Notice of Privacy Practices

NOTICE OF HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO IT

Natchaug Hospital thinks patient information is confidential. Federal law supports this. Natchaug Hospital willingly follows all the new federal privacy standards, which are outlined below. If you have questions about the confidentiality of patient information at Natchaug Hospital, please call us at 860-456-1311.

Our Responsibilities Under the Federal Privacy Standard

The federal privacy standard established under the Health Information Portability and Accountability Act of 1996 (HIPAA) requires us to:

• Maintain the privacy of your medical information and put into place reasonable and appropriate physical, administrative and technical safeguards to protect your information.

• Provide you with a notice, such as this one, that spells out our legal duties and privacy practices with respect to any individually identifiable healthcare information we collect and maintain about you.

• Abide by the terms of this notice.

• Train our personnel concerning privacy and confidentiality.

• Put a sanctions policy into place to discipline any employee who breaches your privacy and confidentiality with respect to your medical information or breaches any of our policies with regard patient privacy and confidentiality.

• Mitigate (reduce or lessen the harm of) any breach of privacy/confidentiality.

Your Rights Under the Federal Privacy Standard

Although your medical records are the physical property of the healthcare provider who completed them, you have certain rights with regard to the information contained in these records. Specifically:

You have the right to request restrictions on the use and disclosure of your medical information.

You should know, however, that even though the federal regulations give us the right to use and disclose protected health information without your consent for purposes of treatment, payment and healthcare operations, Connecticut State law continues to provide special protections for psychiatric information. Under Connecticut State law, we are required to obtain your consent for the disclosure certain protected health information for purposes of payment and coordination of care with other providers. Accordingly, we will ask you to consent to the use and disclosure of your protected health information at intake. You should also know that there are some other uses and disclosures that do not require your consent or authorization. These include, for example, disclosures that may be required by law, such as mandatory communicable disease and child abuse reporting. Also, while you may have the right to request restrictions on the use and disclosure of your individually identifiable medical information in other circumstances, we, as your healthcare provider, do not have to agree to the restrictions you request. If we do agree to abide by the restrictions you request, we will abide by them until such time as you request otherwise, or until such time as we decide to change this agreement. If we decide to change this agreement, we will give you advance notice of our intention to do so.

You have the right to revoke your consent or authorization to use or disclose health information, except to the extent that we have already taken action in reliance upon your consent or authorization.

Disclosures for Treatment, Payment and Health Operations

Treatment: If you give us consent, we will use your health information for treatment purposes. Treatment means the provision of healthcare and related services, including coordinating and managing your healthcare with a third party, consulting between and among healthcare providers, and referring you to another healthcare provider as needed to receive appropriate care.

Payment: If you give us consent, we will use your health information for payment purposes. For example, we may send a bill to you, or to a third-party payer, such as a health insurer. The information on or accompanying the bill may include information that identifies you, your diagnosis, treatment received, and any supplies used.

Healthcare Operations: If you give us consent, we will use your health information to conduct healthcare operations, such as working to continually improve the quality and effectiveness of the services we provide. For example, members of the medical staff, the risk or quality improvement manager, or members of the quality assurance team, may use information from your medical record to assess the care your were given, the outcome of your case and the competence of your caregivers. We may also disclose information from your medical record to some of our business associates if some of the services you receive are provided through contracts with business associates. Examples include laboratories that analyze the results of diagnostic tests or a copy service that makes copies of medical records. When we use these services, we may disclose some of your healthcare information to the business associate so that they can perform the function(s) we have contracted with them to do, and so that they can bill you or your third-party payer for services rendered. To protect your health information, however, we require that all of our business associates appropriately safeguard your information.

Other Uses and Disclosures that Do Not Require Your Consent

Notification: We may use or disclose some of your protected healthcare information to notify, or assist in notifying, a family member, personal representative or other person responsible for your care of your location, and general condition.

Communication with family: Unless you object, our healthcare professionals, using their best judgment, may disclose to a member of your family, a close personal friend or any other person that you identify, those elements of your healthcare information that are relevant to that person’s involvement in your care or payment for your care.

Research: We may disclose information to researchers when their research has been approved by an institutional review board that reviewed the research proposal and established protocols to ensure the privacy of your health information.
Funeral directors: We may disclose some of your healthcare information to funeral directors, consistent with applicable law, to enable them to carry out their duties.

Marketing: We may contact you to give you information about treatment alternatives or other health-related benefits and services that may be of interest to you.

Continuity of care: We may contact you to give you appointment reminders or information about treatment alternatives and follow-up care.

Fund-raising: We may contact you as a part of a fund-raising effort. You should know, however, that you have the right to request not to receive subsequent find-raising materials.

U.S. Food and Drug Administration (FDA): We may disclose some of your healthcare information to the FDA relative to adverse effects or adverse events with respect to food, drugs, supplements, products or product defects, or as relevant to post-marketing surveillance to facilitate or enable product recalls, repairs, or replacement.

Workers’ compensation: We may disclose your healthcare information, to the extent authorized by, and necessary to comply with, laws relating to workers’ compensation or other similar programs established by law.

Public health: As required by law, we may disclose your healthcare information to public health or other legal authorities charged with preventing or controlling disease, injury, or disability.

Correctional institution: If you are an inmate of a correctional institution, we may disclose to the institution, or to agents of the institution, any of your healthcare information that may be necessary for your health and the health and safety of others.

Law enforcement: We may disclose your healthcare information for purposes required by law or in response to a valid subpoena.

Health oversight agencies and public health authorities: If a member of our workforce or a business associate believes in good faith that we have engaged in unlawful conduct or have otherwise violated professional or clinical standards and are potentially endangering patients, workers or the public, they may disclose your health information to health oversight agencies and/or public health authorities, such as the Connecticut Department of Health.

U.S. Department of Health and Human Services (DHHS): Under the privacy standards, we must disclose your healthcare information to DHHS as needed for them to determine our compliance with their standards.

Department of Mental Health and Addictions Services (DMHAS): Under existing state laws and regulations, we must disclose some of your protected health information to DMHAS if you are receiving Medicaid or State Administered General Assistance.

Healthcare accreditation organizations: We may disclose your healthcare information to representatives from healthcare accreditation organizations, such as the Joint Commission on the Accreditation of Healthcare Organizations, if we are required to do so in order to obtain or maintain official accreditation for services that we provide.

You have the right to request that we communicate your protected healthcare information with you by alternate means.

For example, you may request that we communicate any protected healthcare information to you using an address that you specify, by e-mail or fax, or by means of a specialized communications device, such as a TTY. If the method of communication is reasonable, we must grant your request.

You have the right to a copy of this notice about healthcare information practices.

Although we have posted a copy of this notice on our website, and in prominent locations throughout our facilities, you have a right to a hard copy upon request.

You have the right to inspect and copy your health information upon request.

You need to know, however, that this right is not absolute. We can refuse to give you access to your medical records in certain situations. Specifically, we may deny you access if:

1. A licensed healthcare professional has determined, in the exercise of his or her professional judgment, that access is reasonably likely to endanger your life and/or physical safety or the life and/or physical safety of another person.

2. Your record makes reference to another individual (other than a healthcare provider) and a licensed healthcare provider has determined, in the exercise of his or her professional judgment, that your access to the record is reasonably likely to cause substantial harm to this other person.

3. The request is made by someone acting as your personal representative and a licensed healthcare professional has determined, in the exercise of his or her professional judgment, that providing access is reasonably likely to cause substantial harm to you and/or another person.

IF WE GRANT YOU ACCESS TO YOUR MEDICAL RECORD, WE WILL TELL YOU WHAT, IF ANYTHING, YOU HAVE TO DO TO GET ACCESS. WE ALSO RESERVE THE RIGHT TO CHARGE A REASONABLE, COST-BASED FEE FOR MAKING ANY REQUESTED COPIES.

If your request for access to your medical record is denied because a licensed healthcare professional has determined that access is reasonably likely to harm you or someone else, we must inform you of this decision within 30 days of your making the request.

You need to know, however, that we may obtain a 30-day extension to the original 30-day period if the requested information is not maintained on site or if we are unable to act on your request within the original 30-day period.

If your request for access to your medical record is denied because a licensed healthcare professional has determined that access is reasonably likely to harm you or someone else, you may request that the decision to deny you access be reviewed by another licensed professional who must respond within 15 days of your requesting such a review.

IF WE DENY YOU ACCESS TO YOUR MEDICAL RECORD, WE WILL EXPLAIN WHY WE DID SO, WHAT YOUR RIGHTS ARE, AND HOW TO GET THIS DECISION REVIEWED BY ANOTHER LICENSED HEALTHCARE PROFESSIONAL.

Please note that there are certain types of medical records to which you have no right of access. These records include:

1. Psychotherapy notes. Psychotherapy notes are records that are produced by a mental health professional for the purpose of documenting and/or analyzing a conversation during a private counseling session, a group session, a joint counseling session, or a family counseling session. Psychotherapy notes are maintained separately from the rest of your medical record.

2. Information that has been compiled in reasonable anticipation of, or for use in, civil, criminal or administrative actions or proceedings.

3. Protected healthcare information that is subject to the Clinical Laboratory Improvement Amendments of 1988 [(CLIA), 42 U.S.C. § 263a].

4. Information that was obtained from someone, other than a healthcare provider, under a promise of confidentiality. If we have gotten information about you from someone else to whom we have promised confidentiality, we can restrict your access to this information when access would be reasonably likely to reveal the source of the information.

You have the right to request that your health information be amended or corrected.

You should know, however, that we do not have to grant a request of this sort if:

1. We did not create the record. For example, if you want to correct or amend a report created by another provider, you have to ask the provider who created the report to correct or amend the report. Then, if the other provider amends or corrects the report, we will put the revised report in our records.

2. The records are ones to which you have no right of access, as discussed above.

3. The record is accurate and complete.

IF WE GRANT A REQUEST TO AMEND OR CORRECT YOUR RECORDS, WE WILL MAKE THE CORRECTION AND DISTRIBUTE THE CORRECTED RECORD TO THOSE WHO NEED IT. WE WILL ALSO DISTRIBUTE THE CORRECTED RECORD TO ANYONE ELSE THAT YOU DESIGNATE AS SOMEONE YOU WANT TO RECEIVE THE CORRECTED INFORMATION. IF WE DENY YOUR REQUEST TO AMEND OR CORRECT YOUR RECORDS, WE WILL TELL YOU WHY, HOW YOU CAN ATTACH A STATEMENT OF DISAGREEMENT TO YOUR RECORDS (WHICH WE MAY REBUT), AND HOW YOU CAN FILE A COMPLAINT.

You have the right to get an accounting of “non-routine” uses and disclosures.

“Non-routine” uses and disclosures include any that occur for reasons other than treatment, payment and/or health care operations. Note, however, that we are not always required to give you an accounting of “non-routine” uses and disclosures. Specifically, we do not need to give you an accounting of:

1. Any use of your protected healthcare information in our facility directory.

2. Any disclosure of your protected healthcare information to persons directly involved in your care.

3. Any use or disclosure of your protected healthcare information for purposes of notification as provided in HIPAA § 164.510 [uses and disclosures requiring an opportunity for the individual to agree or to object, including notification to family members, personal representatives, or other persons responsible for the care of the individual, of the individual’s location, general condition, or death].

4. Any disclosure of your protected healthcare information for national security or intelligence purposes under HIPAA § 164.512(k)(2) [disclosures not requiring consent, authorization, or an opportunity to object].

5. Any disclosure of your protected healthcare information to correctional institutions or law enforcement officials under HIPAA § 164.512(k)(5) [disclosures not requiring consent, authorization, or an opportunity to object].

6. Any use or disclosure of your protected healthcare information that occurred before April 14, 2003.

When we have to give you an accounting within 60 days, the accounting must include:

1. The date of each disclosure.
2. The name and address of the organization or person who received your protected health information.
3. A brief description of the information disclosed.
4. A brief statement of the purpose of the disclosure that reasonably informs you of the reason for the disclosure or, in place of such a statement, a copy of your written authorization or a copy of the written request for disclosure.

The first accounting in any 12-month period is free. After that, we reserve the right to charge you a reasonable, cost-based fee.

WE RESERVE THE RIGHT TO CHANGE OUR PRIVACY PRACTICES AND TO MAKE ANY NEW PROVISIONS EFFECTIVE FOR ALL OF THE INDIVIDUALLY IDENTIFIABLE HEALTH INFORMATION WE MAINTAIN. IF WE CHANGE OUR INFORMATION PRACTICES, WE WILL MAIL A REVISED NOTICE TO THE ADDRESS YOU HAVE GIVEN US.

How to Get More Information, Report a Problem or File a Complaint

You have the right to complaint to us, or to the Secretary of the United States Department of Health and Human Services, if you believe that your privacy rights have been violated. If you have questions, would like additional information, wish to report a problem or want to file a complaint with us concerning privacy issues and/or your healthcare information, you may contact the Natchaug Hospital Director of Health Information Management at (860) 456-1311, extension 203. You will not be retaliated against for asking questions, reporting a problem or filing a complaint.