THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
I. UNDERSTANDING YOUR HEALTH INFORMATION
Each time you receive services from Agrace, a record of the services provided is made. This record usually contains identification and financial information as well as symptoms, diagnoses, test results, a description of a physical examination, and updates to your plan of care. This record is often referred to as your “medical record,” or “health information,” and includes information contained in paper as well as electronic records.
Your health information is used:
• to plan for your future services;
• for communication among your health-care professionals;
• as a legal document describing the services you received;
• to help Agrace review and improve health care and outcomes;
• as a source of information for important health research;
• to train health professionals and students;
• for other similar activities that allow Agrace to operate efficiently and provide you with quality services.
II. OUR DUTY TO PROTECT YOUR HEALTH INFORMATION
Under the Health Insurance Portability and Accountability Act, also known as “HIPAA”, Agrace is required by law to maintain the privacy of your protected health information and to provide you with this notice of our legal duties and privacy practices with respect to your protected health information.
• Agrace HospiceCare
• Agrace Palliative Care
Agrace must abide by the terms of the notice currently in effect, but may change the terms of this notice if privacy practices change or as federal or state requirements change. Each notice will have an effective date listed on the document. Agrace reserves the right to make the amended notice effective for any health information it has at the time the change is made, as well as for future health information.
Copies of revised notices are available on the Agrace website at www.agrace.org, or upon request by calling Agrace Health Information Management at (608) 327-7447.
III. USE AND DISCLOSURE OF HEALTH INFORMATION
The HIPAA Privacy Rule allows Agrace to use or disclose protected health information about you for purposes of treatment, payment and health care operations. Any uses or disclosures for payment or health care operations must be limited to the minimum necessary in order to accomplish the purpose of the use or disclosure. Please note that Wisconsin law is more protective of certain health information than HIPAA. As required by state law, in most cases, Agrace may not disclose your information related to treatment for mental health, alcohol or drug dependence, or HIV status without your written authorization.
A. Uses and disclosures of your health information for the purpose of providing you with medical care.
Agrace may use your health information to coordinate care within Agrace and with others involved in your care, such as your attending physician, members of the Agrace interdisciplinary team and other health care professionals who have agreed to assist Agrace in coordinating care. For example, physicians involved in your care will need information about your symptoms in order to prescribe appropriate medications.
Agrace also may disclose your health information to other individuals outside of Agrace involved in your care, including: family members, clergy whom you have designated, pharmacists, suppliers of medical equipment or other health care professionals Agrace uses in order to coordinate your care.
Agrace may use and disclose your health information to send bills and collect payment from you, your insurance company or other third parties, for the services you receive from Agrace. For example, Agrace may be required by your health insurer to provide information regarding your health care status so that the insurer will reimburse you or Agrace. Agrace also may need to obtain prior approval from your insurer and may need to explain to the insurer your need for care and the services that will be provided to you.
3. Health Care Operations
Agrace may use and disclose health care information for its own operations in order to facilitate the function of Agrace and as necessary to provide quality care to all of Agrace’s patients. Health care operations includes such activities as:
• Quality assessment and improvement activities.
• Activities designed to improve health or reduce health care costs.
Protocol development, case management and care coordination.
• Contacting health care providers and patients with information about treatment alternatives and other related functions that do not include treatment.
• Professional review and performance evaluation.
• Training programs, including those in which students, trainees or practitioners in health care learn under supervision.
• Training of non-health care professionals.
• Accreditation, certification, licensing or credentialing activities.
• Review and auditing, including compliance reviews, medical reviews, legal services and compliance programs.
• Business planning and development, including cost management and planning related analyses and formulary development.
• Business management and general administrative activities of Agrace.
• Fundraising for the benefit of Agrace and certain marketing activities.
For example Agrace may use your protected health information to evaluate its staff performance, combine your protected health information with other Agrace patients in evaluating how to more effectively serve all Agrace patients, disclose your health information to Agrace staff and contracted personnel for training purposes or use your protected health information to contact you as a reminder regarding a visit to you.
B. Other uses and disclosures of your information that do not require your authorization.
There are some instances when Agrace is permitted or required by law to use and disclose your health information without your authorization. For example:
1. As Required by law
Agrace will disclose your health information when it is required to do so by any federal, state, or local law.
2. Public health risks
Agrace may disclose your health information for public health purposes, such as to:
• Prevent or control a communicable disease, injury or disability and support public health surveillance, investigations and interventions.
• Report vital statistics such as births or deaths.
• Report adverse events and product defects in order to track products or enable product recalls, repairs and replacements and to conduct post-marketing surveillance and compliance with requirements of the Food and Drug Administration.
• Notify a person who has been exposed to a communicable disease or who may be at risk of contracting or spreading a disease.
• Notify an employer about an individual who is a member of the employer’s workforce in certain limited situations, as authorized by law.
3. Abuse, neglect or domestic violence
Agrace is allowed to notify government authorities if Agrace believes a patient is a victim of abuse, neglect or domestic violence. Agrace will make this disclosure only when specifically required or authorized by law or when the patient agrees with the disclosure.
4. Health oversight activities
Agrace may disclose your health information to a health oversight agency for activities including audits, civil administration or criminal investigations, inspections, licensure, or disciplinary action. Agrace, however, may not disclose your health information if you are the subject of an investigation and your health information is not directly related to your receipt of health care or public benefits.
5. Judicial and administrative proceedings
Agrace may disclose your health information in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal as expressly authorized by such order or in response to a subpoena, discovery request or other lawful process, but only when Agrace makes reasonable efforts to either notify you about the request or to obtain an order protecting your health information.
6. Law enforcement
Agrace may disclose your health information to a law enforcement official for law enforcement purposes in the following circumstances:
• In response to a court order, subpoena, warrant, summons or similar process.
• To identify or locate a suspect, fugitive, material witness, or missing person.
• About the victim of a crime if, under certain limited circumstances, Agrace is unable to obtain the person’s agreement.
• About a death Agrace believes may be the result of a crime.
• About criminal conduct at Agrace.
• In emergency circumstances to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime.
7. Coroners, medical examiners and funeral directors
Agrace may disclose your health information to coroners and medical examiners for purposes of determining your cause of death or other duties, as authorized by law. Agrace may also release medical information about patients of Agrace to funeral directors as necessary to carry out their duties.
8. Organ, eye and tissue donation
Agrace may use or disclose your health information to organ procurement organizations or other entities engaged in the procurement, banking or transplantation of organs, eyes or tissue for the purpose of facilitating the donation and transplantation.
9. Visit reminders/additional communications
Agrace may use your health information to call you reminding you of an upcoming visit. Agrace may also use your health information to call you with the results of tests or to give you other health communications.
Agrace may, under certain circumstances, use and disclose your health information for research purposes. Before Agrace discloses any of your health information for research purposes, the project will be subject to an extensive approval process. This process includes evaluating a proposed research project and its use of health information and trying to balance the research needs with your need for privacy. Additionally, when it is necessary for research purposes and so long as the health information does not leave Agrace, Agrace may disclose your health information to researchers preparing to conduct a research project, for example, to help the researchers look for individuals with specific health care needs. Lastly, if certain criteria are met, Agrace may disclose your health information to researchers after your death when it is necessary for research purposes.
11. Limited data set
Agrace may use or disclose a limited data set of your health information, that is, a subset of your health information from which all identifying information has been removed, for purposes of research, public health, or health care operations. Prior to our release, any recipient of that limited data set must agree to appropriately safeguard your health information.
12. Serious threat to health or safety
Agrace may, consistent with applicable law and ethical standards of conduct, disclose your health information if Agrace, in good faith, believes that such disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety or to the health and safety of the public.
13. Specified government functions
In certain circumstances, Federal regulations authorize Agrace to use or disclose your health information to facilitate specified government functions relating to military and veterans, national security and intelligence activities, protective services for the President and others, medical suitability determinations and inmates in law enforcement custody.
14. Worker’s compensation
Agrace may release your health information for worker’s compensation or similar programs that provide benefits for work-related injuries or illness.
15. Communicating additional services provided by Agrace
Under certain conditions, Agrace may use your health information to inform you of additional or health-related services we have to offer.
C. Uses and disclosures of your health information that you may object to or refuse.
Listed below are examples of ways Agrace may use or disclose your health information without your authorization unless you refuse or object.
1. Facility directory – Agrace Inpatient Unit only
If you are a patient at the Agrace Inpatient Unit, we may include limited information about you in a facility directory. This is to provide general information to those who ask about you, such as your family members, friends, clergy, and those making deliveries (e.g., flowers). This information may include your name, location in the facility (e.g., room number, telephone number), your general condition (e.g., fair, stable, etc.) and your religious affiliation.
You have the right to object to the use or disclosure of your information from Agrace’s facility directory. Unless you object, Agrace may disclose the following information for directory purposes to any person who asks for you by name: your location in the facility and your general condition. Unless you object, Agrace may disclose the following information for directory purposes to members of the clergy: your religious affiliation, your name, your location in the facility, and your general condition.
If we are unable to offer you an opportunity to object, for example, if you are
admitted in an emergency, or are otherwise incapacitated, Agrace staff members will exercise their professional judgment to determine if it is in your best interest to have directory information disclosed.
2. Information disclosed to family members, close friends, or others
To coordinate your care and explain your condition and treatment plan, Agrace may disclose health information about you to your family or close personal friends. You have the right to object to these kinds of disclosures. In an emergency situation, Agrace staff will exercise their professional judgment to determine if family or friends should receive information about you. Agrace may disclose health information about you to your family or close personal friends after your death unless doing so is inconsistent with any prior expressed preferences.
Unless you object, Agrace may use your health information to notify, or assist in notifying, members of your family, close personal friends, or any other people responsible for your care about your condition, location, or death.
4. Disaster relief
Unless you object, Agrace may also disclose your health information to an organization authorized to assist in disaster relief efforts so that loved ones can receive information about your location and health status.
5. Fundraising activities
Agrace may use information about you including your name, address, phone number, gender, dates of birth, health insurance status, treating physician, and the dates you received care in order to contact you or your family to raise money for Agrace. Agrace may also release this information to the Agrace Foundation. You have the right to opt out of receiving fundraising communications. Your Protected Health Information (PHI) in the form of photographs, videos, or stories will not be used for fundraising activities unless you provide an authorization for this type of fundraising activity.
If you do not want Agrace to contact you or your family for fundraising purposes, notify the Vice President of the Foundation by calling (608) 276-4660 and indicate that you do not wish to be contacted.
D. Breach notification
Agrace is required to provide patient notification if it discovers a breach of unsecured PHI unless there is a demonstration, based on a risk assessment, that there is a low probability that the PHI has been compromised. You will be notified no later than 60 days after discovery of the breach. Such notification will include information about what happened and what can be done to mitigate any harm.
E. Uses and disclosures of your health information requiring your authorization.
Except as otherwise permitted or required by this Notice of Privacy Practices, Agrace will not use or disclose your health information unless you provide a written authorization, including uses and disclosures of PHI for marketing purposes and disclosures that would constitute a sale of PHI. If you or your representative authorize Agrace to use or disclose your health information, you may revoke that authorization, in writing, at any time. If you revoke your authorization, Agrace will no longer use or disclose health information about you for the reasons covered by your written authorization, except to the extent that Agrace has taken any action in reliance thereon. Agrace is unable to take back any disclosures it has already made under the authorization.
IV. YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION
You have the following rights regarding your health information that Agrace maintains:
• Right to request restrictions
You have the right to request restrictions on certain uses and disclosures of your health information. You have the right to request a limit on Agrace’s disclosure of your health information to someone who is involved in your care or the payment of your care. Agrace is not required to agree to your request, unless your request is for a restriction on a disclosure to a health plan for purposes of payment or health care operations (and is not for the purposes of treatment) and the medical information you are requesting to be restricted from disclosure pertains solely to a health care item or service for which you have paid out of pocket in full. If you wish to make a request for restrictions, please contact Agrace Health Information Management at (608) 327-7447.
• Right to receive confidential communications
You have the right to request that Agrace communicate with you in a certain way. For example, you may ask that Agrace only conduct communications pertaining to your health information with you privately with no other family members present. If you wish to receive confidential communications, please contact Agrace Health Information Management at (608) 327-7447. Agrace will not request that you provide any reasons for your request and will attempt to honor your reasonable requests for confidential communications.
• Right to inspect and copy your health information
You have the right to inspect and copy your health information, including billing records. A request to inspect and copy records containing your health information may be made to Agrace Health Information Management at (608) 327-7447. If you request a copy of your health information, Agrace may charge a reasonable fee for copying and assembling costs associated with your request. You have the right to request that Agrace provide you, an entity or a designated individual with an electronic copy of your electronic health record containing your health information. Agrace may require you to pay the labor costs incurred by Agrace in responding to your request.
• Right to amend health care information
You or your representative has the right to request that Agrace amend your records, if you believe that your health information is incorrect or incomplete. That request may be made as long as the information is maintained by Agrace. A request for an amendment of records must be made in writing to Agrace Health Information Management at 5395 E. Cheryl Parkway, Madison, WI 53711. Agrace may deny the request if it is not in writing or does not include a reason for the amendment. The request also may be denied if your health information records were not created by Agrace, if the health information you wish to amend is not part of the health information you or your representative are permitted to inspect and copy or if, in the opinion of Agrace, the records containing your health information are accurate and complete.
• Right to an accounting
You or your representative have the right to request an accounting of disclosures of your health information made by Agrace for certain reasons, including reasons related to public purposes authorized by law and certain research. The request for an accounting must be made in writing to Agrace Health Information Management at 5395 E. Cheryl Parkway, Madison, WI 53711. The request should specify the time period for the accounting starting on or after April 14, 2003. Accounting requests may not be made for periods of time in excess of six (6) years. Agrace will provide the first accounting you request during any 12-month period without charge. Subsequent accounting requests may be subject to a reasonable cost-based fee.
• Right to a paper copy of this notice
You or your representative have a right to a separate paper copy of this Notice at any time even if you or your representative has received this Notice previously. To obtain a separate paper copy, please contact Agrace Health Information Management at (608) 327-7447. A copy of the current version of Agrace’s Notice of Privacy Practices is also available on the Agrace website: www.agrace.org.
V. CHANGES TO THIS NOTICE
Agrace reserves the right to change this Notice. Agrace reserves the right to make the revised Notice effective for health information we already have about you, as well as any health information we receive in the future. The revised Notice will contain an effective date, and is available to you upon request. We will also post a copy of the revised Notice in a clear and prominent location, as well as on our website.
VI. IF YOU HAVE ANY QUESTIONS REGARDING THIS NOTICE
Please contact the Agrace Privacy Officer with any questions regarding this Notice:
Agrace Privacy Officer
5395 E. Cheryl Parkway
Madison, WI 53711
You or your personal representative has the right to express complaints to Agrace and to the Secretary of the U.S. Department of Health and Human Services if you or your representative believe that your privacy rights have been violated. Any complaints to Agrace should be made in writing to the Agrace Privacy Officer: