Notice of Privacy Practices
Effective April 14, 2003; revised March 1, 2012
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. We will also be obtaining your written acknowledgement that you had the opportunity to review this Notice of Privacy Practices ("Notice"). This Notice applies to Cadence Health*, its controlled entities and hospital-based physician groups, hereafter referred to as Cadence Health ("we" or "us").
Each time you visit a healthcare provider, a record of your visit is made. This information is often referred to as your medical record. Typically, this record contains your symptoms, examination and test results, diagnoses and a plan of care or treatment. Understanding what is in your record enables you to ensure its accuracy. Understanding how your medical information is used helps you to better understand why others may access your medical information. This understanding also allows you to make informed decisions when authorizing disclosure. By reading this Notice and signing the Acknowledgement and/or Receipt of Notice of Privacy Practices section on the Universal Consent, you are allowing Cadence Health to use, access and disclose your medical information for treatment, payment and healthcare operations, as provided below.
TREATMENT, PAYMENT AND HEALTHCARE OPERATIONS
We may use and share medical information in order to provide "Treatment," obtain "Payment" for treatment provided to you and perform our "Healthcare Operations." The three terms are:
Treatment: We use and share your medical information to provide services to you, for example, to diagnose and treat your injury or illness. In addition, we may also share your medical information with physicians, nurses, other caregivers or organizations involved in your present or future treatment.
Payment: We may use and share your medical information to obtain payment for services that were provided to you. For example, we may share your medical information to request payment and receive payment from Medicare, Medicaid, your health insurer, HMO, or other company or program that arranges or pays the cost for some or all of your health care. As an example, we may share your medical information with the person responsible for paying for your treatment; this is the guarantor and could be your spouse, parent, personal representative or legal guardian.
Healthcare Operations: We may use and share your medical information for our healthcare operations, which may include management, planning and activities that continually improve the quality and effectiveness of healthcare services provided. For example, members of the medical staff, risk management or quality improvement teams may use information in your medical record to assess the care and its outcomes.
USES OR DISCLOSURES WITHOUT AUTHORIZATION
Directory: Unless you object or "opt out," your name, location in the facility, general condition and religious affiliation will appear in the patient directory. This information may be provided to members of the clergy and except for religious affiliation, to other people who ask for you by name as well as government agencies and disaster relief organizations.
Electronic Medical Record: Your electronic medical record (EMR) is an electronic recording-rather than a paper record-of your medical information. The EMR may be shared between the controlled entities of Cadence Health. Further, the EMR of the controlled entities (i.e., Central DuPage Hospital, Delnor Hospital and Cadence Physician Group) may be compiled into an integrated EMR. The integrated EMR represents a systematic collection of medical information in a standardized electronic format allowing information to be shared across different healthcare settings. Since more information is accessible at the point of care, the integrated EMR may lead to more informed decisions when caregivers provide your treatment.
Family Members and Personal Representatives: We may use or disclose information to notify or assist in notifying a family member, personal representative or another person responsible for your care as to your location and general condition. Caregivers, using their professional judgment, may disclose to a family member, relative, friend or any other person you identify, medical information relevant to that person's involvement in your care or payment related to your care.
Research: Every effort is made to request your specific authorization (permission) if your medical information may be used for research purposes. However, under rare circumstances we may use or share your medical information if the Board that oversees research, the Institutional Review Board ("IRB"), approves a waiver of authorization or a review preparatory to research for disclosure.
Limited Data Set: We may use or disclose a limited data set (i.e., in which certain identifying information has been removed) of your medical information for purposes of research, public health or healthcare operations. Any recipient of that limited data set must agree to appropriately safeguard your information.
Incidental Uses and Disclosures: Reasonable steps are taken to ensure your privacy is protected; however, while providing your treatment, your information could be unintentionally disclosed as a result of providing your treatment.
Medical Examiners, Coroners and Funeral Directors: We may disclose medical information to examiners, coroners and funeral directors as necessary to carry out their duties.
Organ Procurement Organizations: We may disclose medical information to organizations that collect or transplant organs or tissue for donation.
Marketing: Communications, such as contacting you for appointment reminders, case management, treatment alternatives or other health related products or services are not considered marketing and your authorization is not required. However, if a communication is made that does not contribute to your current or future treatment, thereby considered "marketing," we will request your specific authorization. Further, without your specific authorization, we may not sell your information to a third party for marketing purposes.
Copy of Notice: We will provide you with a paper copy of the current Notice if you request it.
Fundraising: If you have not opted out, we may contact you for fundraising purposes. Notice of your right to opt-out will be prominently posted on all mailings for fundraising.
Workers' Compensation: We may disclose medical information to the extent authorized by law and necessary to receive payment for a work-related claim.
Health Oversight Agencies: As required by law, we may disclose your medical information to public health or legal authorities charged with preventing or controlling disease, injury or disability.
As Required by Law: We may disclose information for law enforcement purposes or in response to a valid subpoena or court order. Should you be an inmate of a correctional institution, we may disclose to the institution, or agents thereof, information necessary for your health and the health and safety of others.
MENTAL HEALTH, ALCOHOL AND DRUG ABUSE
The confidentiality of mental health, alcohol and drug abuse medical records maintained by our program is protected by federal and state laws. Generally, Cadence Health may not acknowledge to anyone outside the program that a patient attends the program or disclose any information identifying that a patient is receiving treatment for alcohol or drug abuse unless one of the following conditions is met:
- The patient gives written consent for disclosure.
- The disclosure is allowed by court order.
- The disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit or program evaluation.
The conditions above generally apply as long as the patient is not a threat to self or others. Further, protection does not apply to the disclosure of information to the authorities for suspected abuse or neglect (child or adult).
MEDICAL INFORMATION RIGHTS
Your medical record is the physical property of the Cadence Health organization where the medical information was created; however, the information within your medical record belongs to you. You have privacy rights, which may not be waived as a condition of your treatment or payment for your healthcare services. Your specific privacy rights are provided below.
Request for Restriction(s): You have the right to request restriction on certain uses and disclosures of your medical information for the purposes of payment or healthcare operations. We will comply with your request except to the extent that disclosure has already occurred or if you are in need of emergency treatment. It is your right to request that your account be designated as "self pay," which means your medical information will not be further disclosed for payment purposes. If you specify the self pay designation, you will be responsible for paying or independently submitting the bill to your insurance company.
Breach Notification: For any unauthorized acquisition, access, use or disclosure of your unsecured medical information, you are to be notified in writing and, or by phone within 60 days of our discovery. If a breach of your medical information is detected and poses a significant risk of financial, reputational or other harm, you will be informed as to:
- What occurred, including the date of the breach and the discovery date
- The types of medical information that were breached
- Steps you should take to protect yourself
- Actions we will take to investigate the breach, mitigate harm to you and protect against further breaches
- Contact information so you may follow up on the breach
Access and Copy: You have the right to inspect and obtain a copy of your medical record, except in limited circumstances defined by federal regulations. Further, you may designate that your medical information be copied in electronic format (CD, flash drive or email) to the extent such format is supported by the electronic medical record. If you are denied access to your medical record for certain reasons, the denial may be appealed. For more information on your access rights, contact the Privacy Office at 630.933.5048.
Opt Out: You may request that your information be removed from mailing lists for marketing and fundraising. Also, if admitted to the hospital, you may request that your name not appear within the facility directory (Note: opting out of the facility directory may prevent the provision of information to individuals who request information about you or otherwise should know about your care).
Amendment: You may make a written request to amend your health information. You must give us reason for the amendment. In certain cases, we may deny your request for an amendment. If we deny your request for an amendment, you have the right to file a statement of disagreement and we may prepare a rebuttal if we object. We will provide you with a copy of the rebuttal.
Accounting of Disclosure(s): You may request an accounting of disclosures of health information. Accounting of disclosures may be limited to instances where the disclosure is known or a record exists or the disclosure type is specified by Statute.
Alternate Communication(s): You have the right to request that confidential communications be made by alternate means, for example, fax versus mail or at alternate locations. Your request must be in writing. We will make every effort to honor your request.
Revoke: If you provide authorization for a specific use or disclosure, you may revoke that authorization at any time by writing the Medical Records Department at 25 North Winfield Road, Winfield, Illinois 60190. If you revoke your authorization, you understand that we cannot take back disclosures made prior to processing your request.
Cadence Health will:
- Protect the privacy of your medical information
- Provide you with this Notice of our legal duties and privacy practices
- Abide by the terms of this Notice
We reserve the right to change our practices and to make the new provisions effective for all medical information we maintain. If this Notice is changed, it will be displayed at common entry points and on our website at cadencehealth.org.
INFORMATION OR CONCERN
If you have any questions or would like additional information, you may contact the Privacy Office at 630.933.5048. Additional information about filing a complaint can be found at www.hhs.gov/ocr/privacy. Cadence Health maintains a non-retaliation policy on behalf of individuals that file complaints in good faith.
*Cadence Health is the parent company of Central DuPage Hospital, Delnor Hospital, its controlled entities and physician groups.