HIPAA Disclosure

NOTICE OF PRIVACY PRACTICES – UPDATED JANUARY 1, 2018

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Blue Cloud Pediatric Surgery Centers (hereinafter “The Provider”) uses this Notice of Privacy Practices (“Notice”) to comply with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). HIPAA was enacted by Congress to establish standards for protecting the confidentiality and security of your health information. This document is available in Spanish.

Purpose

The Provider and its professional staff, employees, and credentialed Medical and Dental Staff follow the privacy practices described in this Notice. The Provider is covered by both HIPAA and the Privacy Act of the state in which facility is located.  This Notice, which was developed to comply with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), describes the general ways your protected health information (“PHI”) may be used and disclosed in order for The Provider to provide you with medical and dental treatment, to collect payment for the services rendered to you by The Provider, and to facilitate The Provider’s health care operations.

PHI, as defined by HIPAA, means your personal health information that is found in your medical and billing records and that relates to your past, present, or future physical or mental health conditions or the provision of payment for services related to those health conditions. During the course of treatment, payment, and health care operations activities, this may include information created or received by health care providers, insurance companies, and/or your employer.

Your Health Information Rights

You have the following rights regarding your PHI. To exercise any of the following rights, you must submit a written request. To obtain forms relating to PHI, please contact The Provider at (717) 759-4375.

  • Right to a copy of this Notice. You may obtain a paper copy of this Notice at any time, even if you have been provided with an electronic copy. You do not have to submit a written request to obtain the Notice. Paper copies of this Notice may be obtained at The Provider’s reception desk.
  • Right to inspect and copy. You may inspect and/or receive a copy of your PHI maintained by The Provider.
  • Request amendment. If you believe your PHI maintained by The Provider is incorrect or incomplete, you may request an amendment to your information. The Provider is not required to agree to your request.
  • Request restriction. You may request limitations on how The Provider uses and/or discloses your PHI. The Provider is not required to agree to your request. If The Provider agrees to your request, The Provider will comply with your request unless the use or disclosure is necessary in order to provide you with emergency treatment or is otherwise required by law.
  • Receive confidential communications. You may request that communications from The Provider regarding your PHI be provided to you in a certain way or at a certain location. For example, you may prefer to receive mail regarding your PHI at an address other than your usual mailing address. You must specify how or where you wish to be contacted.
  • Accounting of disclosures. You may request a list of disclosures made by The Provider of your PHI to persons or entities other than for the purposes of treatment, payment, or health care operations, or pursuant to your specific authorization.  This list will contain each disclosure The Provider has made for the past six (6) years.

The Provider Responsibilities

The Provider is required by law to ensure your PHI is kept private in accordance with federal and state law and provide you with notice of The Provider’s legal duties and privacy practices with respect to your PHI. The Provider is required to abide by the terms of this Notice as long as it is in effect. If The Provider revises this Notice, The Provider will follow the terms of the revised Notice as long as it is in effect.

Use and Disclosure of Your Protected Health Information

The following is a list of ways The Provider may use and disclose your PHI. Not every possible use or disclosure in any given section is listed. However, all of the ways The Provider is permitted to use and disclose your PHI will fall within one of the sections below:

  • Treatment. The Provider may use your PHI to provide you with medical treatment or services. The Provider may disclose your PHI to doctors, nurses, technicians, medical students, or other members of your health care team at The Provider to keep them informed about your care status or condition as necessary. The Provider also may disclose your PHI to people outside The Provider who may be involved in your medical care such as health care providers who will provide follow-up care after surgery, including, but not limited to, dentists and primary care physicians.
  • Payment. The Provider may use and disclose your PHI to obtain payment from your insurance company or a third party. Also, The Provider may disclose your PHI to your other health care providers to assist those providers in obtaining payment from your insurance company or a third party.
  • Health Care Operations. The Provider may use and disclose your PHI for routine health care operations. Health care operations at The Provider include, but are not limited to, training and education programs, reviewing the quality of care provided by health care professionals, obtaining health insurance or stop-gap insurance, conducting legal services and auditing services, conducting business planning and development activities, conducting risk management activities and investigations, and managing the business and general administrative activities of The Provider. The Provider may also disclose your PHI to your other health care providers to assist them in their health care operations.
  • Appointments and Alternatives. The Provider may use and disclose your PHI to contact you to provide appointment reminders, prescription refill reminders, information about disease management or wellness programs, and other communications regarding your case management or health care coordination.
  • Business Associates. The Provider may disclose your PHI to The Provider’s business associates in order to carry out treatment, payment, or health care operations.
  • Coroners, Medical Examiners, and Funeral Directors. The Provider may disclose PHI to a coroner or medical examiner to identify a deceased person, to determine the cause of death, or as otherwise permitted by law. The Provider may also disclose PHI to funeral directors as necessary to carry out their duties.
  • Correctional Institutions. If you are an inmate of a correctional institution or under the custody of a law enforcement official, The Provider may disclose your PHI to the correctional institution or law enforcement official to provide you with health care, to protect your health and safety or the health and safety of others, or for the safety and security of the correctional institution or law enforcement official.
  • Group Health Plans. The Provider maintains a group health plan for its employees, and may disclose PHI of individuals covered under this plan to the sponsor of the group health plan, as permitted by law.
  • Health Oversight Activities. The Provider may disclose your PHI to a health oversight agency or entity for activities authorized by law such as audits, investigations, inspections, and licensure.
  • Health-Related Benefits and Services. The Provider may use and disclose your PHI to inform you about health­ related benefits or services that may be of interest to you or to provide you a promotional gift of nominal value. PHI may not be used for any marketing purposes without the patient’s expressed consent.

Choose one:  I DO/I DO NOT authorize the use/release of my PHI for the marketing of health-related products and services.  ____(initials)

  • Individuals Involved in Your Care or Payment for Your Care. The Provider may disclose your PHI to a family member, other relative, close friend who is involved in your medical care, or to someone who helps pay for your care if the PHI disclosed is directly relevant to such person’s involvement with your care, unless you tell us otherwise.
  • Law Enforcement. The Provider may disclose your PHI for law enforcement purposes, as required by law or in response to a valid subpoena.
  • Lawsuits and Disputes. The Provider may disclose your PHI in response to a court or administrative order. The Provider may also disclose your PHI in response to a valid subpoena, discovery request, or other lawful process provided that efforts have been made to tell you about the request or to obtain an order protecting the information requested, as required by law.
  • Organ and Tissue Donation. The Provider may disclose PHI to organizations that handle organ procurement; organ, eye, or tissue transplantation; or to an organ donation bank to facilitate organ or tissue donation and transplantation.
  • Public Health Activities. As required by law, The Provider may disclose your PHI for public health activities, including, but not limited to, the prevention of disease, injury, or disability; reporting births and deaths; reporting child abuse or neglect; reporting reactions to medications or product problems; notification of recalls; infectious disease control; and notifying government authorities of suspected abuse, neglect or domestic violence. The Provider may disclose portions of your PHI to local, state, and/or federal registry programs as required.
  • Research. The Provider may disclose your PHI to researchers when the research has been legally approved and protocols have been established to ensure the privacy of your PHI.  Pursuant to STATE law, in the case of research and any other situation that requires The Provider to de-identify your PHI (i.e., information that can be used to identify you has been removed from the PHI record in accordance with HIPAA-compliant methodologies), The Provider may not re-identify your PHI (i.e., the information that was previously removed cannot be reinserted into the applicable record).
  • Serious Threat to Health or Safety. The Provider may use and disclose your PHI when The Provider deems it necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.
  • Workers’ Compensation. The Provider may disclose your PHI to workers’ compensation or similar programs to the extent necessary to comply with laws relating to worker’s compensation or similar programs.

Written Authorization

Except as described above, The Provider will not use or disclose your PHI unless you authorize The Provider to do so, in writing, on the form provided by The Provider. You may revoke any prior authorization in writing.  A written revocation will not apply to any previous use or disclosure of PHI made in good faith under a prior authorization.

Changes to This Notice

The Provider reserves the right to change this Notice and to make the revised Notice effective for PHI The Provider already has about you as well as any information The Provider receives in the future. A copy of the current Notice or a summary of the current Notice will be posted at The Provider and on our website, www.bluecloudpsc.com.

The effective date of the Notice will appear on the first page of the Notice or summary. In addition, each time you register at or are admitted to The Provider for treatment or health care services, The Provider will have available for you, at your request, a copy of the current Notice in effect.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with The Provider at (717) 759-4375 or with the Secretary of the United States Department of Health and Human Services. You will not be penalized or retaliated against in any way for making a complaint.

Department of Health and Human Services

Office of Civil Rights

1-800-368-1019/TDD: 1-800-537-7697

https://www.hhs.gov/hipaa

Contact

If you have any questions about this Notice or your privacy rights or wish to obtain a form (see below) to exercise your rights as described above, you may contact The Provider at (717) 759-4375

Forms Available

  • Notice of Privacy Practices (English/Spanish)
  • Patient Request to Restrict Use or Disclosure of Protected Health Information
  • Authorization for Use and Disclosure of Medical Info
  • Patient Request to Amend Protected Health Information
  • Patient Request for Access to Protected Health Information
  • Revocation of Authorization to Release Personal Health Information