPAA. Certain federal laws also are more stringent than HIPAA. RMCHCS will follow the most restrictive applicable law. More restrictive laws include health information related to substance abuse and internet privacy laws. More restrictive New Mexico laws include genetic and HIV testing requirements.
Uses and Disclosures Requiring Authorization
Psychotherapy notes: RMCHCS will obtain your authorization prior to using or disclosing psychotherapy notes, except for use by the originator of the psychotherapy notes for treatment, for our own training programs to assist in the improvement of the care we provide, for proper oversight of the originator of the psychotherapy notes and where necessary to defend ourselves in a legal action brought by the subject of the psychotherapy notes.
Marketing: RMCHCS must obtain your authorization prior to using or disclosing PHI for marketing purposes, including subsidized treatment communications, except during face-to-face communication, or when providing a promotional gift of nominal value.
Sale of PHI: Disclosures or uses that may constitute the sale of PHI will only be made if RMCHCS obtains the required authorization from you.
Other uses and disclosures: Prior to any use or disclosure of PHI, which is not described in this notice, RMCHCS will obtain your authorization.
Organ and tissue donors: If you are an organ donor, we may share minimally necessary PHI as needed so organ or tissue donation or transplant can take place.
Armed Forces and Vets: When the appropriate conditions apply, we may use or disclose PHI of individuals who are Armed Forces personnel (1) for activities deemed necessary by appropriate military command authorities; (2) for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits, or (3) to foreign military authority if you are a member of that foreign military services.
Workers’ compensation: We may share minimally necessary PHI as needed for workers’ compensation or other programs. These programs help out with workers’ benefits. State and federal laws control any sharing of this information.
Public health: We may share a minimal amount of PHI as needed for public health activities. These activities generally include the following:
- To prevent or control disease, injury or disability
- To report births or deaths
- To report child abuse or neglect
- To report vulnerable adult abuse
- To report reaction to medications or problems with products
- To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition
- To notify the right government authority if we believe a patient has been the victim of domestic violence. We will only share this information with your permission or when required by law.
Health oversight activities and registries: We may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations and inspections. Oversight agencies that oversee the healthcare system, government benefit programs, other government regulatory programs and civil rights laws.
Lawsuits and claims: We may disclose PHI in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), or in certain conditions in response to a subpoena, discovery request or other lawful process.
The Law: We may share minimally necessary PHI as needed about you if we are asked to do so by an officer of the law:
- In response to a court order, subpoena, warrant, summons or similar process
- To identify or locate a suspect, fugitive, material witness or missing person
- About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement
- About a death we believe may be the result of criminal conduct
- About criminal conduct involving our practice
- In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.
When there is a death: We may also share minimally necessary PHI about you as needed to a health officer, for example, to identify a dead person or to tell the cause of death. We may also share minimally necessary PHI as needed about patients to funeral homes so they can do their jobs.
National safety: We may share a minimal amount of PHI about you as needed to federal law officers, as the law tells us we must.
Inmates: If you are an inmate or under the care of the law, we may need to share minimally necessary PHI about you. This sharing would be needed: (1) for another place to give you healthcare; (2) to protect your health and safety or the health and safety of others or; (3) for the safety and security of the jail or prison.
Rights About Your Healthcare Records
Right to view and copy: You can view and copy the PHI used to make decisions about your care. This includes health and billing records but does not include psychotherapy notes or records or any other PHI that would be impermissible to share by law. To view and copy this PHI, you need to write the RMCHCS Health Information Office. (The address is at the end of this policy.) We may charge a fee for the costs to copy and mail the information to you.
Authorization and revocation: If you provide authorization to use or disclose PHI about you, you may revoke that authorization in writing at any time. If you revoke your authorization, we will no longer use or disclose PHI about you for the reasons covered by your authorization. We are unable to take back any disclosure we have already made with your authorization, and we are required to retain records of the care that we provide to you.
Right to request restrictions on PHI for items and services paid out-of-pocket: In any instance where you or another individual, who is not your health plan, pays out-of-pocket and in full for any service or item that we provide to you, you have the right to request restrictions on the PHI we may disclose to you health plan related to those items and services. We will accommodate all such requests, unless required by law to make a disclosure.
Right to change: If you feel that any of the PHI we have about you is wrong or that something is missing, you may ask us to make changes. As long as the information is kept by RMCHCS, you have a right to ask for a change. To make a change, you can write to the Health Information Office. You need to give us a reason for the change. We may say “no” to your request if it is not in writing or does not include a reason for the change. We may say “no” to your request if you ask us to change information that:
- Was not made by us
- Was made by a person who is no longer here to make the change
- Is not part of the PHI we keep
- Is not part of the PHI you are allowed to look at and copy
- Is right as it is written
Right to a list: You have the right to ask for a list of all the instances in which we have shared your PHI. This does not include people on our staff, but only persons who are not on our staff. To request a list of all the instances in which we have shared your PHI, write to the RMCHCS Health Information Office. You need to give a time period that does not begin before April 14, 2003. The first request will be free. If you ask for this information more than once, we may charge you for the cost of making the list. We will tell you the cost and you can choose to continue, modify or withdraw your request.
Right to receive notification of a breach: We are required to notify you of any instance in which there has been a breach of your unsecured PHI.
Right to ask for information in private: You have the right to ask that we tell you about health matters in a certain way or at a certain place. Maybe you want to ask that we only contact you at work or by mail. To ask to receive yourPHI in private, write to the Health Information Office. Tell us how or where you wish to be contacted. We will do as you ask, if what you ask is within reason.
Right to a copy of this notice: You have the right to a hard copy of this notice. You may ask us to give you a copy of this notice at any time. To request a copy of this notice, write to the RMCHCS Privacy Officer.
Right to ask for limitations on sharing PHI: Your PHI is only shared when necessary. However, you have the right to ask for a limitation on the health information we share about you for treatment, payment or healthcare operations. You have the right to ask for a limitation on the PHI we share about you to someone who is involved in your care or the payment of your care. You also have the right to request a limit on the people who are able to get the information we share. However, we do not need to agree to what you ask, except as outlined in this notice. If we do agree, we will do what you ask unless the information is needed to give you emergency care. RMCHCS does not have to agree to your request for limits, but, we will try to do what you ask if it is within reason.
If you believe your privacy rights have not been honored, you may file a complaint with RMCHCS or with the Secretary of the Department of Health and Human Services. To file a complaint, contact the RMCHCS Privacy Officer at 505-863-7265. All complaints must to be in writing.
If you are a patient in the hospital, your name, location and your health status will be listed in a patient directory and will be shared with anyone who asks for you by name, unless you ask not to be listed in the directory. This information will also be shared with the faith worker you choose – unless you ask that they NOT visit you. Behavioral Health Services (BHS) patients are not put on the patient list.
If you have any questions about his notice, please contact the Privacy Officer at 505 863-7265 or write to : Health Information Office 1901 Red Rock Drive Gallup, New Mexico 87301.