Allen Hospital - HIPAA / Privacy Policy

FAQs |

Notice of Privacy Practices for Allen Health System, our clinics and other facilities, and our organized healthcare arrangement.

Introduction

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

We are required by federal law to maintain the privacy of your health information and to give you our Notice of Privacy Practices (this “Notice”) that describes our privacy practices, our legal duties and your rights concerning your medical information.

Who Will Follow This Notice

This Notice describes the privacy practices of the organizations listed in Appendix A (“Affiliates”), including hospitals, clinics and other health care providers that the organizations operate, as well as any health care facility or physician practice now or in the future controlled by or under common control by IHS. The organizations are part of the UnityPoint Health (collectively “IHS”).

This Notice also serves as the Joint Notice of Privacy Practices of the physicians, nurse practitioners and other health care professionals on our medical staffs (collectively, “Practitioners”) and other health care providers that provide health care services in our hospitals, clinics and other sites. Accordingly, this Notice will be followed by (1) our workforce members and (2) the independent physicians and other Practitioners that are not employees, agents, servants, partners or joint venturers of IHS. All Practitioners are solely responsible for their judgment and conduct in treating or providing professional services to patients and for their compliance with state and federal laws. Nothing in this Notice is meant to imply or create an employment relationship between any independent physician or other Practitioner and us. We use a joint Notice of Privacy Practices and a joint Acknowledgement Form with independent physicians and other Practitioners to reduce paperwork and make it easier to share information to improve your care. This Notice does not change or limit any consents for treatment or procedures the patient may sign during the time the patient receives care from any of us.

HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION

Except where such use or disclosure is otherwise prohibited by state or federal law, the Affiliate is permitted or required to use or disclose your health information without your authorization (permission) in the following situations. Some, but not all, specific examples of the different types of disclosures have been listed.

Please note that state law is more protective of certain health information than
HIPAA. Some states have separate privacy laws that may apply additional legal requirements, particularly for categories of health information such as mental health, substance abuse treatment and HIV status. If the state privacy laws are more stringent than federal privacy laws, we will follow state privacy laws.

Treatment. We will use and disclose your health information for treatment. For example, we will share health information about you with nurses, physicians, students and others who are involved in your care at an Affiliate. Our Affiliates enter and can view your health information in our electronic medical record system. We will also disclose your health information to your physicians, health care facilities and other health care providers that provide care to you at their sites rather than our sites for their use in treating you in the future. For example, if you are transferred from one of our hospitals to a nursing facility, we will send health information about you to the nursing facility.

Payment. To collect payment from you, an insurance company or a third party for the treatment and services you receive (e.g., submitting a claim to your insurance company).

Health Care Operations . For our health care operations (e.g., to evaluate our staff and internal processes).

Fundraising. Certain limited information may be used or disclosed to conduct fundraising activities on behalf of any Affiliate. You have the right to request that you not receive fundraising materials from the Affiliates.

Appointments and Health Care Services. To provide you with appointment reminders or to notify you of possible treatment alternatives or health-related benefits or services.

Facility Directory . While you are an inpatient at any IHS hospital, your name, location in our facility, general condition (e.g., fair, serious, etc.), and religious affiliation may be included in the IHS hospital’s facility directory and released (except religious affiliation) to people who ask for you by name. This information and your religious affiliation may be given to a member of the clergy, even if they do not ask for you by name. You have the right to request that your name not be included in the directory.

Friends and Family. To a friend or family member involved in your medical care or payment for your care. If you are available, such disclosures will be made only if we have obtained your permission, if you do not object to the disclosure after having the opportunity, or if it is reasonable for us, based on the circumstances, to assume you have no objection to such disclosure. If you are unavailable, incapacitated or in an emergency situation, the Affiliate may disclose limited information to these persons if the Affiliate determines disclosure is in your best interest.

Health Care Providers. To another health care provider involved in your treatment in order for that provider to treat you, bill for its services and conduct certain of its health care operations.

Disaster Relief. To a public or private entity assisting in a disaster relief effort (e.g., to notify your family about your location, condition or death).

Public Health Activities. To public health authorities for public health activities as permitted or required by law (e.g., to report births, deaths, child abuse and neglect, immunizations and communicable diseases).

Abuse, Neglect and Domestic Violence. The Affiliate may notify the appropriate government authority if it believes an individual has been the victim of abuse, neglect or domestic violence. Unless such disclosure is required by law, the Affiliate will make this disclosure only if you agree or under other limited circumstances when such disclosure is authorized by law.

Health Safety Risks. Under certain circumstances, when necessary to prevent a serious and imminent threat to your health and safety or to the health and safety of the public or another person.

Organ Donations . To organ procurement or organ, eye or tissue transplantation organizations, or to organ donation banks to facilitate organ or tissue donation and transplantation.

Military and National Security . If you are a member of the U.S. or foreign armed forces, as required by the military command authorities. The Affiliate may also release your health information to authorized federal officials for certain national security activities.

Workers’ Compensation . To persons (e.g., employers, insurance carriers, attorneys) in order to comply with workers’ compensation laws or other similar programs providing benefits for work-related injuries.

Health Oversight Activities. To a health oversight agency for activities authorized by law to monitor the health care system, Medicare and other government programs and compliance with civil rights laws (e.g., facility inspections and licensure, or disciplinary actions).

Legal Proceedings. We may disclose health information about you in response to a subpoena or other lawful process issued during a judicial proceeding (e.g., a lawsuit) or an administrative proceeding by you or someone else involved in the dispute, but only if the party seeking the information demonstrates that reasonable efforts have been made to notify you of the request or to obtain a protective order from the court.

Law Enforcement. To law enforcement authorities for law enforcement purposes, such as (1) in response to a court order, subpoena, warrant, summons or similar process, (2) to identify or locate a suspect, fugitive, material witness or missing person, (3) about the victim of a crime if we obtain the individual’s consent or, under certain limited circumstances, if we are unable to obtain the individuals’ consent (4) about a death which is believed to be the result of criminal conduct, (5) to report a crime that occurred on the Affiliate’s premises, and (6) in emergency circumstances, to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime. The Affiliate must comply with federal and state laws in making such disclosures.

Deceased Individuals. To a coroner or medical examiner as necessary to carry out their duties (e.g., to identify a deceased person or determine the cause of death), or to funeral directors as authorized by law.

Correctional Institutions. To a correctional institution where you are an inmate or to a law enforcement official who has custody of you for certain limited purposes (e.g., to provide you with health care).

Research. For research-related activities that meet all applicable privacy law requirements.

Limited Health Information . Limited health information that excludes your name, Social Security Number and certain other information that could be used to easily identify you to a third party for research purposes, public health activities and health care operations. The party to whom we disclose the information is required to keep it confidential. For example, we may disclose your limited health information to a state hospital association for research purposes and public health activities.

Required by Law . When required to do so by federal, state or local law (e.g.,to report child or dependent adult abuse and violent wounds).

Incidental Disclosures. We take reasonable steps to protect your health information from unauthorized disclosure. Occasionally, an unintended disclosure of your health information which might occur during a use or disclosure for treatment or another authorized reason (e.g., information overheard during a discussion regarding your care with you or a member of your family).

Business Associates. Some of the activities described above are performed through contracts with outside vendors called business associates. It may be necessary for Affiliates to provide some of your health information to business associates so that they can assist us with these activities. We require business associates to appropriately safeguard the privacy of your information.

Organized Health Care Arrangement. The Affiliate is a clinically integrated care setting where patients receive care from Affiliate personnel and from independent doctors and other practitioners who provide care to patients at the Affiliate (collectively called “practitioners”). The Affiliate and these practitioners need to share health information freely to provide care to patients, and to conduct Affiliate health care operations. Therefore, the Affiliate and the practitioners have agreed to follow uniform information practices when using or disclosing health information related to inpatient or outpatient hospital services. This arrangement is called an “Organized Health Care Arrangement” and only covers information practices for services rendered through the Affiliate.

It does not cover the information practices of the practitioners in their offices or at other care settings. It does not alter the independent status of the Affiliate and the practitioners or make them jointly responsible for the clinical services provided by them. In other words, the Facility is not responsible for (1) the negligence (or mistakes) of the independent practitioners providing care at the Affiliate; or (2) any violations of your privacy rights by the

You and Your Authorization. The Affiliate must also disclose your health information to you, as described later in this Notice. Uses and disclosures of health information not covered by this Notice or the laws that apply to us will be made only with your written permission. If you give us permission to use or disclose health information about you, you may revoke (take back) that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose health information about you for the reasons set forth in your written authorization. We are unable to take back any disclosures we have already made with your permission.

About This Notice

The Affiliate is required to abide by the terms of the Notice currently in effect. The Affiliate reserves the right to change the terms of this Notice and make the new Notice provisions effective for all of your health information that it maintains, including that which it created or received while the prior Notice was in effect. If the Affiliate makes a material change to its privacy practices, it will amend its Notice. We will post a copy of the current Notice in the Affiliate. The Notice will state the effective date.

Contact Information

Privacy Officer: Allen Hospital, 1825 Logan Avenue, Waterloo, IA 50703
319-235-3941 (TDD 319-235-3180)

If you have questions about charges for professional services that you receive from physicians and other Professionals, please contact the Professional’s billing office identified on your account statement. E

Effective Date: February 1, 2012

Who Will Follow These Privacy Practices?
Our rules to protect your privacy will be followed by all workforce members of the site where you are being treated, as well as physicians and other health care practitioners with permission to provide services at our sites who are independent of any UnityPoint Health affiliate (together called “IHS” in this Notice).

What Health Information Is Covered Under This Notice?
This Notice covers health information at IHS that may be written (such as a hard copy medical record file), spoken (such as physicians discussing treatment options), or electronic (such as billing records kept on a computer).

How Can IHS Use Your Health Information?
The law allows IHS to use or share your health information for routine activities without requiring your permission, such as:
For treatment
For payment
To run the hospital or physician group;
For appointment reminders and communications
The law also allows IHS to use and share Health information without your permission for other limited reasons, including:
Public health activities
Some research activities
Health and safety reasons
Organ and tissue donation requests
Workers’ compensation requests
Law enforcement requests
Some marketing and fundraising activities
Uses and sharing permitted or required by law

What Activities Require Your Written Permission?
If IHS needs to use or disclose your health information for other purposes not described in this frequently asked questions guide or the attached full Notice of Privacy Practices, IHS must ask for your written authorization.

What Activities Do You Have a Right to Object To?
In many circumstances, you may have the right to object before we do the following:
Share information with your family members, friends or others involved in your care
List your name, room number and condition in a directory available to hospital visitors, as well as list your religion in a directory available to clergy members.

What Are My Privacy Rights as a Patient?
You have the right to…
Get a copy of your medical and billing records
Ask us to change your medical and billing records if you think there is a mistake
Request a preferred method of contact (for example, having calls go to your cell phone rather than to your home or work)
Get a list of certain health information shared for reasons other than treatment, billing or our health care operations with other persons or organizations
Receive a paper copy of our Notice of Privacy Practices. This is your copy of the Notice. If you would like an additional copy, you may request one at any IHS registration desk.
Ask us to limit the information we share. (Note that we may not be able to grant requests beyond what the law requires)
Complain in writing to us if you believe your privacy rights have been violated

Questions or Concerns?
Please contact our HIPAA Privacy Officer or Patient Advocate at 319-235-3941
(TDD 319-235-3180).

Your Rights

ACCESS TO HEALTH INFORMATION. You may request to inspect and copy much of the health information we maintain about you, with some exceptions. This includes most medical and billing records, but does not include psychotherapy notes. We may charge a fee for the costs of copying, mailing, and other supplies associated with your request.

REQUEST FOR RESTRICTIONS. You have the right to request a restriction on how we use or disclose your health information for treatment, payment, or health care operations, or to certain family members or friends identified by you who are involved in your care or the payment for your care. We are not required to agree to your request, but will let you know whether we have agreed.

AMENDMENT. You may request that we amend certain portions of your health information if you believe that it is incorrect or incomplete. We may require you to give a reason to support your request. We are not required to make all requested amendments, but we will give each request careful consideration. If we deny your request, we will provide you with a written explanation of the reasons and your rights.

ACCOUNTING. You have the right to receive a list of certain disclosures of your health information made by us or our business associates. You must state a time period for your request, which may not be longer than six years. The first list in any 12-month period will be provided to you for free; you may be charged a fee for each subsequent list you request within the same 12-month period.

CONFIDENTIAL COMMUNICATIONS. You have the right to request that we communicate with you about medical matters in a different manner or at a different place. We will agree to your request if it is reasonable, and you specify an alternative means or location to contact you.

PAPER NOTICE. You are entitled to receive a written copy of this Notice at any time.

How To Exercise These Rights. All requests to exercise these rights must be in writing. We will follow written policies to handle requests, and we will notify you of our decision or actions and your rights. Contact the Affiliate’s Privacy Officer or Clinic Manager using the contact information at the end of this Notice for more information or to obtain request forms.

COMPLAINTS. If you believe your privacy rights have been violated, you may file a complaint with the Affiliate using the contact information at the end of this Notice. You may also submit a complaint to the Secretary of the Department of Health and Human Services. All complaints must be submitted in writing. You will not be penalized or retaliated against for filing a complaint.

QUESTIONS. If you have questions about this Notice, please contact the
Affiliate’s Privacy Officer or Clinic Manager at the contact information at the end of this Notice.

ALLEN HEALTH SYSTEMS, INC.
Allen Memorial Hospital Corporation

INTERNET PRIVACY

Collecting and Using Personal Information
Welcome to Allen Hospital's website. We appreciate your interest in us! When you visit and navigate our sites and when you communicate with us via our website, we will not collect personal information about you unless you provide us that information voluntarily. If you provide personal information to us voluntarily via our website, we will not sell, license or transmit that information outside of Allen Hospital and affiliated vendors/contractors who are involved in administering or providing services for fufillment of your specific information requests (newsletters and e-health information). We will disclose information in compliance with applicable laws and regulations and will require recipients to protect the information and use it only for the purpose provided.

By “personal information,” we mean data that is unique to an individual, such as a name, address, social security number or telephone number. We may request personal information from you at our site in order to deliver requested materials to you, respond to your questions or deliver a product or service.

E-Mail and Asking Questions
First of all, it is important that you realize that any online health services and health information is not intended as a substitute for direct information from a trained medical professional, such as a physician, nurse or caregiver. You should always consult directly with a medical professional for diagnosis and treatment of any specific health problems or immediate health concerns. The information on our website is not medical advice!

We welcome your health-related comments or questions or general questions about our website and have provided e-mail contact opportunities for that purpose. We will share your comments and questions with our customer service personnel (often My Nurse nurses, sometimes other clinical staff members) and those employees most capable of addressing your questions and concerns.

Please note that your e-mail, like most, if not all, non-encrypted Internet e-mail communications, may be accessed and viewed by other Internet users, without your knowledge and permission, while in transit to us. For that reason, to protect your privacy, please do not use e-mail to communicate information to us that you consider confidential. If you wish, you may contact us instead via telephone at the numbers provided at various locations on our sites or call the main My Nurse telephone number (1-877-242-8899).

Where you provide information to us using the “Ask a question” form, you will be advised that you are entering a secure transaction area. The information is placed on a secure server and then retrieved by personnel at My Nurse, our 24-hour a day health information and physician referral service. This information transmission is safer than ordinary e-mail. For your reply, please indicate whether you wish us to respond to you by telephone or by your e-mail address to you (please note that such an e-mail reply is not delivered in a secure server environment, hence not private—see notes about regular e-mail, above).

Beyond answering your question, website management personnel will periodically review questions (without patient identifiers or e-mail addresses) to determine if additional information should be placed on the web site that would benefit other patients.

Healthcare Content on this Site
The health care information provided on or accessed from this site has been authored by UnityPoint Health and the staff members and physicians of its affiliates, with the exception of the health care information that has been authored by and purchased from third party vendors including, but not limited to, A.D.A.M., HealthDay and HeartAware, who are responsible for security and quality of information licensed by them. UnityPoint Health provides health care information for general knowledge and education and this content is not intended as a replacement for advice from your personal physician or direct caregivers.

Information Security
We will use security procedures to protect personal information you submit to us from misuse or unauthorized disclosure. The personal information that you submit to us is stored in a secure database behind an electronic firewall. You can access your personal information only by using a password. We encourage you to change your password regularly and not to share it with anyone.

Access to the data is limited to a few computer technicians for our site who need to maintain the database and who also use passwords for that access, as well as outside vendors who may occasionally assist us in maintaining and improving our hardware and software tools.

Allen Hospital will make every effort to safeguard your personal information. However, like other Internet sites, we cannot guarantee that it is completely secure from people who might attempt to evade security measures or intercept transmissions over the Internet.

Other Information/"Cookies"
You should also be aware that when you visit our website, we collect certain information that does not identify you personally, but provides us with “usage data,” such as the number of visitors we receive or what pages are visited most often. This data helps us to analyze and improve the usefulness of the information we provide online. We do not collect information about your specific use on the site or track what you view.

We use IP addresses to collect aggregate information about numbers of visitors and site usage. An Internet Protocol (IP) address is a number that is automatically assigned to your computer by your Internet Service Provider (ISP) whenever you access the Internet. This number may be the same each time you access the Internet or it may change. The address is logged on our server when your computer requests information. However, to allow users to access our site anonymously, your IP address is not linked with personal information about you. (We reserve the right, however, to use IP addresses to identify any individuals who threaten our site, service or customers.)

As our website develops, we may also use what is known as “cookie” technology. A "cookie" is an element of data that a website can send to your browser when you link to that website. It is not a computer program and has no ability to read data residing on your computer or instruct it to perform any step or function. By assigning a unique data element to each visitor, the website is able to recognize repeat users, track usage patterns and better serve you when you return to that site. The cookie does not extract other personal information about you, such as your name or address. Most browsers provide a simple procedure that will enable you to control whether you want to receive cookies by notifying you when a website is about to deposit a cookie file.

Linking to Other Sites
From time to time our website may provide links to other websites, not owned or controlled by Allen Hospital that we think might be useful or of interest to you. We cannot, however, be responsible for the privacy practices used by other website owners or the content or accuracy of those other websites. Links to various outside websites do not constitute or imply endorsement by Allen Hospital of these websites, any products or services described on these sites, or of any other material contained in them.

Changes to This Statement
Allen Hospital may change this statement from time to time without notice. We plan to post notice on our home page for no less than a week if any significant changes occur. This privacy statement is not intended to and does not create any contractual or other legal rights in or on behalf of any party.