HIPAA Privacy Practices Notice

Great Smokies Medical Center
Notice of Privacy Practices

Original Effective Date: March 6, 2003
Effective Date of this Revision: September 20, 2020

If you have questions re: this Notice, contact one of our Privacy Officers: Pat Gallimore or Anne Cortes:

Great Smokies Medical Center | 1312 Patton Ave | Asheville NC 28806 | Phone: (828) 252-9833 | gsmcweb.com

This Notice of Privacy Practices (Notice) describes how your medical information may be used and disclosed by Great Smokies Medical Center and how you can get access to this information. Please review it carefully.

 

We are committed to protecting the privacy of your personal health information. Protected Health Information (PHI) is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health conditions and related healthcare services.

This Notice describes how we may use your PHI within our practice or network and disclose (share outside of our practice or network) to carry out treatment, payment or healthcare operations. We may share your information for other purposes that are permitted or required by law. This Notice also describes your rights to access and control your PHI.

We are required by law to maintain the privacy and security of your PHI. We will follow the terms outlined in this Notice and make reasonable efforts to disclose the minimum PHI necessary.

We will notify you promptly if a breach occurs that may compromise the privacy or security of your information.

We may change our Notice at any time. Any changes will apply to all PHI. We will provide you with revised Notices by:

• Posting the revised Notice in a clear and prominent location in our office
• Posting the revised Notice on our website: gsmcweb.com.

 

Uses and Disclosures of PHI

We may use or disclose (share) PHI to help provide healthcare services for you.

Your PHI may be used and disclosed by your physician, our office staff and other healthcare providers outside of our office who are involved in your care and treatment for the purpose of providing healthcare services to you.

EXAMPLES:

• Your PHI may be provided to a physician to whom you have been referred for evaluation to ensure that the physician has the necessary information to diagnose or treat you.
• We may share your PHI from time-to-time with another physician or healthcare provider (e.g., a specialist or laboratory) who, at the request of your physician, becomes involved in your care by providing assistance with your diagnosis or treatment.
• We may also share your PHI with those outside of our practice who provide or participate in providing healthcare services, pricing or billing for you such as home health agencies, compounding pharmacies, and laboratories.
• We may use and disclose PHI as necessary to obtain payment for services. We may provide PHI to others to bill or collect for services.
• We may share PHI with health insurers to determine if a service is reimbursable.

 

PHI may be shared with the following:

• Billing companies and collection agencies
• Health Insurance companies and government agencies, for example to document qualification for benefits

 

EXAMPLE:

• We may need to provide your insurance company with a description of services received and the reasons for providing those services (for example, an EKG to evaluate chest pain), to enable you to be reimbursed for the cost of services.
• We may disclose your PHI when we contact your health insurers to receive approval prior to your receiving certain procedures or services to determine if the services will be reimbursed.

 

We may use or disclose PHI, as needed, to conduct the business activities of this practice which are called healthcare operations.

EXAMPLE:

• Training students, other healthcare providers, or ancillary staff such as billing personnel to help them learn or improve their skills
• Reviewing Quality Improvement processes that look at the delivery of healthcare to help provide safer, more effective healthcare
• Using information to assist in resolving problems or complaints within the practice

 

We may use and disclose your PHI without your permission in the following situations:

• As required by law limited to the relevant requirements of the law. For example, we may be required to report gunshot wounds or suspected abuse or neglect.
• Public health agencies as permitted by law to collect or receive information for the purpose of controlling disease, injury or disability. We may notify individuals who may have been exposed to a communicable disease or may be at risk of contracting or spreading a disease or condition.
• Health oversight agencies for activities authorized by law, such as audits, investigations, and inspections; oversight agencies seeking this information include government agencies that oversee the healthcare system, government benefit programs, other government regulatory agencies.
• Legal proceedings to assist in any legal proceeding or in response to a court order, in certain conditions in response to a subpoena, or other lawful process.
• Police or other law enforcement purposes to comply with all applicable legal requirements for law enforcement purposes as it pertains to criminal investigations; for example, as pertaining to victims of crime or in the event that a crime occurs on our premises.
• Coroners, funeral directors, medical examiners for purpose of identification, determining cause of death or assisting the coroner or medical examiner to perform other duties authorized by law.
• Medical research when their research has been approved by an Institutional Review Board (IRB) that has reviewed the research proposal and established protocols to ensure the privacy of your PHI.
• Special government purposes; for example, for national security purposes or, if you are a member of the military, with the military under limited circumstances.
• Correctional institutions for the health and safety of inmates and others under custody of law, as well as for the health and safety of other individuals in contact with those in custody.
• Workers’ Compensation and other similar legally established programs to comply with existing laws.

 

Other uses and disclosures of your PHI:

• Business Associates: Some services are provided through the use of contracted entities called “Business Associates.” Business Associates are third party professionals (for example, individuals involved in billing and transcription services) who are contractually required to maintain/safeguard the privacy of your PHI.
• Health Information Exchange: We may make your PHI available electronically to other healthcare providers outside of our facility who are involved in your care.
• Treatment alternatives: We may use your PHI to enable us to provide you with information about treatment alternatives or other health-related topics that may be of interest to you; for example, our periodic newsletters that are available at no cost at our facility or may be emailed to you. You may contact our Privacy Officer to request that these materials not be sent to you.
• Appointment reminders: We may contact you by mail, email, fax, phone or voicemail to remind you about upcoming appointments.
• Notification of political actions relevant to consumer healthcare: We may send you email communications about issues that affect the healthcare services you receive; for example, notification about state or national legislation that could affect healthcare services.

We may use or disclose your PHI to a family member, close friend or person you approve as being involved in your healthcare in the following situations UNLESS you object:

 

• To notify a family member or other individuals involved in your care about your location, general condition, or death
• To an authorized public or private entity to assist in disaster relief efforts; for example, for coordinating contacts with or disclosures to family and other individuals involved in your healthcare
• If you are not present or able to agree or object, we will use our professional judgment to determine if it is in your best interest to share your PHI.

 

The following uses and disclosures of PHI require your written authorization:

• Marketing
• Disclosures for any purposes which require the sale of your information
• Release of psychotherapy notes: Psychotherapy notes are those by a mental health professional for the purpose of documenting a conversation during a private session. This session could be with an individual or with a group. Psychotherapy notes are kept separate from the rest of the medical record and do not include: medications and how they affect you, start and stop time of counseling sessions, types of treatments provided, results of tests, diagnosis, treatment plan, symptoms, or prognoses.

 

All other uses and disclosures not recorded in this Notice will require a written authorization from you or your personal representative. Written authorization is a method by which you can inform us how you want your information used and disclosed. Your written authorization may be revoked by you in writing at any time. PHI that has been disclosed prior to the receipt of the written authorization based on the direction provided in the prior Notice will not be subject to your written authorization.

Your Privacy Rights

You have certain rights related to your PHI.

• You have the right to tell us in writing to share information with your family, close friends, or others involved in your care and to share information in a disaster relief situation.
• You have the right to change your mind regarding sharing your PHI by informing one of the privacy officers (contact information at the top of this document) in writing.

 

You have the right to see and obtain a copy of your PHI.

This means you may inspect and obtain a copy of PHI about you that is contained in a designated record set for as long as we maintain the PHI. On request, we will provide you a copy of your records as soon as possible and no later than 30 working days following the request. There are some exceptions to the records which may be copied, and your request may be denied. We may charge you a reasonable cost-based fee for a copy of the records.

 

You have the right to request a restriction of your PHI.

You may request that this practice not use or disclose any part of your PHI for the purposes of treatment, payment or healthcare operations. We are not required to agree with these requests. If we agree to a restriction request, we will honor the restriction request unless the information is needed to provide emergency treatment.

 

There is one exception: we must accept your request in writing to restrict disclosure of PHI to a health insurance plan if you pay out of pocket in full for a service or product unless sharing that information is otherwise required by law.

 

You have the right to request that we communicate with you in different ways or at different locations.

You may also request that we use an alternative address or other method of contact such as mailing information to a post office box. We will not ask you for an explanation about the request. We will accommodate all reasonable requests.

 

You may have the right to request an amendment of your PHI.

If you feel that your PHI is not correct, you may request an amendment of your PHI on your medical record along with an explanation of the reason for the request. In certain cases, we may deny your request for an amendment at which time you will have an opportunity to disagree.

 

You have the right to a list of people or organizations who have received your health information from us.

This right applies to disclosures for purposes other than treatment, payment or healthcare operations. You have the right to obtain a listing of these disclosures that occurred after April 14, 2003 for up to six years prior to the date of your request. You may be charged a reasonable fee if you request more than one list within a 12-month period.

 

You have the right to choose someone to act on your behalf.

If you have given someone medical power of attorney over you or have or have a legal guardian, those persons can exercise your rights on your behalf and make choices about your health information. We will ask for proof of this relationship before we take any action.

 

Additional Privacy Rights

• You have the right to obtain a paper copy of this Notice from us, upon request. We will provide you a copy of this Notice the first day we treat you at our facility. In an emergency situation we will give you this Notice as soon as possible.
• You have a right to receive prompt notification of any breach that compromised the privacy or security of your PHI.

 

Complaints

If you think we have violated your rights or you have a complaint about our privacy practices, you can contact one of our Privacy Officers listed above. You may file a complaint to the United States Department of Health and Human Services for Civil Rights by letter or phone call 1- (877) 696-6775 if you believe your privacy rights have been violated. We will not retaliate because you filed a complaint.