Notice of Privacy Practices

Our Legal Duty: We are required by applicable federal and state law to maintain the privacy of your health information. We are also required to give you Notice about our privacy practices, our legal duties and your rights concerning your health information. We must follow the privacy practices that are described in this Notice while in effect. This notice takes effect 4/14/03 and will remain in effect until we replace it.
Please review it carefully.

We reserve the right to change our privacy practices and the terms of this Notice at any time, provided such changes are permitted by applicable law. We reserve the right to make the changes in our privacy practices and the new terms of our notice effect all health information that we maintain, including health information we created or received before we made the changes. If there are changes this notice, we will make new notices available upon request.

Who Will Follow This Notice: This notice describes the facility’s practices and that of any programs associated with St. Luke Health Services. Any health care professional authorized to enter information into your file or record and all employees, staff and other personnel will follow the terms of this notice. In addition, these entities, sites and locations may share medical information with each other for treatment, payment or facility operation purposes described in this notice.

Our Pledge Regarding Medical Information: We understand that medical information about you and your health is personal. We are committed to protecting medical information about you. We create a record of care and services your receive in our facility. We need this record to provide you with quality care and to comply with certain legal requirements. This notice applies to all records of your care.

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. It also describes your rights and certain obligations we have regarding the use and disclosure of medical information. We are required by law to:
• Make sure that medical information that identifies you is kept private
• Give you this notice of our legal duties and privacy practices with respect to medical information about you; and
• Follow the terms of the notice that is currently in effect

This Notice of Privacy Practices describes how we may use and disclose your protected health information to carry out treatment, payment or healthcare operations and for other purposes that are permitted or required by law. It also describes your rights to access and control your protected health information. “Protected Health Information (PHI)” is information about you, including demographic information that may identify you and items that relate to your past, present, or future physical or mental health or condition and related health care services.

Uses and Disclosures of Your Medical Health Information:
We use and disclose health information about you for treatment, payment and healthcare operations. For example:

For Treatment: We may use medical information about you to provide you with medical treatment. We may disclose medical information about you to the various departments of our facility to coordinate medical care. We also may disclose medical information about you to people outside the facility who may be involved in your medical care, such as a designated family member in case of an emergency or others we use to provide services that are a part of your care, such as your HMO and you DSS caseworker. When required to, we will obtain your authorization before disclosing any of your information. Only the minimally necessary information will be revealed during any disclosures.

For Payment: We may use and disclose medical information about you so that the treatment and services you receive may be billed to and payment may be collected from you, an insurance company, or a third party. For example, we may need to give your health plan information about treatment you received so your plan will pay us or reimburse you. We may also tell your health plan about treatment you are going to receive to obtain prior approval or in order to determine whether you plan will cover the treatment.

As Required By Law: We will disclose minimally necessary medical information about you when required to do so by federal, state, or local law.

To Avert a Serious Threat to Health or Safety: We may use and disclose minimally necessary medical information about you when necessary to prevent a serious threat to your health and safety of the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent threat.

Worker’s Compensation: We may release minimally necessary medical information about you for workers’ compensation or similar programs. These programs provide benefits for work related injuries or illness. State and/or federal law control the release of such information.

Public Health Risk: We may disclose minimally necessary medical information about you for public health activities. These activities generally include the following:
• To prevent or control disease or injury or disability;
• To report victims of abuse, neglect or domestic violence or other crimes;
• To report reaction to medication or problems with products; or
• To notify a person why you may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition

Health Oversight Activities: We may disclose minimally necessary medical information to health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Law Enforcement and Disputes: If you are involved in a lawsuit or dispute, we may disclose minimally necessary medical information about you if asked to do so by a law enforcement official.
• In response to a proper court order or similar process;
• In response to a subpoena for a member of the St. Luke Health Services staff;
• About criminal conduct involving our facility; and
• In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of a person who commits the crime if the crime is on agency premises or against agency personal.

Coroners, Medical Examiners and Funeral Directors: We may also release minimally necessary medical information about you to a medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death.

National Security and Intelligence Activities: We may release minimally necessary medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

Marketing Health-Related: We will not use your health information for marketing communications without your written permission.

Individual Rights Regarding Medical Information about You:
You have the following rights regarding medical information we maintain about you:

Right to Inspect and Copy: You have the right to inspect and copy medical information that may be used to make decisions about your care, within limited exceptions.

To inspect and copy medical information that may be used to make decisions about you, you must submit your request to the Health Information Management Department. (All requests to obtain access to your health information must be in writing. If you request copies we can charge you $.75 for each page).

Right to Amend: If you feel that any of the medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by our facility.

To request an amendment, your request must be made in writing and submitted to the Health Information Management Department. In addition, you must provide a reason that supports your request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:
• Was not created by us, unless the person or entity that created the information is no longer available to made the amendment;
• Is not part of the medical information kept by our facility;
• Is not part of the information which you would be permitted to inspect and copy; or
• Is accurate and complete.

Right to an Accounting of Disclosures: You have the right to request an “accounting of disclosures.” This is a list of the disclosures we have made of your medical information. We are not required to account for routine disclosures.

To request this accounting of disclosures; you must submit your request in writing to the Health Information Management Department. Your request must state a time period which may not be longer than six years and may not include dates before April 14, 2003. The first accounting you request within a twelve-month period will not include a cost for providing the disclosure list. For additional accountings, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to Request Confidential Communications: You have the right to request that we communicate with you about medical matters in certain way or at a certain location. For example you can ask that we only speak to you when your roommate is not in the room. We must accommodate your request if it is reasonable and specifies the alternate location.

Right to Request Restrictions: Even though all disclosures we already make are minimally necessary, you have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for you care. Finally, you have the right to request restriction on the people who are able to obtain information we disclose. However, we are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment. To request a restriction or limitation, your request must be made in writing and submitted to the Health Information Management Department.

If you any questions about our privacy practices or have concerns, please contact us using the contact information at the end of this notice.

On or after 4/14/03, if you are concerned that we may have violated your privacy rights, as described above, or you disagree with a decision we made about access to your protected health information or in response to a request you made to amend or restrict the use or disclosure of your protected health information, you may contact the following person:

Privacy Officer
St. Luke Health Services
299 East River Road
Oswego, NY 13126
315-342-3166, Ext. 155