What is HIPAA?
HIPAA is an acronym that stands for the Health Insurance Portability and Accountability Act of 1996. Title II of this act contains provisions for "Administrative Simplification":
- Privacy – effective April 14, 2003
- Security – effective April 2005
- Standards for electronic transmission of certain administrative and financial transactions – effective October 2003
The privacy provisions have led to numerous changes in how health information will be used and released by the health center and physicians offices/clinics. Hospitals/clinics everywhere have been busy implementing new procedures to comply with these new rules. However, the changes being implemented will not affect patient care.
One change patients at SRHC will notice is that when they first come to the health center, they will be given a document called "Notice of Privacy Practices". This notice tells patients how their health information will be used, the circumstances under which it will be disclosed, and the rights patients have relating to their health information.
Because of these rules, the public may also notice some changes. For example, members of the public will have to ask for a patient by name in order to obtain their room number or information about them. At the time of patient registration, patients will have the option of determining whether or not to be included in the patient directory:
- I want my name included in the patient directory. I understand that my name, location in the hospital, and general condition may be provided to any person asking about me by name (including phone inquiries), and to members of the clergy (including religious affiliation), my family, individuals involved in my health care, for disaster relief effort, or as required by law.
- I do not want my name included in the patient directory. I understand mail addressed to me will be returned and any flowers sent to me will not be delivered. Any person, including visitors, asking for me by name, including outside telephone calls will not be forwarded and will be told, "There is no one by that name listed in our patient directory."
In addition, patients will be asked during their nursing assessment for the names and phone numbers of up to three "contacts" with whom the health center and providers can verbally discuss your health information.
Patients will also notice that there is one department in the health center that will provide answers to questions about their health information. This is the "Privacy Contact Department" and is located in the Department of Health Information Management at Salina Regional Health Center.
The privacy rules are a big step for health centers and clinics. Anyone can obtain a copy of Salina Regional Health Center's Notice of Privacy Practices by logging onto our website at www.srhc.com or asking for one at the registration desk.
Privacy Contact Department
HIPAA - Patient Privacy
This Notice of Privacy Practices is effective as of April 14, 2003
THIS NOTICE DESCRIBES HOW YOUR HEALTH INFORMATION MAY BE USED, DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This notice serves as a joint notice of privacy practices of this health center and those independent health care providers who provide you care while you are in the health center and do not provide you a separate notice of privacy practice for this specific hospitalization.
UNDERSTANDING YOUR HEALTH INFORMATION -- HOW IT IS USED AND HOW IT MAY BE SHARED WITH OTHERS: There are laws that require we give this Notice to you about what we do with your health information. This Notice is about the health information we keep while you are receiving care in the Hospital.
WHAT IF YOU HAVE QUESTIONS ABOUT THIS NOTICE? If you do not understand this Notice or what it says about how we may use your health information, please contact:
Salina Regional Health Center
400 S. Santa Fe
Salina, KS 67401
(p) 785 452 6897 (f) 785 452 7752
WHAT IS YOUR HEALTH RECORD OR HEALTH INFORMATION? When you go to a hospital, doctor, or other health care provider, a record is made that tells about your treatment. This record will have information about your illnesses, your injuries, signs of illness, exams, laboratory results, treatment given to you, and notes about what might need to be done at a later date. Your health information could contain all kinds of information about your health problems. The hospital keeps this health information and can use this information in many different ways. What we do with your health information and how we can use and share this information is what the rest of this Notice describes.
WHAT ARE THE RESPONSIBILITIES OF THE HOSPITAL WHEN IT COMES TO YOUR HEALTH INFORMATION?
This hospital is required by law to:
• Keep your health information private, only giving it out when allowed by law to do so;
• Explain our legal duty and our rules about keeping your health information private to you;
• Follow the rules given in this Notice;
• Let you know when we can’t agree with a request or demand you may make to restrict the sharing of your health information with others.
• Help you when you want your health information sent in a different way than it usually is sent or to a different place than it usually is sent.
We will not give out your health information without your permission except in certain cases explained in this Notice. There are laws that say we can give out your health information to others without your permission. The Hospital will follow these laws. The Hospital can give out your health information electronically (over computer networks, for example) or by facsimile.
WHAT ARE YOUR HEALTH INFORMATION RIGHTS? Your health information is the physical property of the doctor or hospital that wrote it. The information contained in that health information belongs to you. You have certain rights concerning this health information. The following is a list explaining your rights:
- Inspect and Copy Your Records. This information will usually include medical and billing records. Your information will not have psychotherapy notes and information that is made to be used in a court proceeding or information covered by special laws. If you want to see your health information and get a copy of your health information, you must write a request to the Contact Office. If you are disabled or ill, you can make this request over the phone or in person. You may be charged for copies and mailing. We may refuse your request for your health information. If we refuse you, you will be told in writing. In some cases, you can have the decision to not allow you to see your health information reviewed. A neutral person will review your request and we will do what they say.
- Right to Amend Your Records. If you feel that your health information is not complete or wrong, you can ask that we change it. You can ask that we make a change to your health information for as long as we have it. If you want to make a change to your health information, you must give a good reason for the change. If you don’t put your request for a change in writing and give a good reason, we may not allow the change to be made. We may also refuse your request for change for the following reasons: (1) the information was not created by this Hospital; (2) it is not a part of the health information kept by or for the Hospital; (3) it is not information you are permitted to see or copy; or (4) it is accurate and complete.
- You Have a Right to a List of Individuals to Whom We Gave Your Health Information. To request a list of names to whom we gave your health information, you must write a request to the Hospital. You have to include a time period in your request. The time period can be no longer than six (6) years and you cannot request a list of names that covers the time period before April 14, 2003. You should tell us in what form you want the list (paper copy, electronically, or some other form). We can provide you with one list at no cost for any given 12 month period. You will be charged for any additional lists within the year period.
- You Have the Right to Ask for a Restriction. You have the right to ask that we restrict or limit some part of your health information. You can also ask that we limit information about you to a person who is giving you care or paying for care like a family member or friend. For example, you could ask that we not give out information about some treatment you have had or that we not tell certain people specific information in your health information. We are not required to agree to your request unless you personally pay for a service and request that your insurer not be notified. However, when the law requires that we bill your insurer, we must do so. There is a person called a Privacy Officer who is the only one who can agree to your request. We will notify you if the restriction will be applied or not. How to make a request. If you want to restrict or limit the information in your health information that we give out, you must put your request in writing. Tell us (1) what information you want to limit; (2) whether you want to limit our use of your health information, our giving out your health information, or both; and (3) whom should not receive the health information.
- You Have the Right to Ask for Privacy in Communications. You have the right to ask that we communicate with you about your health information only in a certain way or at a certain location. An example would be asking that you only be contacted by us at work or only by mail. To ask for privacy in communications, you must make your request in writing to the Hospital. We will attempt to grant all reasonable requests and although you are not required to give reasons for your request, we may ask you. Be sure to be specific in your request about how and where you wish to be contacted. We may charge you for this privacy request and if you fail to pay, the privacy communication will be stopped.
- You Have the Right to a Paper Copy of This Notice. You have a right to a copy of this Notice at any time. Even if you get this Notice over e-mail, you still can get a paper copy of it. You can request a copy from the Hospital or you can go to our web site, www.srhc.com, and obtain one there.
- Your Rights Regarding Electronic Health Information Exchange. Salina Regional Health Center participates in electronic health information exchange, or HIE. New technology allows a provider or a health plan to make a single request through a health information organization, or HIO, to obtain electronic records for a specific patient from other HIE participants for purposes of treatment, payment, or health care operations. HIOs are required to use appropriate safeguards to prevent unauthorized uses and disclosures. You have two options with respect to HIE. First, you may permit authorized individuals to access your electronic health information through an HIO. If you choose this option, you do not have to do anything. Second, you may restrict access to all of your information through an HIO (except access by properly authorized individuals as needed to report specific information as required by law). If you wish to restrict access, you must complete and submit a specific form available at http://www.khie.org. You cannot restrict access to certain information only; your choice is to permit or restrict access to all of your information. If you have questions regarding HIE or HIOs, please visit http://www.khie.org for additional information. Even if you restrict access through an HIO, providers and health plans may share your information directly through other means (e.g., facsimile or secure e-mail) without your specific written authorization. If you receive health care services in a state other than Kansas, different rules may apply regarding restrictions on access to your electronic health information. Please communicate directly with your out-of-state health care provider regarding those rules.
HOW WILL WE USE AND GIVE OUT YOUR HEALTH INFORMATION? The Hospital can use and disclose your health information without your permission. The following is a list of when we can do this:
- For Treatment. We may use your health information to provide you with medical treatment or services. We may give your health information to other doctors, nurses, technicians, medical students, or other staff personnel who are involved in taking care of you. For example, a doctor treating you for a broken bone may need to know if you have diabetes because diabetes may slow the healing process. In addition, the doctor may need to tell the dietitian if you have diabetes so that we can arrange for meals. Different departments of the Hospital may share your health information in order to coordinate the different services you need, such as prescriptions, lab work, and x-rays. We also may disclose your health information to people outside the Hospital who may be involved in your treatment while you are in the Hospital or after you leave the Hospital.
- For Payment. We may use and give out your health information about the treatment you receive here in the Hospital so that you or the insurance company or even a third party can be billed. For example, we may give your health insurance company information about your surgery so that your insurance plan will pay us or pay you for the surgery. Sometimes we may have to tell your insurance company before your surgery to get an "ok" from them so that they will cover the surgery.
- For Health Care Operations. We may use or give out your health information to make sure we are giving you the best care possible. For example, we may use your health information to see how well our staff takes care of you. We may combine your health care information with other individual’s information to decide about additional services we should offer to our patients and to see if new treatments really work. We may also give your health care information out to doctors, nurses technicians, medical students, and other hospital workers for their review and for their studies. We may also combine information we have with other hospitals to compare and see how we are doing and how we can provide better treatment. We may remove information from your health information so others who look at your health information cannot see your name. This way, we can study information without knowing the individual names. Here are some other reasons we may use and disclose your health care information: to see how well we are doing in helping our patients; to help reduce health care costs; to develop questionnaires and surveys; to help with care management; to make sure we are doing our job well and successfully; to better train people so they can get the skills they need to best perform their special skills; to help insurance companies better serve you in their policy making; to help those that check up on hospitals and ensure that we are doing our job correctly; to help us plan and develop the business part of health care including fund-raising and advertising so that we are profitable. For example, if you have surgery we may use your surgery information to see how long you were in the operating room so we can see how to schedule operations better.
- Appointment Reminders. We may give out your health information to contact you, a relative, or a friend to remind you that you have an appointment at our Hospital. We may leave a message on your answering machine or voice mail system unless you tell us not to.
- Treatment Alternatives. We may use or give out your health information to let you know about treatments that may be offered to you so you can make good choices about your health care.
- Health Related Benefits and Services. We may use and give out health information to tell you about health benefits or services that may be of interest to you.
- Fund-raising Activities. We may use your health information to contact you to help our Hospital raise money. We may also give out your health information to a foundation so they can help the Hospital raise money. For fund-raising activities, we will only give out basic contact information such as name, address, phone number, and the dates you were treated at the Hospital. If you do not want the Hospital to contact you for its fund-raising purposes, you must notify the Contact Office in writing.
- Hospital Directory. We may give out limited information about you that will be available to the public. While you are here at the Hospital as a patient, the information we give out may be your name, room number in the Hospital, and your general condition (for example, "fair," "stable," etc. and your religion. All the above information except your religion can be given out to the public who asks for you by name. Your religion may be given to a minister, priest, or rabbi even if they don’t ask for you by name. This is so your relatives, friends, and religious persons can visit you in the Hospital. If you do not want this information given out, you must write the Hospital or by stating on the admission form.
- Individuals Involved in Your Care or Payment for Your Care. We may give out health information about you to one of your friends or family members who is in some way involved in your medical care. We may give out your health information to another person who is helping pay for your care. We may tell your family or friends about your condition and that you are in the Hospital. Also, we may give out your health information as part of a disaster relief effort so your family knows about your condition and location. How much of your health information we give out to another person will depend on how much they are involved in your care.
- Research. Sometimes for special reasons, we may give out your health information to researchers who want to do scientific research about how well certain drugs or treatments work. If a researcher wants to do a study involving you and your information, we will follow steps to make sure good research is approved that will benefit all people. The research must be worthwhile. We may give out health information to researchers to help them find the patients they need for their research study. This information we give them will usually not leave the Hospital. If a researcher wants your name, address, and other information about you, we will almost always ask permission from you before they contact you.
- As Required by Law. Federal, state, and local laws may require us to give out certain kinds of health information. Things like wounds from weapons, abuse, communicable diseases, and neglect are examples of such information and we do not need your permission to give out this information.
- To Avoid a Serious Threat to Health or Safety. We may use or give out your health information if your health and safety is at risk or in danger. We also will give out your health information if the health of the public or another individual is at risk. If we give this information out, it will be given to someone who may be able to prevent the threat.
- Organ and Tissue Donation. If you are an organ donor, we may give out your health information to people who deal with organ collection, eye or tissue transplants, or to a donation bank. We give your information to these people to make sure organ or tissue donation or transplants can be made.
- Military and Veterans. If you are a member of the armed forces, we may give out your health information as required by those military authorities in command. If you are a member of the military of another country than the U.S., we may release your health information to the authority in command in your country.
- Worker's Compensation. If you are involved in an injury that happens while you are at work, we may have to give out your health information so your medical bills can be paid by your employer. This is called worker’s compensation.
- Public Health Risks. We may give out your health information without your permission if there is a danger to the public’s health. Some general examples of these dangers: to avoid disease, injury or disability; to report births and deaths; to report child abuse and neglect; to report reactions to drugs and other health products; to report a recall of health products or medications; to tell a person they have been exposed to a disease or may get a disease or spread the disease; to tell a government authority if we believe a patient has been abused, neglected, or the victim of violence; to let employers know about a workplace illness; to report trauma injury to the state.
- Health Oversight Activities. We may give out your health information without your permission to a special group who checks up on hospitals to make sure they’re following the rules. These special groups investigate, inspect, and license hospitals. This is necessary for our government to know about our hospitals and that they are following the rules and the laws.
- Surveys. We may use and disclose your PHI to contact you to evaluate your satisfaction with our services provided.
- Lawsuits and Disputes. We may give out your health information if you are involved in a lawsuit or dispute. If a court orders that we give out your health information even if you are not involved in a lawsuit or dispute, we may also give out your health information. Other reasons that may cause us to release your health information would be if there is an order to appear in court, a discovery request, or other legal reason by someone else involved in a dispute. There must be an effort made to tell you about this request or an order to make sure that the information they want is protected.
- Law Enforcement. We may give out your health information if asked for by a police official for the following reasons: for a court order, subpoena, warrant, or summons; to find a suspect, fugitive, witness, or missing person; to find out about the victim of a crime if we cannot get the person’s ok; about a death we believe may be the result of a crime; about some crime that happens at the Hospital; in emergencies to report a crime, the place where the crime happened, the victim of the crime, or the identity, description or whereabouts of the person who committed the crime.
- Coroners, Medical Examiners and funeral Directors. We may give out your health information to a coroner or medical examiner to identify a person who has died or determine the cause of death. We may also give out health information to funeral directors so they can carry out their duties.
- National Security and Intelligence Activities. We may give out your health information to federal authorities for intelligence, counter-intelligence, and other situations involving our national safety.
- Protective Services for the President and Others. We may give out health information about you to federal officials so they can protect the President or other officials or foreign heads of state or so they may conduct special investigations.
- Inmates. If you are an inmate of a prison or placed under the charge of a law enforcement official, we may give out your health information (1) to the prison to provide you with health care; (2) to protect the health and safety of you and others; (3) for the safety of the prison.
- Employers. We may give out health information about you to your employer if we provide health care services to you at the request of your employer, and the health care services are provided either to conduct an evaluation relating to medical surveillance of the workplace or to evaluate whether you have a work-related illness or injury. Disclosures to your employer for any other purpose will only be made if you execute a specific authorization for release of that information to your employer.
- Redisclosure. When we use or give out your health information, it may contain information we received from other hospitals and doctors.
- Breach Notification. You have the right to be notified if we determine that there has been a breach of your protected health information.
GIVING PERMISSION AND REVOKING PREVIOUS PERMISSION TO USE OR DISCLOSE YOUR HEALTH INFORMATION: Except as stated in this Notice, in order for us to give out your information, you have to complete a written authorization form. If you want, you can later choose not to let us give out your health information. You can do this at any time. Your request to later stop permission to give out your health information must be in writing and sent to the Hospital. It is not possible for us to take back any information we have already given out about you that we made with your permission.
WHAT SHOULD YOU DO IF YOU HAVE A COMPLAINT CONCERNING YOUR HEALTH INFORMATION? If you believe your privacy rights have been violated, you may file a complaint with our practice or with the U.S. Department of Health and Human Services – Office for Civil Rights (Regional Office at Kansas City), 601 East 12th Street Room 248, Kansas City, MO 64106, 816.426.7277, or through www.hhs.gov/ocr/privacy/hipaa/complaints/index.html. To file a complaint with our hospital, contact Salina Regional Health Center Privacy Officer, 400 S. Santa Fe, Salina, Kansas 67401, 785-452-6897. All complaints must be submitted in writing. THERE IS NO PENALTY FOR FILING A COMPLAINT.
IF CHANGES ARE MADE TO THIS NOTICE: We have the right to change this Notice at any time without letting people know we are going to change it. We have the right to make the changed Notice apply for health information we already have about you as well as any information we receive in the future. We will post a copy of the newest Notice in the Hospital. You will find the date the Notice takes effect at the top of the first page below the title. You can get a copy of this Notice at any time by contacting the Contact Office listed above or by going to our web site, www.srhc.com. You may get a copy of the current Notice each time you are admitted to the Hospital for treatment. We will give you a copy of this Notice whenever you request it.