HIPAA Privacy Notice
Virginia Mennonite Retirement Community
POLICIES AND PROCEDURES
Policy Number: CE-049
Policy Name: HIPAA - Notice of Privacy Practices
Department: Compliance and Ethics
Service Line: Corporate Origin Date: 4/14/2003 Revision Date: 12/29/2014
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. IF YOU HAVE ANY QUESTIONS ABOUT THIS NOTICE, PLEASE CONTACT VMRC’S COMPLIANCE AND PRIVACY OFFICER AT 540-564-3701.
WHO WILL FOLLOW THIS NOTICE
This notice describes Virginia Mennonite Retirement Community’s (VMRC) privacy practices. All these entities, sites, and locations follow the terms of this notice. In addition, these entities, sites, and locations may share personal health information (PHI) with each other for treatment, payment, or health care operations purposes described in this notice.
VMRC’S PLEDGE REGARDING HEALTH INFORMATION
VMRC understands that PHI and your health care are personal. VMRC is committed to protecting your PHI. VMRC creates a record of the care and services you receive from us. This record is needed so that you can be provided with quality care and to comply with certain legal requirements. This notice applies to all of the records of your respective care generated by this organization whether made by your personal doctor or others working in this facility. This notice will tell you about the ways in which we may use and disclose your PHI. VMRC describes your rights to your PHI and also describes certain obligations that VMRC has regarding the use and disclosure of your PHI.
VMRC IS REQUIRED BY LAW TO
- Make sure that health information that identifies you is kept private;
- Give you this notice of VMRC’s legal duties and privacy practices with respect to your PHI; and information about you;
- Notify you if there is a breach of unsecured PHI; and
- Follow the terms of the notice that is currently in effect.
HOW VMRC MAY USE AND DISCLOSE YOUR PHI
The following categories describe different ways that VMRC can use and disclose PHI. For each category of use or disclosure, VMRC will explain what is meant and endeavor to provide examples. Not every use or disclosure in a category will be listed; however, all the ways VMRC is permitted to use and disclose information will fall within one of the categories.
For Treatment: VMRC may use your PHI to provide you with health care treatment or services. VMRC may disclose PHI to doctors, nurses, technicians, health students, or other personnel who are involved in your care. These persons may work at VMRC, at the hospital (if you are hospitalized under our supervision), at a doctor's office, lab, pharmacy, or other health care provider whom VMRC may refer you to for consultation, taking x- rays, performing lab tests, having prescriptions filled, or for other treatment purposes. Example: A doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. In addition, the doctor may need to tell the dietitian at the hospital if you have diabetes so that appropriate meals can be arranged. VMRC may also disclose your PHI to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status, and location.
For Payment: VMRC may use and disclose PHI so that the treatment and services you receive from VMRC may be billed to and payment collected from you, an insurance company, or a third party. Example: VMRC may need to give PHI about your office visit so your health plan will pay us or reimburse you for the visit. VMRC may also tell your health plan about a treatment you are going to receive so as to obtain prior approval or to determine whether your plan will cover the treatment.
For Health Care Operations: VMRC may use and disclose PHI for operations of our health care practice. These uses and disclosures are necessary to run our practice and make sure that all of our residents receive quality care. Example: VMRC may use PHI to review our treatment and services and to evaluate the performance of our staff in caring for you. VMRC may also combine PHI about many residents to decide what additional services we should offer, what services are not needed, whether certain new treatments are effective, or to compare how we are doing with respect to others, and to see where we can make improvements. VMRC may remove information that identifies you from this set of health information so others may use it to study health care delivery without learning who our specific residents are.
Appointment Reminders: VMRC may use and disclose PHI to contact you as a reminder that you have an appointment. Please let us know if you do not wish to have us contact you concerning your appointment or if you wish to have us use a different telephone number or address to contact you for this purpose.
Fundraising Activities: VMRC may use PHI to contact you in an effort to raise money for our not-for-profit operations. We may disclose PHI to a foundation related to our practice so that this foundation may contact you with regards to raising money for our practice. VMRC will only release contact information such as your name, address, telephone number, and the dates you received treatment or services from us. Please contact VMRC if you do not want to be contacted such fundraising efforts.
As Required By Law: VMRC will disclose PHI when required to do so by federal, state, or local law.
To Avert a Serious Threat to Health or Safety: VMRC may use and/or disclose PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.
Military and Veterans: If you are a member of the armed forces or separated/discharged from military services, VMRC may release PHI as required by military command authorities or the Department of Veterans Affairs as may be applicable. We may also release PHI about foreign military personnel to the appropriate foreign military authorities.
Workers' Compensation: VMRC may release PHI for Workers' Compensation (WC) or similar programs. These programs provide benefits for work related injuries or illness.
Public Health Risks: VMRC may disclose phi for public health activities. These activities generally include the following:
- To prevent or control disease, injury, or disability.
- To report births and deaths.
- To report child abuse and/or neglect.
- To report reactions to medications or problems with products
- To notify persons of recalls of products they may be using.
- To notify persons or organizations required to receive information on FDA regulated products.
- To notify a person who may have been exposed to a disease or may be at risk for contracting and/or spreading a disease or condition.
- To notify the appropriate government authority if VMRC believes a patient has been the victim of abuse, neglect, and/or domestic violence. VMRC will only make this disclosure if you agree or when required or authorized by law.
Health Oversight Activities: VMRC may disclose PHI to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary so that the government can monitor the health care system, government programs, and insure compliance with civil rights laws.
Lawsuits and Disputes: If you are involved in a lawsuit or a dispute, VMRC may disclose PHI in response to a court or administrative order. VMRC may also disclose PHI in response to a subpoena, discovery request, and/or other lawful process by another entity/person involved in the dispute but only if efforts have been made to inform you of the request and/or to obtain an order protecting the information requested.
Law Enforcement: VMRC may release PHI if it is requested by a law enforcement official:
- In reporting certain injuries (as required by law) such as gunshot wounds, burns, and injuries to perpetrators of crime.
- In response to a court order, subpoena, warrant, summons, or similar process.
- To identify or locate a suspect, fugitive, material witness, or missing person
- Name and address
- Date of birth (DOB) or place of birth
- Social security number (SSN)
- Blood type and/or rh factor
- Type of injury
- Date and time of treatment and/or death (if applicable) and
- A description of distinguishing physical characteristics
- About the victim of a crime if the victim agrees to disclosure or under certain limited circumstances if VMRC is unable to obtain the person's agreement.
- About a death we believe may be the result of criminal conduct.
- About criminal conduct at the VMRC facility, and
- In emergency circumstances to report a crime, the location of the crime or victims, and/or the identity, description, or location of the person who committed the crime.
Coroners, Health Examiners, and Funeral Directors: VMRC may release PHI to a coroner or health examiner. This may be necessary so as to identify a deceased person and/or determine the cause of death. VMRC may also release PHI about residents to funeral directors as it may be necessary for them to carry out their duties.
National Security and Intelligence Activities: VMRC may release PHI to authorized federal officials for intelligence, counterintelligence, and/or other national security activities as authorized by law.
Protective Services for the President and Others: VMRC may disclose PHI to authorized federal officials so they may provide protection to the President, other authorized persons, or foreign heads of state, or to conduct special investigations.
YOUR RIGHTS REGARDING PHI
You have the following rights regarding PHI that VMRC maintains about you: Right to Inspect and Copy: You have the right to inspect and copy your PHI that may be used to make decisions about your care. Usually this includes health and billing records. To inspect and copy PHI that may be used to make decisions about your care, you must submit your request in writing to VMRC’s Compliance and Privacy Officer. If you request a copy of the information, a fee may be charged to cover the costs of copying, mailing, supplies, and other services associated with your request.
VMRC may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to your PHI, you may request that the denial be reviewed. Another licensed health care professional chosen by VMRC will review your request and the denial. The person conducting the review will not be the person who denied your original request. VMRC will subsequently comply with the outcome of the review.
Right to Amend: If you feel that your PHI is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as VMRC retains the information. To request an amendment, your request must be made in writing, submitted to VMRC’s Compliance and Privacy Officer and it must be contained on one page of paper legibly handwritten or typed in at least a 10 point font size. In addition, you must provide a reason that supports your
request for the amendment(s).
VMRC may deny your request for the amendment(s) if it is not in writing or does not include a reason to support the request. In addition, VMRC may deny your request if you ask us to amend information that:
- Was not created by us unless the person or entity that created the information is no longer available to make the amendment;
- Is not part of the PHI kept by or for VMRC;
- Is not part of the information which you would be permitted to inspect and copy; or
- Is accurate and complete.
Any amendment VMRC makes to your PHI will be disclosed to those with whom VMRC discloses information as previously specified in this document.
Right to an Accounting of Disclosures: You have the right to request a list accounting for any disclosures of your PHI that VMRC has made except for uses and disclosures for treatment, payment, and health care operations as previously described. To request this list of disclosures, you must submit your request in writing to VMRC’s Compliance and Privacy Officer. Your request must state a time period which may not be longer than six years and may not include dates before April 14, 2003. The first list you request within a 12 month period will be free of charge. For additional lists, VMRC may charge for the costs of providing the list. VMRC will notify you of the cost involved and you may choose to withdraw or modify your request at that time prior to any costs being incurred. VMRC will mail you a list of disclosures in paper form within 30 days of your request or will notify you if we are unable to supply the list within that time period and by what date the list will be supplied; however, this date will not exceed a total of 60 days from the date wherein you made the request.
Right to Request Restrictions: You have the right to request a restriction or limitation on the PHI that VMRC uses or discloses about you for treatment, payment, or health care operations. You have the right to request a limit on the PHI VMRC discloses about you to someone who is involved in your care or the payment for your care such as a family member or friend. Example: You could ask that we restrict a specified nurse from use of your PHI or that we not disclose your PHI to your spouse about a surgery you have had.
VMRC is not required to agree to your request for restrictions unless the restriction is for disclosures to a health plan where the resident pays out of pocket in full for the health care item or service. Also, VMRC is not required to agree to your request for restrictions if it is not feasible for us to insure our compliance or believe that by agreeing it will negatively impact the care we may provide you. If VMRC does agree, we will comply with your request unless the information is needed to provide you emergency treatment. To request a restriction, you must make your request in writing to VMRC’s Compliance and Privacy Officer. In your request, you must inform us as to what information you want to limit and to whom you want the limits to apply. Example: Use of any information by a specified nurse or disclosure of specified surgery to your spouse.
Right to Request Confidential Communications: You have the right to request that VMRC communicate with you about health matters in a certain manner or at a certain location. Example: You can ask that we only contact you at work or by mail to a post office box. To request confidential communications, you must make your request in writing to VMRC’s Compliance and Privacy Officer. VMRC will not inquire about the reason for your request. VMRC will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.
Right to a Paper Copy of This Notice: You have the right to a paper copy of this notice at any time; however, at the time of first service rendered after April 14, 2003, it is required that you receive a paper copy. To obtain a copy, please request it from VMRC’s Compliance and Privacy Officer. You may also obtain a copy of this notice from our website (www.vmrc.org). If you have received a notice electronically, you still retain the right to receive a paper copy upon request.
CHANGES TO THIS NOTICE
This notice of Privacy Practice is in compliance with current regulations. VMRC reserves the right to automatically update this notice should a change in regulations be applicable to the notice. VMRC also reserves the right to make the revised or changed notice effective for PHI that we already have about you as well as any information received in the future. VMRC will post a copy of the revised notice in the Supportive Living (SL) facilities and on the VMRC website. This notice will contain on the first page, in the top right corner, the effective date. In addition, each time you register for treatment or health care services, VMRC will offer you a copy of the current notice in effect.
If you believe your privacy rights have been violated, you may file a complaint with VMRC or with the Secretary of the Department of Health and Human Services (DHHS). To file a complaint with VMRC, you must use the standard complaint form, titled “Complaint Regarding Uses or Disclosures of Health Information.” These forms are available from any VMRC receptionist. The completed form must be submitted to VMRC’s Compliance Officer (the Vice President of Supportive Living) in an envelope provided by the receptionist. There will be no retaliatory measures taken against anyone for filing a complaint.
OTHER USES OF PHI
Other uses and disclosures of PHI not covered by this policy or the laws that apply to VMRC will be made only with your written permission. This includes most uses and disclosures of psychotherapy notes, information for marketing purposes, and the sale of health information. If you provide VMRC permission to use or disclose PHI, you may revoke that permission, in writing, at any time. If you revoke your permission, VMRC will no longer use or disclose PHI for the reasons covered by your written authorization. You understand that VMRC is unable to take recall any disclosures already made with your permission and that VMRC is required to retain our records of the care that VMRC provided to you.
ACKNOWLEDGEMENT OF RECEIPT OF THIS NOTICE
VMRC will request that you sign a separate form or notice acknowledging you have received a copy of this policy. If you choose to or are unable to sign, a staff member will sign their name and date.
VIRGINIA MENNONITE RETIREMENT COMMUNITY
ACKNOWLEDGEMENT OF RECEIPT OF NOTICE OF PRIVACY PRACTICES
I, _________, have received the Notice of Privacy Practices from Virginia Mennonite Retirement Community (VMRC).
X _________(Resident or Responsible Party) _________(Date)
In lieu of the resident’s signature, I,__________, an employee of Virginia Mennonite Retirement Community, state that________, the resident involved, has been given VMRC’s current Notice of Privacy Practices.
This acknowledgement will subsequently be filed with your records.