Notice of Privacy

Hancock Health Gateway Services Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.

OUR RESPONSIBILITIES

Hancock Health Gateway Services (HHGS) takes the privacy of your protected health information (“PHI”) seriously.  We are required by law to maintain that privacy, to provide you with this Notice of Privacy Practices, and to notify you following a breach of your unsecured PHI.  This Notice is provided to tell you about our duties and practices with respect to your PHI.  We are required to abide by the terms of this Notice that is currently in effect.  

HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION

The following categories describe different ways that we use and disclose your PHI.  For each category we explain what we mean and give some examples.  Not every use or disclosure in a category will be listed.  However, all of the ways we are permitted to use and disclose PHI will fall within one of the categories.

  • For Treatment. We may use your PHI to provide you with, manage, or coordinate treatment, health care or other related services.  We may disclose your health information to doctors, nurses, aids, technicians or other employees who are involved in your care.  We may also disclose your PHI to other health care providers who are providing treatment to you, whether or not we are involved with your treatment at that time.  For example, if we transfer you to another health care facility, we would disclose your PHI to that facility for the continuation of your care. In some cases the sharing of your PHI with other healthcare providers may be done electronically, including through an electronic health information exchange.
  • For Payment. We may use and disclose your PHI to bill and collect for the treatment and services we provide to you.  We may also disclose your PHI to another health care provider or payor of health care for the payment activities of that entity.  For example, we may send your PHI to an insurance company or other third party so that the hospital can receive payment for your hospital expense.
  • For Health Care Operations. We may use and disclose your PHI for health care operations.  These uses and disclosures are necessary to operate HHGS, to make sure you receive competent, quality health care, and to maintain and improve the quality of health care we provide.  We may also provide your PHI to various governmental or accreditation entities.  We may also disclose your PHI to another health care provider or payor for certain health care operations activities of that entity, if that entity also has a relationship with you.  In addition, we may disclose your PHI to any of the entities doing business on behalf of Hancock Health Gateway Services.  For example, HHGS may disclose your PHI to individuals assisting in quality review programs or peer review analysis.
  • Incidental Uses and Disclosures. We may occasionally inadvertently use or disclose your PHI when such use or disclosure is incident to another use or disclosure that is permitted or required by law.  For example, while we have safeguards in place to protect against others overhearing conversations among doctors, nurses or other HHGS personnel, there may be times that such conversations are in fact overheard.
  • Disclosures to You. Upon your request, we may use or disclose your PHI in accordance with your request.
  • Limited Data Sets. We may use or disclose certain parts of your PHI, called a “limited data set,” for purposes of research, public health reasons or for our health care operations.  We would disclose a limited data set only to third parties that have provided us with satisfactory assurances that they will use or disclose your PHI only for limited purposes.
  • Disclosures to the Secretary of Health and Human Services. We may be required by law to disclose your PHI to the Secretary of the Department of Health and Human Services, or his/her designee to determine whether we are complying with privacy laws.
  • De-Identified Information. We may use your PHI, or disclose it to a third party whom we have hired, to create information that does not identify you in any way.  Once your PHI has been de-identified, it can be used or disclosed in any way according to law.
  • Disclosures by Members of Our Workforce. Members of our workforce, including employees, volunteers, trainees or independent contractors, may disclose your PHI to a health oversight agency, public health authority, health care accreditation organization or attorney hired by the workforce member, to report the workforce member’s belief that we have engaged in unlawful conduct or that our care or services could endanger a patient, workers or the public.  Also, if a workforce member is a crime victim, the member may disclose your medical information to a law enforcement official.
  • As Required By Law. We will disclose your PHI when required to do so by federal, state or local law.
  • For Public Health Purposes. We may disclose your PHI for public health activities.  While there may be others, public health activities generally include the following:  (i) Preventing or controlling disease, injury or disability; (ii) Reporting births and deaths; (iii) Reporting defective medical devices or problems with medications; (iv) Notifying people of recalls of products they may be using; and (v) Notifying a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.

Health Oversight Activities.  We may disclose your PHI to a health oversight agency for activities authorized by law.  These oversight activities may include audits, investigations, and inspections.  These activities are necessary for the government to monitor the health care system, government benefit programs, and compliance with civil rights laws.

  • Judicial Purposes. We may disclose your PHI in response to a court or administrative order.  We may also disclose your PHI in response to a subpoena, discovery request, or other lawful process, but only if efforts have been made to notify you and give you an opportunity to object to the request, or to obtain a protective order for the PHI
  • Law Enforcement. We may release PHI if asked to do so by a law enforcement official, if such disclosure is:  (i) Required by law; (ii) In response to a court order, subpoena, warrant, summons or similar process; (iii) To identify or locate a suspect, fugitive, material witness, or missing person; (iv) About the victim of a crime; (v) About a death we believe may be the result of criminal conduct; (vi) About criminal conduct at the Covered Entity; or (vi) In emergency circumstances to report the details of a crime.
  • Coroners, Medical Examiners and Funeral Directors. In certain circumstances, we may disclose your PHI to a coroner or medical examiner.  This may be necessary, for example, to identify a deceased person or determine the cause of death.  We may also release your PHI to funeral directors as necessary to carry out their duties.
  • Organ and Tissue Donation. We may disclose your PHI to organizations that handle organ procurement or donation, or organ, eye or tissue transplantation, as necessary to facilitate organ or tissue donation and transplantation.
  • Research. Under certain circumstances, we may use and disclose your PHI for research purposes.  For example, a research project may involve comparing the health and recovery of all individuals who received one medication to those who received another.  However, before we use or disclose your PHI for research, the project will have been approved through a special approval process that evaluates a proposed research project and its use of health information, trying to balance the research needs with your need for privacy of your PHI.  Additionally, when it is necessary for research purposes and so long as the PHI does not leave HHGS, we may disclose your PHI to researchers preparing to conduct a research project, for example, to help the researchers look for individuals with specific health needs.  Lastly, if certain criteria are met, we may disclose your PHI to researchers after your death when it is necessary for research purposes.
  • To Avert a Serious Threat to Health or Safety. We may use and disclose your PHI if we believe it is necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.  Any disclosure, however, would only be to someone able to help prevent or lessen the threat or to law enforcement authorities in particular circumstances.
  • Military and Veterans. If you are an member of the armed forces, we may disclose your PHI as required by military command authorities.  We may also release PHI about foreign military personnel to the appropriate foreign military authority.
  • National Security and Intelligence Activities. We may disclose your PHI to authorized federal officials for lawful intelligence, counterintelligence, and other national security activities authorized by law.
  • Protective Services for the President and Others. We may disclose your PHI to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or for the conduct of special investigations.
  • Custodial Situations. If you are an inmate in a correctional institution, we may disclose your PHI to a correctional institution or law enforcement official that makes certain representations to us.
  • Workers’ Compensation. We may disclose your PHI as authorized by and to the extent necessary to comply with workers’ compensation laws or laws relating to similar programs.
  • Suspected Abuse or Neglect. If we believe that a person is a victim of child or adult abuse or neglect, we are required by law to report certain information to public authorities.
  • Treatment Alternatives, Appointment Reminders and Health-Related Benefits. We may use and disclose your PHI to inform you of or recommend possible treatment alternatives or health-related benefits or services that may be of interest to you.  Additionally, we may use and disclose your PHI to provide appointment reminders.  If you do not wish us to contact you about these activities, you must notify us in writing.
  • Fundraising Activities. We may use your PHI to contact you in an effort to raise money for HHGS and its operations.  We may disclose your PHI to a foundation related to HHGS so that the foundation may contact you to raise money for HHGS.  In these cases, we would use or disclose only your name, address and phone number, age, gender, and the dates and departments of service.  If you do not want us to contact you for fundraising efforts, you must notify us in writing to opt out.
  • Marketing. Most uses and disclosures of PHI for marketing purposes will be made only with your written authorization.  We may use PHI to communicate to you about a product or service if the communication occurs face-to-face, involves a gift of nominal value, or is for a drug refill.
  • Facility Directory. We may include certain limited information about you in our directory.  This information may include your name, location in the Hospital, your general condition (e.g., fair, stable, etc.) and your religious affiliation.  The directory information, except for your religious affiliation, may also be released to people who ask for you by name.  Your religious affiliation may be given to a member of the clergy, such as a priest or minister, even if they do not ask for you by name.  If you do not wish to be included in the facility directory, you may opt out at the time of admission.
  • Sale of PHI. Except in limited circumstances permitted by law, we will not sell your PHI without your written authorization.
  • Individuals Involved in Your Care or Payment for Your Care. We may release PHI about you to a family member, other relative, or any other person identified by you who is involved in your health care.  We may also disclose PHI to someone who is involved with or helps pay for your care.  We may also tell your family, friends, personal representative or other person responsible for your health care your condition and that you are at HHGS.
  • Third Parties. We may disclose your PHI to certain third parties with whom we contract to perform services on our behalf.  If we disclose your PHI to these entities, we will obtain their agreement to safeguard your information.
  • Communications Regarding HRH Programs or Products. We may use and disclose your PHI to communicate with you about a health-related product or service of HHGS.  In addition, we may use or disclose your PHI to tell you about products or services related to your treatment, case management or care coordination, or alternative treatments, therapies, providers or settings of care for you.
  • Disclosures of Records Containing Drug or Alcohol Abuse Information. Because of federal law, we will not release your PHI without your written permission if it contains information about drug or alcohol abuse, except in very limited situations.
  • Disclosures of Medical Information of Minors. Under Indiana law, we cannot disclose the PHI of minors to non-custodial parents if we have documentation of a court order or decree that prohibits the non-custodial parent from receiving such information.
  • Disclosures of Mental Health Records. If your PHI contains information regarding your mental health, we can disclose it without written permission only in the following situations: (i) If the disclosure is made to you (unless it is determined by a physician that the release would be detrimental to your health); (ii) Disclosures to our employees in certain circumstances; (iii) For payment purposes; (iv) To the Division of Mental Health if for data collection, research, and monitoring managed care providers if the disclosure is made to the division of mental health; (v) For law enforcement purposes or to avert a serious threat to the health and safety of you or others;(vi) To a coroner or medical examiner; (vii) To satisfy reporting requirements; (viii) To satisfy release of information requirements that are required by law; (ix) To another provider in an emergency; (x) For legitimate business purposes; (xi) Under a court order; (xii) To the Secret Service if necessary to protect a person under Secret Service protection; and (xiii) To the Statewide waiver ombudsman.  Most disclosures of psychotherapy notes require a signed authorization. 

OTHER USES OF PHI

Other uses and disclosures of PHI not covered by this Notice or the laws that apply to us will be made only with your written authorization.  If you provide us authorization to use or disclose your PHI, you may revoke that authorization, in writing, at any time.  If you revoke your authorization, we will no longer use or disclose health information about you for the reasons covered by your written authorization.  You understand that we are unable to take back any disclosures we have already made under the authorization, and that we are required to retain our records of the care that we provide to you.

YOUR RIGHTS REGARDING YOUR PHI

You have the following rights regarding PHI we maintain about you:

  • Right to Request Restrictions. You have the right to request a restriction or limitation on the PHI we use or disclose about you for treatment, payment or health care operations.  You also have the right to request a limit on the PHI we disclose about you to someone who is involved in your care or the payment for your care.  In your request, you must tell us (1) what information you want to limit; (2) whether restriction is requested for current visit only or all hospital visits; (3) whether you want to limit our use, disclosure or both; and (4) to whom you want the limits to apply.  For any services for which you paid out-of-pocket in full, we will honor your request to not disclose information about those services to your health plan, provided that such disclosure is not necessary for your treatment.  In all other circumstances, we are not required to agree to your request.  If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment. 
  • Right to Request Confidential Communications. You have the right to request that we communicate with you or your responsible party about your health care in an alternative way or at a certain location (e.g., telephone, email).  We will not ask you the reason for your request.  We will accommodate all reasonable requests.  Your request must specify how or where you wish to be contacted.
  • Right to Inspect and Copy. You have the right to inspect and copy PHI that may be used to make decisions about your care.  You also have the right to direct that we transmit a copy of such information directly to another person designated by you.  If we maintain PHI about you in electronic format, you have the right to a copy of your PHI in the electronic form or format you request, so long as the PHI is readily producible in that form or format.  If it is not readily producible in the form or format you request, we will provide it to you in a reasonable alternative format.  If you request a copy of the PHI, we may charge a fee for the costs of copying, mailing or other supplies associated with your request.
  • Right to Amend. You have the right to ask us to amend your PHI for as long as the information is kept by us.  We may deny your request for an amendment if it is not in writing or does not include a reason to support the request.  In addition, we may deny your request if you ask us to amend PHI that:  (i) Was not created by us, unless the person or entity that created the PHI is no longer available to make the amendment; (ii) Is not part of the PHI kept by or for us; (iii) Is not part of the PHI you are permitted to inspect and copy; or (iv) Is accurate and complete.
  • Right to an Accounting of Disclosures. You have the right to request a list of certain disclosures that we have made of your PHI.  Your request must state a time period that may not be longer than six years.  Your request should indicate in what form you want the list (for example, on paper, electronically).  The first list you request within a twelve-month period will be free.  For additional lists during such twelve-month period, we may charge you for the costs of providing the list.  We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
  • Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice.  You may request a copy of this Notice at any time.  Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of this Notice.  You may request a copy of this Notice in writing or obtain it at our web site at  https://www.hancockgateway.org
  • Contact Information. To exercise any of your rights under HIPAA, you must make your request in writing to HIPAA Privacy Officer, 6189 W. John L. Modglin Drive, Greenfield, IN 46140.

WHO THIS NOTICE APPLIES TO

This Notice describes HHGS practices and those of: (i) Any health care professional authorized to enter information into or consult your HHGS medical record; (ii) All departments and units of HHGS; (iii) Any member of a volunteer group we allow to help you; (iv) All employees as leased from Hancock Regional Hospital and Hancock Physician Network, staff and other HHGS personnel; (v) All members   doing business on behalf of HHGS, which includes members of the medical staff; (vi) Hancock Regional Hospital; (vii) Hancock Physician Network and (viii) Hancock Regional Surgery Center, LLC.  HHGS participates in an OCHA (Organized Healthcare Arrangement) including members of Hancock Regional Hospital, Hancock Physician Network and Hancock Regional Surgery Center, LLC.

All these entities, sites and locations follow the terms of this Notice.  In addition, these entities, sites and locations may share PHI with each other for treatment, payment or operations as described in this Notice.

CHANGES TO THIS NOTICE

We reserve the right to change this Notice.  We reserve the right to make the revised Notice effective for PHI we already have about you as well as any PHI we receive in the future.  We will post a copy of the current Notice in a clear and prominent location to which you have access.  In addition, if we revise this Notice, you may request a copy of the current Notice in effect.

COMPLAINTS

If you believe your privacy rights have been violated, you may file a complaint with the HIPAA Privacy Officer  or with the Secretary of the Department of Health and Human Services.  To file a complaint with us, contact the Privacy Hot Line at 1.866.833.0731.  All complaints must be submitted in writing.

You will not be retaliated against for filing a complaint.

If you have any questions about this Notice, please contact our Privacy Officials:

HIPAA Privacy Officer:  317.468.4253

HIPAA Security Officer: 317.468.4521

Original Effective Date:  September 9, 2019