Effective Date: September 1, 2014
PATIENT NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED FOR PURPOSES OF TREATMENT, PAYMENT, AND HEALTHCARE OPERATIONS AND FOR OTHER PURPOSES PERMITTED BY LAW. THIS NOTICE DESCRIBES HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Campbell Clinic is required by law to:
(1) Maintain the privacy of your protected health information
(2) Provide you with this Notice
(3) Make good faith efforts to obtain your written acknowledgement that you received this Notice
(4) Abide by the terms of this Notice; and
(5) Additionally, we reserve the right to change this Notice. We reserve the right to make any new Notice that will be adopted effective for all protected health information we maintain. Any new Notice adopted will be presented at your next appointment following the revision or through U.S. Mail.
Protected health information (PHI) is defined as demographic and individually identifiable health information about you (individually identifiable health information) that will or may identify you and relates to your past, present or future physical, mental health or condition that involves providing healthcare services or healthcare payment.
HOW IS HEALTHCARE OPERATIONS DEFINED?
Healthcare operations include conducting quality assessment and improvement activities, reviewing the competence or qualifications and accrediting/licensing of healthcare professionals and plans, fundraising, a trust that is authorized under § 501(c)(3) evaluating healthcare professionals health plans performance, training future healthcare professionals, insurance activities relating to the renewal of a contract for insurance, conducting or arranging for medical review and auditing services, compiling and analyzing information in anticipation of or for use in civil or criminal legal proceedings, general administrative and business functions necessary for the covered entity to remain a viable business.
WHY DO YOU SIGN AN AUTHORIZATION FORM?
In order to release your PHI for any reason other than treatment, payment and healthcare operations, you must sign an authorization that clearly explains how your information will be used. Additionally, information about the following conditions requires an authorization even though release of information is related to treatment, payment or healthcare operations.
□ Alcoholism/drug abuse treatment – Federal Confidentiality 42 CFR Part 2
□ Psychotherapy Notes
You may change your mind and revoke your authorization, except inasmuch as we have relied on the authorization until that point or if the authorization was obtained as a condition of obtaining insurance coverage. All requests to revoke an authorization should be in writing. If Campbell Clinic determines that an authorization request gives an improper, inaccurate and/or misleading description of an individual’s health condition, Campbell Clinic shall decline to release less than the individual’s entire record.
HOW IS YOUR MEDICAL INFORMATION USED?
Campbell Clinic uses medical records as a basis for recording individually identifiable health information and planning care and treatment and as a tool for routine healthcare operations such as assessing quality. Your insurance company may request information that we are required to submit in order to provide and bill for your care, such as procedure and diagnosis information. Other healthcare providers or health plans reviewing your records must follow the same confidentiality laws and rules required of Campbell Clinic. Patient records are a valuable tool used by researchers in finding the best possible treatment for diseases and medical conditions. All researchers must follow the same rules and laws that other healthcare providers are required to follow to ensure the privacy of your patient information. Information that may identify you will not be released for research purposes to anyone outside of Campbell Clinic without your written authorization.
We may use certain information (name, address, telephone number or email information, age date of birth, gender, health insurance status, dates of service, department of service information, treating physician information or outcome information) to contact you for the purpose of raising money for the Campbell Foundation (the charitable trust for the physicians of Campbell Clinic, dedicated to education, orthopaedic research and community healthcare) and you will have the right to opt out of receiving such communications with each solicitation. The money raised will be used to expand and improve the services and programs we provide to the community. You are free to opt out of fundraising solicitation and your decision will have no impact on your treatment or payment for services at Campbell Clinic Orthopaedics or the Campbell Clinic Surgery Center. If you do not want to receive future fundraising requests supporting the Campbell Foundation, please call our office at (901) 759-5490 and leave a message identifying yourself and stating that you do not want to receive fundraising requests. There is no requirement that you agree to accept fundraising communication from us, and we will honor your request not to receive any fundraising communications from us after the date we receive your decision.
SPECIFIC EXAMPLES OF HOW YOUR MEDICAL INFORMATION MAY BE USED FOR TREATMENT, PAYMENT OR HEALTHCARE OPERATIONS
□ Medical information will/may be used to justify needed patient care services; i.e., lab tests, prescriptions).
□ We will/may use your medical information to establish a treatment plan.
□ We may disclose your PHI to another provider for treatment; e.g., specialist, pharmacy, laboratory.
□ We will/may submit claims to your insurance company containing medical information.
□ We will/may contact you to remind you of your appointment by calling you or mailing a postcard.
□ We may contact you to discuss treatment alternatives or other health-related benefits that may be of interest to you as a patient.
□ Campbell Clinic uses medical records as a basis for recording individually identifiable health information and planning care and treatment, and as a tool for routine healthcare operations such as assessing quality.
USE OF YOUR AUTHORIZATION
Campbell Clinic will contractually require our business associates to follow the same confidentiality laws and ruled required of Campbell Clinic, healthcare providers or health plans. We will not allow others outside of Campbell Clinic and Campbell Clinic’s business associates to have access to your medical information unless we have the appropriate authorization to do so. Business associates perform various activities such as billing services, transcription services, etc. We will provide this Notice and request your acknowledgement of receipt of this Notice and may request your authorization to release information at your first visit. With your authorization, we will release the information that you have approved for release.
WHEN YOUR AUTHORIZATION IS NOT REQUIRED
Please note that the law requires some information to be disclosed in certain circumstances. This includes mandatory reports of abuse of children or elderly or disabled persons. Additionally, this includes uses and disclosures to the public health authority or federal/state entity that is authorized by law to collect or receive such information. One example of the public health authorities’ purpose is preventing and controlling disease. An example of a federal entity is the Food and Drug Administration. An example of a state entity is the State Department of Health that is authorized to receive a variety of data concerning different health conditions. Also, subpoenas or court orders may compel the disclosure of confidential health information in the context of a lawsuit or administrative proceeding. See complete list below:
Emergencies: We may use or disclose your PHI in an emergency treatment situation. If this happens, your physician shall try to obtain your acknowledgement of receipt by you of your rights under this Notice as soon as reasonably practicable after the delivery of treatment. If your physician or another physician in the practice is required by law to treat you, he or she may still use or disclose your PHI to treat you.
Required By Law: We may use or disclose your PHI to the extent that the use or disclosure is required by law. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. You will be notified, as required by law, of any such uses or disclosures.
Public Health and Communicable Diseases: We may disclose your PHI for public health activities and purposes to a public health authority that is permitted by law to collect or receive the information. The disclosure will be made for the purpose of controlling disease, injury or disability. We may also disclose your PHI, if directed by the public health authority, to a foreign government agency that is collaborating with the public health authority. Further, we may disclose your PHI, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.
Health Oversight: We may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies seeking this information include government agencies that oversee the healthcare system, government benefit programs, other government regulatory programs and civil rights laws.
Abuse or Neglect: We may disclose your PHI to a public health authority that is authorized by law to receive reports of child abuse or neglect. In addition, we may disclose your PHI if we believe that you have been a victim of abuse, neglect or domestic violence to the governmental entity or agency authorized to receive such information. In this case, the disclosure will be made consistent with the requirements of applicable federal and state laws.
Food and Drug Administration: We may disclose your PHI to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations, track products; to enable product recalls; to make repairs or replacements, or to conduct post marketing surveillance, as required.
Legal Proceedings: We may disclose PHI in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), in certain conditions in response to a subpoena, discovery request or other lawful process.
Law Enforcement: We may also disclose PHI, so long as applicable legal requirements are met, for law enforcement purposes. These law enforcement purposes include (1) legal processes and otherwise required by law, (2) limited information requests for identification and location purposes, (3) pertaining to victims of a crime, (4) suspicion that death has occurred as a result of criminal conduct, (5) in the event that a crime occurs on the premises of the Practice, and (6) medical emergency (not on the Practice’s premises) and it is likely that a crime has occurred.
Coroners, Funeral Directors, and Organ Donation: We may disclose PHI to a coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose PHI to a funeral director, as authorized by law, in order to permit the funeral director to carry out their duties. We may disclose such information in reasonable anticipation of death. PHI may be used and disclosed for cadaveric organ, eye or tissue donation purposes.
Research: We may disclose your PHI to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your PHI.
Criminal Activity: Consistent with applicable federal and state laws, we may disclose your PHI, if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose PHI if it is necessary for law enforcement authorities to identify or apprehend an individual.
Military Activity and National Security: When the appropriate conditions apply, we may use or disclose PHI of individuals who are Armed Forces personnel (1) for activities deemed necessary by appropriate military command authorities; (2) for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits, or (3) to foreign military authority if you are a member of that foreign military service. We may also disclose your PHI to authorized federal officials for conducting national security and intelligence activities, including for the provision of protective services to the Present or others legally authorized.
Workers’ Compensation: Your PHI may be disclosed by us as authorized to comply with workers’ compensation laws and other similar legally established programs.
Inmates: We may use or disclose your PHI if you are an inmate of a correctional facility and your physician created or received your PHI in the course of providing care to you.
Required Uses and Disclosures: Under the law, we must make disclosures to you and when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the requirements of federal law.
A SUMMARY OF YOUR RIGHTS
The Patient Notice, which you are now reviewing, is part of your patient rights. You have the right to receive and read this Notice.
You have a right to request restrictions regarding how we use and disclose your PHI regarding treatment, payment, healthcare operations; however, we are not required to agree to your restrictions. If we do agree to your requested restriction, we will follow your request, unless you are in need of emergency treatment and the information is needed to provide emergency care. However, your restriction (if agreed to) will not prevent us from releasing information as required by other state and federal laws. [See WHEN YOUR AUTHORIZATION IS NOT REQUIRED]. Finally, if we accept your restrictions, we have the right to terminate them by notifying you of such, except for those restrictions provided under the HITECH Act.
You have the right to be notified when an impermissible or unauthorized access, use and/or disclosure of unsecured PHI occurs as set forth in the Health Information Technology for Economic and Clinical Health Act (HITECH Act).
Also under the HITECH Act, you have a right to request the restriction of disclosure of your PHI to a health plan for purposes of carrying out payment or healthcare operations. The PHI in the restriction request will pertain solely to a healthcare item or service for which Campbell Clinic has been paid in full by the patient (or the patient’s representative) “out of pocket”.
You have a right to request that we communicate about your treatment and/or PHI by alternative means or at alternative locations. We are required to accept reasonable requests. We require that you make this request in writing.
You do not have to sign an authorization form; however, it may prevent us from completing a task you have requested (such as enrollment in a research study or examining you to create a report for your attorney). You refusal to sign an authorization form will not be held against you.
You may change your mind and revoke your authorization, except inasmuch as we have relied on the authorization until that point or if the authorization was obtained as a condition of obtaining insurance coverage.
You have the right to opt out of receiving future fundraising requests supporting The Campbell Foundation. If you do not want to receive future requests, please call our office at (901) 759-5490 and leave a message identifying yourself and stating that you do not want to receive fundraising requests. There is no requirement that you agree to accept fundraising communication from us, and we will honor your request not to receive any fundraising communications from us after the date we receive your decision.
You have the right to inspect and copy your PHI, as permitted by law.
You have the right to request amendments to your PHI. We require that all requests for amendments be in writing and provide a reason to support the requested amendment. An amendment to your medical record will be made in the form of an addendum as is common practice in the medical field. Additionally, under federal law, we may deny the amendment. Please contact the Privacy Liaison or Officer of Campbell Clinic for details and to exercise your rights.
You have the right to an accounting of all entities that obtained information unrelated to treatment, payment or healthcare operations that you do not approve by completing an authorization.
You have a right to this Notice. Any material revisions to this Notice will be made available to you within 60 days.
You have a right to contact the Privacy Officer of Campbell Clinic to request additional information or ask questions.
You may complain to the Privacy Officer of Campbell Clinic and to the Secretary of the Department of Health and Human Services if you feel your privacy rights have been violated. Campbell Clinic will not retaliate against you for filing a complaint.
CHANGES TO THE TERMS OF THIS NOTICE
We reserve the right to change this Notice. We reserve the right to make the changed Notice Effective for PHI we already have as well as for any PHI we create or receive in the future. A copy of our current notice is posted in our office, and will be available upon request.
Effective Date of Notice: September 1, 2014.
Contact person for information about this Notice or to file a complaint:
Privacy Officer, Campbell Clinic
1400 S. Germantown Road
Germantown, TN 38138
Campbell Clinic has created this privacy statement in order to demonstrate our firm commitment to privacy. The purpose of this Online Privacy Statement is to inform you about the types of information we gather online about you when you visit our website, how we may use that information, whether we disclose it to anyone, the choices you have regarding our use of it, and your ability to correct that information. This Statement will explain the following regarding the treatment of data collected on our website. This Online Privacy Statement may change from time to time, so please check back periodically.
The information we collect on our website generally falls into the following two categories: Personally Identifiable Information and Non-Personally Identifiable Information.
Personally Identifiable Information: This refers to information that lets us know the specifics of who you are. The Personally Identifiable Information we collect when you use our Site may include your name, address, phone number, e-mail address, employer, insurance provider, and title. We request Personally Identifiable Information when you receive healthcare services, complete patient satisfaction surveys, and correspond with us. Patients, Employees, and other persons who visit this site to make an appointment, get results, communicate to our healthcare providers, or make payments on their account are required to submit personal information to identify themselves and all such information is protected to the standards of the U.S. HIPAA and HITECH law Privacy Rules, Public Law 104-191 § 261-264, 45 CFR 160 & 164 and all subsequent regulations. It will be clear when you are on a part of our Site that requires personal information, because we will ask you for it and you will have a choice to provide that information.
Reasons We Share Personal Data: We may share your personal data with your consent or to complete any transaction or provide any healthcare services you have requested or authorized. We also may share data with vendors and agencies working on our mutual behalf (such as insurance claims processing); when required by law or to respond to legal process; to protect our patientss; to protect lives; to maintain the security of our products and systems; and to protect Campbell Clinic’s and its patient’s rights and property.
Campbell Clinic acknowledges your trust and is committed to protecting the information you provide us. To prevent unauthorized access, maintain accuracy, and ensure proper use of information, we have employed physical and electronic safeguards, and managerial processes to protect the information we collect online. We use Secure Sockets Layer / Transport Layer Security (SSL/TLS) encryption technology to safeguard your information while it is being sent to us. SSL/TLS encryption is designed to make the information unreadable by anyone but us. This security measure is working when you see either the symbol of an unbroken key or closed padlock (depending on your browser) on the bottom of your browser window. Our site uses SSL/TLS encryption at the highest level currently permitted under U.S. Law: RSA 4096-bit:AES256:ECDHE encryption conforming to the TLS v1.2 standard of the Certificate Authority Standards Board. Visitors with older computers and not using the most current web browser(s) may shift down to a lower level of encryption, however we do not support any encryption below TLSv1.0 with RSA 1028-bit:AES128:CBC. Your computer will automatically negotiate the highest level of encryption possible to ensure maximum security.