Notice of Privacy Practices

EFFECTIVE MARCH 1, 2018

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.

THE PRIVACY OF YOUR MEDICAL INFORMATION IS IMPORTANT TO US

If you have questions about this notice, please contact our Compliance Line at 1-800-290-1946

Our Legal Duty

We are required by applicable federal and state law to maintain the privacy of your medical information.  We are also required to give you this notice about our privacy practices, our legal duties, and your rights concerning your medical information.  We must follow the privacy practices that are described in this notice while it is in effect.  This notice initially took effect April 13, 2003 and has since been updated, including this update effective March 1, 2018, and will remain in effect until we replace it.

We reserve the right to change our privacy practices and the terms of this notice at any time, provided such changes are permitted by applicable law.  We reserve the right to make the changes in our privacy practices and the new terms of our notice effective for all medical information that we maintain, including medical information we created or received before we made the changes.  Before we make a significant change in our privacy practices, we will change this notice and make the new notice available upon request.

You may request a copy of our notice at any time, and it is available on our website.  For more information about our privacy practices, or for additional copies of this notice, please contact us using the information listed at the end of this notice.

Who Will Follow This Notice

Riverside Healthcare provides health care to our patients in conjunction with physicians and other professionals and organizations. This notice describes our organization’s practices and those participants listed below in our organized health care arrangement.  As such, we may share your medical information and the medical information of others we service with each other as needed for treatment, payment or health care operations relating to our organized health care arrangement.
This notice does not imply any joint venture or any other special association or legal relationship between the hospital and its medical staff. This notice is an administrative tool permitted by federal law allowing the hospital and medical staff to tell you about common
privacy practices.

Along with the hospital, the following participate in our organized health care arrangement:

• Any employee, trainee, volunteer or employed health care professional who treats you
• All corporations, divisions, departments and units of our organization
• Members of our medical staff and their employees or workforce who provide services or support to the physician at the hospital.
• Our employed physicians and their office staff.                                                                   
• Any business associate of Riverside Healthcare with whom we share protected health information                                                                      

Uses and Disclosures of Medical Information

We use and disclose medical information about you for treatment, payment, and health care operations.  Please note that the following are examples and not an exhaustive listing:

Treatment:  We may use or disclose your medical information to a physician or other health care provider in order to provide treatment or health-related services to you or to arrange the next level of care on your behalf.

Payment:  We may use and disclose your medical information to obtain payment for services we provide to you, including but not limited to disclosing your information to a billing company in connection with collections and billing activities.  We may need to give your insurance company your medical information in order to pre-authorize planned services or receive payment for services provided. We may disclose your medical information to another health care provider or entity subject to the federal and state Privacy Rules so they can obtain payment.

Health Care Operations:  We may use and disclose your medical information in connection with our health care operations.  These uses are necessary to make sure that all our patients receive quality care.
Some examples are: 

• Assess the care and outcomes in your case and others like it in our efforts to continually improve the quality and effectiveness of the health care services we provide
• Review of our treatment or services to evaluate the performance of our staff providing your care
• Sending you a satisfaction survey
• Review of information about many of our patients to determine if additional services should be added or perhaps are no longer needed
• Information may be given to our doctors, nurses, medical and health care students, and other personnel to be used for education and learning purposes
• Use in accreditation, certification, licensing or credentialing activities
• We may remove information that identifies you from your medical information, so others may use it for studies in health care delivery without learning who the patients are
• We may disclose your medical information to another provider who has or had a relationship with you and is subject to the same Privacy rules, for their health care operation purposes.

Appointment Reminders:  We may use and disclose medical information to contact you as a reminder that you have an appointment for treatment or medical care at our organization.

To Your Family and Friends: Unless you object, we may disclose your medical information to a family member, friend or other person to the extent necessary to help with your health care or with payment for your health care.
We may use or disclose medical information to notify or assist in the notification of (including identifying or locating) a family member, your personal representative, emergency contact, or other person responsible for your care, your location, your general condition, or for making arrangements in case of your death.
If you are not present, or in the event of your incapacity or an emergency, we will disclose your medical information based on our professional judgment of whether the disclosure would be in your best interest. 
We will also use our professional judgment and our experience with common practice to allow a person to pick up filled prescriptions, medical supplies, or other similar forms of medical information.

Hospital Directory:  We may use your name, your location in our facility, your general medical condition, and your religious affiliation in our facility directories.  We will disclose this information to members of the clergy and, except for religious affiliation, to other persons who ask for you by name.  We will provide you with an opportunity to restrict or prohibit some or all disclosures for facility directories unless emergency circumstances prevent your opportunity to object.  In addition, we may disclose medical information about you to an organization assisting in a disaster relief effort, so your family can be notified about your condition and location.

By Law or Special Circumstances:  We may use or disclose your medical information as authorized by law for purposes deemed to be in the public interest or benefit, including but not limited to:

• as required by law
• for public health activities, including disease and vital statistic reporting, FDA oversight, and prevention or control of disease, injury or disability
• to proper authorities if we reasonably suspect that you are a possible victim of child or adult abuse, neglect, or domestic violence or other crimes
• to the extent necessary to protect your health or safety or the health or safety of others
• to health oversight agencies or government programs or their contractors
• In response to court and administrative orders and other lawful processes
• to law enforcement officials after receiving subpoenas and other lawful processes, concerning crime victims, suspicious deaths, crimes on our premises, reporting crimes in emergencies, and for purposes of identifying or locating a suspect, fugitive, material witness, crime victim, missing person, or other person
• to coroners, medical examiners, and funeral directors
• to organ procurement and tissue donation organizations
• to avert a serious threat to health or safety
• to the military and to federal officials for lawful intelligence, counterintelligence, and national security activities
• to correctional institutions regarding inmates or other individuals in lawful custody
• as authorized by state worker’s compensation laws

Research:  We may use and disclose information to researchers and research partners when our institutional review board has reviewed the research proposal and established protocols to ensure the privacy of your protected health information and approved their research.   

Future Communications: We may use your medical information to contact you with information about health-related benefits and services or about treatment alternatives that may be of interest to you.  We may provide you information by a general newsletter, in person or by way of products or services of nominal value. We may disclose your medical information to a business associate to assist us in these activities.
We may contact you by email or text messaging for appointment reminders, patient surveys, or other general communications if you provide us with your email address and/or mobile telephone number.  You expressly permit this type of contact unless you notify us that you do not want to receive email or text messages.

Fundraising: We may use your medical information to contact you for our fundraising purposes. We will limit our use and disclosure to your demographic information (e.g., name, address, other contact information, age, gender, and date of birth), the dates that health care or other service was provided to you, department or location of service information, treating provider, outcome information, and health insurance status. We may disclose this information to a business associate or an affiliated foundation to assist us in our fund-raising activities. We will provide you, in any fundraising materials, a description of how you may opt out of receiving future fundraising communications.

Organized Health Care Arrangements:  Riverside Healthcare participates in certain health care arrangements with other health care providers, including independent physicians on our medical staff and other organization such as Rush Health.  As a participant in these organized health care arrangements, we share information with other participants for certain joint activities, including utilization review, quality assessment, contracting, and payment.

Use and Disclosure of Certain Types of Medical Information:  For certain types of medical information, we may be required to protect your privacy in ways stricter than we have discussed in this notice. We will not use or disclose your medical information if that disclosure is prohibited or significantly limited by other applicable law unless required by law, pursuant to a valid written authorization; in accordance with appropriate subpoena procedures; or to other persons as may be required or allowed by law. Examples include but are not limited to federal and state laws concerning substance abuse/dependence, mental health and developmental disabilities, AIDS/HIV, and sexually-transmitted disease.

Other Uses of Health Information: Except as permitted by law, we will not sell your medical information or use or disclose it for marketing without your prior written authorization. 

On Your Authorization:  You may give us written authorization to use your medical information or to disclose it to anyone for any purpose.  We may charge a fee for this service, including postage if copies are mailed, as allowed by federal and state laws. If you give us an authorization, you may revoke it in writing at any time.  Your revocation will not affect any use or disclosures permitted by your authorization while it was in effect.  Unless you give us a written authorization, we cannot use or disclose your medical information for any reason except those described in this notice or required/allowed by law.

Your Health Information Rights

Right to Inspect and Copy:  You have the right to look at or get copies of your medical information, with limited exceptions.  You must make a request in writing to obtain access to your medical information.  You may obtain a form to request access by using the contact information listed for our Privacy Officer at the end of this notice.  You may also request access by sending us a letter to the address at the end of this notice.  If you request copies, you may request that we provide them in a format other than on paper (for example, an electronic file), and we will use the format you request unless we cannot practicably do so. We may will charge you a fee for this service, including postage if you want the copies mailed to you, as allowed by federal and state laws.  Contact us using the information listed at the end of this notice for a full explanation of our fee structure.
We may deny your request to inspect and copy in very limited circumstances as allowed by law.  If you are denied access to your medical information, you may request that the denial be reviewed.  Another licensed health care professional chosen by the hospital will review your request and the denial.  The person conducting the review will not be the person who denied your request.  We will comply with the outcome of the review.

Disclosure Accounting:  You have the right to receive a list of instances in which we or our business associates disclosed your medical information for purposes other than treatment, payment, health care operations, as authorized by you, and for certain other activities, for six (6) years from the date of your request.  You must make a request in writing to request a listing of disclosures.  You may obtain a form to request the accounting by using the contact information for our Privacy Officer at the end of this notice.  If you request this accounting more than once in a 12-month period, we may charge you a reasonable, cost-based fee for responding to these additional requests.  Contact us using the information listed at the end of this notice for a full explanation of our fee structure.

Restriction:  You have the right to request that we place certain restrictions on our use or disclosure of your medical information.  We are not required to agree to these additional restrictions except in limited circumstances described below, but if we do, we will abide by our agreement (except in an emergency). Any request for additional restrictions must be in writing.  You may obtain a form to request additional restrictions on the use or disclosure of your medical information by using the contact information for our Privacy Officer listed at the end of this notice.  We will not be bound to the restrictions unless our agreement is formally put in writing and signed by a person authorized to make such an agreement on our behalf. We will grant a request for restriction of disclosure of your protected health information to your health insurer if three conditions are met: (1) the reason we would disclose to the insurer is for payment or health care operations, (2) the disclosure is not required by law, and (3) you or another person has paid us in full for the health care item or service.

Confidential Communication:  You have the right to request that we communicate with you about your medical information by alternative means or to alternative locations. For example, you might request that we contact you at work or by mail. You must make your request in writing. You may obtain a form to request alternative communications by using the contact information listed at the end of this notice. We must accommodate your request if it is reasonable, specifies the alternative means or location, and provides satisfactory explanation how payments will be handled under the alternative means or location you request.

Amendment.  If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information. Your request must be in writing, and it must explain why the information should be amended. You may obtain a form to request an amendment by using the contact information for our Privacy Officer listed at the end of this notice. We may deny your request if we did not create the information you want amended or for certain other reasons.  If we deny your request, we will provide you a written explanation.  You may respond with a statement of disagreement to be attached to the information you wanted amended.  If we accept your request to amend the information, we will make reasonable efforts to inform others, including people you name, of the amendment and to include the changes in any future disclosures of that information.

Electronic Notice:  If you receive this notice on our web site or by electronic mail (email), you are entitled to receive this notice in written form.  Please contact us using the information listed for our Privacy Officer at the end of this notice to obtain this notice in written form.

Health Information Exchange

Riverside Healthcare participates in health information exchanges (HIEs), including Rush Health Connect, the HIE operated by Rush Health.  As a participant, we make patient medical information available electronically to other participating hospitals, physicians, and other authorized users for treatment, payment, and healthcare operations purposes.  We may also receive information about patients from other participants in our HIEs.  These health information exchanges, including Rush Health Connect, may participate in other HIEs on our behalf.  In the future, we may also participate directly in additional regional, state or federal HIEs.

Our participation in Rush Health Connect and other HIEs has been designed to comply with federal and state privacy and security laws.  Access to your medical information through an HIE is limited to authorized users who confirm that they will comply with these laws.  You may elect to opt-out and not allow your health or medical information to be available electronically to other providers through the HIEs in which we participate for treatment.  If you do not want your health or medical information to be shared with other providers through these HIEs, please contact our Privacy Officer using the information listed at the end of this notice to receive an Opt-Out form and return the completed form to that Officer. Note that if you choose to opt-out after your information has been shared through an HIE, information that was previously shared will likely still be available to other participants, although no new information will be shared.  The Chief Privacy Officer can also provide you the form needed to reverse your opt-out should you later choose to make your health information available through the HIEs. Making your information available for treatment through our HIEs is not a condition of receiving care.

Information Sharing Through Our Electronic Medical Record

Riverside Medical Center uses an electronic medical record software called Epic, which has a number of programs, including but not limited to CareEverywhere and Carequality, that allow us to electronically exchange medical information with other healthcare providers. These programs facilitate the electronic sharing and exchange of medical and other individually identifiable health information among health care providers.  Through these programs, we may electronically disclose demographic, medical, billing, and other health-related information about you to other healthcare providers and electronically request and obtain such information from them for purposes including but not limited to facilitating or providing treatment, optimizing continuity of care, reducing the need for unnecessary or duplicative procedures or tests, arranging for payment for healthcare services, or otherwise conducting or administering healthcare operations. If you do not want your health information to be shared through these programs, please contact our Privacy Officer using the information listed at the end of this notice to receive an Opt-Out form and return the completed form to that Officer. The Chief Privacy Officer can also provide you the form needed to reverse your opt-out should you later choose to make your health information available through these programs. Making your information available in this manner is not a condition of receiving care.