Notice of Privacy Practices
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
Under the privacy regulations of the Health Insurance Portability and Accountability Act of 1996, as amended (HIPAA), Curry Health Network is required to maintain the privacy of protected health information (PHI). This Notice of Privacy Practices describes how we may use and disclose your PHI to carry out payment and health care operations, and for other purposes that are permitted or required by law. It also sets out our legal obligations concerning your PHI and describes your rights to access and control your PHI.
Protected health information (PHI) is individually identifiable health information, including demographic information, collected from you or created or received by a health care provider, a health plan, your employer, or a health care clearinghouse and that relates to:
(1) your past, present, or future physical or mental health or condition;
(2) the provision of health care to you; or
(3) the past, present, or future payment for the provision of health care to you.
If you have any questions or want additional information about this Notice or the policies and procedures described in the Notice, please contact the Privacy Officer by calling 541.247.3164 or emailing.
Who Will Follow This Notice?This notice applies to the following individuals and organizations:
All of Curry Health Network's entities, departments, and units (e.g., Curry General Hospital, Curry Medical Center, Curry Medical Practice, Curry Women's Clinic, Curry Family Medical, and Rush Surgery Center).
Members of our medical staff, employees, volunteers, trainees, students, and other health care personnel who provide services at Curry or affiliated patient care settings.
Our ResponsibilitiesThe Health Network is required by law to adopt reasonable safeguards to protect the privacy and security of your PHI. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information. We must follow the duties and privacy practices described in this notice and give you a copy of it. We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.
Primary Uses and Disclosures of Protected Health Information
The following is a description of how we are most likely to use or disclose your PHI.
Treatment, Payment, and Health Care OperationsThe Health Network has the right to use and disclose your PHI for all activities that are included within the definitions of "treatment," "payment," and "health care operations" as set out in 45 C.F.R. § 164.501 (this provision is a part of what is known as "the HIPAA Privacy Regulations"). This Notice does not list all of the activities included within the definitions of "treatment, payment and health care operations," but most uses or disclosures will be covered by one of these categories.
Treatment: The Health Network will use or disclose your PHI for treatment purposes. Treatment purposes include the provision, coordination or management of health care and related services among health care providers and third parties. This includes consultation between health care providers and the referral from one health care provider to another.
Payment: The Health Network will use or disclose your PHI so that treatment and services you receive may be billed and payment may be collected from you, an insurance company, health plan, or third-party payor. The Health Network will also disclose PHI to third-party payors to determine whether the cost of services will be covered. PHI will also be disclosed to emergency responders to allow them to obtain payment or reimbursement for services provided to you.
Health Care Operations: Health Care Operations: The Health Network will use or disclose your PHI to support its business functions. These functions include, but are not limited to: quality assessment and improvement, reviewing provider performance, licensing, business planning, and business development. For example, The Health Network may use your information (1) to provide you with information about one of the Health Network's programs, (2) to respond to a participant service inquiry from you, (3) to review the quality of medical services being provided to you, or (4) to conduct audits or medical review of claims activity.
Business AssociatesThe Health Network may contract with individuals and entities (known as "business associates") to perform various functions on the Health Network's behalf or to provide certain types of services. To perform these functions or to provide the services, business associates will receive, create, maintain, use or disclose PHI, but only after the Health Network requires the business associates to agree in writing to appropriately safeguard the privacy and security of your information as required by law.
Other Possible Uses and Disclosures of Protected Health Information
The following is a description of other possible ways in which the Health Network may use and disclose your PHI.
Health Oversight ActivitiesThe Health Network may disclose your PHI to a health oversight agency for activities authorized by law, such as audits; investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions; or other activities
Required by LawThe Health Network may use or disclose your PHI to the extent that federal, state or local law requires the use or disclosure. When used in this Notice, "required by law" is defined as it is in the HIPAA Privacy Regulations.
Public Health ActivitiesThe Health Network may use or disclose your PHI for public health activities that are permitted or required by law. For example, the Health Network may use or disclose information for the purpose of preventing or controlling disease, injury, or disability, or the Health Network may disclose such information to a public health authority authorized to receive reports of child abuse or neglect. The Health Network also may disclose PHI, if directed by a public health authority, to a foreign government agency that is collaborating with the public health authority.
Abuse or NeglectThe Health Network may disclose your PHI to a government authority that is authorized by law to receive reports of abuse, neglect, or domestic violence. Additionally, as required by law, The Health Network may disclose your information to a governmental entity authorized to receive such information if it is believed that you have been a victim of abuse, neglect, or domestic violence.
The Health Network may disclose your PHI:
(1) in the course of any judicial or administrative proceeding;
(2) in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized); or
(3) in response to a subpoena, a discovery request, or other lawful process, once the Health Network has met all administrative requirements of the HIPAA Privacy Regulations.
Under certain conditions, the Health Network may disclose your PHI to law enforcement officials. Some of the reasons for such a disclosure may include, but is not limited to:
(1) it is required by law or some other legal process;
(2) it is necessary to locate or identify a suspect, fugitive, material witness, or missing person; or
(3) it is necessary to provide evidence of a crime that occurred on our premises.
Coroners, Medical Examiners, Funeral Directors, and Organ DonationThe Health Network may disclose your PHI to a coroner or medical examiner for purposes of identifying a deceased person, determining a cause of death, or for the coroner or medical examiner to perform other duties authorized by law. The Health Network also may disclose, as authorized by law, information to funeral directors so that they may carry out their duties. The Health Network may disclose PHI to organizations that handle organ, eye, or tissue donation and transplantation.
ResearchThe Health Network may disclose your PHI to researchers when an institutional review board or privacy board has: (1) reviewed the research proposal and established protocols to ensure the privacy of the information and (2) approved the research.
To Prevent a Serious Threat to Health or Safety
Consistent with applicable federal and state laws, the Health Network may disclose your PHI if it is believed that the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. The Health Network may also disclose PHI if it is necessary for law enforcement authorities to identify or apprehend an individual.
Military Activity and National Security, Protective Services
Under certain conditions the Health Network may disclose your PHI if you are, or were, Armed Forces personnel for activities deemed necessary by appropriate military command authorities. If you are a member of foreign military service, the Health Network may disclose, in certain circumstances, your information to the foreign military authority. The Health Network also may disclose your PHI to authorized federal officials for conducting national security and intelligence activities, and for the protection of the President, other authorized persons, or heads of state.
InmatesIf you are an inmate of a correctional institution, the Health Network may disclose your PHI to the correctional institution or to a law enforcement official for: (1) the institution to provide health care to you; (2) your health and safety and the health and safety of others; or (3) the safety and security of the correctional institution.
Workers' CompensationThe Health Network may disclose your PHI to comply with workers' compensation laws and other similar programs that provide benefits for work-related injuries or illnesses.
Others Involved in Your Health CareUnless you object, the Health Network may disclose your PHI to a friend or family member that you have identified as being involved in your health care. The Health Network also may disclose your information to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status, and location. If you are not present or able to agree to these disclosures of your PHI, then the Health Network may, using its professional judgment, determine whether the disclosure is in your best interest.
Other uses and disclosures of your PHI that are not described above will be made only with your written authorization. If you provide the Health Network with such an authorization, you may revoke the authorization in writing, and this revocation will be effective for future uses and disclosures of PHI. The revocation will not, however, be effective for information that the Health Network has already used or disclosed in reliance on your authorization.
Specially Protected Health Information
Federal and state law may impose additional privacy and confidentiality restrictions on the use and disclosure of mental health, AIDS/HIV, drug addictions, alcoholism, and other substance abuse treatment, developmental disabilities, and/or genetic information and records.
The following is a description of your rights with respect to your PHI.
Right to Request a RestrictionYou have the right to request a restriction on the Health Network's use and disclosure of the PHI for payment or health care operations. Your request must be in writing. The Health Network is not required to agree to a restriction when it is using PHI for treatment purposes. However, the Health Network must agree if your request is for either payment or health care operational purposes and is for an item for which the Health Network has been paid in full.
Right to Inspect and CopyYou have the right to inspect and obtain an electronic or paper copy of your PHI that is contained in a "designated record set." Generally, a "designated record set" contains medical and billing records, as well as other records that are used to make decisions about your health care benefits. However, you may not inspect or obtain a copy of psychotherapy notes or certain other information that may be contained in a designated record set.
To inspect and obtain a copy of your PHI that is contained in a designated record set, you must submit your request in writing. If you request a copy of the information, the Health Network may charge a fee for the costs of copying, mailing, or other supplies associated with your request. The Health Network may deny your request to inspect and copy your PHI in certain limited circumstances.
Right to AmendIf you believe that your PHI is incorrect or incomplete, you may request the Health Network to amend your information.
To request an amendment, your request must be made in writing and submitted to the Privacy Officer. In addition, you must provide a reason that supports your request.
The Health Network may deny your request for amendment if it determines that the information that is the subject of the request:
Was not created by us, unless the requestor provides a reasonable basis to believe that the originator of the PHI is no longer available to make the amendment;
Is not part of the designated record set kept by or on behalf of the Health Network;
Is not part of the information which you would be permitted to inspect and copy; or
Is accurate and complete.
A denial, in whole or in part, of a request for amendment will be made in writing and explain the basis for the denial. Upon denial, you have the right to submit a written statement disagreeing with the denial.
Right to an AccountingYou have a right to an accounting of most disclosures of your PHI that are for reasons other than treatment, payment or health care operations. An accounting will include the date of the disclosure, to whom the disclosure was made, a brief description of the information disclosed, and the purpose for the disclosure. You must request an accounting by submitting your request in writing.
Right to an Electronic or Paper Copy of This NoticeIf you wish to exercise any of your rights with respect to your health information, please contact the following for more information: Privacy Officer (541) 247-3164. You have a right to an electronic or paper copy of this notice. You may download an electronic copy here.
Right to Notification of BreachYou have the right to be notified upon discovery of a breach of PHI. The Privacy Officer will make such notifications to you in writing without unreasonable delay in the event such a breach occurs.
Right to Choose Someone to Act for YouIf you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.
Other Permissible Uses and Disclosures You Have a Right to Object To:
Appointment Reminders:We may use and disclose PHI to contact you as a reminder that you have an appointment for treatment or medical care at Curry General Hospital or an affiliated clinic or entity.
Health-Related Benefits and Services:We may use and disclose PHI to tell you about health-related benefits or services that may be of interest to you.
Fundraising Activities:We may use information about you to contact you in an effort to raise money for the Curry Health Network and its operations. We may disclose PHI to the Curry Health Foundation so that they may contact you. These may include contact information, such as your name, address, phone number, and when you received treatment. If you do not want Curry to contact you for fundraising purposes, you must notify the Privacy Officer in writing.
You may complain to The Health Network if you believe that it has violated your privacy rights. You may file a complaint with the Health Network by writing to: Curry Health Network, Attn: Privacy Officer/Compliance, 94220 4th Street, Gold Beach, OR 97444.
You also may file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights be sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting their web site at www.hhs.gov/ocr/privacy/hipaa/complaints/.
The Health Network will not penalize or in any other way retaliate against you for filing a complaint, either with the Health Network or with the Secretary of the U.S. Department of Health and Human Services.
This Notice is effective on January 1, 2014.