This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
Effective September 23, 2013
If you have any questions about this notice, please contact our Privacy Office at the address or telephone number.
During your treatment at Jackson Hospital & Clinic, Inc, doctors, nurses and other caregivers may gather information about your medical history and your current health. Each time you are treated at our facility, we make a record of your visit. This record usually contains your health history, current symptoms, examination, and test results, diagnoses, treatment, and plan for future care or treatment. This information is referred to as "Protected Health Information" or PHI. Protected health information is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related healthcare services. This Notice of Privacy Practices (the "Notice") describes how we may use and disclose your PHI to carry out treatment, payment or healthcare operations and for other purposes that are permitted or required by law. It also describes your privacy rights regarding your protected health information.
We are required by law to meet the requirements of this Notice with respect to your PHI and maintain the privacy and security of your protected health information. We will let you know promptly if a breach occurs that may have compromised the privacy and security of your information. We must follow the duties and privacy practices described in this Notice and give you a copy of it. We will not use or share your information other than as described here unless you tell us we can in writing.
We may update this Notice from time to time. We will provide you with a current copy of this Notice on request; you may also obtain a current copy at our office, on our website www.jackson.org or by calling our registration office at 334-293-8842.
1. Uses and Disclosures of Protected Health Information or (PHI)
We may use or disclose your PHI as set forth in this Section 1. Section 1 does not identify all the uses and disclosures we may make of your PHI; these are merely examples. We will not use or disclose your PHI, however, other than as permitted or required by applicable laws.
Uses and Disclosures That Do Not Require Your Authorization or Opportunity to Agree or Object
We may use or disclose your PHI without your authorization and without offering you the opportunity to agree or object, for the following purposes:
Written consent regarding uses and disclosures of PHI: We may ask you to sign a consent form regarding use and disclosure of your PHI to carry out certain treatment, payment, and healthcare operations activities (discussed below). We are not required to obtain this consent prior to rendering services to you, but obtaining this consent enables us to better protect the privacy of your PHI. Please note that we reserve the right not to treat you if you do not sign the consent form.
Treatment: We may use and disclose your PHI to provide, coordinate, or manage your healthcare and any related services. This includes the coordination or management of your healthcare with another provider. For example, we may disclose your PHI from time-to-time to another physician or healthcare provider (e.g., a specialist or laboratory) who, at the request of your physician, becomes involved in your care by providing assistance with your healthcare diagnosis or treatment. We may also disclose your PHI to a pharmacy to order a prescription for you. Note that some health information, such as substance abuse treatment may not be used or disclosed without your consent.
Payment: We may use your PHI to obtain payment for healthcare services provided to you by us or by another provider. This may include disclosures in connection with certain activities that your health insurance plan may undertake before it approves or pays for the healthcare services we recommend for you, such as making a determination of eligibility or coverage for insurance benefits, reviewing services provided to you for medical necessity, or undertaking utilization review activities. For example, obtaining approval for a hospital stay may require that your relevant PHI be disclosed to your health plan to obtain approval for hospital admission. In addition, we may disclose information about you for purposes of an independent review of a denial of a claim based on lack of medical necessity.
Healthcare operations: We may use or disclose, as needed, your PHI in connection with certain business operations (i.e., "healthcare operations"). Healthcare operations include, but are not limited to, quality assessment activities, employee review activities, training of medical students, licensing matters, and conducting or arranging for other business activities relating to the delivery of healthcare. For example, we may use or disclose your PHI to medical school students who see patients at our offices. We may also use a sign-in sheet at the registration desk where you may be asked to provide your name, the name of your physician, and other pertinent information. We may also call you by name in the waiting room when your physician is ready to see you.
Business associates: We may disclose your PHI to third-party "business associates" that create, receive, maintain or transmit PHI on our behalf. Examples of business associates include attorneys, accountants and other consultants, collection agencies and accreditation organizations. We enter written agreements with Business associates that obligate the business associate to safeguard your PHI and not use or disclose your information except as permitted by applicable law. To protect information, however, we require the business associate to appropriately safeguard your information. After February 17, 2010, business associates must comply with the same federal security and privacy rules as we do. Notification: We may use or disclose information to notify or assist in notifying a family member, a personal representative, or another person responsible for your care, location, and general condition.
Appointment reminders and other health information: We may use your PHI to send you reminders about future appointments. We may also send you refill reminders or other communications about your current medications. However, if we receive any financial remuneration for making such refill or medication communications beyond our costs of making the communication, we must first obtain your written authorization. We may contact you with information about new or alternative treatments or other healthcare services or for purposes of care coordination, unless we receive financial remuneration in exchange for making the communication; in that case, we must first obtain your written authorization. The above mentioned information only applies to written communications; however, we are not required to obtain your written authorization for face-to-face communications.
Fundraising: We may (or our business associate or foundation may) use certain of your PHI (specifically, your name, address, age, gender, date of birth and other demographic information; dates you received healthcare from us; department of service information; treating physician; outcome information and health insurance status) to contact you in connection with certain fundraising activities. You may opt out of receiving our fundraising communications at any time. Each written fund-raising communication we deliver to you will include an opportunity to opt-out. Alternatively, you may contact the Privacy Officer using the contact information listed previously to opt-out of fundraising communications.
Required by law: We may use or disclose your PHI as required by law.
Public health: We may disclose your PHI for public health activities and purposes to a public health authority that is permitted by law to collect or receive the information. For example, a disclosure may be made for the purpose of preventing or controlling disease, injury or disability or reporting births and deaths.
Communicable diseases: We may disclose your PHI, subject to applicable laws, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.
Health oversight: We may disclose your PHI to a health oversight agency, the Centers for Medicare and Medicaid Services and state health departments for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies seeking this information include government agencies that oversee the healthcare system, government benefit programs, other government regulatory programs and civil rights laws. These activities are necessary for the government to monitor the healthcare system, government programs, and compliance with civil rights laws. If members of our work force or business associates believe in good faith that we have engaged in unlawful conduct or otherwise violated professional or clinical standards and are potentially endangering one or more patients, workers, or the public, they may disclose your health information to health oversight agencies and/or public health authorities, such as the Department of health.
Abuse or neglect: We may disclose your PHI to a public health authority or government agency to report child abuse or neglect or if we believe that you have been a victim of abuse, neglect or domestic violence to the extent consistent with applicable laws.
Food and Drug Administration: We may disclose your PHI to the Food and Drug Administration ("FDA") in connection with regulation of the quality, safety, or effectiveness of FDAregulated products or activities in accordance with FDA regulations and other applicable laws. Such disclosures may include, for example, reporting adverse events, product defects or problems; reporting biologic product deviations; and disclosures made in connection with product recalls.
Lawsuits and disputes: We may disclose your PHI about you in response to a valid court order or administrative order if and to the extent such order expressly authorizes such disclosure. We also may disclose your PHI in response to certain types of subpoenas, discovery requests or other lawful process not accompanied by a court order or administrative order, in certain circumstances, consistent with applicable laws. We may also disclose information in the context of civil litigation where you have put your condition at issue in the litigation.
Law enforcement: We may disclose your PHI in response to a valid court order, grand jury subpoena, or a valid search warrant. In addition, we are required by applicable laws to report certain types of wounds, such as gunshot wounds and some burns; provided, however, that in such cases, we are normally only required to report the fact of injury, and any additional disclosures would require your consent or a court order. We may also release information to law enforcement that is not a part of the health record (in other words, non-medical information) (i) to identify or locate a suspect, fugitive, material witness, or missing person; (ii) under certain limited circumstances, if you are the victim of a crime and we are unable to obtain your agreement; (iii) about a death we believe may be the result of criminal conduct; (iv) about criminal conduct at our facility; and (v) in identity, description or location of the person who committed the crime.
Coroners, funeral directors, and organ donation: We may disclose your PHI coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose PHI to funeral directors, as authorized by law, in order to permit the funeral director to carry out their duties. We may disclose such information in reasonable anticipation of death. PHI may be used disclosed for cadaveric organ, eye or tissue donation purposes.
Research: We may disclose your PHI to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your PHI. In some cases, researchers may be permitted to use your PHI in a limited way to determine whether the study or the potential participants are appropriate.
Marketing/continuity of care: We may contact you to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you. If we contact you to provide marketing information for other products or services, you have the right to opt out of receiving such communications. Contact the Privacy Officer. If we receive compensation from another entity for the marketing, we must obtain your signed authorization.
Criminal activity: We may disclose your PHI, in accordance with applicable laws, if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose PHI if it is necessary for law enforcement authorities to identify or apprehend an individual.
Military activity and national security: If you are a current or former member of the Armed Forces, we may use or disclose your PHI, in accordance with applicable laws and regulations, (i) for activities deemed necessary by appropriate military command authorities; (ii) for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits, or (iii) to a foreign military authority if you are a member of those foreign military services. We may also disclose your protected health information to authorized federal officials for conducting national security and intelligence activities, including for the provision of protective services to the President or others legally authorized.
Workers' compensation: We may disclose your PHI as authorized to comply with workers' compensation laws and other similar legally-established programs. These programs provide benefits for work-related injuries or illness.
Inmates: We may use or disclose your PHI if you are an inmate of a correctional facility and your physician created or received your PHI in the course of providing care to you. If you are under the custody of a law enforcement official, we will release PHI about you to the law enforcement official only as permitted by law.
Uses and Disclosures That Require Giving You the Opportunity to Agree or Object
We may use or disclose your PHI in certain instances only after you have the opportunity to agree or object.
Facility directories: We may use and disclose in our facility directory your name, the location at which you are receiving care, your general condition (such as fair or stable), and your religious affiliation. We may disclose this information only to individuals who ask for you by name. Your religious affiliation may be given to a member of the clergy, such as a minister, priest or rabbi, even if they do not ask for you by name. You are free to object to the use of your PHI for this purpose. If you wish to object, please notify the registration staff member.
Others involved in your healthcare or payment for your care: We may disclose your PHI to family members, close friends or other individuals involved in your care or payment for your care, but only to the extent the information directly relates to that person's involvement in your care or payment for your care. If you are present and able to agree or object (or if you are available in advance), then we may only disclose your PHI if you don't object after you have been informed of your opportunity to do so (although such agreement may be reasonably inferred from the circumstances). If you are not present or unable to agree or object to the use or disclosure of the PHI (e.g., if you are incapacitated), we may disclose your PHI if we determine that it is in your best interest to do so (e.g., in an emergency). We may also use or disclose your protected health information to notify or assist in notifying a family member, personal representative or individual who is responsible for your care of your location, general condition or death. We may also use or disclose your PHI to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in your healthcare. We may also use our professional judgment to make reasonable decisions such as allowing someone acting on your behalf (e.g., your parent or spouse) to pick up prescriptions, medical supplies, x-rays or other things that include your PHI. You are free to object to the use of your PHI for the above purposes. If you wish to object, please notify the Privacy Officer.
Other Uses and Disclosure of PHI
Except as set forth above, we will not use or disclose your PHI without obtaining your specific written authorization. We are also required to obtain a written authorization from you for most uses and disclosures of psychotherapy notes, most uses and disclosures of PHI for marketing purposes, and some disclosures that constitute sales of PHI. If you provide us with a specific, written authorization to use or disclose your PHI, you may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose your PHI for the reasons covered by your written authorization, except to the extent we have already relied on your authorization.
2. Your Rights
Although your medical records are the physical property of Jackson Hospital & Clinic, Inc, you have rights. Following is a statement of your rights with respect to your PHI and a brief description of how you may exercise these rights.
You have the right to inspect and copy your PHI. This means you may inspect and obtain a copy of PHI about you for so long as we maintain the PHI. If you wish to inspect and copy your PHI, you must submit your request in writing to the Privacy Officer. We will provide a copy or summary of your health information, usually within 30 days of your request.
If we maintain your PHI electronically as part of a designated record set, you have the right to receive an electronic copy of your information upon request. We will provide you with an electronic copy of your PHI in the electronic format you specify, if readily producible; if not, we will provide you with an alternative, readable electronic format or, if you prefer, in a readable hard copy.
You may also direct us to transmit your health information (whether in hard copy or electronic form) directly to another entity or person; provided, however, that, in order for us to transmit your information to another entity or individual, your written request to the Privacy Officer must clearly and specifically designate the entity or individual.
We may deny your request to inspect and copy your information in certain limited circumstances. For example, we may deny access if your physician believes it will be harmful to your health, or could cause a threat to others. If you are denied access to medical information, you may request that the denial be reviewed. A licensed healthcare professional will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.
We are prohibited by law from disclosing certain parts of your PHI to you, including, for example, psychotherapy notes and information compiled in reasonable anticipation of, or use in, a civil, criminal or administrative proceeding.
We may charge you a reasonable, cost-based fee for a copy of your records, subject to applicable laws. This fee may include, for example, the cost of any electronic media used to provide an electronic copy (e.g., CD or portable drive), if applicable.
Please contact the Privacy Officer if you have questions about access to your record.
You have the right to request a restriction of your PHI: This means you may ask us not to use or disclose any part of your PHI for certain, specific purposes, to extent consistent with applicable law. You may also request that any part of your PHI not be disclosed to family members or friends who may be involved in your care or for notification purposes as described in this Notice.
You should make such requests in writing to the Privacy Officer. The request must (i) identify the PHI you wish to restrict; (ii) specify whether you wish to restrict use or disclosure of the information, or both; and (iii) identify the individuals and entities to whom the restriction will apply.
If you pay out of pocket, in full for an item or service, and you make a written request, as provided above, to restrict disclosure of your PHI to your health plan, we will not disclose your PHI, to the extent the information relates solely to the item or service for which you paid out of pocket, in full, to the health plan; provided, however, that we are not required to comply with such a request if compliance conflicts with applicable laws (e.g., laws that would prevent us from accepting payment from you above applicable cost-sharing amounts unless we disclose certain PHI).
Otherwise, we are not required to agree to a restriction that you may request. However, if we agree to the requested restriction, we may not use or disclose your PHI in violation of that restriction unless it is needed to provide emergency treatment.
Right to request confidential communications: You have the right to request that we communicate with you about confidential medical matters in a certain way or at a certain location. For example, you can ask that we only contact you only at work or only by mail. To request confidential communications, please deliver a written request to the Privacy Officer. We will accommodate reasonable requests. We will not ask you the reason for your request; provided, however, that we may inquire about (and we may condition agreement to such accommodation upon you providing) information as to how payment will be handled or specification of an alternative address or other method of contact. Your request must specify how or where you wish to be contacted, and we may require you to provide information about how payment will be handled.
Right to request amendment: If you believe that PHI we have about you is incorrect or incomplete, you have the right to ask us to change the information. You have the right to request an amendment for as long as we keep the information. To request a change to your information, your request must be made in writing and submitted to the Privacy Officer. In addition, you must provide a reason that supports your request. We may deny your request for an amendment in certain instances, including, for example, if (i) the request is not in writing or does not include a reason to support the request; (ii) the subject PHI was not created by us, unless the person or entity that created the information is no longer available to make the amendment; (iii) the information for which the amendment is requested is not part of the PHI kept by or for us; (iv) the information for which an amendment is requested is not part of the information you would be permitted to inspect and copy; or (v) the information for which an amendment is requested is accurate and complete. If we deny your request for amendment, you have the right to file a statement of disagreement with us and we may prepare a rebuttal to your statement and will provide you with a copy of any such rebuttal. We will respond in writing within 60 days.
You have the right to receive an accounting of certain disclosures of your PHI: This accounting would include certain, non-routine disclosures of your PHI (e.g., disclosures for law enforcement purposes, disclosures in response to a court order or subpoena, disclosures for public health, health oversight, and research purposes). It excludes disclosures for treatment, payment and healthcare operations purposes, as set forth herein, disclosures to you, and other routine types of disclosures (e.g., disclosures you authorized, disclosures to your family or friend involved in your care). To request an accounting, please deliver a written request to the Privacy Officer. Request must specify the time period for the requested accounting; provided, however, that the period for the accounting (i) may not exceed six (6) years; and (ii) may not include any date prior to April 14, 2003. You may receive one free accounting in any 12-month period. We will charge you for additional requests.
You have the right to obtain a paper copy of this notice from us, upon request, even if you have agreed to accept this notice electronically and even though we have posted a copy of the Notice in prominent locations throughout the facility and on our website at www.jackson.org.
You have the right to receive notifications of breaches of your unsecured PHI: We will notify you regarding any breaches of your unsecured PHI. Such notification will be by U.S. mail addressed to you at the last known mailing address in our files. You may also authorize us to notify you by email, but we will not notify you by email without such notification.
You have a right to choose someone to act for you: If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.
You can file a complaint with our Privacy Officer if you feel we have violated your rights by using the information listed below. You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington D.C. 20201, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints.
4. Contact the Privacy Officer
To ask questions, to file a complaint, or to obtain additional information about this Notice or any information herein, or about our privacy, security, or breach notification practices with respect to PHI, please contact the Privacy Officer in the Health Information Management Department at 334-293-8907 or call the HIPAA Hotline toll-free, at 855-830-2071, or by mail at:
Health Information Management Department/Privacy Officer
1725 Pine Street
Montgomery, AL 36106