THE POTTSVILLE HOSPITAL AND WARNE CLINIC
NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE READ IT CAREFULLY. CFR 164.520(b)

This notice is not intended to create contractual or other rights independent of the Standards for Privacy of Individually Identifiable Health Information, or privacy rule, issued by the Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act (HIPAA).

If you have any questions concerning this notice, you may address them to:

Privacy Officer
The Pottsville Hospital & Warne Clinic
420 South Jackson Street, Pottsville, PA 17901
570-621-5000

I. Safeguarding Your Protected Health Information

The Pottsville Hospital and Warne Clinic is required by law to maintain the privacy of your health information. We are also required to provide you with this notice of our legal duties and privacy practices with respect to your protected health information. We are required to follow the terms of this notice, though we reserve the right to change ourprivacy practices and the terms of this notice at any time. If we do so, the Hospital will post a new notice. You may also request a copy of the revised notice from the privacy officer listed above, or you may obtain it from our website at http://www.pottsvillehospital.com.

Your protected patient health information is any information that

• is created or maintained by us or our business associates
• relates to your past, present, or future physical and/or mental health
• and that individually identifies you or can be reasonably used to identify you.

Your medical and billing records are two examples of information that are generally considered protect health information.

II. Uses and Disclosures for Treatment, Payment and Healthcare Operations

The law permits us to use and disclose your protected health information without written authorization for the purpose of treatment, payment, and healthcare operations. Although the following list contains many examples of uses and disclosures for treatment, payment, and healthcare operations, it does not list every possible situation. In addition, some examples may overlap and fall into more than one category.

Treatment

Treatment includes coordination, provision, and management of healthcare services to you by our facility or one or more other healthcare providers. The following list includes some examples of treatment uses and/or disclosures:

• During your visit, hospital staff and physicians involved in your care may review your medical record and share and discuss it with each other.
• If we need to refer you to an outside physician for care, we may share and discuss information with this individual or his/her staff.
• If we need to consult another physician concerning your care, we may share and discuss your information with this individual.
• We may share and discuss your information with an outside home health agency, durable medical equipment supplier, medical transport services, or other healthcare providers that we are referring you to for further healthcare products or services.
• We may share and discuss your information with other hospitals or health care facilities such as but not limited to nursing homes where you may be admitted to for further care following your discharge from our facility.

Payment

Uses and disclosures for payment reasons are defined as activities taken to assure reimbursement for services rendered to the patient by the provider. The following list includes a few examples of such activities:

• We share information with your health insurance provider to determine if you are eligible for coverage or whether the proposed treatment is covered by your insurance.
• We use your information when submitting a claim to your health insurance company. · We disclose information when providing a bill to a family member or other designated person who is identified as responsible for payment of services provided to you.
• We use or disclose information to a collection agency or our attorney in an effort to collect an outstanding balance.
• We provide medical records and other documents to your insurance company if they need to determine if the services we provided were medically necessary.
• We permit your health insurance provider to access your medical and billing records for auditing and medical necessity reviews.
• We disclose your information in a legal action to obtain reimbursement for delinquent accounts.

Healthcare Operations

Uses and disclosures for healthcare operations are defined as activities that we engage in during our facility operations. The following list includes a few examples of such activities:

• Using a patient sign-in sheet at our registration and waiting areas.
• Announcing patient names from our sign-in sheets in waiting areas.
• Making appointment reminder telephone calls.
• Mailing correspondence to you with our name and return address on the envelope.
• Including your name on our patient directory for distribution to various department, including pastoral care department as a reference for local clergy.
• Sharing information about your medical care to our patient accounts department, or to other providers such as physicians involved in your care, so a bill can be generated to obtain reimbursement for services provided.
• Conducting quality assessment and improvement activities, to include but not limited to departmental, medical staff, and interdepartmental performance improvement teams, to review and analyze the medical care provided.
• Conducting training programs for students, trainees, or other healthcare practitioners participating in an educational program.
• Reviewing the competence or qualifications of healthcare professionals.
• Business planning and development activities.
• Administrative purposes to include but not limited to underwriting, premium rating, case-mix analysis, and compliance activities.
• Resolution of patient complaints.
• Using your medical information for legal services in defense of the hospital.

III. Uses and Disclosures without consent or authorization

The privacy regulations permit us to use or disclose your medical information without your authorization. This sections explains the situations and gives some examples. Some examples may apply to more than one area and not just the one area under which they appear.

Patient
We may disclose information to you without your authorization.

Personal Representative
We may disclose protected health information to your personal representative.

IndividualInvolved in Your Care or Responsible for Payment for Your Care
We may disclose your protected health information to an individual involved in your care or responsible for paying your bill. This individual may be a spouse, a family member, or close friend. For example, we may discuss your discharge instructions with a family member caring for you within the immediate 24 hours following ambulatory surgery. We are required to limit the disclosure of this information to someone directly involved in the patient’s care or payment of the care. If you are present and able to make healthcare decisions, we will give you the opportunity to agree or object to the disclosure and we may not make the disclosure if you object.

Notification
We may disclose your protected health information to notify, or to assist in the notification of, a family member, a personal representative, or another individual responsible for your care regarding your location, general condition, or death. For example, if you are involved in a motor vehicle accident and are brought to our Hospital’s Emergency Department for treatment, we would notify your spouse. We can also release information to a disaster relief entity, such as the Red Cross, so they can notify the family, a personal representative, or other individual involved in your care concerning your location, general condition, or death. We can also release information to the Red Cross so they can notify individuals in the military of a family medical crisis.

As Required by Law
Under federal, state, and local laws, we may disclose your protected health information. For example, we may disclose information to the Division of Vital Records for the purpose of registering births and deaths. Other mandatory reporting includes child abuse, disease prevention and control, cancer reporting, vaccine related reporting, medical device related deaths, gunshot wounds and other deadly weapon reporting, blood alcohol testing, and Pennsylvania Health Care Cost Containment Council reporting.

Other Public Health Reporting
Above we mentioned our mandatory reporting but there are other instances where we may voluntarily report information to assist in public health matters. An example includes adverse event reporting drug and medical devices and assistance with medical product recalls, repairs, and replacements. Another example includes notifying someone who could have been exposed to a communicable disease or is at risk of contracting or spreading a disease or condition in situations where we are authorized by law to make the notification as part of public health intervention. In the case of HIV-related information, we must comply with state law limitations on HIV contract tracing and disclosure.

OSHA, Injury Care Treatment, and Worker’s Compensation
We provide healthcare to certain patients at the request of their employer as required per law. We may disclose to the employer information concerning a work-related injury or illness or workplace/employment medical evaluation results to comply with OSHA and worker’s compensation law.

Abuse, Neglect and Domestic Violence
Above we mentioned about child abuse reporting. If we suspect a patient to be a victim of abuse, neglect, or domestic violence, we may voluntarily report this information along with your protected health information to the Department of Aging for an elderly patient or the Department of Public Welfare for a nursing home patient. In these cases, we will get an agreement from the patient to proceed with limited exceptions.

Coroner’s and Medical Examiners
We may disclose your protected health information to these individuals for the purpose of identifying the deceased, determining cause of death, and to facilitate performance of their duties.

Funeral Director
We may disclose your protected health information to these individuals for the purpose of carrying out their duties. This also includes HIV related information.

Organ and Tissue Donation
We may disclose your protected health information to organ donation organizations for the purpose of facilitating the donation and transplantation process.

Accreditation and Licensure Activities
We may disclose your protected health information to organizations pursuing accreditation or licensure activities of our facility. This activity would involve inspecting, auditing, and investigative purposes.

Judicial and Administrative Proceedings
We may disclose your protected health information in response to a subpoena or a court order which may request us to produce originals or copies of your medical records for a court proceeding.

Protection from Harm
We may disclose your protected health information to protect another individual from being harmed. For example, we may warn that a patient has threatened another identifiable individual with imminent serious bodily harm if we have reason to believe that the threat is real.

Military Activities
We may disclose protected health information of patients in the military if we receive a request from the military command authorities.

National Security
We may disclose protected health information to federal officials for the purposes of conducting legally authorized intelligence, counterintelligence, and other national security activities.

Protection of the President and others
We may disclose protected health information to federal officials such as Secret Service Agents for purposes of protecting the President and other dignitaries.

Law Enforcement
We may disclose medical information if we are asked to do so by a law enforcement official, in response to a court order, subpoena, summons, warrant, or similar law enforcement process.

Correctional Institutions and Other Law Enforcement Custodial Settings
We may disclose protected health information to a correctional institution or a law enforcement official having custody of a patient when the information is needed for purposes of healthcare, safety, or security.

Patient Directory
We may include certain limited information about you in the hospital directory while you are a patient at the hospital. The directory may include your name, location in the hospital, your general condition and your religious affiliation. The directory information, excluding religious affiliation, may be disclosed to people who ask for you by name unless you request us not to release any part or all of this information and we will follow your instructions.

Business Associates
We may utilize individuals or company’s to perform a function or activity on our behalf. We may disclose protected health information to our business associates and allow them to create and receive protected health information. This business associate arrangement is outlined in a business associate agreement between both parties to protect the privacy of protected health information.

Fund-Raising Activities
We may use and disclose with our development office or a business associate that is related to us your name, address, phone number, and other such information (called “demographic information”) and dates that health care was provided to you. This information may be used to solicit a donation from you. Any fund-raising materials will explain how you can tell us or a business associate that you do not want to be contacted in the future. If you do so, we will use reasonable efforts to avoid contacting you in the future.

IV. Uses and Disclosures with authorization

If we did not list a particular situation in sections 2 or 3, then we will obtain written authorization from you to release your protected health information. A patient authorization can be revoked at any time except to the extent that we have already relied upon the authorization.

If a minor does not have legal capacity to make his/her own health care decisions, a parent, legal guardian, or other personal representative generally provides authorization to use and disclose the minor’s protected health information and exercise the minor’s privacy rights.

If a patient is declared incompetent, a personal representative such as a healthcare power of attorney, guardian, or close family member may provide authorization to use and disclose the patient’s protected health information and exercise the patient’s privacy rights.

If a patient dies, the health information continues to remain protected health information. In order to disclose the information, authorization must be obtained from a personal representative such as the executor of the estate in order to use and disclose the deceased patient’s protected health information and exercise the deceased patient’s privacy rights.

V. Individual Patient Rights Concerning Protected Health Information

The Health Insurance Portability and Accountability Act provides for individual patient rights concerning the use of protected health information. These rights include accountability; amendments; confidential communications; inspection and copies; notification; and restrictions.

Accountability
You have the right to obtain an accounting of certain disclosures of your protected health information by us (or a Hospital business associate). The accounting summary will include name and address of recipient, date, brief description of disclosed information and purpose of disclosure.

A patient’s right to an accounting does not apply to all disclosures. The following disclosures are excluded from the accounting process:

• to you or your personal representative,
• or the purposes of treatment, payment, or healthcare operations,
• to an individual involved in your care or the payment of your care,
• for notification purposes,
• and for national security, intelligence purpose, or correctional facilities for law enforcement purposes.

The right to accounting is effective for disclosures occurring on or after April 14, 2003 and within six years of the request for an accounting.

To exercise your right, your written request should be submitted to the privacy officer and should specify the applicable timeframe.

Upon receipt of the request, the Hospital is required to respond within 30 days. If we cannot comply, we will notify you in writing, explaining the reason for the delay and offer a timeframe upon which we can comply (within a 30 day extension).

We are required to provide the first accounting request to a patient within a 12 month period free of charge. We reserve the right to charge a reasonable fee for any additional requests within a 12 month period. We will notify you of the cost and in doing so, you may wish to withdraw or change your request before any costs are incurred. We reserve the right to require payment in advance for accounting fees.

Amendments

Should you feel that your protected health information is incomplete or incorrect, you may request to amend your information. You have a right to amend the information for as long as we maintain the information.

To request an amendment, you must submit a written request to the privacy officer. The request should state the specific change and described the reason for the change.

We may deny the request for amendment if the request reflects any of the following situations:

• we did not create the information,
• is not a part of the information maintained by us,
• is not part of the information you may inspect and copy,
• is accurate or complete.

We are required to respond by accepting the amendment or providing a denial within 60 days of receipt. If we cannot comply, we will notify you in writing, explaining the reason for the delay and offer a timeframe upon which we can comply (within a 30 day extension).

Confidential Communications

You have a right to request that we communicate your protected health information by certain measures or certain location. For example, you may request that we only contact you by mail.

To exercise your right, you must submit a written request to the privacy officer. The request should state how or where you want to be contacted. If another individual is responsible for the payment of services, the request must specify how payment will be addressed. You are not required to offer an explanation of the reason for your request.

Inspection and Copies

You have the right to inspect and receive a copy of your protected health information. Generally, you have the right to inspect your medical and billing records.

To exercise your right, you must submit your written request to the privacy officer. The request must specify the information to be accessed; how the patient wants to obtain access, such as inspection, hand-carry, mail; and the type of medium such as paper or electronic format; and include a mailing address, if applicable.

Upon receipt of the request, the Hospital is required to respond within 30 days if the information is maintained on-site, or 60 days if the information is kept off-site. If we cannot comply with these timeframes, we will notify you in writing, explaining the reason for the delay and offer a timeframe upon which we can comply (within a 30 day extension).

The Hospital has the right to deny access to protected health information under the following circumstances:

• A licensed healthcare professional determines that the requested access would endanger the welfare or physical safety of the patient or another individual.
• A licensed healthcare professional determines that the requested access is reasonably likely to cause substantial harm to a non-healthcare provider.
• The information was obtained from an individual other than a healthcare provider under the premise of confidentiality and the requested access would be reasonably likely to reveal the source of the information.
• The access is requested by a personal representative and a licensed healthcare professional determines that the request is reasonably likely to cause substantial harm to the patient or another person.

The Hospital reserves the right to arrange a convenient time and place for inspection of records.

The Hospital is required to comply with a form or format specified by the patient if the covered protected health information is readily producible in that format. Otherwise, we only need to provide the information in a readable hard copy form or such other form as mutually agreed.

We may comply with a request for access by providing a summary of the requested protected health information if you are in agreement. We may also offer an explanation of health information if you are in agreement.

The Hospital reserves the right to charge you a reasonable fee for copying your protected health information. We may also charge a reasonable fee for mailing the copies. You may learn more about these fees by contacting the privacy officer.

The Hospital also reserves the right to charge you a reasonable fee for a summary or explanation. These fees will be communicated in advance of the agreement.

The Hospital reserves the right to request payment in advance for copying and mailing fees.

Notification
Upon request, you have the right to receive a paper copy of our Notice of Privacy Practices. Patients may request a paper copy - even if they agreed to receive it electronically.

To exercise your right, contact the privacy officer.

Restriction

You have the right to request that we restrict uses and disclosures of your protected health information for treatment, payment, or healthcare operations; to someone who is involved in your care or responsible for payment of the care; or for notification purposes.

To exercise your right, you must submit your written request to the privacy officer and explain what information is to be restricted, how it is to be restricted, and to whom it should be restricted.

The Hospital reserves the right to deny the requests. If the Hospital reserves the right to agree, we must comply with the request unless the information is needed for emergency care.

The Hospital can terminate the agreement to a restriction, with your consent, as to all the protected health information that we maintain. We can also terminate the agreement without your consent, but only as to protected health information created or received after we notify you of the termination of the agreement.

VI. Revisions to this Notice

The Hospital reserves the right to change this notice at any time. We reserve the right to make any change effective for all protected health information that we maintain at the time of the change – including information that we created or received prior to the effective date of the change.

We will post this notice at our registration and waiting areas. The notice will also be available at our website at http://www.pottsvillehospital.com.

VII. Complaints

If you feel at any time that your privacy rights have been violated, you may submit a complaint to our privacy officer. You may also submit your complaint to the Secretary of Health and Human Services. You will not face any consequences for filing a complaint.

Effective: 4/14/2003
Revised: 10/1/2003