Notice of Privacy Practices

Notice of Privacy Practices in current effect for The Christ Hospital Health Network

Notice:

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. 
The terms of this Notice of Privacy Practices (Notice) apply to The Christ Hospital; The Christ College of Nursing; The Christ Hospital Auxiliary; ExCel Insurance Co. Ltd.; The Carl and Edyth Lindner Center for Research and Education at The Christ Hospital, LLC; The Christ Hospital Foundation; TCH/USP Surgery Centers, LLC; TCH Physicians, LLC; Gamble Realty Company; HPL Realty Company, LLC; The Christ Hospital Clinically Integrated Network, LLC; The Christ Hospital Spine Surgery Center, LLC; The Christ Hospital Medical Associates, LLC; The Christ Hospital Cardiovascular Associates, LLC; The Christ Hospital Medical Specialists, LLC; The Christ Hospital Orthopaedic Associates, LLC; The Christ Hospital Orthopaedic Associates II, LLC; The Christ Hospital Orthopaedic Associates III, LLC; The Christ Hospital Medical Associates II, LLC; The Christ Hospital Medical Associates III, LLC; The Christ Hospital Medical Specialists II, LLC; Professional Diagnostic Services, LLC; and any other related entities, each of which are legally separate covered entities and are under common ownership and control. For the purpose of this Notice, these entities have elected to become a single Affiliated Covered Entity that will be referred to as The Christ Hospital Health Network (TCHHN). The members of this healthcare system will share protected health information of patients as necessary to carry out treatment, payment, and healthcare operations as permitted by law. 
We have a legal duty to safeguard your protected health information. 
We are required by law to maintain the privacy of our patients' personal health information. We call this information "protected health information" or PHI, for short. We must provide patients with notice of our legal duties and privacy practices with respect to PHI. We are required to abide by the terms of this Notice so long as it remains in effect. We reserve the right to change the terms of this Notice of Privacy Practices as necessary and to make the new Notice effective for all PHI maintained by us. You may receive a copy of any revised Notices at TCHHN, or a copy of the current Notice of Privacy Practices by mailing a request to TCHHN HIPAA Privacy Officer, Attention Compliance Department, 2139 Auburn Ave., Cincinnati, OH 45219.
Uses and disclosures of your protected health information: 
- Your Authorization. We will not use or disclose your PHI for any purpose other than treatment, payment and healthcare operations, unless you have signed a form authorizing the use or disclosure, with exception to the situations outlined below. You have the right to revoke that authorization in writing unless we have taken any action in reliance on the authorization. 
- Uses and Disclosures for Treatment. We will use and disclose your PHI as necessary for your treatment. For example, doctors, nurses and other professionals involved in your care will use information in your medical record and medical information that you provide to plan your course of treatment. This may include procedures, medications, tests, etc. 
- Uses and Disclosures for Payment. We will use and disclose your PHI as necessary for payment purposes. For example, we may forward information regarding your medical procedures and treatment to your insurance company to arrange payment for the services provided to you or we may use your information to prepare a bill to send to you or to the person responsible for payment on your behalf. We may make uses and disclosures of your PHI to another entity or healthcare provider for purposes of such entity or healthcare provider receiving payment for the services provided to you. For example, we may forward information to the ambulance company that brought you to the hospital so they can prepare a bill for you or your insurance company for the ambulance service. 
- Uses and Disclosures for Healthcare Operations. We will use and disclose your PHI as necessary, and as permitted by law, for our healthcare operations, which include, but are not limited to, clinical improvement, professional peer review, business management, accreditation and licensing, etc. For example, we may use and disclose your PHI for purposes of improving the clinical treatment and care of our patients. 
- Our Facility Directory. We maintain a facility directory listing your name, room number, general condition and, if you wish, your religious affiliation. Unless you choose to have your information excluded from this directory, the information, excluding your religious affiliation, will be disclosed to anyone who requests it by asking for you by name. This information, including your religious affiliation, may also be provided to members of the clergy. You have the right during registration to have all or any part of your information excluded from this directory. 
- Family and Friends Involved In Your Care. With your approval, we may disclose your PHI to designated family, friends, and others who are involved in your care or in payment for your care. This may be necessary to facilitate that person's involvement in your care or payment for your care. If you are unavailable, incapacitated, or facing an emergency medical situation and we determine that a limited disclosure may be in your best interest, we may share limited PHI with such individuals without your approval. We may also disclose limited PHI to a public or private entity that is authorized to assist in disaster relief efforts in order for that entity to locate a family member or other persons who may be involved in some aspect of your care. 
- Business Associates. Certain aspects and components of our services are performed through contracts with outside persons or organizations, such as auditing, accreditation, legal services, etc. At times, it may be necessary for us to provide your PHI to one or more of these outside persons or organizations that assist us with our healthcare operations. In all cases, those business associates are required to appropriately safeguard the privacy of your information. 
- Fundraising. We may contact you to donate to a fundraising effort for or on our behalf. You have the right to "opt-out" of receiving fundraising materials/communications and may do so by calling 513-585-3394 and informing us of your wish to not receive such materials. TCHHN will not condition treatment or payment on your choice with respect to the receipt of fundraising communications. 
- Marketing. We must receive your authorization for any use or disclosure of PHI for marketing, except if the communication is in the form of a face-to-face communication made to you personally; or a promotional gift of nominal value provided by TCHHN. If the marketing is to result in financial remuneration (direct or indirect payment) to TCHHN by a third party, we will state this on the authorization. It is not considered marketing to send you information related to your individual treatment, case management or care coordination; or to direct or recommend alternative treatment, therapies, healthcare providers, settings of care; or to describe a health-related product or service that is provided by TCHHN, unless TCHHN received direct or indirect payment in exchange for making the communication. Otherwise, these types of non-marketing communications may be sent without your written authorization. 
- Psychotherapy Notes. We must receive your authorization for any use or disclosure of psychotherapy notes, except: 1) for use by the originator of the psychotherapy notes for treatment or health oversight activities; 2) for use or disclosure by TCHHN for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family or individual counseling; 3) for use or disclosure by TCHHN to defend itself in a legal action or other proceeding brought by you; 4) to the extent required to investigate or determine TCHHN's compliance with the HIPAA regulations; 5) to the extent required to investigate or determine that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law; 6) for health oversight activities with respect to the oversight of the originator of the psychotherapy notes; 7) for disclosure to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law; 8) or if disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and is made to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat. 
- Sale of PHI.  We must receive your authorization for any use or disclosure of your PHI which is a sale of PHI.  Such authorization will state that the disclosure will result in remuneration to TCHHN. 
- Appointments and Services. We may contact you to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you. You have the right to request to receive communications regarding your PHI from us by alternative means or at alternative locations. For example, if you do not want appointment reminders to be left on voice mail or sent to a particular address. Requests can be made in writing at the time of registration. We agree to comply with reasonable requests. Some requests, as determined by our registration employee, may need to be submitted to our Privacy Officer for evaluation. In this case, you would need to complete a Confidential Communication Request Form and submit it to TCHHN HIPAA Privacy Officer, Attention Compliance Department, 2139 Auburn Ave., Cincinnati, OH 45219. 
- Confidentiality of Alcohol and Drug Abuse Records. Federal law and regulations protect the confidentiality of alcohol and drug program records maintained by TCHHN. PHI containing information on your alcohol or drug use may not be disclosed without 1) your written authorization; 2) a court order; or 3) unless the disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit or program evaluation. 
- Reporting of Crimes. Federal law or regulations do not protect any information about a crime committed by you at our facility or about any threat to commit a crime. Federal laws and regulations do not protect any information about suspected child abuse or neglect from being reported under state law to appropriate state or local authorities. 
- Confidentiality of HIV Test or Diagnosis of AIDS or AIDS-Related Condition. Ohio law requires that we have your authorization or a court order before disclosing the results of an HIV test or diagnosis of AIDS or AIDS-related conditions. 
- Other Uses and Disclosures. We are permitted or required by law to make the following uses and disclosures of your PHI without your authorization:
- We may release your PHI for any purpose required by law which include but are not limited to: 1) if we suspect child abuse or neglect; 2) if we believe you to be a victim of abuse, neglect, or domestic violence; 3) to law enforcement officials to report wounds, injuries and crimes; 4) to a government oversight agency conducting audits, investigations, or civil or criminal proceedings; and 5) if required to do so by a court or administrative ordered subpoena or discovery request. You will have notice of such release in most of these cases; 
- We may release your PHI for public health activities which include but are not limited to: 1) required reporting of disease, injury, and birth and death, 2) for required public health investigations; and 3) to coroners and/or funeral directors consistent with law; 
- We may release your PHI to the Food and Drug Administration if necessary to report adverse events, product defects, or to participate in product recalls; 
- We may release your PHI to your employer when we have provided healthcare to you at the request of your employer; in most cases you will receive notice that information is disclosed to your employer; 
- We may release your PHI to arrange an organ or tissue donation from you or a transplant for you; 
- We may release your PHI if we suspect a serious threat to health or safety; 
- We may release your PHI for certain research purposes without your authorization when such research is approved by an institutional review board with established rules to ensure privacy or with researcher representation that limit the use and disclosure of the PHI; 
- We may release your PHI if you are a member of the military as required by armed forces services. 
- We may release your PHI to national security and intelligence agencies, as well as disclosures to authorized federal officials for the protection of the President of the United States or other authorized persons or foreign heads of state. 
- We may release your PHI to workers' compensation agencies if necessary for your workers' compensation benefit determination. 
- We may use or disclose your PHI in an emergency treatment situation. If this happens, your physician will attempt to obtain your acknowledgment of this Notice as soon as reasonably practicable after the delivery of treatment. 
- We may use and disclose your PHI to tell you about certain health-related benefits or services that may be of interest to you. 
- We may release PHI if asked to do so by a law enforcement official in response to a court order, subpoena, warrant, summons or similar process. 
  If you are involved in a lawsuit or a dispute, we may disclose protected health information about you in response to a court order or administrative order. We may also disclose protected health information about you in response to a subpoena, discovery request or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.
Rights that you have regarding your PHI:
- Access to Your Protected Health Information. You have the right to receive a copy and/or inspect much of the PHI we retain on your behalf, unless excluded by law. All requests for access must be made in writing and signed by you or your legal representative. We may charge you a fee for copying the information and for postage if you request a mailed copy. You may obtain an authorization for release of patient protected health information form from TCHHN Medical Record Services, 2139 Auburn Ave., Cincinnati, OH 45219 or 513-263-8660.
- Amendments to Your Protected Health Information. You have the right to request, in writing, PHI that we maintain about you be amended. We are not obligated to make all requested amendments but will give each request careful consideration. All amendment requests, in order to be considered by us, must be in writing, signed by you or your representative, and must state the reasons for the amendment request. If an amendment is made by us at your request, we may also notify others who work with us and have copies of the uncorrected record if we believe that such notification is necessary. You may obtain an amendment request form from TCHHN Medical Record Services, 2139 Auburn Ave., Cincinnati, OH 45219 or 513-263-8660.
- Accounting for Disclosures of Your Protected Health Information. You have the right to receive an accounting of certain disclosures made by us of your PHI after April 14, 2003. Requests must be made in writing and signed by you or your legal representative. You may obtain an accounting request form from TCHHN Medical Record Services, 2139 Auburn Ave., Cincinnati, OH 45219 or 513-263-8660. The first accounting in any 12-month period is free; you will be charged a fee for each subsequent accounting you request within the same 12-month period.
- Restrictions on Use and Disclosure of Your Protected Health Information. You have the right to request a restriction on the uses and disclosures of your PHI for treatment, payment and healthcare operations. For example, you have the right to request that we not disclose your PHI to a health plan for payment or healthcare operations purposes if that PHI pertains to a healthcare item or service for which we have been involved and which has been paid out of pocket in full. We are required to comply with your request for this type of restriction. For all other requests for restrictions on use and disclosures of your PHI, we are not required to agree to your request, but will attempt to accommodate reasonable requests when appropriate. These requests can be made in writing at the time of registration. Some requests, as determined by our registration employee, may need to be submitted to our Privacy Officer for evaluation. In this case, you would need to complete a Request for Restriction Form and submit it to TCHHN HIPAA Privacy Officer, Attention Compliance Department, 2139 Auburn Ave., Cincinnati, OH 45219.
- Right to Confidential Communications.  You also have the right to request to receive private health information communications by alternative means or at alternative locations. For example, you can ask that we only contact you at work or by mail. To request confidential communications, you must make your request in writing at the time of registration. We will accommodate all reasonable requests. Some requests, as determined by our registration employee, may need to be submitted to our Privacy Officer for evaluation. In this case, you would need to complete a Confidential Communication Request Form and submit it to TCHHN HIPAA Privacy Officer, Attention Compliance Department, 2139 Auburn Ave., Cincinnati, OH 45219.
- Right to a Paper Copy of this Notice.  You have the right to a paper copy of this Notice. As a patient, you retain the right to obtain a paper copy of this Notice of Privacy Practices, even if you have requested such copy by email or other electronic means. You may ask us to give you a copy of this Notice at any time or you may obtain a copy at:
  - our website
  - any registration area within TCHHN, or
  - contact TCHHN HIPAA Privacy Officer, Attention Compliance Department, 2139 Auburn Ave., Cincinnati, OH 45219 or 513-585-2925. 
How to complain about our privacy practices: If you believe your privacy rights have been violated, you may file a written complaint with TCHHN HIPAA Privacy Officer, Attention Compliance Department, 2139 Auburn Ave., Cincinnati, OH 45219. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services in writing within 180 days of an alleged violation of your rights. There will be no retaliation for filing a complaint.
Breach Notification:
In the event of any Breach of Unsecured PHI, TCHHN shall fully comply with the HIPAA/HITECH breach notification requirements, which will include notification to you of any impact the Breach may have had on you and/or your family member(s) and actions TCHHN undertook to minimize any impact the Breach may have on you.
Person to contact for further information or assistance: If you have questions or need further assistance regarding this Notice, you may contact TCHHN's Privacy Office by telephone at 513-585-2925 or by mail at TCHHN HIPAA Privacy Officer, Attention Compliance Department, 2139 Auburn Ave., Cincinnati, OH 45219.
Effective date: This Notice of Privacy Practices is effective April 14, 2003, with revisions effective Sept. 23, 2013.