Notice of privacy practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

A federal regulation, known as the HIPAA Privacy Rule, requires that we provide detailed notice in the writing of our privacy practices. This notice describes the privacy practices of CMH Regional Health System. For purposes of this notice, the pronouns “we,” “us” and “our” refer to CMH and include:

• Any person who assists in providing care to you through any department or service of CMH, including: Clinton Memorial Hospital, Progressive Care, Blanchester Medical Services, Family Health Center, East Clinton Medical Services, Home Care Services, Corporate Health Services, CMH AfterHours, Rehabilitation Services, CMH Pediatric and Adolescent Services, CMH Neurological Services, CMH Ophthalmology Services, Community Health Services and CMH Community Dental Services.
• Any person who assists in providing care to you at any CMH location.
• Any business associate of CMH who performs a service on behalf of CMH using your health information.

I. OUR PLEDGE TO YOU
Each time you visit a hospital, physician or other health care provider of CMH, a record of your visit is made. This record contains information about you that we create or obtain for the purpose of providing health care to you. Typically, this health information includes a description of your symptoms, examinations and test results, diagnosis, treatment and a plan for future care or treatment.

The HIPAA Privacy Rule requires that we protect the privacy of health information that identifies a patient, or when there is reasonable cause to believe the information can be used to identify a patient. This information is called protected health information or PHI. This notice describes your rights as our patient, and our obligations regarding the use and disclosure of your PHI. We are required by law to:

• Maintain the privacy of PHI about you.
• Give you this notice of your rights, and our legal duties and privacy practices with respect to PHI.
• Comply with the terms of the notice of privacy practices that is currently in effect.

We understand that your health information is private. We are committed to providing you the with highest quality care while maintaining the confidentiality of your health information. We reserve the right to make changes to this notice and to make such changes effective for all PHI we maintain about you, including PHI we already have. If and when this notice is changed, we will post a copy in our facilities in prominent locations and on our web site. We will also provide you with a copy of the revised notice at your request.

II. HOW WE MAY USE AND DISCLOSE PROTECTED HEALTH INFORMATION (PHI) ABOUT YOU
The following categories describe different ways in which we may use and disclose your health information. The examples included with each category do not list every type of use or disclosure that may fall within that category, but are provided to give you some idea of what we may do with your health information.

USES AND disclosures OF PHI THAT DO NOT REQUIRE YOUR PERMISSION FOR TREATMENT, PAYMENT AND HEALTH CARE OPERATIONS
Individuals, entities, departments and service providers identified as part of CMH in this notice may share your PHI with each other as necessary to carry out treatment, payment and health care operations related to the care provided to you. In addition:

Treatment: We may use and disclose PHI about you to provide, coordinate or manage your health care and related services. We may consult with other health care providers regarding your treatment, and coordinate and manage your health care with others. For example, we may use and disclose PHI when you need a prescription, lab work, an x-ray or other health-related services. This includes providing your health information to a specialist as part of a referral so that the specialist may treat you.

Payment: We may use and disclose PHI so that we can bill and collect payment for the treatment and services provided to you. The information may include information that identifies you, your diagnosis, and the procedures and supplies used during your treatment. Before providing treatment or services, we may share details with your health insurer concerning the services you are scheduled to receive. For example, we may ask for payment approval from your health insurer before we provide care or services. We may use and disclose PHI for billing, claims management and collection activities.

We may use and disclose PHI to insurance companies providing you with additional coverage. We may disclose limited PHI to consumer reporting agencies as it relates to collection of payments owed to us.

Health care operations: We may use and disclose PHI in performing business activities that are called health care operations. Health care operations include doing things that allow us to improve the quality of care we provide and to reduce health care costs. We may use information in your health record to assess the care provided and outcomes attained in your case and others like it. This information will be used in an effort to improve the quality of patient care. Your health information may also be used to resolve any complaints you have.

Communications from us to you: We may contact you to remind you of appointments and to provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you. We may also contact you for fund-raising purposes.

OTHER USES AND disclosures WE CAN MAKE WITHOUT YOUR WRITTEN PERMISSION
We may use and disclose your PHI in the following circumstances without your permission, provided that we comply with state law and with certain conditions imposed by the HIPAA Privacy Rule.

Uses and disclosures to which you have the opportunity to agree or to object: Unless you notify us that you object, we will use your name, location in the facility, general condition and religious affiliation for hospital directory purposes. This information may be provided to members of the clergy and, except for religious affiliation, to other people who ask for you by name. Unless you object, we may also disclose PHI about you to your family members, close friends or any other person identified by you. The PHI we disclose must be directly related to the person’s involvement in your care or in payment for your care.

You should also be aware that we may disclose PHI about you to a family member, personal representative or other person involved in your care in order to notify them about your location, general condition or death. (In the event of a disaster, we may disclose this limited information to disaster relief agencies so that they can provide this notification.) If you are either not present or are unable to consent or to object, we will rely on our professional judgment to determine whether the use or disclosure of your PHI to persons involved in your care or in payment for your care is in your best interests. We will also rely on this judgment and our experience with common practice to make reasonable decisions about your best interest in allowing a person to act on your behalf to pick up filled prescriptions, medical supplies, test information or other things that contain PHI about you.

Uses or disclosures required by law: We may use and disclose PHI as required by federal, state or dlocal law. Any disclosure will be strictly limited to the requirements of the law.

Uses or disclosures for public health activities: In accordance with applicable laws, we may use or disclose PHI to public health authorities or other authorized persons to carry out certain activities related to public health, including:

• To prevent or control disease, injury or disability.
• To report disease, injury, birth or death.
• To report child abuse or neglect.
• To report reactions to medications, or problems with products or devices regulated by the U.S. Food and Drug Administration or other activities related to the quality, safety or effectiveness of FDA-regulated products or activities.
• To locate and notify persons of recalls of products they may be using.
• To notify a person who may have been exposed to a communicable disease in order to control who may be at risk of contracting or spreading the disease.
• To report to your employer, under limited circumstances, information related primarily to workplace injuries or illness, or workplace medical surveillance.

Uses or disclosures regarding abuse, neglect or domestic violence: We may disclose PHI, in accordance with applicable laws, to the designated authorities if we reasonably believe that a person has been a victim of domestic violence, abuse or neglect.

Uses or disclosures For health oversight activities: In accordance with applicable laws, we may disclose PHI to a health oversight agency for oversight activities. These could include, for example, audits, investigations, inspections, licensure and disciplinary activities conducted by the agencies that are required by law to monitor the health care system, certain governmental health care programs and compliance with specific laws.

Uses or disclosures For lawsuits and other legal proceedings: We may use or disclose PHI when required by a court or administrative tribunal order. We may also disclose PHI in response to subpoenas, discovery requests or other required legal processes when we are satisfied that efforts have been made to advise the individual whose PHI is being sought of the request, or to obtain an order from the court or other tribunal protecting the information requested.

Uses or disclosures for law enforcement: When required by law, we may disclose PHI to law enforcement officials. For example, we may disclose PHI about a crime committed at one of our facilities.

Uses or disclosures to coroners, medical examiners and funeral directors: In accordance with applicable laws, we may disclose health information to coroners and medical examiners. For example, we may disclose PHI to assist in the identification of a deceased person and to determine a cause of death. In addition, we may disclose PHI to funeral directors as required by law so that they may carry out their duties.

Uses or disclosures for organ and tissue donation: If you are an organ donor, consistent with applicable laws, we may disclose health information to organ procurement organizations or other entities engaged in the procurement, banking or transplantation of organs for the purpose of tissue donation and transplantation.

Uses or disclosures for research: We may use and disclose PHI for research purposes under certain limited circumstances. In general, we must obtain written permission to use and disclose PHI for research purposes unless the research project meets the criteria contained in the HIPAA Privacy Rule to ensure the ongoing privacy of PHI.

Uses or disclosures to avert a serious threat to health and safety: In accordance with applicable Ohio law and ethical standards, we may use or disclose PHI to prevent or lessen a serious threat to an individual’s health and safety or to the health and safety of others. Any disclosure, however, would be to someone who we believe is able to help prevent or lessen the threat.

Uses or disclosures for specialized government functions: Under certain circumstances, and consistent with applicable Ohio law, we may disclose PHI:

• For specified military and veteran activities. For example, we may disclose PHI to military authorities who are able to demonstrate that they have the authority to receive such information.
• For national security and intelligence activities. For example, we may disclose PHI to those federal authorities who are authorized to conduct national security activities pursuant to the National Security Act.
• To help provide protective services for the president and others specified by federal law.
• To promote the health and safety of a particular inmate or any other person at a correctional institution or who is involved with an inmate in a custodial situation.

Uses or disclosures for workers compensation: We may disclose PHI to the extent authorized by and to the extent necessary to comply with laws relating to workers’ compensation or other similar programs established by law.

Disclosures required by the HIPAA Privacy Rule: We are required to disclose PHI to the Secretary of the Department of Health and Human Services when directed by the secretary in order to review our compliance with the HIPAA Privacy Rule.

ALL OTHER USES AND disclosures OF PHI REQUIRE YOUR AUTHORIZATION
All other uses and disclosures of PHI about you will only be made with your written authorization. You can revoke that authorization at any time by notifying us in writing of your decision. If you revoke your authorization, we will no longer use or disclose PHI about you for the reasons covered by your authorization. However, we will not be able to take back any disclosures made prior to your revocation.

III. YOUR RIGHTS REGARDING PROTECTED HEALTH INFORMATION (PHI) ABOUT YOU
Under the HIPAA Privacy Rule, you have the following rights regarding PHI about you. All requests to exercise these rights must be submitted in writing to our privacy officer at the address listed in section VI. below.

Inspection and copying: In most cases, you have a right to inspect and obtain a copy of the information contained in the “designated record set” we keep regarding your care. This “designated record set” is defined by federal law as the medical and billing records maintained by or for CMH that are used to make decisions about you. If we deny your request to inspect and/or obtain a copy of records about you, we will explain, in writing, that we have denied your request whether you may have that decision reviewed and the process by which you may seek further review. If you request copies, we will charge a fee for the cost of copying, mailing or other related supplies.

Amendment: If you believe the information in your record is incorrect or if important information is missing, you have the right to request that we amend the records. We require that you:

• Explain the reason you are requesting the amendment as part of your written request.
• Identify others who need to receive the amended information, if we agree to make the amendment.
• Agree to allow us to notify others, identified by us, if we agree to the amendment.

If we accept your request for amendment, we will notify you in writing. We may deny your request to amend your PHI if we determine that:

• The information about which you have requested an amendment was not created by us (unless you can demonstrate that the creator of the information is no longer available).
• The information is not part of the designated record set we maintain about you.
• The existing record is complete and accurate.

If we deny your request for an amendment, we will notify you in writing. You may then submit a written statement of disagreement. We may respond, in writing, and must provide you with a copy of any response. Anytime the information which is the subject of a dispute regarding amendment is disclosed, these documents, or a summary of the information within them, will also be disclosed. If you don’t submit a statement of disagreement regarding a denied amendment request, you may request that we disclose your request for amendment and our denial with subsequent disclosures of the information which is the subject of the request for amendment.

Accounting of disclosures: You have the right to obtain an accounting of the disclosures we have made of your PHI, except for:

• disclosures made for treatment, payment or health care operations purposes.
• Certain disclosures required by law to be kept confidential.
• disclosures you specifically authorized.

The request may be for a period of up to six years starting after April 14, 2003. You may request that we provide you an accounting of disclosures on paper or in electronic form. The first request for an accounting of disclosures in any 12-month period is free; other requests will be charged according to our cost of producing the accounting. We will inform you of the cost before we begin to prepare the accounting of disclosures.

Notice of privacy practices: You have the right to obtain a paper copy of this notice, even if you have received an electronic copy of this notice.

Request for confidential communications: You have the right to request that medical information be communicated to you in a confidential manner. For example, you may request that we send your mail to an address other than your home. Your written request must tell us the specific way which you would like us to communicate with you. You do not have to tell us why you are making such a request. However, we may need information from you regarding how your treatment is to be paid for before we can consider your request. We will agree to your request when it is reasonable for us to do so, and we will notify you, in writing, of our decision.

Request for restrictions: You have the right to request a restriction on certain uses and disclosures of your information for treatment, payment or health care operations or to persons involved in your care, except when the uses or disclosures are required by law or are necessary to provide care in an emergency situation. We are not legally required to agree to your request. We will notify you, in writing, of our decision regarding your request.

IV. COMPLAINTS
If you believe that your privacy rights have been violated, you may file a written complaint with our privacy officer at the address listed below in section VI. You may also file a written complaint with the Secretary of the United States Department of Health and Human Services. Our privacy officer can provide you with the address. Complaints must be filed within six months of the time that you become aware of the violation. We will not retaliate or take action against you for filing a complaint.

V. QUESTIONS
If you have questions about our notice or our privacy practices, or require further information, please contact our privacy officer at the address noted below. You may also call our corporate compliance 24-hour hotline at 1-888-248-9808.

VI. PRIVACY OFFICER CONTACT INFORMATION
Our privacy officer can be contacted at:

CMH Regional Health System
P.O. Box 600
610 W. Main St.
Wilmington, OH 45177
(937) 382-9216