Longmont United Hospital's Notice of Privacy Practices
Longmont United Hospital is committed to respecting the privacy of our patients and maintaining the confidentiality of their protected health information. When you consent to treatment at Longmont United Hospital, you consent to the use of your information as outlined in our Notice of Privacy Practices. If we decide to change our Notice, such changes will be posted here on our web site. You may visit our web site and browse without giving us any personal information.
Notice of Privacy Practices (Effective September 15, 2013). This notice describes how medical information about you may be used and disclosed and how you can get access to this information. If this notice was sent to you by e-mail, you may request a paper copy of this notice.
Please review it carefully.
If you have any questions regarding this Notice of Privacy, please contact the Hospital’s main number, 303.651.5111 and ask for the Privacy Officer.
Our Commitment to Our Patients
We are committed to keeping your medical information confidential and private. To provide quality care and to comply with legal requirements, we create a record of the care and services you receive at our facilities. This notice applies to all of the records of your care that we maintain, whether created by our staff or your personal Physician. Your personal Physician may have different policies or notices regarding the physician’s use and disclosure of your medical information created in the physician’s office. This notice explains how LUH, its affiliate entities, departments and Milestone Medical Group may use and disclose medical information about you. This notice also describes your rights and duties regarding how we use and disclose your medical information. We are required by law to:
- Keep medical information about you private;
- Give you this notice of our legal duties and privacy practices regarding medical information about you; and
- Follow the terms of our most current notice.
Who Will Follow These Privacy Practices
We at Longmont United Hospital (LUH) provide healthcare to our patients in partnership with physicians, other professionals and organizations. The information of privacy practices in this notice will be followed by:
- Any healthcare professional who treats you at any of our locations.
- All departments and units of our organization including our Health Center of Integrated Therapies, Hope Cancer Care Center and Homestead Adult Day Care.
- Milestone Medical Group, their physicians, allied health providers and staff.
- Members of our Organized Health Care Arrangement (“OHCA”) which include all Members of our organized Medical Staff and Allied Health Practitioners such as Nurse Midwives, Nurse Practitioners and Physician Assistants. The OHCA does not cover the information practices in the private offices or other practice locations of physicians or allied health practitioners who are not employed by Milestone Medical Group.
- Employees, staff or volunteers of our organization, including staff at our joint venture organizations with which we share protected health information.
- Any business associate or partner with whom we share protected health information.
How We May Use and Disclose Medical Information About You
The following categories describe ways in which we may use your personal health information (“PHI”) within our organization and release your information to others outside our organization. We have not listed every use or release of information within each category, however, all permitted uses will comply with one of the following categories:
- Treatment, Payment and Health Operations. We may use and disclose medical information about you for treatment (such as sending medical information about you to a specialist as part of a referral); to obtain payment for treatment (such as sending billing information to your insurance company Medicare or Medicaid); and to support our health care operations (such as comparing patient data for quality improvement.)
- Business Associates. Our Business Associates are required by agreement or contract and by law to comply with the provisions of HIPAA and HITECH and give you the same rights as we do.
- Fundraising. We may use your name, address, age, gender and dates of service to contact you in the future to raise money for our Hospital or our other facilities. We may also provide this information to our Hospital Foundation for the same purpose. Our Hospital Foundation is required by law to comply with HIPAA regulations and state confidentiality laws. If you do not wish to be contacted for these efforts, please contact Longmont United Hospital Foundation at 303.651.2273 or send written notification to Longmont United Hospital Foundation, 1380 Tulip St., Suite A, Longmont, CO 80501 or the Privacy Officer at 303.651.5111.
- Appointment Reminders or Other Contact. We also may contact you for appointment reminders, or to tell you about or recommend possible treatment options, alternatives, health-related benefits or services that may be of interest to you.
- Research That Does Not Involve Your Treatment. Research projects are subject to certain safeguards and a special approval process to ensure the privacy of your medical information. In some instances, the law allows us to use your medical information for research without your approval.
- Deceased Individuals. We may disclose PHI to a family member, relative, or others who were involved in the healthcare or payment for healthcare of a deceased individual if not inconsistent with the prior expressed preferences of the individual that are known to us.
- Required or Permitted by Law. Under certain requirements, we may disclose medical information about you without prior authorization for public health purposes, abuse or neglect reporting, health oversight audits or inspections, research studies, funeral arrangements and organ donation, workers’ compensation purposes, and emergencies.
We may disclose your medical information when required by law, such as in response to a request from law enforcement in specific circumstances, or in response to valid judicial or administrative orders. We may release your medical information if you are a member of the military or a veteran, for national security and intelligence activities, or for protective services for the President and others.
- Shared Medical Record/Health Information Exchanges. We maintain PHI about our patients in shared electronic medical records that allow our facilities and physicians to share PHI. We may also participate in various electronic health information exchanges that facilitate access to PHI by other health care providers for your care. For example, if you are admitted on an emergency basis to another hospital or facility that participates in the health information exchange, the exchange will allow us to make your PHI available electronically to those who need it to treat you.
Your Consent is Required to Share PHI with Family
- Family or Individuals Involved in Your Care or Payment for your Care. If you agree or do not object, we may disclose your PHI to your family, relatives or another person identified by you who is involved in your healthcare or the payment for your healthcare. You have the right to request a restriction on disclosure of your PHI to your family or others involved in your care. If you are not present or you are incapacitated or it is an emergency or disaster relief situation, we may disclose limited PHI about you.
- Hospital or Facility Directory. If admitted or otherwise receiving treatment or services in our facility, unless you tell us otherwise, we may list information about you in our hospital directory such as your name, location in the facility, your general condition (good, fair, etc.) and your religious affiliation, and will release all but your religious affiliation to anyone who asks about you by name. Your religious affiliation may be disclosed only to a clergy member, and even if they do not ask for you by name.
The law permits us to disclose the following information:
1) Patient’s name;
2) Room number or general location within the hospital;
3) General condition (“good, fair, serious, critical, deceased”) and
4) Religious affiliation (available to clergy persons)
You have the right to refuse to have your information listed in the directory or to be disclosed for the purposes listed above.
Your Written Authorization is Required for Additional Disclosures
In any other situation not covered by this notice, we will ask for your written authorization before using or disclosing medical information about you. If you chose to authorize use or disclosure, you can later revoke that authorization by notifying us in writing of your decision. Some situations that require your written authorization are:
- Mental Health or Psychotherapy Treatment. We will disclose your mental health information in accordance with HIPAA and State law. In most cases, your written authorization or the written authorization of your representative is required.
- Substance Abuse Treatment. We will disclose your substance abuse treatment information in accordance with HIPAA and 42 CFR Part 2, Federal Substance Abuse Confidentiality Regulations. In most cases, your written authorization or the written authorization of your representative is required.
- Research Involving Your Treatment. When a research study involves your treatment, we may share your health information with researchers after you have signed a consent and authorization form, or in rare circumstances, when an Institutional Review Board (“IRB”) issues a waiver. Waivers are granted when the IRB determines appropriate safeguards are in place to protect the privacy of your personal health information. Research studies require an IRB to review and approve research protocols for protection of the individuals who participate.
You do not have to sign the research consent and authorization form to get treatment from the Hospital; however, if you want to participate in a research study you must sign the research consent and authorization form.
- Marketing. We may ask you to sign an authorization to use or disclose your protected health information for our marketing purposes. The authorization will state whether we receive any direct or indirect compensation for the marketing. Your authorization is needed except for when the marketing occurs in face-to-face communications made by us to you or for promotional gifts of nominal value. Marketing is defined as a communication about a product or service, except for communications made:
- To describe a health-related product or service that is provided by the covered facility or individual making the communication;
- For treatment of the individual; or
- For case management or care coordination of the individual, or to direct or recommend alternative treatments, therapies, providers, or settings of care to the individual.
The communications described in the exceptions listed above are within the parameters of “healthcare operations” as defined by HIPAA, and are permissible without authorization.
- Sale of Medical Information. We are prohibited from selling your medical information without your authorization or an applicable exception such as exhanges for public health activities; exchanges for research and payment that reflect the costs of preparing and transmitting data for research purposes; exchanges for treatment, subject to rules Health and Human Services (“HHS”) may promote to prevent medical information from inappropriate access, use or disclosure; exchanges for health care operations; payment covering the cost of exchanges between LUH or Milestone Medical Group and its business associates for activities that support our business and according to the contract with the business associate; payment for the cost of providing the individual with a copy of his or her medical information; exchanges approved by HHS when it determines that the exchanges are necessary and appropriate.
Your Rights Regarding Medical Information About You
The information in your health record belongs to you. You have a right to:
- Request a restriction on certain uses and disclosures. You may request in writing that we not use or disclose medical information about you for treatment, payment or healthcare operations or to persons involved in your care except when specifically authorized by you, when required by law, or in an emergency. We will consider your request, but we are not legally required to accept it unless it is a restriction on health information to your health plan. You have the right to request your medical information regarding a particular item or specific service not be disclosed to a health plan or other third party payer for purposes of payment or healthcare operations (unless required by law), if the information pertains solely to the item or service of your restriction request and you have paid in full out of pocket for the item or service. We will inform you of our decision on your request.
A request for restriction should be made in writing and must tell us (1) what information you want to limit; (2) whether you want to limit our use or disclosure; and (3) to whom you want the limits to apply. To request a restriction contact Health Information Management (Medical Records) at 303.651.5069 or Milestone Medical Group if the restriction pertains to services received at a Milestone Medical Group office location.
- Request communication in a confidential manner or location. You have the right to request that medical information about you be communicated to you in a confidential manner, such as sending mail to an address other than your home. Your request must specify how or where you wish to be contacted. We will honor all reasonable requests.
- Inspect or obtain a copy of your medical information. In most cases, you have the right to review and obtain a paper or electronic copy of medical information that we use to make decisions about your care by submitting a written request. If you request copies, we may charge a fee for the cost of copying, mailing or other related supplies. If we deny your request to review or obtain a copy, you may submit a written request for a review of that decision.
- Request an amendment to your health information. If you believe that information in your record is incorrect or if important information is missing, you have the right to request that we amend the records. You must submit your request in writing and state your reason for requesting the amendment. We may deny your request to amend a record if the information was not created by us; if it is not part of the medical information maintained by us; if it is not part of the information that you would be permitted to review or copy; or if we determine that the record is accurate. Please note that if we accept your request to amend your record, in most cases we will not delete any information from your health record. You may appeal, in writing, a decision by us not to amend a record. Request to copy, add or correct information must be sent to the Medical Records Department at LUH. To appeal our decision on your request must be sent in writing to the Privacy Officer at the address listed at the end of this notice.
- An accounting of disclosures. You have the right to an accounting or list of when and to whom we have disclosed medical information about you, other than for treatment, payment, health care operations, or where you specifically authorized a disclosure by submitting a written request. The request must state the time period desired for the accounting, which must be no more than six-year period prior to the date of the request. You may receive the list in paper or electronic form. The first disclosure list request in a 12-month period is free; other requests will be charged according to our cost of producing the list. We will inform you of the cost before we process your request.
- Revoke your authorization to use or share health information. This will not apply to any prior actions taken with your authorization.
- Notification of a Breach. You have the right to be notified in the event that we or one of our Business Associates discovers a breach of unsecured protected health information involving your medical information.
- To file a complaint
- If you are concerned that your privacy rights may have been violated, or you disagree with a decision we made about access to your records, you may contact the Patient Relations Representative or Privacy Officer at 303.651.5111.
- You may send a written complaint to the U.S. Department of Health and Human Services Office of Civil Rights.
- We will not penalize or retaliate against you for filing a complaint.
Changes to this Notice
We may change our privacy policies at any time. Changes will apply to medical information we have on file and any new information we receive after the change occurs. Before we make a significant change in our policies, we will change our notice and post the new notice in our facility and on our Web site at www.luhcares.org. You can get a copy of the current notice at any time. The effective date is listed just below the title. You will be offered a copy of the current notice each time you register for treatment at one of our facilities. You will also be asked to acknowledge in writing your receipt of this notice.
Contact: Privacy Officer
Longmont United Hospital
1950 Mountain View Avenue
Longmont, Colorado 80501