Privacy Notice

 
Affiliates of Hawai‘i Pacific Health

NOTICE OF PRIVACY PRACTICES
EFFECTIVE DATE OF REVISED NOTICE: MARCH 1, 2011
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
If you have any questions about this Notice, please contact our Privacy Officer listed below.

1. Introduction
This joint Notice of Privacy Practices (this “Notice”) describes how we may use and disclose your protected health information (“PHI”) to carry out treatment, payment, and/or health care operations and for other purposes that are permitted or required by law. It also describes your rights concerning your PHI. PHI is information about you, including information that may identify who you are or where you live, that relates to your past, present, or future physical or mental health or condition, related health care services, and payment for such services.

To promote continuity and consistency of care, we have an integrated electronic medical record at all our facilities. This means information created in the course of our caring for you will reside in the integrated record and may be available to others involved with your care.

2. Who Will Follow This Notice
This Notice describes the privacy practices of our facilities that make up the Hawai‘i Pacific Health Affiliated Covered Entity and of members of each facility’s “organized health care arrangement’, as follows:

  •Kapi'olani Medical Center for Women and Children;
•Pali Momi Medical Center;
•Kapi'olani Medical Specialists;
•Straub Clinic and Hospital;
•Kauai Medical Clinic;
•Wilcox Memorial Hospital;
•All departments, units, and clinics of each of the above-named facilities;
•Any health care professional authorized to enter information into your medical or billing records at our facilities;
•All employees, medical staff members, allied health professionals, and other authorized workforce who may need access to your information;
•Volunteers we allow to help you at our facilities; and
•All residents, postgraduate fellows, medical students, and students of other health care professions or educational programs at our facilities.

For purposes of complying with federal privacy and security requirements, the above-described Hawai‘i Pacific Health facilities have designated themselves as an Affiliated Covered Entity. These are facilities under common ownership and control that have agreed to treat themselves as a single “covered entity” under these federal laws. Hawai‘i Pacific Health, as the member of these affiliated facilities, will coordinate privacy practices among these facilities and, from time to time, will have access to some PHI as a business associate of these facilities. Additionally, the independent providers who are providing health care services at or through our facilities, or who share electronic medical records with Hawai‘i Pacific Health’s Health Advantage Connect partners, have agreed to follow this Notice when providing services at or through that facility. These independent providers, however, are legally separate and responsible for their own acts.

3. Our Legal Duty
We are required by law to:

  •Keep records of the care that we provided to you;
•Keep your PHI private;
•Notify you, under certain circumstances, of breaches affecting your PHI;
•Abide by the terms of the Notice that is currently in effect; and
•Give you this Notice of our duties and privacy practices with respect to your PHI.

We may change our Notice at any time. We reserve the right to revise or amend this Notice. Any revision or amendment to this Notice will apply to all of your records that any of our facilities have created or maintained in the past and for any of your records that we may create or maintain in the future. We will visibly post a copy of our current Notice in our admitting and business offices. You may request a copy of the Notice from these locations. The Notice also will be posted on our website. Your personal doctor may have separate policies or notices regarding the use and disclosure of PHI that is created in his/her private practice.

4. We May Use and Disclose Medical Information about You
The following categories describe different ways we may use and disclose PHI. Not every use or disclosure in a category will be listed.

a. Treatment: We may use and disclose your PHI to provide you with medical treatment or services. For example, we may disclose your PHI to doctors, nurses, and other health care personnel or providers to coordinate the different things you need, such as prescriptions, lab work, and X-rays. We may also permit disclosure of your electronic health record via electronic transfer to other facilities and providers for treatment purposes. This includes continuing care, such as hospice or home care, as well as unrelated care you may seek on your own at other locations.

We participate in one or more Health Information Exchanges (“HIE”). Your health information and basic identifying information regarding your visits to our facilities may be shared with the HIEs for the purposes of diagnosis and treatment. Other providers participating in these HIEs may access this information as part of your treatment.

b. Payment: We may use and disclose your PHI to bill and collect payment for your health care services. We may disclose your PHI to other health care providers and organizations involved in your care to assist in their billing and collection efforts. This may include, for example, disclosures to your health insurance plan about services we recommend for you so your plan can determine eligibility, coverage, or medical necessity or for utilization review activities. We also may disclose your PHI to third parties for collection of payment.

c. Healthcare Operations: We may use your PHI or share it with others in the course of operating our facilities. For example, we may use your information to evaluate: the performance of our staff in caring for you; the quality of our services; and effectiveness of various treatments. This includes combining information we have with information from other health care providers to compare our services and outcomes so we can see where we can make improvements in our care and services. We may remove information that identifies you from this set of medical information so others may use it to study health care and health care delivery without learning who the specific patients are. We also may call you by name in the waiting areas. We also may disclose your PHI to third parties who perform various activities on our behalf, such as accounting, transcription services, data analysis, and risk management.

In addition, we may disclose your PHI for payment activities and certain business operations of another health care provider or health plan as long as they have or had a relationship with you; the information disclosed pertains to that relationship; and the information is used for one of the following health care operations: quality assessment and improvement; case management and care coordination.

d. Education and Training: Education and Training: We may disclose information to doctors, nurses, technicians, training doctors, medical students, postgraduate fellows and other hospital personnel for review and learning purposes. These same classes of individuals and other health care professional students may participate in examinations or procedures and in your care as part of our educational programs.

e. Appointment Reminders: Appointment Reminders: We may use and disclose your PHI to contact you as a reminder that you have an appointment or to provide you information regarding your medical care.

f. Treatment Alternatives: We may use and disclose PHI to tell you about possible treatment options or alternatives.

g. Health Related Benefits and Services: Health Related Benefits and Services: We may use and disclose your PHI to tell you about health-related benefits or services that may be of interest to you.

h. Research: Under certain circumstances, we may use and disclose your PHI for research purposes but only as allowed by law or with your permission. For example, a research project may involve comparing the health and recovery of all patients who received one medication to those who received another, for the same condition. We may use or allow other researchers to review your PHI for the purpose of preparing a plan for a specific research project but, in that event, none of your identifiable information will be allowed to leave our facilities. We may use your PHI to contact you with information about a research study in which you might be interested in participating. If you choose to participate in a research study, you will be asked to sign a form authorizing the use and disclosure of your PHI for that study. All research studies must be reviewed and approved by a committee, called an Institutional Review Board (IRB), before subjects may be enrolled. This process evaluates a proposed research project and its use of medical information, trying to balance the research needs with patients’ need for privacy of their medical information.

i. For Fundraising: We may use or disclose certain PHI to an institutionally affiliated foundation to contact you to raise money for our facilities and their operations. We would disclose only contact information and the dates you received treatment or services at one of our facilities. If you do not want to be contacted in this way, please notify the Privacy Officer.

5. You Will Have the Opportunity to Agree or Object to These Uses and Disclosures
Provided you do not object, we may disclose your PHI in the following situations after we discuss it with you. If, however, you are not able to object, we may disclose your PHI if it is consistent with your known prior expressed wishes and is determined to be in your best interests. As soon as you are able, we will give you the opportunity to object to any further disclosures.

  •Facility Directory: Unless you object, we will include certain limited information about you in the facility directory while you are a patient at one of our facilities. This information may include your name, location in the facility, your general condition (fair, stable, etc.), and your religious affiliation. With the exception of your religious affiliation, the directory information may be released to people who ask for you by name. Your religious affiliation may be given to a member of the clergy, such as a priest or rabbi, even if they don’t ask for you by name. We provide this information so your family, friends, and clergy can visit you and know, generally, how you are doing. If you do not want this information listed in the directory, you must notify the admissions office or fill out a Directory Restriction Form.
•Individuals Involved in Your Care or Payment for Your Care and Notification: Unless you object, we may disclose to a member of your family, a relative, a close friend, or any other person you identify information that directly relates to that person’s involvement in your health care. We also may give information to someone who helps pay for your care. We may share PHI with these people to notify them about your location and general condition. Finally, we may disclose PHI about you to disaster relief agencies, such as the Red Cross, so that your family can be notified about your condition, status, and location.

6. We May Make the Following Uses and Disclosures Without Your Authorization
  •When Required By Law: We will use and disclose your PHI when we are required to do so by federal, state, or local law.
•To Avert a Serious Threat to Health or Safety: We may use and disclose your PHI to prevent a serious threat to your health and safety or the health and safety of others.
•For Organ and Tissue Donation: We will disclose your PHI to a designated organ donor program as required or permitted by law.
•For Specific Government Functions: We may release medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law, as well as to others so they may provide protection to the President and other authorized persons or foreign heads of state. If you are a member of the armed forces, we may release your information as required to your military command authorities.
•For Legal Proceedings: We may disclose your PHI in response to a subpoena, discovery request, or other lawful process by someone involved in a dispute, but only after efforts have been made to tell you about the request or to obtain an order protecting the PHI requested.
•For Law Enforcement: We may use or disclose your PHI for law enforcement purposes, such as legal processes, limited information requests for identification and location purposes, information pertaining to victims of a crime, suspicion that death has occurred as a result of criminal conduct, a crime occurring on our premises, and certain medical emergencies (not on the premises).
•For Health Oversight: We may disclose PHI about you to a state or federal health oversight agency that is authorized by law to oversee our operations. These activities are necessary for the government to monitor our health care system, government programs, and compliance with civil rights laws.
•To Coroners, Medical Examiners, and Funeral Directors: We may disclose your PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or to determine the cause of death. We also may release PHI to funeral directors as necessary for them to carry out their duties.
•For Workers’ Compensation: We may disclose your PHI as permitted by workers’ compensation laws and other similar programs.
•For Public Health: We will disclose PHI to public health authorities for public health activities, investigations, or interventions as required by law. Public health activities generally include:
  - Reporting births and deaths, birth defects, children at risk, and child abuse or neglect;
- Preventing or controlling disease, injury, or disability;
- Notifying people of recalls of medical products they may be using;
- Notifying a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
- Reporting reactions to medications or problems with products; and
- Notifying the appropriate government authority if we believe a patient has been the victim of abuse or neglect.
  •Regarding Inmates or Individuals in Custody: If you are in legal custody, we may disclose your PHI to a correctional institution or law enforcement official. PHI may be disclosed to provide you health care, to protect your health and safety or the health and safety of others, or for the safety and security of the correctional institution.


7. Other Uses and Disclosures of Your PHI
Other uses and disclosures of your PHI not covered by this Notice or the laws that apply to us will be made only with your written authorization. If you provide us permission to use or disclose your PHI, you may revoke that permission, in writing, at any time. If you revoke your permission, we will stop any use or disclosure of PHI previously permitted by your written authorization. We are unable to “take back” any disclosures we have already made with your permission. Certain information, such as HIV/AIDS and substance abuse information, is subject to additional protections.

8. Your Rights Regarding Your PHI
a. You have the right to request restrictions on how we use and disclose your PHI for treatment, payment, or health care operations. We, however, are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment. To request a restriction, your request must be in writing to our Privacy Officer and must describe:
• The information you wish restricted;
• Whether you are requesting to limit our use, disclosures, or both; and
• To whom you want the limitation to apply.

You have a right to request a restriction on the information disclosed to your health plan if you make arrangements to pay for the related services in full at the time the services are provided.

b. You have the right to request confidential communications from us by alternative means or at an alternative location. We will accommodate reasonable requests. We may ask you for information as to how payment will be handled or to specify an alternative address or other method of contact. We will not request an explanation from you as to the basis for the request. Please notify our Admissions/Registration staff.

c. You have the right to inspect and obtain a paper or electronic copy your PHI that our facilities use to make decisions about you for as long as we maintain the PHI. There are a few exceptions. If we deny your request to inspect your PHI, we will give you reasons in writing for the denial and explain any right to have the denial reviewed. If you want copies of your PHI, a charge for copying may be imposed. You may direct that the copy be transmitted directly to an entity or person designated by you, provided that any such designation is clear, conspicuous, and specific with complete name and mailing address or other identifying information. Please contact our Health Information Management Department if you have questions about access to your health information.

d. You have the right to request an amendment if you feel the PHI we have about you is incorrect or incomplete. In certain cases, we may deny your request for an amendment. If we deny your request, you have the right to file a statement of disagreement with us. We may prepare a rebuttal and will provide you with a copy of such rebuttal. Please contact our Health Information Department if you have questions about the process.
e. You have the right to find out what disclosures we have made about you, to whom, and why. When you request an accounting of disclosures of your electronic health record, the accounting can be up to three years prior to the date of your request. Effective January 1, 2014 we will include disclosures for treatment, payment and health care operations made on and after January 1, 2014. This applies to disclosures made for reasons other than treatment, payment, or our health care operations. It also excludes disclosures we made to you or as authorized by you, for a facility directory, to family members or friends involved in your care, for notification purposes, or as required by law. The right to receive this information is subject to certain exceptions, restrictions, and limitations. Please contact our Health Information Department for further information.

e. You have the right to find out what disclosures we have made about you to whom, and why. This applies to disclosures made for reasons other than treatment, payment, or our health care operations. It also excludes disclosures we made to you or as authorized by you, for a facility directory, to family members or friends involved in your care, for notification purposes, or as required by law. The right to receive this information is subject to certain exceptions, restrictions, and limitations. Please contact our Health Information Department for further information.

f. You have the right to a paper copy of this Notice. You are entitled to receive a paper copy of our Notice even if you have agreed to accept this Notice electronically. You may ask us to give you a copy of this Notice at any time. To obtain a paper copy of this Notice, contact our Privacy Officer.

g. You have the right to file a complaint. If you believe your privacy rights regarding your PHI may have been violated, you may file a complaint with any of our facilities or the Secretary of the Department of Health and Human Services. You will not be penalized for filing a complaint in good faith.

For additional information or to submit a complaint, please contact our Privacy Officer:

Privacy Officer
55 Merchant St., 26th Floor
Honolulu, HI 96813
(808) 535-7148
privacyofficer@kapiolani.org