Privacy Statement

This Notice describes how medical information about you may be used and disclosed and how you can get access to this information.

Effective: April 14, 2003

Revised: August 2012

Our Privacy Practices

As a major resource for health services and education, Albemarle Health strives to support local medical communities and to work with providers throughout the region to deliver quality care. Your privacy is important to us, and it is our policy to respect your privacy when you are our patient.

Summary of your rights to privacy

Albemarle Health has a legal duty to protect health information about you.

Albemarle Health may use and disclose protected health information (PHI) about you without your authorization in the following circumstances:

• to provide health care treatment to you

• to obtain payment for services

• for health care operations

• under other certain circumstances

In addition:

• You can object to certain uses and disclosures.

• We may contact you to provide appointment reminders.

• We may contact you with information about treatment, services, products or health care providers.

• We may contact you for fundraising activities.

You have several rights regarding PHI about you:

• You have the right to request restrictions on uses and disclosures of your information.

• You have the right to request different ways to communicate with you.

• You have the right to a copy of your information.

• You have the right to request amendment of your information.

• You have the right to a listing of disclosures we have made.

• You have the right to a complete copy of our Notice of Privacy Practices.

We have a legal duty to protect health information about you.

We are required to do the following:

We are required to protect the privacy of health information about you that can identify you (which we call protected health information, or PHI for short). We must give you notice of our legal duties and privacy practices concerning PHI:

• We must protect PHI that we have created or received about your past, present, or future health condition, health care we provide to you, or payment for your health care.

• We must notify you about how we protect PHI about you.

• We must explain how, when and why we use and/or disclose PHI about you.

• We may only use and/or disclose PHI about you as we have described in this Notice.

• We must provide you with sufficient notice if we acquire, access, use or disclose your PHI in a manner that is not permitted under this Notice and compromises the security or privacy of the PHI.

• We are required to follow the procedures in this Notice.

• We reserve the right to change the terms of this Notice and to make new notice provisions effective for all PHI that we maintain by first:

• Posting the revised Notice in our facility

• Making copies of the revised Notice available upon request (either at our facility or through the appropriate Privacy Officer listed at the end of this Notice)

• Posting the revised Notice on our website

We may use and disclose PHI about you without your authorization in the following circumstances:

We may use and disclose PHI about you for treatment purposes.

Electronic Health Information Exchange (HIE): This facility uses an electronic health information exchange program that allows patient information to be shared with providers that are involved in the patient’s care. This exchange program provides a fast, secure, and reliable way to provide health information to providers. The health information is shared in accordance with this Notice of Privacy Practices and federal and state law. Patients have the right to opt out of the electronic health information exchange program; however, providers may request and receive information using other methods, such as fax or mail.

If you have previously opted out of the electronic health information exchange program and would like to opt in, you may obtain a form from this facility or from patient registration staff. Complete the form and return to the address listed on the form or to the registration staff.

General: We may use and disclose PHI about you to provide, coordinate or manage your health care and related services. This may include communicating with other health care providers about your treatment and coordinating and managing your health care with others. For example, we may use and disclose PHI about you when you need a prescription, lab work, an x-ray or other health care services. In addition, we may use and disclose PHI about you when referring you to another health care provider.

Example: A doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. In addition, the doctor may need to tell the dietitian if you have diabetes so that we can arrange for appropriate meals. Departments of the hospital may also need to share your PHI about you in order to coordinate different services you may need, such as prescriptions, lab work and x-rays. We may also disclose PHI about you to people outside the hospital who may be involved in your medical care after you leave the hospital, such as home health providers or others who may provide services that are part of your care.

Example: Your doctor may share medical information about you with another health care provider. For example, if you are referred to another doctor, that doctor will need to know if you are allergic to any medications. Similarly, your doctor may share PHI about you with a pharmacy when calling in a prescription.

We may use and disclose PHI about you to obtain payment for services.

Generally, we may use and give your medical information to others to bill and collect payment for the treatment and services provided to you. Before you receive scheduled services, we may share information about these services with your health plan(s). Sharing information allows us to ask for coverage under your plan or policy and for approval of payment before we provide the services. We may also share portions of your medical information with the following

• Billing departments

• Collection departments or agencies

• Insurance companies, health plans and their agents which provide your coverage

• Hospital departments that review the quality and cost of the care you received

• Consumer reporting agencies (e.g., credit bureaus)

Example: Let’s say you have a broken leg. We may need to give your health plan(s) information about your condition, supplies used (such as plaster for your cast or crutches), and services you received (such as x-rays or surgery). The information is given to our billing department and your health plan so we can be paid or you can be reimbursed. We may also send the same information to our hospital department which reviews our care of your illness or injury.

We may use and disclose PHI about you for health care operations.

We may use and disclose PHI about you when we perform business activities, that we call health care operations. These health care operations allow us to improve the quality of care we provide and reduce health care costs. We may use or reveal PHI about you to carry out certain business actions separately or as part of our involvement in an Organized Health Care Arrangement (OHCA) with ECU Health Care Components or as part of an OHCA with the credentialed and privileged members of our medical staff. Examples of the way we may use or disclose PHI about you for health care operations include:

• Reviewing and improving the quality, efficiency and cost of care we provide to you and other patients. For example, we may use PHI about you to develop ways to help our health care providers and staff decide what medical treatment should be provided to others.

• Improving health care and lowering costs for groups of people who have similar health problems and managing and coordinating the care for these groups. We may use PHI to identify people with similar health problems and to give them information about treatment alternatives, classes or new procedures.

• Reviewing and evaluating the skills, qualifications and performance of health care providers taking care of you.

For example, you may be contacted by a survey vendor to ask about your experience, at which time you may decline to answer questions. If you wish not to be contacted by the survey vendor you may opt out by notifying our hospital registration staff.

• Providing training programs for students, trainees, health care providers or non-health care professionals (for example, billing clerks or assistants, etc.) to help them practice or improve their skills.

• Cooperating with outside organizations that assess the quality of the care we and others provide. These organizations might include government agencies or accrediting bodies such as The Joint Commission.

• Cooperating with outside organizations that evaluate, certify or license health care providers, staff or facilities in a particular field or specialty. For example, we may use or disclose PHI so that one of our nurses may become certified in a specific field of nursing, such as pediatric nursing.

• Assisting various people who review our activities. For example, PHI about you may be seen by doctors reviewing the services provided to you, or by accountants, lawyers and others who assist us in complying with applicable laws.

• Planning for our organization’s future operations and fundraising for the benefit of our organization.

• Conducting business management and general administrative activities related to our organization and the services it provides, including providing information.

• Resolving grievances within our organization.

• Reviewing activities and using or disclosing PHI in the event that we sell our business, property or give control of our business or property to someone else.

• Complying with this Notice and with applicable laws.

We may use and disclose PHI about you under other circumstances without your authorization.

We may use and/or disclose PHI about you in certain circumstances that do not require your consent or agreement. Those circumstances include

• Use and/or disclosure required by law. For example, a disclosure that is required by federal, state or local law or other judicial or administrative proceeding.

• Use and/or disclosure necessary for public health activities.

For example, we may disclose PHI about you if you have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition.

• Disclosure relating to victims of abuse or neglect.

• Use and disclosure for health oversight activities. For example, we may disclose PHI about you to a state or federal health oversight agency which is authorized by law to oversee our operations.

• Disclosure for judicial and administrative proceedings. For example, we may disclose PHI about you in response to an order of a court or administrative tribunal.

• Disclosure for law enforcement purposes. For example, we may disclose PHI about you in order to comply with laws that require the reporting of certain types of wounds or other physical injuries.

• Use and/or disclosure relating to decedents. For example, we may disclose PHI about you to a coroner or medical examiner for the purposes of identifying you should you die.

• Use and/or disclosure relating to cadaveric organ, eye or tissue donation.

• Use and/or disclosure relating to medical research. Under certain circumstances, we may disclose PHI about you for medical research.

• Use and/or disclosure to avert a serious threat to health or safety. For example, we may disclose PHI about you to prevent or lessen a serious and eminent threat to the health or safety of a person or the public.

• Use and/or disclosure relating to specialized government functions. For example, we may disclose PHI about you if it relates to military activities, national security and intelligence activities, or protective services for the President.

• Use and/or disclosure relating to correctional institutions and in other law enforcement custodial situations. For example, in certain circumstances, we may disclose PHI about you to a correctional institution having lawful custody of you.

You can object to certain uses and disclosures.

Unless you object, we may use or disclose PHI about you in the following circumstances:

• We may share your name, your room number and your condition in our patient listing with clergy and with people who ask for you by name. We also may share your religious affiliation with clergy.

• We may share with a family member, relative, friend or other person identified by you, PHI about you directly related to that person’s involvement in your care or payment for your care. We may share with a family member, personal representative or other person responsible for your care, PHI about you necessary to notify such individuals of your location, general condition or death.

• We may share with a public or private agency (for example, American Red Cross) PHI about you for disaster relief purposes. Even if you object, we may still share the PHI about you, if necessary for emergency circumstances.

If you would like to object to our use or disclosure of PHI about you in the above circumstances, please call the appropriate Privacy Officer listed at the end of this Notice.

We may contact you to provide appointment reminders.

We may use and/or disclose PHI to contact you to provide a reminder to you about an appointment you have for treatment or medical care.

We may contact you with information about treatment services, products and healthcare providers.

We may use and/or disclose PHI to manage or coordinate your healthcare. This may include telling you about treatments, services, products and other healthcare providers. We may also use and/or disclose PHI about you to give you gifts of small value.

Example: If you are diagnosed with diabetes, we may tell you about nutritional and other counseling services that may be of interest to you.

We may contact you for fundraising activities.

We may use and/or disclose PHI about you, including disclosure to a foundation, to contact you to raise money for the hospital and its operations. We would only release contact information and the dates you received treatment or services at the hospital. If you do not want to be contacted in this way, you must make your request in writing. Contact a Privacy Officer listed at the end of this Notice.

Other use or disclosure of PHI about you requires your written authorization.

Under circumstances other than those listed here, we will ask for your written authorization before we use or disclose PHI about you. If you sign a written authorization allowing us to disclose PHI about you in a specific situation, you can later cancel your authorization in writing. If you cancel your authorization in writing, we will not disclose PHI about you after we receive your cancellation, except for disclosures that were being processed before we received your cancellation.

You have several rights about your PHI

You have the right to request restrictions on uses and disclosures of PHI about you.

You have the right to request that we restrict the use and disclosure of PHI about you. We are not required to agree to your requested restrictions, except in limited circumstances when you pay 100% of your bill out of pocket. However, even if we agree to your request, in certain situations your restrictions may not be followed. These situations include emergency treatment, disclosures to the Secretary of the Department of Health and Human Services, and uses and disclosures described in the previous sections of this Notice. You may request a restriction by notifying our staff.

You have the right to request different ways to communicate with you.

You have the right to request how and where we contact you about PHI. For example, you may request that we contact you at your work address or phone number or by email. Your request must be in writing. We must accommodate reasonable requests, but, when appropriate, may condition that accommodation on your providing us with information regarding how payment, if any, will be handled and your specification of an alternative address or other method of contact. You may request alternative communications by notifying the person registering you or your health care provider.

You have the right to see and copy PHI about you.

You have the right to request to see and receive a copy of PHI about you contained in clinical, billing and other records used to make decisions about you. Your request must be in writing. We may charge you related fees. Instead of providing a full copy of the PHI about you, we may give you a summary or explanation of the PHI about you, if you agree in advance to the form and cost of the summary or explanation. In certain situations, we are not required to comply with your request. Under these circumstances, we will respond to you in writing, stating why we will not grant your request and describing any rights you may have to request a review of our denial. You may request to see and receive a copy of PHI about you by contacting your provider’s medical records department.

You have the right to request amendment of PHI about you.

You have the right to request that we make amendments to clinical, billing and other records used to make decisions about you. Your request must be in writing and must explain your reason(s) for the amendment. We may deny your request if:

1) the information was not created by us (unless you prove the creator of the information is no longer available to amend the record);

2) the information is not part of the records used to make decisions about you;

3) we believe the information is correct and complete; or

4) you would not have the right to see and copy the record as described in the previous paragraph. We will tell you in writing the reasons for the denial and describe your rights to give us a written statement disagreeing with the denial. If we accept your request to amend the information, we will make reasonable efforts to inform others of the amendment, including persons you name who have received PHI about you and who need the amendment. You may request an amendment of PHI about you by contacting your provider’s medical records department.

You have the right to a listing of disclosures we have made.

If you ask our contact person in writing, you have the right to receive a written list of certain disclosures of PHI about you. You may ask for disclosures made up to six years before your request (not including disclosures made prior to April 14, 2003). We are not required to include disclosures

• for your treatment

• for billing and collection of payment for your treatment

• for our health care operations

• requested by you, that you authorized or that are made to individuals involved in your care, and

• allowed by law

The list will include the date of the disclosure, the name (and address, if available) of the person or organization receiving the information, a brief description of the information disclosed and the purpose of the disclosure. If you request a list of disclosures more than once in a twelve month period, we can charge you a reasonable fee. You may request a listing of disclosures by contacting your provider’s medical records department.

You have the right to a copy of this Notice.

You have the right to request a paper copy of this Notice at any time by contacting the registration person or your health care provider. We will provide a copy of this Notice no later than the date you first receive service from us (except for emergencies, in which case we will provide you with the Notice as soon as possible).

We reserve the right to change the terms of this Notice and make the new provisions effective for all PHI that it maintains. If we revise this Notice, a copy will be made available to you upon request.

You may file a complaint about our privacy practices.

If you think your privacy rights have been violated by us, or you want to complain to us about our privacy practices, you can contact the privacy officer at the end of this Notice. All complaints will be investigated to help resolve any issues you may have. You may also send a written complaint to the United States Secretary of the Department of Health and Human Services. If you file a complaint, we will not take any action against you or change our treatment of you in any way.

Special Protections

In some cases, North Carolina or Federal law may provide additional protection for your PHI. In the following situations, we will follow the practices specified in this section before using or disclosing the PHI affected in accordance with the remainder of this Notice.

Treatment for drug dependence

If you request treatment and rehabilitation for drug dependence, we will not disclose your name to any police officer or other law-enforcement officer unless you consent to our sharing of it.

Communicable diseases

If you suffer from a communicable disease (for example, tuberculosis, syphilis or HIV/AIDS), information about your disease will be treated as confidential. We will only release such information under the following circumstances:

1) for statistical purposes in a way that does not identify you;

2) with your written consent or the written consent of your guardian;

3) to other health care personnel providing you with treatment

4) to protect the public health and as provided by regulation;

5) to report as required by law;

6) pursuant to a subpoena or court order;

7) as otherwise specifically authorized or required by law.

Mental health services

One or more of the facilities covered by this Notice may be required to keep confidential information relating to mental health services, including treatment for mental illness, developmental disability or substance abuse. Such information will not be disclosed without your written consent, except in certain circumstances, potentially including the following:

1) to individuals within our facility involved in your treatment or rehabilitation,

2) to other facilities when necessary to coordinate appropriate and effective care, treatment or rehabilitation,

3) to your next of kin upon your request if the next of kin plays a legitimate role in your treatment,

4) when in our opinion there is an imminent danger to the health or safety of another individual,

5) to a provider of support services,

6) to a State or governmental agency when we believe you may be eligible for financial benefits through such agency,

7) to researchers if there is a justifiable documented need for the information,

8) to report suspected neglect or abuse as required by law,

9) to make other reports to the State as required by law,

10) upon court order,

11) to a prosecuting attorney and to your attorney in a case where you are a criminal defendant and a mental examination has been ordered by the court,

12) to the Attorney General’s office when the information is necessary for performance of the statutory responsibilities of the Attorney General,

13) to our attorney if such information is relevant to litigation involving our facility, and

14) to an attorney upon your request. Furthermore, if we determine that the disclosure is in your best interest we may: (i) disclose information about your admission or discharge to your next of kin, and (ii) disclose confidential information for purposes of filing a petition for involuntary commitment or a petition for adjudication of incompetency.

To the extent that any PHI can identify you as a substance abuse patient, such information may be entitled to stricter protection, and we will comply with any applicable law restricting the disclosure of such information.

Federally assisted alcohol and drug treatment programs

If you are receiving treatment in a federally assisted alcohol and drug treatment program, your health information may be disclosed without your written consent only as follows

• within the program for activities related to the provision of substance abuse diagnosis, treatment, or referral for treatment

• to respond to a medical emergency

• when required by a court order issued in accordance with the regulations

• to communicate with law enforcement personnel about a crime or threatened crime on the premises of a program or against program personnel

• to qualified personnel for a research, audit or evaluation activity

• to comply with state law mandating the reporting of child abuse or neglect

Inspections and surveys

One or more of our facilities and services are subject to inspection by State representatives who may as a part of this process review patient health information. If you receive services from our hospice, home health agency, ambulatory surgery center or outpatient cardiac rehabilitation program, we will provide you with written notice and the opportunity to object to their review prior to the release of your information.

Unemancipated minors

If you are under the age of 18 and are not married and have not been emancipated by an order of the court, you may consent to treatment for the following services without the consent of your parents and therefore may exercise the rights and authority set forth in this Notice: treatment for venereal disease, pregnancy, drug and/or alcohol abuse, and emotional disturbance. Exceptions to state law in this regard include instances in which your physician determines that this information should be shared with your parents or guardian because of a serious threat to your life or health, or in instances in which your parents or guardian contact the physician directly concerning the treatment of one of these conditions.

The effective date of this Notice is April 14, 2003.

Revised August 2012

To Contact Us:

Albemarle Health/Albemarle Hospital…….252-335-0531

Privacy Officer…………………….. 252-384-4081