This notice describes how medical information about you may be used and shared and how you can get access to this information. Please review it carefully.
Our Pledge Regarding Health Information
We are committed to protecting your health information. We are required by law to 1) make sure that health information that identifies you is kept private; 2) provide you this notice of our legal duties and privacy practices with respect to your health information; and 3) to follow the terms of this notice. We reserve the right to change this notice. Any revision will affect how your current health information is treated as well as any information we receive in the future.
Who We Are
This Notice describes the privacy practices of the Crotched Mountain Rehabilitation Center, Inc. (“Crotched Mountain”). Crotched Mountain is a single affiliated covered entity for purposes of the Health Insurance Portability and Accountability Act (“HIPAA”). Our healthcare team covered by this notice includes healthcare providers and the staff at Crotched Mountain and other providers who are involved in your care, which would include your primary care provider, specialty care providers, consulting providers and on-call providers. Also covered by this notice are all other non-clinical employees including managerial, administrative, and support staff employed by Crotched Mountain.
Our Privacy Obligations
The law requires us to maintain the privacy of certain health information called “Protected Health Information” (“PHI”). PHI is the information that you provide us or that we create or receive about your health care (e.g., your name, address, dates of service, date of birth, social security number, phone number, etc.), symptoms, test results, diagnoses, treatment and care plan. Information about care you have received from other providers may also be included in your CMRC health record. The law also requires us to provide you with this Notice of our legal duties and privacy practices. When we use or disclose (share) your Protected Health Information, we are required to follow the terms of this Notice or other notice in effect at the time we use or share the PHI. Finally, the law provides you with certain rights described in this Notice.
I. Ways We Can Use and Share Your PHI Without Written Permission
In many situations, we can use and share your Protected Health Information for activities that are common in hospitals and clinics. Crotched Mountain uses your health information within our system of services and shares your health information outside its operations in order to give you excellent medical care. In certain other situations, which we will describe in Section II below, we must have your written permission (authorization) to use and/or share your PHI. We do not need any type of permission from you for the following uses and disclosures:
A. Treatment, Payment and Healthcare Operations
We use and share your Protected Health Information to provide and manage your health care and other related services to you—for example, to diagnose and treat your injury or illness. In addition, we may contact you to provide appointment reminders or information about treatment options. We may tell you about other health related benefits and services we provide that might interest you. We may also share your PHI with other doctors, nurses, and others involved in your care and other third parties such as home health care, visiting nurses, other rehabilitation hospitals, other hospitals involved in your care, nursing facilities, ambulance companies and area agencies for the developmentally disabled for healthcare related services. It will also share information with those who treated you before you arrive at Crotched Mountain and those who will treat you in the future. This helps to make sure that everyone caring for you has the information they need.
We may use and share your Protected Health Information to receive payment for services that we provide to you. For example, we may share your PHI to obtain prior approval, request payment, and collect payment from you, an insurance company, a third party or other program that arranges or pays the cost of some or all of your health care (“your payor”) and to confirm that your payor will pay for the health care. Your payor uses this information to tell if you are eligible for benefits.
Health Care Operations
We may use and share your Protected Health Information for our health care operations, which include management, planning, and activities that help to improve the quality and efficiency of the care that we deliver. For example, we may use PHI to review the quality and skill of our physicians, nurses, and other health care providers or for their training. In addition, we may share PHI with certain others who help us with our activities, including those we hire to perform services. Some of the information is shared with outside parties who perform these health care operations or other services on behalf of Crotched Mountain (“business associates”). These business associates must also take steps to keep your health information private.
Crotched Mountain may use your health information to contact you at the address and telephone numbers you give to us (including leaving messages at the telephone numbers) about appointments, insurance, benefits, billing or payment matters, pre-procedure assessment or test results, with information about patient care issues, treatment choices and follow up care instructions, at the email address or other contact information you provide to assist us in activities described in this Notice, such as conducting patient satisfaction surveys.
B. Your Healthcare Providers Outside of Crotched Mountain
We may also share some portion of your Protected Health Information with your doctor and other health care providers when they need it to provide treatment to you, to obtain payment for the care they give to you, or to perform certain parts of their health care operations, such as reviewing the quality and skill of their health care professionals.
C. Use or Disclosure for Directory of Patients
We may include your name, location in Crotched Mountain, general health condition and religious affiliation in a patient directory without receiving your permission unless you tell us you do not want your information in the directory. Information in the directory may be shared with anyone who asks for you by name or with members of the clergy; however, religious affiliation will only be shared with members of the clergy.
D. Disclosure to Relatives, Close Friends and Your Other Caregivers
We may share your Protected Health Information with your family member/relative, a close personal friend if they are involved in your care or payment for your care or another person who you identify if we (1) first provide you with the chance to object to the disclosure and you do not object; (2) infer that you do not object to the disclosure; or (3) obtain your agreement to share your PHI with these individuals. If you are not present at the time we share your PHI, or you are not able to agree or disagree to our sharing your PHI because you are not capable or there is an emergency circumstance, we may use our professional judgment to decide that sharing the PHI is in your best interest. We may also use or share your PHI to notify (or assist in notifying) these individuals about your location and general condition.
E. Public Health and Safety Activities
We are required or are permitted by law to report Protected Health Information to certain government agencies and others. For example, we may share your Protected Health Information for the following:
To report health information to public health authorities for the purpose of preventing or controlling disease, injury, or disability;
To report abuse and neglect to the appropriate State agencies;
To report information to the U.S. Food and Drug Administration (FDA) about products and activities it regulates;
For law enforcement purposes under specific conditions such as reporting when someone is the victim of a crime; we may share your Protected Health Information with the police or other law enforcement officials as required or permitted by law or in compliance with a court order.
To prevent or lessen a serious and imminent health or safety threat to you, another person, or the public;
For health oversight activities: to the extent authorized by law, we may share your Protected Health Information with a health oversight agency that oversees the health care system and ensures the rules of government health programs, such as Medicare or Medicaid, are being followed.
For legal and administrative proceedings: we may share your Protected Health Information in the course of a legal or administrative proceeding as required by law or in response to a court order.
To report information to your employer as required under laws addressing work-related illnesses and injuries or workplace medical surveillance; and
To authorized federal officials for national security activities or specialized government functions.
We may use and share your Protected Health Information to the extent we are required to do so by any other law not already referred to above.
F. Fundraising Communications
We may contact you with information about the importance of contributions to Crotched Mountain and invite you to participate. We may share with our fundraising staff limited information about you (e.g., your name, address, and phone number) including the dates on which we provided health care to you, without your written authorization. You may opt out of receiving any fundraising requests at any time by calling us at 603.547.3311 or emailing us at firstname.lastname@example.org.
G. Other Uses
We may share Protected Health Information with a coroner, medical examiner, or funeral director as authorized by law.
Organ and Tissue Procurement
We may share your Protected Health Information with organizations that facilitate organ, eye, or tissue procurement, banking, or transplantation, if you have indicated a desire to be an organ or tissue donor.
We may share your Protected Health Information as permitted by or required by state law relating to workers’ compensation or other similar programs.
II. Written Permission For Other Uses and Disclosures of Your PHI and Administrative Proceedings
A. Use or Disclosure with Your Permission (Authorization)
For purposes other than the types described above, we may only use or share your Protected Health Information when you grant us your written permission (authorization). For example, you will need to give us your permission before we send your PHI to your life insurance company.
We must also obtain your written permission (authorization) prior to using your Protected Health Information to send you any marketing materials. However, we may communicate with you about the following topics, which are not considered marketing: products or services we offer that may be related to your treatment, case management, or care coordination, or alternative treatments, therapies, health care providers, or care settings; or patient satisfaction surveys.
C. Sale of EHR or PHI
We must obtain your written permission for any disclosure that may constitute a sale of PHI or your Electronic Health Record. An example being sale of PHI for research purposes where Crotched Mountain receives remuneration. An authorization is not needed if the purpose of the exchange is for treatment of the individual; public health activities; research purposes where the price charged reflects the cost of preparation and transmittal of the information; health care operations related to the sale, merger or consolidation of the covered entity; providing the individual with a copy of the PHI maintained about him or her.
D. Uses and Disclosures of Your Highly Confidential Information
Federal or state laws require special privacy protections for certain highly confidential information about you, including any portion of your Protected Health Information that is:(1) kept in psychotherapy notes; (2) about treatment of mental health and developmental disabilities; (3) about alcohol and drug abuse prevention and treatment; (4) about HIV/AIDS testing and treatment; (5) about venereal disease(s); (6) about genetic testing; (7) about child abuse and neglect; (8) about domestic abuse of an adult with a disability; or (9) about sexual assault. Before we share your “highly confidential information” for a purpose other than those permitted by law, we must obtain your written permission to explicitly disclose such PHI.
III. Your Rights Regarding Your Protected Health Information
A. For Further Information or Disclosure
If you want more information about your privacy rights, are concerned that we have violated your privacy rights, or disagree with a decision that we made about access to your Protected Health Information, you may contact the Privacy Officer of Crotched Mountain Rehabilitation Center, Inc. who is currently Michael Terrian, Senior Vice President of Administration. You may also file a written complaint with the Office for Civil Rights (“OCR”) of the U.S. Department of Health and Human Services. When you ask, the Privacy Officer will provide you with the correct address for the OCR. We will not take any action against you if you file a complaint with us or with the OCR.
B. Right to Receive Confidential Communications
You may ask us to send papers that contain your Protected Health Information to a different location than the address that you gave us, or in a special way. If so, you will need to ask us in writing. We will try to grant your request if we feel it is reasonable. For example, you may ask us to send a copy of your medical record to a different address than your home address or to a family member.
C. Right to Revoke Your Written Permission
You may change your mind about your authorization or any written permission regarding your PHI, including “highly confidential information” by giving or sending a written “revocation statement” to the Privacy Office at the address below. The revocation will not apply to the extent that we have already taken action where we relied on your permission.
D. Right to Inspect and Receive Copies
You may request access to your medical record file, billing records, and other records used to make decisions about your treatment and payment for your treatment. You can review these records and/or ask for copies. Under limited circumstances, we may deny you access to a portion of your records. If you are denied access to health information, you may request that the denial be reviewed. If you want to access your records, you may obtain a record request form from the Privacy Officer. Return the fully completed form to the Privacy Officer. If you request copies, we will charge you the amount listed on our current rate sheet. We will also charge you for our postage costs, if you request that we mail the copies to you. For a copy of records, material, or information that cannot routinely be copied on a standard photocopy machine, such as x-ray films or pictures, we may charge for the reasonable cost of the copy.
If your Protected Health Information is maintained in an electronic format (known as an electronic medical record or an electronic health record), you have the right to request that an electronic copy of your record be given to you or transmitted to another individual or entity. We will make every effort to provide access to your Protected Health Information in the form or format that you request, if it is readily producible in such form or format. If the protected health information is not readily producible in the form or format you request, then your record will be provided in either our standard electronic format or if you do not want this form or format, a readable hard copy form. We may charge you a reasonable, cost-based fee for the labor associated with transmitting the electronic medical record.
E. Right to Amend Your Records
You have the right to request that we amend your Protected Health Information maintained in medical record files, billing records, and other records used to make decisions about your treatment and payment for your Treatment. If you want to amend your records, you may obtain an amendment request form from the Privacy Officer After which, you can return the completed form to the Privacy Officer. We will comply with your request unless we believe that the information that would be amended is correct and complete or that other circumstances apply.
F. Right to Receive an Accounting of Disclosures
You have the right to request an “accounting of disclosures” of your Protected Health Information made for reasons other than treatment, payment, or health care operations, or with your authorization. You must make this request in writing to the Privacy Officer. The request cannot cover dates for more than a six year period prior to the date on the request. We may charge you for the costs of providing the information.
G. Breach Notification
You have the right to be notified of any breach of your protected health information by Crotched Mountain or one of our business associates. Crotched Mountain will adhere to all federal and state requirements for breach notification.
H. Right to Request Restrictions
You have the right to ask us to restrict or limit the Protected Health Information we use or disclose about you for treatment, payment, or health care operations. You must make this request in writing to the Privacy Officer. However, we are not required to agree to your request and we will not agree to any request unless we feel that we can fully live up to our promise to do so.
I. Out-of-Pocket Payments
If you paid out-of-pocket in full for a specific item or service (or in other words, you have requested that we not bill your payor, if applicable), you have the right to ask that your Protected Health Information with respect to that item or service not be disclosed to your payor for purposes of payment or health care operations, and Crotched Mountain will honor that request.
J. Right to Change Terms of this Notice
We may change the terms of this Notice at any time. If we change this Notice, we may make the new notice terms effective for all Protected Health Information that we maintain, including any information created or received prior to issuing the new notice. If we change this Notice, we will post the new notice in common areas throughout our facilities and or on our website www.crotchedmountain.org. You also may obtain any new notice by contacting Crotched Mountain Rehabilitation Center, Inc. at the address listed below:
Crotched Mountain Rehabilitation Center, Inc.
Attention: Privacy Officer
1 Verney Drive
Greenfield, NH 03047
K. Right to Complain
If you feel we have not adhered to the rights described herein, you may complain by contacting the Privacy Officer as listed directly above in paragraph J. You can also file a Complaint with the U.S. Department of Health and Human Service, Office for Civil Rights by sending a letter ro 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a Complaint.