1 PRIVACY PRACTICES THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. General Information To comply with federal law, this Notice describes the privacy practices of the following controlled affiliates of Memorial Group, Inc. (collectively, Memorial ), and applies to your protected health information generated by the employees and private independent physicians.* Memorial Hospital (includes on- and off-campus satellite offices) Memorial Care Center Memorial Home Care Memorial Medical Group, LLC including its employed physicians and all offices of its subsidiaries: P.C. Associates, LLC; M.S.A. Alliance, LLC; O.B. Practice, LLC; C.A. Group, LLC; and O.A. Associates, LLC For purposes of this Notice and all other allowable purposes of compliance with the federal standards for privacy and security found in the Health Insurance Portability and Accountability Act of 1996 and its regulations and the Health Information Technology for Economic and Clinical Health Act and its regulations (collectively, HIPAA ), the separate, affiliated covered entities listed above have designated themselves as a single covered entity ( Memorial ), effective as of January 01, This Notice also applies to your protected health information generated, used, or disclosed by Memorial s employees or private independent physicians* who participate in an Organized Health Care Arrangement (OHCA) with Memorial. Memorial and private physicians* in the OHCA share protected health information with each other as necessary to carry out treatment, payment, and healthcare operations related to the OHCA and your care and treatment at Memorial. Your private physicians* may have different policies or notices regarding use and disclosure of your protected health information created in their private offices or clinic practices. Both the Affiliated Covered Entity designation and the Organized Health Care Arrangement apply only to federal privacy and security requirements regarding your protected health information (PHI). In all other respects, each physician* makes independent treatment decisions and professional medical/clinical judgments about the care and services you receive and is not an agent or joint venturer of Memorial by virtue of this Notice. Understandably, Memorial does not control and is not responsible for these treatment decisions. *Includes private physicians, dentists, podiatrists, and all other allied health practitioners appointed to the Medical Staff of Memorial Hospital. OUR PRIVACY OBLIGATIONS We are required by law to maintain the privacy of your PHI and to provide you with this Notice of our legal duties and privacy practices with respect to your PHI. When we use or disclose your PHI, we are required to abide by the terms of this Notice (or the notice in effect at the time of the use or disclosure).
2 PERMISSIBLE USES AND DISCLOSURES WITHOUT YOUR WRITTEN AUTHORIZATION In certain situations, described below, we must obtain your written authorization to use and/or disclose your PHI. However, unless otherwise specified by federal or Illinois law, or Memorial policy, we do not need any type of authorization from you for the following uses and disclosures: FOR TREATMENT We may use and disclose your PHI to provide treatment and other services to you - for example, to diagnose and treat your injury or illness or to contact you to provide appointment reminders. In addition, we may contact you to provide information about treatment alternatives or other healthrelated benefits and services that may be of interest to you. If we receive payment from third parties for making these communications, they are generally considered marketing and your authorization will be required as described below. We may use information to contact you following a procedure so as to verify your recovery. We may also disclose your PHI to other healthcare providers involved in your treatment. FOR PAYMENT We may use and disclose your PHI to obtain payment for services that we provide to you - for example, disclosures to claim and obtain payment from Medicare, Medicaid, your health insurer, PPO, HMO, or other company or program that arranges or pays for some or all of your healthcare costs. We may also disclose your PHI to another covered entity in order for them to bill for services you received at Memorial. FOR HEALTHCARE OPERATIONS We may use and disclose your PHI for our healthcare operations, which include internal administration and planning and various activities that improve the quality and cost effectiveness of the care that we deliver to you. For example, we may use your PHI to evaluate the quality and competence of our physicians, nurses and other healthcare workers. We may also disclose PHI to an office manager or patient care coordinator in order to resolve any complaints you may have. We may ask you to sign in at a reception desk when you arrive and we may call out your name when the healthcare provider is ready to see you. We may also disclose PHI to your physicians and the specialists selected by them as well as other healthcare providers when such PHI is required for them to treat you, receive payment for services they render to you, or conduct healthcare operations such as quality assessment and improvement activities, reviewing the quality and competence of healthcare professionals, or for healthcare fraud and abuse detection or compliance. We may disclose and discuss your PHI during and after you receive services with physicians and other healthcare providers as well as Memorial s employees including all aspects of your condition, treatment and content of your medical records with Memorial s management and staff employees as well as Memorial s authorized representatives for various specific purposes such as, quality assurance, utilization review, legal, accreditation, licensure, etc. These disclosures and subsequent discussions of your PHI are for quality improvement, hospital or practice management, utilization review, risk management, litigation defense evaluation and preparation, complaint resolution, and other operational purposes. 2
3 USE OR DISCLOSURE FOR DIRECTORY OF INDIVIDUALS AT MEMORIAL HOSPITAL OR MEMORIAL CARE CENTER If you are in Memorial Hospital or Memorial Care Center, we may include your name, location in the facility, general health condition, and religious affiliation in a patient directory without obtaining your authorization unless you object to inclusion in the directory. Information in the directory may be disclosed to anyone who asks for you by name or to members of the clergy, provided, however, that religious affiliation will only be disclosed to members of the clergy. DISCLOSURE TO INDIVIDUALS INVOLVED IN YOUR CARE OR PAYMENT FOR YOUR CARE Unless you object, we may release medical information about you to a friend or family member who is involved in your medical care, if that information relates to your care. We may also give information to someone who helps pay for your care. We may provide information to family members, physicians, clergy, or others who are involved in your medical care. We may disclose medical information about you to doctors, nurses, technicians, medical students, or other personnel who are involved in taking care of you. We also may disclose medical information about you to people outside Memorial who may be involved in your medical care after you leave Memorial, such as physicians, family members, clergy, or others we use to provide services that are part of your care. BUSINESS ASSOCIATES We may disclose your medical information to our business associates who perform functions on our behalf or provide us with services, if the health information is necessary for those functions or services. For example, we may use another company to do our billing, or to provide transcription or consulting services for us. All of our business associates are obligated, under contract with us, to protect the privacy and ensure the security of your protected health information. FUND RAISING COMMUNICATIONS We may contact you to request a tax-deductible charitable contribution to assist Memorial Hospital in continuing its mission of providing high-quality and cost-effective services to the residents of Southwest Illinois. In connection with any fund raising, we may disclose to our Foundation office without your written authorization, demographic information about you (i.e. name, address, and phone number), dates on which we provided healthcare services to you, the department within our organization where you received services, the physician who provided services to you, information regarding the outcome of your care with us, and your health insurance coverage status. If you do not wish to receive future fund raising materials, please write to Memorial Foundation, Inc., 4500 Memorial Drive, Belleville, Illinois In the event that you contact us with this request, all reasonable efforts will be taken to ensure that you will not receive any fund raising communications from us in the future. PUBLIC HEALTH ACTIVITIES We may disclose your PHI for the following public health activities: to report health information to public health authorities for the purpose of preventing or controlling disease, injury or disability; to report child abuse and neglect to the Illinois Department of Children and Family Services or other government authorities authorized by law to receive such reports; to report information about products and services under the jurisdiction of the U.S. Food and Drug Administration; to alert a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition; to report information to your employer as required under laws 3
4 addressing work-related illnesses and injuries or workplace medical surveillance; and other public health activities that are required by law. VICTIMS OF ABUSE, NEGLECT OR DOMESTIC VIOLENCE If we reasonably believe you are a victim of abuse, neglect, or domestic violence, we may disclose your PHI to the Illinois Department of Children and Family Services, the Illinois Department of Human Services, or other governmental authority, including social service or protective services agencies, authorized by law to receive reports of such abuse, neglect, or domestic violence. HEALTH OVERSIGHT ACTIVITIES We may disclose your PHI to a health oversight agency that oversees the healthcare system and is charged with responsibility for ensuring compliance with the rules of government health programs such as Medicare or Medicaid. JUDICIAL AND ADMINISTRATIVE PROCEEDINGS We may disclose your PHI in the course of a judicial or administrative proceeding in response to a legal order or other lawful process. DATA BREACH NOTIFICATION PURPOSES We may use or disclose your PHI to provide legally required notices of unauthorized access to or disclosure of your protected health information. LAW ENFORCEMENT OFFICIALS We may disclose your PHI to the police or other law enforcement officials as required or permitted by law or in compliance with a court order or a grand jury or administrative subpoena. DECEDENTS We may disclose your PHI to a coroner, medical examiner, or funeral home as authorized by law. ORGAN AND TISSUE PROCUREMENT We may disclose your PHI to organizations that facilitate organ, eye, or tissue procurement, banking, or transplantation. RESEARCH We may use or disclose your PHI to researchers without your consent or authorization when a waiver of authorization for disclosure has been approved by an Institutional Review Board. HEALTH OR SAFETY We may use or disclose your PHI to prevent or lessen a serious and imminent threat to a person s or the public s health or safety. SPECIALIZED GOVERNMENT FUNCTIONS We may use and disclose your PHI to units of the government with special functions, such as the U.S. military or the U.S. Department of State, under certain circumstances. WORKERS COMPENSATION We may disclose your PHI as authorized by, and to the extent necessary to comply with, state law relating to workers compensation or other similar programs. 4
5 AS REQUIRED BY LAW We may use and disclose your PHI when required to do so by any other federal or state law or regulation applicable to disclosures in the preceding categories. USES AND DISCLOSURES REQUIRING YOUR WRITTEN AUTHORIZATION For any purpose other than the ones described above, we may use or disclose your PHI only when you grant us your written authorization. For instance, you will need to execute an authorization form before we can send your PHI to your life insurance company or to the attorney representing you in litigation in which you are involved. MARKETING We must obtain your written authorization prior to using your PHI to send you any marketing materials. We can, however, provide you with marketing materials in a face-to-face encounter without obtaining your marketing authorization. We are also permitted to give you a promotional gift of nominal value, if we so choose, without obtaining your marketing authorization. In addition, we may communicate with you about products or services, unless we receive payment for making the communications, relating to your treatment, case management, care coordination, alternative treatments, therapies, providers or care settings without your marketing authorization. USES AND DISCLOSURES OF YOUR HIGHLY CONFIDENTIAL INFORMATION In addition, federal and Illinois law require special privacy protections for certain highly confidential information about you ( Highly Confidential Information ), including the subset of your PHI that is: maintained in psychotherapy notes; about mental health program and developmental disabilities services; about alcohol and drug abuse services; about HIV/AIDS testing; about venereal disease(s); about genetic testing; about child abuse and neglect; about domestic abuse of an adult with a disability; or about sexual assault. In order for us to disclose your Highly Confidential Information for a purpose other than those permitted by laws regulating such information, we must obtain your written authorization. Other uses and disclosures of Protected Health Information, such as disclosures that constitute a sale of your protected health information, as defined in HIPAA, or any other uses and disclosures not covered by this Notice or the laws that apply to us will be made only with your written authorization. If you do give us an authorization, you may revoke it at any time by submitting a written revocation to our Privacy Officer and we will no longer disclose your PHI under the authorization. But disclosures that we made in reliance on your authorization before you revoked it will not be affected by the revocation. YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION RIGHT TO INSPECT AND COPY YOUR HEALTH INFORMATION You may request access to your Memorial designated record set in order to inspect and/or request copies of the records. Under limited circumstances, we may deny you access to all or a portion of your records. All requests for access must be made in writing. If you desire access to your records, please obtain a Record Access Form from the Health Information Management Department and submit the completed form to the Health Information Management Department. If you request copies for nonmedical or non-payment related reasons, we will charge you reasonable duplication fees. 5
6 RIGHT TO AN ELECTRONIC COPY OF ELECTRONIC MEDICAL RECORDS If your PHI is maintained in an electronic format, you have the right to request that an electronic copy of your record be given to you or transmitted to another individual or entity. We will make every effort to provide access to your PHI in the form or format you request, if it is readily producible in such form or format. If the PHI is not readily producible in the form or format you request, your record will be provided in either our standard electronic format or a readable hard copy form. We may charge you a reasonable, cost-based fee for copying the electronic medical record. RIGHT TO REQUEST ADDITIONAL RESTRICTIONS You may request restrictions on our use and disclosure of your PHI for: treatment, payment and healthcare operations; to individuals (such as a family member, other relative, close personal friend or any other person identified by you) involved with your care or with payment related to your care; or to notify or assist in the notification of such individuals regarding your location and general condition. If you wish to request additional restrictions, you must submit a written request to the Privacy Officer. Your request must state the specific restriction requested and to whom you want the restrictions to apply. We are not required to agree to your request, unless you are asking us to restrict the use and disclosure of your PHI to a health plan for payment or health care operation purposes and such information you wish to restrict pertains solely to a health care item or service for which you have paid us out-of-pocket in full. If we do agree to your requested restriction, we may not use or disclose your PHI in violation of that restriction unless it is needed to provide emergency treatment. RIGHT TO RECEIVE NOTICE OF A BREACH OF PHI You have the right to be notified upon a breach of any of your unsecured protected health information. RIGHT TO RECEIVE CONFIDENTIAL COMMUNICATIONS You may request to receive your PHI by alternative means of communication or at alternative locations and we will accommodate any such reasonable written request. RIGHT TO REVOKE YOUR AUTHORIZATION You may revoke your authorization except to the extent that we have taken action in reliance upon it. You may obtain a revocation authorization form by contacting the Privacy Office. RIGHT TO AMEND YOUR RECORDS You have the right to request that we amend PHI maintained in your Memorial designated record set. Amendment requests must be submitted in writing and clearly identify the information to be amended, as well as the reasons for the amendment. If you desire to amend your records, please obtain an amendment request form from the Privacy Office and submit the completed form to the Privacy Office. We will comply with your request unless we believe that the information to be amended is accurate and complete or other special circumstances apply. In the case of a requested amendment concerning the treatment of a mental illness or developmental disability, you have the right to appeal our decision not to amend your PHI to an Illinois court. RIGHT TO RECEIVE AN ACCOUNTING OF DISCLOSURES Upon your written request, you may obtain an accounting of certain disclosures of your PHI made by us during any period of time prior to the date of your request provided such period does not exceed six (6) years. If you request an accounting more than once during a twelve (12) month period, you will be charged a reasonable cost-based fee. 6
7 FOR FURTHER INFORMATION AND COMPLAINTS If you desire further information about your privacy rights, are concerned that we have violated your privacy rights, or disagree with a decision that we made about access to your PHI, you may contact our Privacy Office at the address listed on the next page. You may also file written complaints with the Director, Office for Civil Rights of the U.S. Department of Health and Human Services. Upon request, the Privacy Office will provide you with the correct address for the Director. We will not retaliate against you if you file a complaint with us, or the Director. RIGHT TO RECEIVE PAPER COPY OF THIS NOTICE Notices will be available in each of our registration areas for you to read and/or take a copy. Also, upon request, you may obtain a paper copy of this Notice, even if you have agreed to receive such notice electronically. EFFECTIVE DATE This Notice is effective on September 23, RIGHT TO CHANGE TERMS OF THIS NOTICE We may change the terms of this Notice at any time. If we change this Notice, we may make the new notice terms effective for all Protected Health Information that we maintain, including any information created or received prior to issuing the new notice. If we change this Notice, we will post the new notice in registration areas around Memorial Hospital, Memorial Care Center, all on- and off-campus satellite offices, Memorial Medical Group offices, and on our Internet sites at and You also may obtain any new notice by contacting the following: Privacy Office Memorial Hospital c/o Health Information Management 4500 Memorial Drive Belleville, IL (618) Revised 02/13, 09/13 7