NOTICE OF HEART CARE CENTERS OF ILLINOIS' PRIVACY PRACTICES
Effective Date: March 26, 2013
THIS NOTICE DESCRIBES HOW PROTECTED HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY AND RETAIN FOR YOUR RECORDS.
Federal and state law provides you with certain basic rights and protections in connection with the Protected Health Information (PHI) we maintain about you. Heart Care Centers of Illinois S.C. ("HCCI") is required by law to maintain the privacy of your PHI and to provide you with notice of its legal duties and privacy practices with respect to your PHI. This notice summarizes your rights and HCCI's duties with respect to your PHI. It also describes how HCCI's personnel may use and disclose your PHI. Finally, it describes the complaint process for you to follow if you believe your privacy rights have been violated. If you have any questions about this notice or your rights relating to your Protected Health Information (PHI), please contact HCCI's Privacy Officer.
II. Your Rights Regarding Protected Health Information (PHI) About You.
You have the following rights regarding Protected Health Information we maintain about you:
A. Right to Access (Paper or Electronic) PHI. You have the right to access your Protected Health Information. This includes medical and billing records. You or your designee will be provided upon request, your PHI maintained by HCCI in the ordinary course of business, in the requested applicable format.
You must submit your request in writing to HCCI's Privacy Officer. If you request a copy of your PHI, we may charge a fee for the costs of copying, mailing and other supplies associated with your request. HIPAA/HITECH Rules established a 30-day period (with an extension available under certain circumstances) for covered entities (HCCI) to comply with an access request.
B. Right to Amend. If you feel that any of the PHI we have about you is incomplete, you may ask us to amend such information. You have the right to request an amendment for as long as the information is kept by or for us.
To request an amendment, your request must be made in writing and submitted to HCCI's Privacy Officer. In addition, you must provide a reason that supports your request.
We may deny your request for an amendment if it is not in writing or does not include a reason to support that request. In addition, we may deny your request if you ask us to amend information that:
• Was not created by us, unless the person or entity that created the information is no longer available to make the amendment
• Is not part of the PHI kept by or for HCCI
• Is not part of the information which you would be permitted to inspect and copy; or
• Is accurate and complete.
If we deny the requested amendment, you have the right to submit a written statement disagreeing with the denial or, alternatively, you may request HCCI to provide your request for amendment and the denial with any future disclosures of the information.
C. Right to an Accounting of Disclosures. You have the right to receive an accounting of certain disclosures of your PHI made by us in the six years prior to the date on which the accounting is requested, starting from the original HIPAA compliance date of April 14, 2003. Such right to accounting, however, does not extend to disclosures made to you or pursuant to your authorization or disclosures made for treatment, payment and health care operations to family members or friends involved in your care, for notification purposes, for national security or intelligence purposes, or to correctional institutions or law enforcement officials in custodial situations.
To request an accounting of disclosures to which you are entitled, you must submit your request in writing to HCCI's Privacy Officer. Your request must state a time period which may not be longer than six years and may not include dates before April 14, 2003. Your request should indicate in what form you want the list (for example, on paper, electronically). The first list you request within any consecutive 12 month period will be free. For additional lists, we may charge you for the costs associated with providing the list. If we intend to charge a fee, we will notify you of the estimated cost involved and will give you an opportunity to withdraw or modify your request before any costs are incurred.
D. Right to Request Restrictions. You have the right to request restrictions or limitations on the PHI we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the PHI we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not use or disclose information to a relative about a surgery you had.
Right to Restrict Certain Disclosures of PHI to a Health Plan. You have the right to restrict certain disclosures of PHI to a health plan when the individual (or any person other than the health plan) pays for treatment at issue out of pocket in full.
We will comply with your request unless the information is needed to provide you emergency treatment. A restriction agreed to by HCCI is not effective to prevent uses or disclosures permitted or required under Section III.A below (excluding treatment, payment and health care operations).
Your request for restrictions should be made in writing to HCCI's Privacy Officer. In your request, you should tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply (for example, disclosure to your spouse, relative, etc.).
E. Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. Any such request must be made in writing to HCCI's Privacy Officer and must specify how or where you wish to be contacted. We will not ask you the reason for your request and will accommodate all reasonable requests.
F. Right to Receive a Copy of This Notice. You have the right to receive a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. You may obtain a copy of this notice at our Website, or by contacting HCCI's Privacy Officer.
G. Right to be Notified Following a Breach of Your Unsecured PHI. You have the right to be notified without unreasonable delay, but in no case later than 60 calendar days after discovery. The notice must be written in plain language and include the nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification, the unauthorized person who used the protected health information or to whom the disclosure was made, whether the protected health information was actually acquired or viewed, and the extent to which the risk to the protected health information has been mitigated.
III. Use and Disclosure of Your Protected Health Information (PHI)
A. Uses and Disclosure of PHI That Do Not Require Your Consent or Authorization. Following are examples of the types of uses and disclosures of your PHI that HCCI is permitted or required by law to make without your consent or authorization.
Treatment. To provide you with medical treatment or services, we may need to use or disclose information about you to doctors, nurses, technicians, medical students or other personnel who are involved in your treatment. For example a doctor may need to know what drugs you are allergic to before prescribing medications. Personnel may share PHI about you to coordinate your care. For instance, the laboratory may request information to complete lab work. We may also disclose PHI about you to people who may be involved in your medical care, such as home health agencies, your family and clergy members.
Payment. We may use and disclose your PHI to bill and receive payment for the treatment that you received here. For example, we may use or disclose your PHI to your insurance company about a service you received so that your insurance company can pay us or reimburse you for service. We may also ask your insurance company for prior authorization for a service to determine whether the insurance company will cover it.
Health Care Operations. We can use and disclose PHI about you for HCCI operations. These include uses and disclosures that are necessary to make sure that our patients receive quality care. For example, we may use or disclose PHI about you to evaluate our staff's performance in caring for you. PHI about you and other patients may also be combined to allow us to evaluate whether we should offer additional services or discontinue other services and whether certain treatments are effective. We may also compare this information with other physicians to evaluate whether we can make improvements in the care and services that we offer. To best protect your privacy when we are combining PHI, we will remove information that identifies you.
Required By Law: We may use or disclose your PHI to the extent that the use or disclosure is required by law. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law.
Public Health: We may disclose your PHI for public health activities and purposes to a public health authority that is permitted by law to collect or receive the information. The disclosure will be made for the purpose of preventing or controlling disease, injury or disability. We may also disclose your PHI, if directed by the public health authority, to a foreign government agency that is collaborating with the public health authority.
Communicable Diseases: We may disclose your PHI, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.
Health Oversight: We may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, other government regulatory programs and civil rights laws.
Abuse or Neglect: We may disclose your PHI to a public health authority that is authorized by law to receive reports of child abuse or neglect. In addition, we may disclose your PHI if we believe that you have been a victim of abuse, neglect or domestic violence to the governmental entity or agency authorized to receive such information. In this case, the disclosure will be made consistent with the requirements of applicable federal and state laws.
Food and Drug Administration: We may disclose your PHI to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations, track products; to enable product recalls; to make repairs or replacements, or to conduct post marketing surveillance, as required.
Judicial and Administrative Proceedings: We may disclose your PHI in the course of a judicial or administrative proceeding in response to an order of a court or administrative tribunal. We may also disclose your PHI in response to a subpoena, discovery request, or other lawful process, but only if reasonable efforts have been made to notify you of the request or to obtain a protective order limiting the use of the information to the litigation or proceeding for which it was requested.
Law Enforcement: We may also disclose PHI, so long as applicable legal requirement are met, for law enforcement purposes include (1) legal processes and as otherwise required by law, (2) limited information requests for identification and location purposes, (3) pertaining to victims of a crime, (4) suspicion that death has occurred as a result of criminal conduct, (5) in the event that a crime occurs on the premises of the practice, and (6) medical emergency (not on the practices premises) and it is likely that a crime had occurred.
Coroners, Funeral Directors, and Organ Donation: We may disclose PHI to a coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose PHI to a funeral director to carry out their duties. We may disclose such information in reasonable anticipation of death. Information may be used or disclosed to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue for the purpose of facilitating organ, eye or tissue donation and transplantation.
Research: We may disclose your PHI to researchers when their research has been approved by an institutional review board or privacy board that has reviewed the research proposal and established protocols to ensure the privacy of your PHI.
Serious Threat to Health or Safety: Consistent with applicable federal and state laws, we may disclose PHI, if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose PHI if it is necessary for law enforcement authorities to identify or apprehend an individual because of a statement by the individual admitting participation in a violent crime that the practice reasonably believes may have caused serious physical harm to the victim or where it appears from all the circumstances that the individual has escaped from a correctional institution or from lawful custody.
Military Activity and National Security: When the appropriate conditions apply, we may use or disclose PHI of individuals who are Armed Forces personnel (1) for activities deemed necessary by appropriate military command authorities; (2) for the purpose of a determination by the Department of Veteran Affairs of your eligibility for benefits, or (3) to foreign military authority if you are a member of that foreign military service. We may also disclose your PHI to authorized federal officials for conducting national security and intelligence activities, including the provision of protective services to the President or others legally authorized.
Worker's Compensation: Your PHI may be disclosed by us as authorized to comply with workers' compensation laws and other similar legally-established programs.
Inmates: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release PHI about you to the correctional institution or law enforcement official. This release would be necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
Required Uses and Disclosures: Under the law we must make disclosures to you when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the requirements of the law and regulations.
Appointment Reminders: We may use and disclose PHI to contact you as a reminder that you have an appointment for treatment or medical care.
Treatment Alternatives: We may use and disclose PHI to tell you about or recommend possible treatment options or alternatives that may be of interest to you.
Health-Related Benefits and Services: We may use and disclose PHI to tell you about health related benefits or services that may be of interest to you.
Fund-Raising: You may be contacted to raise funds and have the right to opt out of receiving such communications. If you opt-out of fund-raising communications you are asked to request an opt-out by emailing or calling the HCCI Privacy Officer at the number listed at the end of this notice. PHI used for fundraising purposes is limited to individuals' names, addresses, other contact information, age, gender, date of birth, dates during which individuals received the relevant health care, general department of treatment, and treatment outcome information. Conditioning of treatment or payment on individuals' choice with respect to receiving fundraising communication is prohibited.
B. Uses and Disclosures to Which You Have the Opportunity to Object. We may use or disclose your PHI for any of the purposes described in this section unless you affirmatively object to or otherwise restrict a particular release. Please direct any written objections or restrictions to HCCI's Privacy Officer.
Others Involved in Your Healthcare: Unless you object, we may disclose to a member of your family, a relative, a close friend or any other person you identify, PHI that directly relates to that person's involvement in your health care. If you are unable to agree or object to such a disclosure, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgment. We may use or disclose PHI to notify or assist in notifying a family member, personal representative or any other person that is responsible for your care, of your location, general condition or death. Finally, we may use or disclose PHI to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in your health care.
C. Uses and Disclosures of PHI Not Described in this Privacy Notice: Other uses and disclosures of your PHI not described in this Privacy Notice will be made only with your written authorization. You may revoke this authorization at any time, in writing, except to the extent that HCCI had already taken an action in reliance upon your previous authorization.
D. Uses and Disclosures of PHI for Marketing Purposes and Sales of PHI: Most uses and disclosures of PHI for marketing purposes and sales of PHI require your individual authorization. The sale of PHI is defined as any disclosure of the information for which HCCI would receive remuneration from or on behalf of the recipient. Your authorization must explain that the disclosure will result in HCCI receiving remuneration for PHI.
IV. Changes to This Notice
We are required to abide by the terms of this notice which is currently in effect. However, we reserve the right to change this notice at any time. In addition, we reserve the right to make the revised or changed notice effective for the PHI we receive in the future. We will post a copy of the current notice in our offices. The notice will contain on the first page, in the top left hand corner, the effective date. In addition, each time you visit our offices for treatment or health care services, we will offer you a copy of the then current notice in effect.
If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the Department of Health and Human Services. To file a complaint with us, contact HCCI's Privacy Officer. All complaints must be submitted in writing. You will not be penalized for filing a complaint.
VI. Contact Information
Questions, comments and requests regarding the matters described in this notice should be directed to the following:
Address: 13011 S. 104th Avenue, Suite 100
Palos Park, IL 60464
Telephone: (708) 478-3600
Facsimile: (708) 478-3552