Notice of Privacy Practices
Effective Date: August 2011
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. PLEASE REVIEW IT CAREFULLY. Leer una versión en español.
If you have any questions about this Notice, please contact:
Director Quality Management
3660 South National
Springfield, MO 65807
Corporate Privacy Officer
3801 S. National Avenue
Springfield, MO 65807
Our Pledge Regarding Medical Information
This notice is intended to inform you about our practices related to the protection of the privacy of your medical records. Generally, we are required by law to ensure that medical information that identifies you is kept private. We are required by law to follow the terms of the notice that is currently in effect.
This notice will explain how we may use and disclose your medical information, our obligations related to the use and disclosure of your medical information, and your rights related to medical information that we have about you. This notice applies to all of the records of your care generated by our organization, whether made by our employees or your physician. Private physician offices may have different policies or notices regarding the physician's use and disclosure of your medical information created in the physician's office.
We may obtain, but we are not required to obtain, your consent for the use or disclosure of your protected health information for treatment, payment, or healthcare operations. We are required to obtain your authorization for the use or disclosure of information for other specific purposes or reasons. We have listed some of the types of uses or disclosures below. Not every use or disclosure is covered, but all of the ways that we are allowed to use and disclose information will fall into one of the categories.
Who Will Follow This Notice
This notice describes our organizations's practices and that of:
- Any health care professional who is authorized to enter information in your medical record; Examples of these persons include emergency room physicians, radiologists, anesthesiologists, pathologists, physician assistants, nurse practitioners, and other physicians who may be called upon by your doctor to consult on your case.
- Lester E. Cox Medical Centers ("CoxHealth") facilities, departments and clinics including Ferrell-Duncan Clinic as well as all of its affiliated entities including, but not limited to: Oxford Healthcare; Cox HPS of the Ozarks, Inc.; Primrose Place, Inc.; Cox-Monett Hospital, Inc.; Medical Developments, Inc.; Ozark Neuro Rehab and Cancer Research for the Ozarks.
- All employees, volunteers, and students conducting internships or clinical practice.
In addition, the individuals listed above may share medical information as described in this Notice of Privacy Practices. These participants are hereinafter referred to collectively with the hospital as "CoxHealth".
How We May Use and Disclose Medical Information About You
The following categories describe different ways that we use and disclose medical information.
For Treatment: We may use medical information about you to provide you with medical treatment or services. We may need to use or disclose information about you to doctors, nurses, technicians, students or other CoxHealth personnel who are involved in your treatment. For example, a doctor may need to know what drugs you are allergic to before prescribing medications. Departments or entities throughout CoxHealth may share medical information about you to coordinate your care. For instance, the laboratory may request information to complete lab work. We may also provide your physician or a subsequent healthcare provider with copies of various reports that should assist in treating you once you are discharged from our care.
For Payment: We may use and disclose your medical information so that the treatment and services you receive may be appropriately billed, and so that payment may be collected from you, an insurance company or a third-party payer. For example, we may use or disclose your medical information to your insurance company about a service you received at CoxHealth so that your insurance company can pay us or reimburse you for the service. We may also ask your insurance company for prior authorization for a service to determine whether the insurance company will cover it. We may use or disclose your medical information to a Court about a service you received at CoxHealth in order to collect an unpaid account. We also may disclose your information so that other covered entities may obtain payment for treatment that they have provided (such as ambulance service providers, Emergency Physicians of Springfield, Litton-Giddings Radiological Associates, Inc., Ozark Anesthesia Associates, Inc., Pathology Services of Springfield, P.C.). Please be aware that you may receive separate bills from these independent contract groups. Unless a restriction is requested, the guarantor/responsible party will have access to information created during the episode of treatment.
For Healthcare Operations: We can use and disclose medical information about you for CoxHealth operations. These include uses and disclosures that are necessary to run CoxHealth and make sure that our patients receive quality care. These uses and disclosures include, but are not limited to the following: quality assessment and improvement activities; reviewing competence or qualifications of healthcare professionals; reviews by external agencies for licensure, accreditation, or auditing. For example, we may disclose medical information to outside organizations or providers in order for them to provide services to you on our behalf. We may use or disclose medical information about you to evaluate our staff's performance in caring for you. Medical information about you and other patients may also be combined to allow us to evaluate whether CoxHealth should offer additional services or discontinue other services and whether certain treatments are effective. We may also compare this information with other health care systems to evaluate whether we can make improvements in the care and services that we offer.
For Another Provider's Treatment, Payment or Health Care Operations: The law also permits us to disclose your medical information to another health care provider involved with your treatment to enable that provider to treat you and get paid for those services as well as for that provider's health care operations and activities involving quality reviews, assessments or compliance audits.
Special Circumstances When We May Disclose Your Medical Information Related to Treatment, Payment, or Operations: After removing identifying information (such as your name, address, and social security number) from your medical information, we may use your information for research, public health activities, or other health care operations.
Planned Uses or Disclosures to Which You May Object
We will use or disclose your health information for the purposes described in this section unless you object to or otherwise restrict a particular release. You must direct your written objections or restrictions to the on-site Privacy Coordinator or the CoxHealth Corporate Privacy Officer.
- Facility Directories (Hospital patients only) - A facility directory may include your name, your location in the facility, your general condition such as fair, critical, etc., and your religious affiliation (if provided by you). Unless you tell us that you would like to restrict your information in the facility directory, you will be included, and directory information may be disclosed to people who ask for you by name. Unless you object, visiting community clergy or their designated staff may obtain your religious affiliation without asking for you by name. This can be prevented by not providing your religious affiliation or by affirmatively objecting.
- Appointment Reminders/Scheduling/Follow-up Calls - We may use and disclose health information to contact you as a reminder that you have an appointment, have been referred to schedule a visit, or to follow-up with you after a recent visit. We may leave a brief reminder on your answering machine/voicemail system unless you tell us not to.
- Individuals Involved in your Healthcare - We will only disclose to a member of your family, a relative, a close friend, or any other person you identify your protected health information that directly relates to that person's involvement in your health care. You will be asked to provide the names of these individuals. If you are unable to agree or object to such a disclosure, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgment. We may use or disclose protected health information to notify or assist in notifying a family member, personal representative or any person that is responsible for your care of your location, general condition or death. We may also give this information to someone who will help or is helping to pay for your care.
- Medical Emergency - We may use or disclose your protected health information in an medical emergency. If this happens, we shall try to obtain your acknowledgement as soon as reasonably practicable after the delivery of treatment.
- Communication Barriers - We may use and disclose your protected health information if we attempt to obtain consent from you but are unable to do so due to substantial communication barriers and if it is determined, using professional judgment, that you intend to consent to use or disclose information under the circumstances.
- Fundraising Activities - We may use or disclose your demographic information and the dates that you received treatment, as necessary, in order to contact you for fundraising activities supported by our organization.
- Available Services - We may use or disclose your health information to provide you with information about or recommendations of possible treatment options, alternatives or health benefits or services that may interest you.
Other Uses and Disclosures That May Be Made Without Your Consent
We may use or disclose your protected health information in the following situations without your consent or authorization. These situations include:
Required By Law - When required to do so by federal, state, or local law, including those that require the reporting of certain types of wounds or physical injuries.
To Avert a Serious Threat to Health or Safety - We may use and disclose medical/health information about you when necessary to prevent a serious threat to the health and safety of you, the public, or any other person. However, any such disclosure would only be to someone able to help prevent the threat.
Organ and Tissue Donation - If you are an organ donor, we may release medical/health information to organizations that handle organ procurement or organ, eye or tissue transplantation, or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.
Military and Veterans - If you are a member of the armed forces, we may release medical/health information about you as required by military command authorities or for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits. We may also release medical information about foreign military personnel to the appropriate foreign military authority.
Workers' Compensation - When disclosure is necessary to comply with Workers' Compensation laws or purposes, we may release medical/health information about you for workers' compensation or similar programs. These programs provide benefits for work-related injuries or illness.
Public Health Risks - We may disclose medical/health information about you for public health activities. These activities generally include the following: to prevent or control disease, injury or disability; to report births and deaths; to report abuse or neglect; to report reactions to medications or problems with products; to notify people of recalls of products they may be using; to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; to notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence. We may also disclose your protected health information, if directed by the public health authority, to a foreign government agency that is collaborating with the public health authority. We will only make this disclosure if you agree or when required or authorized by law.
Health Oversight Activities - We may disclose medical/health information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
Legal Proceedings - In the course of any judicial or administrative proceeding, in response to a court order or an administrative tribunal (to the extent such disclosure is expressly authorized), in certain conditions in response to a subpoena, discovery request or other lawful purposes.
Criminal Activity - Consistent with applicable federal and state laws, if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
Law Enforcement - We may release medical/health information if asked to do so by a law enforcement official, under the following circumstances and as otherwise allowed by law. If the material is protected by 42 CFR Part 2 (a federal law protecting the confidentiality of drug and alcohol abuse treatment records), a court order is required.
(1) about a patient who may be a victim of a crime if, under certain limited circumstances, we are unable to obtain the patient's agreement;
(2) about a death we believe may be the result of criminal conduct;
(3) about criminal conduct at the facility;
(4) about a patient where a patient commits or threatens to commit a crime on the premises or against CoxHealth staff (in which case we may release the patient's name, address, and last known whereabouts);
(5) in emergency circumstances, to report a crime, the location of the crime or victims, and the identity, description and/or location of the person who committed the crime; and
(6) when the patient is a forensic client and we are required to share with law enforcement by Missouri statute.
Coroners and Funeral Directors - To a coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose protected health information to a funeral director, as authorized by law, in order to permit the funeral director to carry out their duties.
National Security and Intelligence Activities - We may release medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
Protective Services for the President and Others - We may disclose medical information about you to authorized federal officials so they may conduct special investigations or provide protection to the President and other authorized persons or foreign heads of state.
Inmates - If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release medical/health information about you to the correctional institution or law enforcement official if the release is necessary:
(1) for the institution to provide you with health care;
(2) to protect your health and safety or the health and safety of others; or
(3) for the safety and security of the correctional institution.
Emergency or Disaster Events - We may use or disclose protected health information to a public or private entity authorized by law or by its charter to assist in disaster relief efforts, for the purpose of coordinating care or services with such entities. This may include, but is not limited to emergency managers, fire, law enforcement, public health authorities, emergency medical services such as ambulance districts, utilities, and other public works officials regarding::
- The numbers and locations of CoxHealth patients;
- Emergency notification contacts to expedite contact with families, legal guardians or representatives or others regarding need for evacuation or emergency medical care;
- Any special needs that justify prioritization of utility restoration such as but not limited to dependence on respirator or other medical equipment, phone for emergency contact, etc.; or
- Any other information that is deemed necessary to protect the health, safety and well-being of CoxHealth patients.
Food and Drug Administration - To a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations, track products; to enable product recalls; to make repairs or replacements, or to conduct post marketing surveillance, as required.
Change of Ownership - In the event that CoxHealth is sold or merged with another organization, your protected health information will become the property of the new owner.
Research - To researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your protected health information. These protocols may include a waiver of authorization that has been approved by the Institutional Review Board, Privacy Committee, or any university sponsored Institutional Review Board approved by the Food and Drug Administration. For example, a research project may involve comparing the health and recovery of all patients who received one medication to those who received another medication for the same condition. All research projects, however, are subject to a special approval process under applicable law. This process evaluates a proposed research project and its use of medical information, trying to balance the research needs with patients' need for privacy of their medical/health information. Before we use or disclose medical/health information for research, the project will have been approved through this research approval process. We may, however, disclose medical/health information about you to people preparing to conduct a research project, for example, to help them look for patients with specific medical needs, so long as the medical information they review does not leave the facility.
Disclosures With Written Authorization
Uses or disclosures not covered in this Notice of Privacy Practices will not be made without your written authorization. If you provide us written authorization to use or disclose information, you can change your mind and revoke your authorization at any time, as long as it is in writing. If you revoke your authorization, we will no longer use or disclose the information. However, we will not be able to take back any disclosures that we have made pursuant to your previous authorization.
Your Rights with Respect to Health Information
Right to Inspect and Copy - You may inspect and obtain a copy of your protected health information that is contained in a designated record set, with the exception of psychotherapy notes, for as long as we maintain the protected health information. A "designated record set" contains medical and billing records and any other records our organization uses for making decisions about your treatment. Your request must be submitted in writing to each clinic or entity where you received treatment. A copy of the authorization to request release of information is available from the Privacy Office or Health Information Management at each entity. If you request a copy of the information, we may charge a reasonable fee for the costs of copying, mailing or other supplies associated with your request.
We may deny your request to inspect and copy based on the federal laws above. If you are denied access to medical information, you may request that the denial be reviewed. Another licensed health care professional chosen by the organization will review your request and the denial. The person conducting the review will not be the person who denied your original request. We will comply with the outcome of the review.
Right to Request an Amendment - You have a right to request that your protected health information be amended (changed) if you believe that it is incorrect or incomplete. You have a right to request an amendment for as long as CoxHealth keeps the information. To request an amendment to your information, you must submit a written request to the CoxHealth's Corporate Privacy Officer or the on-site Privacy Coordinator. This written request must include why you want the information amended and why you believe the information is incorrect or incomplete. We can deny your request if it is not in writing and if it does not include a reason why the information should be amended. We can also deny your request for the following reasons:
(1) the information was not created by CoxHealth, unless the person or entity that did create the information is no longer available;
(2) the information is not part of the medical record kept by or for CoxHealth;
(3) the information is not part of the information that you would be permitted to inspect and copy;
(4) we believe the information is accurate and complete.
Right to an Accounting of Disclosures - This means that you have the right to request an "accounting of disclosures." This is a list of the disclosures we make of medical information about you for purposes other than treatment, payment or healthcare operations as described in this Notice of Privacy Practices. It will exclude disclosures:
1. To carry out treatment, payment and health care operations
2. To individuals about themselves
3. Pursuant to an authorization
4. For the facility's directory or to persons involved in the individual's care or other notification purposes
5. For national security or intelligence purposes
6. To correctional institutions or law enforcement officials
7. As part of a limited data set
8. That occurred prior to the compliance date for the covered entity.
To request this list or accounting of disclosures, you must submit your request in writing to our Privacy Officer. Your first request within a 12-month period will be free. For additional lists, we may charge you for the cost of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
Right to Request Restrictions - This means that you have the right to request a restriction of limitation on the medical information we use or disclose about you for treatment, payment or healthcare operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. WE ARE NOT REQUIRED TO AGREE WITH YOUR REQUEST. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment.
To request restrictions, you must make your request in writing to our Corporate Privacy Officer. In your request, you must tell us:
- What information you want to limit;
- Whether you want to limit our use, disclosure or both; and
- To whom you want the limits to apply (for example, disclosure to your spouse).
Right to Request Confidential Communications - This means that you have the right to request that we communicate with you about medical matters in a certain way or at a certain location. (For example, you can ask that we only contact you at work or by mail.) To request confidential communications, you must make your request in writing to CoxHealth's Corporate Privacy Officer or the on-site Privacy Coordinator at the entity where you are receiving treatment. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.
Right to a Paper Copy of This Notice - This means that you have the right to a paper copy of this notice even if you have agreed to receive this notice electronically. To obtain a paper copy of this notice, contact the CoxHealth Corporate Privacy Officer. You may obtain a copy of this notice at our website, www.coxhealth.com.
If you believe that we have violated your privacy rights or have not adhered to the information contained in this Notice of Privacy Practices, you can file a complaint by putting it in writing and sending it to the Corporate Privacy Officer listed at the beginning of this document.
You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services at 1-800-368-1019 (any language) or 1-800-537-7697 (TDD), or view the web-site: http://www.hhs.gov/ocr/privacy/hipaa/complaints/. You will not be retaliated against for filing a complaint with either CoxHealth or the U.S. Department of Health and Human Services.
Changes to This Notice of Privacy Practices
We reserve the right to change or modify the information contained in this Notice of Privacy Practices. Any changes that we make can be effective for any health information that we have about you and any information that we might obtain. Each time you receive services from CoxHealth, we will have available the most current copy of our Notice of Privacy Practices. The most recent version of Privacy Practices will be posted in our building and our website (www.coxhealth.com). Also, you can call or write our contact person, whose information is included in this Notice of Privacy Practices, to obtain the most recent version of this notice.