This notice, effective Sept. 1, 2013, describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.
Samaritan Health Services (SHS) respects our patients’ privacy and is committed to protecting the privacy of your information. We understand that your health and financial information is very personal and we will not use or disclose that information other than as provided for in this Notice. HIPAA and other privacy-related federal and state laws and rules protect the privacy of the health and financial information created and obtained in providing care and services to you. Protected health information includes, but is not limited to, symptoms, test results, diagnoses, treatment, health information from other providers, and billing and payment information relating to these services.
We are required by law to maintain the privacy of protected health information, to provide you with a notice of our legal duties and privacy practices with respect to that information (SHS Notice of Privacy Practices), and to abide by the terms of this Notice currently in effect.
Uses and Disclosures for Treatment, Payment and Health Care Operations
HIPAA and other privacy-related laws and rules allow us to use and disclose your protected health information for purposes of treatment, payment and health care operations.
• Treatment — We may use or disclose your health information in order to provide treatment. For example, we may share information regarding whether you have diabetes to a physician treating you for a broken leg so that they may best treat you since diabetes may slow the healing process. We may also provide health information to other health care professionals providing you with medical care to help them stay informed about the progress of that treatment.
• Payment — We may use and disclose medical information so that the treatment and services you receive at one of our facilities may be billed to and payment collected from you, an insurance company or other third party. For example, we may need to give your health plan medical information about surgery you received at a SHS hospital so your health plan will pay us or reimburse you for the surgery. We may also tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment.
• Health Care Operations — Health information may be used and disclosed for SHS operations, for example to conduct or arrange for services, including: business planning, development and management; medical review; legal services; risk management; auditing functions, including fraud and abuse detection and compliance programs. These uses and disclosures are necessary to run SHS and ensure that all of our patients receive quality care. Forexample, we use and disclose your health information to assess quality and improve services and/or review the qualifications and performance of our health care providers and train our employees.
• Organized Health Care Arrangement — SHS is part of an organized health care arrangement with medical staff that have privileges at SHS facilities. This means that SHS and such medical staff work together to provide health care in a clinically integrated setting. We may use or disclose your health information for the treatment, payment or health care operations of this organized health care arrangement.
Uses and Disclosures of Your Health Information We May Make Unless You Object:
• Facility Directory — The following information is maintained in a facility directory and may be provided to people who ask for you by name, unless you object: location in the SHS facility, general condition and religious affiliation (which will only be shared with clergy). You have the right to object to this disclosure of this information. If you object, then we will not include your information in the facility directory, we will not tell callers or visitors that you are a patient, and we will have to return letters and deliveries (such as flowers) that are addressed to you at the facility.
• Involvement in Care or Payment — We may disclose relevant health information to a friend, family member or other person who is involved in your medical care or who is responsible for payment of your medical care. You have the right to object to such disclosures.
• Notification — We may notify a family member, a personal representative or another person responsible for your care of your location and general condition. We also may disclose this information to a public or private organization authorized by law or its charter to assist in disaster relief efforts to assist with disaster relief coordination. If you object, we will not disclose such information.
• Appointment Reminders, Treatment Alternatives, and Health-Related Benefits and Services — We may contact you to remind you about appointments and provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you.
• Fundraising and/or Marketing Communications — We may contact you about fundraising activities or to market health-related services or benefits. You have the right to opt-out of this type of communication by contacting the SHS Foundation or SHS Marketing departments or the SHS Privacy Office. SHS will not sell your information to any third party.
Uses and Disclosures of Your Health Information That do Not Require Your Authorization (Special Situations)
• Medical Research — We will generally ask for your authorization before using or disclosing your protected health information for research. In limited circumstances, we may use or disclose your protected health information for research purposes without your authorization if an Institutional Review Board (or Privacy Board) determines that authorization is unnecessary because there is minimum risk to your privacy and appropriate privacy protections are in place, or to researchers preparing to conduct a research project.
• To Funeral Directors/Coroners — We may disclose health care information to a coroner, medical examiner or funeral director as authorized by law.
• To Organ Procurement Organizations — We may disclose health care information as is necessary to facilitate organ or tissue donation and transplantation.
• As Required by Federal, State or Local Law — We will disclose health care information when required to do so under federal, state or local law.
• For Law Enforcement Purposes — We may disclose health care information as required by law or as directed by a court order, warrant, criminal subpoena or other lawful process, in response to other law enforcement requests where the law enforcement official provides certain assurances, in other limited circumstances for purposes of identifying or locating suspects, fugitives, material witnesses, missing persons or crime victims, and for other limited law enforcement purposes.
• Pursuant to Lawful Subpoena or Court Order — We may disclose health care information in response to a court or administrative order. We also may disclose health care information in response to a civil subpoena, discovery request, or other lawful process but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.
• To Report Suspected Abuse or Neglect — When required or authorized by law, we will disclose health care information to appropriate government authorities to report suspected abuse, neglect or domestic violence.
• To Avert a Serious Threat to Health or Safety — We will use and disclose health care information to avert a serious and imminent threat to your health or safety or to the health and safety of the public or another person.
• To Correctional Institutions — If you are an inmate or under the custody of a law enforcement official, we may release health care information to the correctional institution or law enforcement official. This disclosure would be necessary for the institution to provide you with health care, to protect your health or the health and safety of others, or for the safety and security of the correctional institution.
• To Health and Oversight Agencies — We may disclose health care information to a health oversight agency for activities authorized by law. These activities are necessary to monitor the health care system, government programs, and compliance with civil rights laws. These oversight activities may include audits, investigations, inspections, licensure, and review of compliance with medical information privacy and security laws.
• For Public Health Purposes — We may disclose health care information for public health activities as authorized by law. This would include notifying a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; to prevent or control disease, injury or disability; or to report births and deaths.
• For Food and Drug Administration (FDA) Surveillance — We may disclose health care information relative to problems and adverse events with food, supplements, medications, and products and product defects, or post marketing surveillance information to enable product recalls, repairs or replacement.
• To Workers’ Compensation Program — We may disclose health care information to the state workers’ compensation program to the extent authorized by law.
• For Work-Related Injuries or Illnesses or Workplace Medical Surveillance — We may disclose health care information where your employer has a duty under state or federal law, to keep records or act on such information.
• To the Military — As required by military command authorities if you are a member of the armed forces, we may disclose health care information. We may also disclose medical information about foreign military personnel to the appropriate foreign military authority.
• For Specialized Government Functions — We may disclose health care information about you to authorized federal officials for activities including intelligence, counterintelligence, and other national security activities authorized by law and for the protective services of the President or others.
• Incidental Disclosures — may occur as a by-product of permitted uses and disclosures of your health care information. For example, a visitor may overhear a discussion about your care at the nursing station. These incidental disclosures are permitted if we have applied reasonable safeguards to protect the confidentiality of your health care information.
• Limited Data Set Information — may be disclosed to third parties for purposes of research, public health and health care operations. Before disclosing this information, direct identifiers are removed and the recipient of the information enters into a contract agreement (containing assurances that the recipient of the information will use appropriate safeguards to prevent inappropriate use or disclosure of the information) limiting how the data may be used or disclosed.
• Personal Representative — We may disclose your protected health information to a personal representative who has legal authority to make health care decisions on your behalf.
Uses and Disclosures of Your Health Information That do Require Your Authorization
Uses and disclosures not in this Notice of Privacy Practices will be made only as allowed or required by law or with your written authorization. For example, we may not use or disclose health information for a marketing purpose without an authorization unless the communication falls under a limited exception. You have the right to revoke an authorization to use or disclose health information at any time, except to the extent we have relied on it to make an authorized use or disclosure, by filling out the appropriate form. Your revocation will not affect medical information that has already been used or disclosed.
Uses and Disclosures of Specially Protected Health Information (Oregon and Federal Law)
Oregon and federal law provides additional confidentiality protections in certain circumstances. For example, in Oregon a health care provider, except in limited circumstances, may not release the identity of a person tested for HIV or the results of an HIV-related test without your consent. You must be notified of this confidentiality right. Drug and alcohol records are specifically protected and typically require specific consent for release under both federal and state law. Mental health records are specially protected in some circumstances, as is genetic information. For more information on Oregon law related to these and other specially protected records, contact the SHS Privacy Officer (address and phone number listed below) or refer to the Oregon Revised Statutes or to the Oregon Administrative Rules. These documents are available online at oregon.gov.
Your Health Information Rights
Please contact the SHS Health Information Management Department or the SHS Privacy office to request forms as noted below.
The medical and billing records we create and store are the property of SHS. The protected health information in it, however, generally belongs to you.
You have a right to:
• Inspect and copy medical information that may be used to make decisions about your care. Usually, this includes medical and billing records, but does not include psychotherapy notes. You may request an electronic copy of information maintained in our electronic medical record. To inspect and copy your medical information, you must complete a request form for that purpose. As authorized by law, SHS may charge a fee for the costs incurred in complying with your request which may include copying, mailing or other supplies. Your request to inspect and copy may be denied in certain very limited circumstances. If you are denied access to medical information, you may request that the denial be reviewed.
• Amend your medical information if you believe that the information is incorrect or incomplete. You must complete a request form to request an amendment. We will put any denial in writing and explain our reasons for that denial. You have the right to respond with a written statement of disagreement to our explanation of denial, and to require that your request, our denial and your statement of disagreement, if any, be included in any future disclosures of your medical record.
• An accounting of disclosures of your health information in the previous six years. The Privacy Rule does not require accounting for disclosures: (a) for treatment, payment or health care operations; (b) to the individual or the individual’s personal representative; (c) for notification of or to persons involved in an individual’s health care or payment for health care, for disaster relief or for facility directories; (d) pursuant to an authorization; (e) of a limited data set; (f) for national security or intelligence purposes; (g) to correctional institutions or law enforcement officials for certain purposes regarding inmates or individuals in lawful custody; or (h) incident to otherwise permitted or required uses or disclosures. Accounting for disclosures to health oversight agencies and law enforcement officials must be temporarily suspended on their written representation that an accounting would likely impede their activities. You may receive an Accounting of Disclosure without charge once every 12 months and we will notify you of the cost involved if you request this information more than once in 12 months.
• Request confidential communications by alternative means or at alternative locations. For example, you may ask that we only contact you at work or by mail. You must complete a request form and we will accommodate any reasonable request subject to arrangement of payment for any additional costs.
• Request a restriction or limitation of the medical information used and disclosed. You must complete a request form for a restriction or limitation. We are required to comply with your request for a restriction of disclosure to a health plan for purposes of payment or health care operations if you paid in-full, out-of-pocket, for the health care item or service. We will attempt to accommodate other reasonable requests but are not required to agree to other requests for restriction.
• Receive a paper copy of the Samaritan Health Services Notice of Privacy Practices. You may ask us to give you a copy at any time, even if you have agreed to receive it electronically. We encourage you to read and ask questions about this Notice of Privacy Practices. For help with these health information rights during normal business hours, please contact the SHS Health Information Management Department or the SHS Privacy Officer (contact information listed below).
The Electronic Medical Record
To promote quality care, SHS operates an electronic medical record (EMR). SHS providers and some providers unaffiliated with SHS may have access to the EMR. Your medical record may be comprised of information in the EMR as well as in a paper record. SHS is legally obligated to notify any individual whose protected health information is affected by a security breach.
Contact and Complaints
If you believe your privacy rights have been violated, you may discuss your concerns with any SHS employee. You may also contact the SHS Privacy Officer by mail, email, or by telephone through the HIPAA Hotline using the contact information below. You may also file a complaint with the U.S. Secretary of Health and Human Services. We respect your right to file a complaint with us or with the Office for Civil Rights, U.S. Secretary of Health and Human Services. If you choose to file a complaint, we will not retaliate against you.
• Mail: Samaritan Health Services
ATTN: SHS Privacy Officer
3600 NW Samaritan Drive
Corvallis, Oregon 97330
• Email: email@example.com
• Phone: HIPAA Hotline at 541-768-6218
• Website: The SHS Notice of Privacy Practices and Privacy Contact Information are also available on the SHS website: samhealth.org.
Revising the Samaritan Health Services Notice of Privacy Practices
We reserve the right to change the terms of this Notice of Privacy Practices and to make any new notice provisions effective for all protected health information created or received prior to the effective date of any such revised notice. If we make changes, we will update the Samaritan Health Services Notice of Privacy Practices and post the revised Notice of Privacy Practices at our service delivery sites and on our website and make the revised Notice available upon request.
Organizations Covered by the Samaritan Health Services Notice of Privacy Practices
This Notice of Privacy Practices applies to employees, volunteers and other workforce members of Samaritan Health Services and their Affiliated Covered Entities identified at samhealth.org/AboutUs.