HIPPA Privacy Notice

Effective Date: April 14, 2003

This Notice Describes How Medical Information About You May Be Used And Disclosed And How You Can Get Access To This Information. Please Review It Carefully

If you have any questions about this notice, please contact CRHC's Privacy Officer at 410-778-3300, Extension 2343.

Who Will Follow This Notice? When this Notice refers to "we" or "us", it is referring to CRHC, as well as all employees, Medical Staff members and other personnel, including volunteers, who we allow to help you or participate in providing health care while you are patient in the hospital. It does not refer to the private physicians who treat you before or after you are a patient.

CRHC and all of these persons follow the terms of this Notice. In addition, CRHC and these persons may share health information with each other for treatment, payment, or health care operations purposes as described in this Notice.

Our Pledge Regarding Medical Information: We understand that your medical information is personal and confidential, and are committed to protecting your medical information. We create a record of the care and services you receive at CRHC to provide you with quality care and to comply with legal requirements. This Notice will tell you how we may use and disclose medical information about you, and describes your rights and certain obligations we have regarding the use and disclosure of your medical information. We are required by law to:

- Make sure that medical information that identifies you is kept private, and is used or disclosed only as described by this Notice or applicable law;
- Make this Notice of our legal duties and privacy practices with respect to your medical information available to you; and
- Follow the terms of the Notice that is currently in effect.

Changes To This Notice: We reserve the right to change this Notice. We reserve the right to make the revised or changed Notice effective for medical information we already have about you as well as any information we receive in the future. We will make available a copy of the current Notice at various places in CRHC. In addition, at any time you may request a copy of the current Notice in effect. The Notice will contain on the first page, in the top right-hand corner, its effective date.

How We May Use and Disclose Medical Information About You?

The following categories describe different ways that we use and disclose your medical information. For each category of uses or disclosures we will explain what we mean and try to give some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of these categories.

For Treatment: We will use medical information about you to provide you with medical treatment or services. We may disclose medical information about you to doctors, nurses, technicians, medical students, or other CRHC personnel who are involved in taking care of you at CRHC. For example, a doctor treating you for a broken bone may need to know if you have diabetes because diabetes may slow the healing process. In addition, the doctor may need to tell the dietitian if you have diabetes so that we can arrange for appropriate meals. We also may disclose medical information about you to people outside CRHC who may be involved in your medical care after you are a patient in the hospital.

For Payment: We will disclose medical information about you to your insurance company, health plan or other person that pays for all or part of your care in order to bill and be paid for the treatment and services you receive at CRHC. For example, we may give your health plan information about treatment you received at CRHC so your health plan will pay us or reimburse you for the treatment, or tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment.

For Healthcare Operations: We will use and disclose medical information about you for CRHC operations. These uses and disclosures are necessary to run CRHC and make sure that all of our patients receive quality care. For example, we may use medical information to review the treatment and services provided to you and to evaluate the performance of our staff in caring for you. We may also combine medical information about many CRHC patients to decide what additional services CRHC should offer, what services are not needed, and whether certain treatments are effective.

Directory: We will include certain limited information about you in the directory while you are a patient in the hospital. This information may include your name, location, your general condition (e.g., fair, stable, etc.), and your religious affiliation. If you do not want anyone to know this information about you, you must notify CRHC at the time of registration, or indicate your preference to a care provider while you are a patient.

Individuals Involved In Your Care: We may release medical information about you to a friend or family member who is involved in your medical care, or to notify a friend or family member that you are a patient.

Appointment Reminders: We may contact you to remind you that you have an appointment. We may leave messages with a family member or on an answering machine if you are not home when we call, unless you tell us in advance not to do so.

Treatment Alternatives or Health-Related Benefits and Services: We may tell you about or recommend possible treatment options or alternatives that may be of interest to you, or we may contact you to tell you about benefits or services that we provide.

Fundraising Activities: We may use certain information (name, address, telephone number, dates of service, age, and gender) to contact you in the future to raise money for CRHC. We may also provide this information to any institutionally related foundation for the same purposes. The money raised will be used to expand and improve the services and programs we provide the community.

Business Associates: We contract with business associates to provide some services. Examples include transportation services or the copy service used to make copies of your health record. When these services are contracted, we may disclose your health information to our business associate so that they may perform the job we have asked them to do. To protect your health information, however, we require the business associate to agree to appropriately safeguard your information.

Special Situations: We may also release your medical information in any of the following circumstances:

- To facilitate organ and tissue donation.
- For specialized governmental functions, including the military and veterans, national security, criminal corrections and public benefit purposes.
- For Workers' Compensation or similar programs, as permitted by law.
- To assist in a disaster relief effort so that your family can be notified about your condition, status and location.
- For research purposes, under certain circumstances, if you are enrolled in a research study.
- For public health activities.
- To avert a serious threat to your health and safety or the health and safety of the public or another person.
- As required by Federal or State law.
- To notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect, or domestic violence.
- For health oversight activities including, for example, audits, investigations, inspections, and licensure.
- For lawsuits and disputes, we may disclose medical information about you in response to a valid court or administrative order, or in response to a subpoena, discovery request, warrant, summons or other lawful process, or in the course of defending ourselves.
- For law enforcement purposes when asked to do so by a law enforcement official.
- To Coroners, Medical Examiners, and Funeral Directors, as necessary to assist them to carry out their duties.
- To correctional institutions or law enforcement officials with respect to inmates.

Written Authorization: Except as described above, we will disclose your medical information only with your prior written authorization. You may revoke that authorization, in writing, at any time, unless we have taken action relying on your prior authorization or if you signed the authorization as a condition of obtaining insurance coverage.

Your Rights Regarding Medical Information About You: You have the following rights regarding medical information we maintain about you:

To Inspect and Copy: You have the right to inspect and copy medical information about your care, except for psychotherapy notes and other mental health records under certain circumstances. To inspect and copy your medical information, you must submit your request in writing to the Medical Records Department at the address given at the end of this Notice. If you request a copy of the information, we may charge a fee for the costs of copying, mailing, or other supplies associated with your request. We may deny your request to inspect and copy medical information in certain very limited circumstances. If you are denied access to medical information, in most cases, you may request that the denial be reviewed. Another licensed healthcare professional chosen by CRHC will review your request and the denial. We will comply with the outcome of the review.

To Amend: If you feel that the medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as we keep your information. You must request an amendment in writing to the Medical Records Department, and must provide a reason for your request. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request, or for other reasons contained in federal law. If we deny your request, you may submit a written statement disagreeing with the denial. We will keep your statement on file and distribute it with all future disclosures of the information to which it relates.

To an Accounting of Disclosures: Except for uses and disclosures of medical information for treatment, payment, and health care operations, you have the right to know who has accessed your confidential healthcare information and for what purpose by requesting an "accounting of disclosures." This is a list of the disclosures of medical information about you, with exceptions permitted by law. The accounting will include the date of each disclosure, the name of the entity or person to whom the disclosure was made and that person's address (if known), and a brief description of the information disclosed together with the purpose of the disclosure. To request this list or accounting of disclosures, you must submit your request in writing to the CRHC Privacy Officer. Your request must state a time period that may not be longer than six years and may not include dates before April 14, 2003.Your request should indicate in what form you want the list (for example: on paper, electronically). The first list you request within a 12-month period will be free. We may charge you for additional lists. We will notify you of the cost involved, and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to Request Restrictions: You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment, or healthcare operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. We are not required to agree to your request to restrict or limit our use or disclosure of information for our own treatment, payment or healthcare operations. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment. To request restrictions, you must make your request in writing to the CRHC Privacy Officer. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply.

Right to Confidential Communications: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you may ask that we contact you only at home or only by mail. All reasonable requests will be granted. Contact the Privacy Officer if you require such confidential communications.

Right to a Paper Copy of This Notice: You have the right to a paper copy of this notice by requesting a paper copy from the CRHC Privacy Officer in writing.

Complaints: If you believe your privacy rights have been violated, you may file a complaint with CRHC or with the Secretary of the Department of Health and Human Services, 200 Independence Avenue, Washington D.C. 20201. To file a complaint with CRHC, contact the Privacy Officer at the following address:

Chester River Hospital Center, Inc., 100 Brown Street, Chestertown, Maryland 21620

All complaints must be submitted in writing. All complaints will be investigated. You will not be penalized for filing a complaint.

You may contact our Privacy Officer at 410-778-3300, extension 2343, for further information about any questions you may have about this Notice or your medical information.

Update to Notice of Privacy Practices

Pursuant to the Health Information Technology for Economic and Clinical Health Act, (the HITECH Act), effective February 18, 2010, you have the following additional rights with respect to your protected health information.

Restrictions on Disclosures

You may request that use or disclosure of your health information to a health plan (e.g. an insurer such as Blue Cross and Blue Shield or Medicare) if such information relates to services for which you paid out-of-pocket (i.e., received no payment from an insurer).

Requests for Information in Electronic Format

You have the right to obtain copies of your health information in electronic format.

Fundraising Activities

The HIPAA rules permit hospitals to use certain types of health information for purposes of sending fundraising communications to individuals.

Previously, HIPPA required the hospitals to inform the individual of their right to opt-out of receiving such information and make reasonable efforts to honor any opt-out request.

Now, under HITECH, in addition to notifying individuals of their "opt out" right, hospitals must honor such opt-out request. Hospitals must treat an opt-out request as the individual's revocation of authorization to use their information for fundraising communications. Unless otherwise specified, such should be interpreted as applying to all fundraising communications and not just the most recent communication sent.

Marketing Activities

The HIPAA rules require hospitals to obtain an individual's authorization to use or disclosure their health information for marketing. Marketing is defined as a communication that encourages the use of a product or service, unless, the communication is made for one of the following three reasons:

to describe a health related product or service provided by the hospital making the communication,
for treatment of the individual, or
for case management/care coordination of the individual or to recommend to, the individual, alternative treatments, therapies, providers or care settings.

Now, under HITECH, if the hospital receives payment for making one of the above three communications, such communication is considered marketing; and therefore subject to the authorization requirement addressed above. Again, there are some exceptions to this rule. Even if payment is received for one of the above three communications, it still will not be considered marketing if:

the communication describes only a drug or biologic that is currently being prescribed for the recipient of the communication and any related payment is reasonable;
the communication is made by the hospital and the individuals' authorization is obtained; or the communication is made by a business associate on the hospital's behalf and in accordance with the business associate agreement with the hospital.

Addendum (1) To Notice of Privacy Practices

We have chosen to participate in the Chesapeake Regional Information System for our Patients, Inc. (CRISP), a statewide health information exchange. As a participant in CRISP, we may share and exchange information that we obtain or create about you for treatment and public health purposes, as permitted by law. This exchange of health information can provide faster access to critical information about your medical condition, improve the coordination of your health care, and assist health care providers and public health officials in making more informed treatment decisions.

You have the right to "opt-out" of CRISP, which will prevent health care providers from accessing some of the information available through the exchange. However, even if you opt-out, a certain amount of your health information will remain in the exchange. Specifically, health care providers who participate in CRISP may continue to access certain diagnostic information related to tests, procedures, etc. that have been ordered for you (e.g., imaging reports and lab results), and they may send this information to other health providers that you have been referred to for evaluation or treatment through CRISP's secure messaging services. You may opt-out of CRISP by calling 1-877-952-7477, or by submitting a completed Opt-Out Form to CRISP by mail, fax, or through their website at www.crisphealth.org.

Scroll To Top