NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice of Privacy Practices is being provided to you as a requirement of the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”). This Notice describes how the Karmanos Cancer Center (“KCC”) may use and disclose your protected health information to carry out treatment, payment or health care operations and for other purposes that are permitted or required by law. It also describes your rights to access and control your protected health information in some cases. Your “protected health information” includes any of your written and oral health information, including demographic data that can be used to identify you. This includes health information that is created or received by your health care provider, and that relates to your past, present or future physical or mental health or condition.
This notice applies to all of the records of your care generated by KCC and our medical staff when they are providing services to you as a patient at our center and/or affiliating organizations such as Harper University Hospital or other Detroit Medical Center facility. Please keep in mind that some of the physicians on our medical staff are not employees of KCC. Therefore, should you see them in a private setting, in their private office for example, they may have different policies or notices regarding the use or disclosure of your medical information.
USES AND DISCLOSURES OF HEALTH INFORMATION FOR TREATMENT, PAYMENT AND HEALTH CARE OPERATIONS
KCC may use your health information that constitutes protected health information as defined in the Administrative Simplification provisions of HIPAA and the regulations thereunder (the “Privacy Rule”), for purposes of providing you treatment, obtaining payment for your care and conducting health care operations. KCC has established policies to guard against unnecessary disclosure of your health information.
To Provide Treatment. KCC may use your health information to coordinate or manage your health care and any related services. This includes the coordination or management of your health care with a third party for treatment purposes. For example, physicians involved in your care will need information about your symptoms in order to prescribe appropriate medications. KCC may disclose your health care information to other physicians who may be treating you or consulting with your physician with respect to your care. In some cases, we may also disclose your protected health information to an outside treatment provider for purposes of the treatment activities of the other provider.
To Obtain Payment. KCC may include your health information in invoices to collect payment from third parties for the care you receive from KCC. For example, KCC may be required by your health insurer to provide information regarding your health care status so that the insurer will reimburse you or KCC. KCC also may need to obtain prior approval from your insurer and may need to explain to the insurer your need for the treatment recommended and the services that will be provided to you. We may also disclose protected health information to your insurer to determine whether you are eligible for benefits or whether a particular service is covered under your health plan.
To Conduct Health Care Operations. KCC may use and disclose health information for its own operations in order to facilitate the function of KCC and as necessary to provide quality care to all of KCC’s patients. Health care operations include such activities as:
Other Uses and Disclosures. As part of treatment, payment and healthcare operations, we may also use or disclose your protected health information for the following purposes:
- Quality assessment and improvement activities.
- Activities designed to improve health or reduce health care costs.
- Contacting health care providers and patients with information about treatment alternatives and other related functions that do not include treatment.
- Professional review and performance evaluation.
- Training programs including those in which students, trainees or practitioners in health care learn under supervision.
- Training of non-health care professionals.
- Accreditation, certification, licensing or credentialing activities.
- Review and auditing, including compliance reviews, medical reviews, legal services and compliance programs.
- Business planning and development including cost management and planning related analyses and formulary development.
- Business management and general administrative activities.
- To remind you of an appointment.
- To inform you of potential treatment alternatives or options.
- To inform you of health-related benefits or services that may be of interest to you.
- To contact you to raise funds for KCC. If you do not wish to be contacted regarding fundraising, please contact our Customer Service Department.
WHEN MUST KCC DISCLOSE YOUR PROTECTED HEALTH INFORMATION?
KCC must disclose your protected health information (i) to you, upon request, (ii) to the Secretary of the Department of Health and Human Services (“DHHS”) to determine whether KCC is in compliance with HIPAA, and (iii) where required by law. In this context, “required by law” means that KCC will make the disclosure only when the Federal, State or local law requires it to do so, but not if the law would simply allow it to do so.
WHEN MAY KCC USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION WITHOUT YOUR AUTHORIZATION?
When Specially Protected. In addition to the Privacy Rule, special protections under State or other Federal law may apply to the use and disclosure of your protected health information. KCC will comply with these State or Federal laws where they are more protective of your privacy than HIPAA and the Privacy Rule.
When There Are Risks to Public Health. KCC may disclose your health information for public activities and purposes in order to:
To Business Associates. KCC may utilize third parties that may need access to your protected health information to perform certain services on behalf of KCC. These third parties are “Business Associates” of KCC. Business Associates must protect any protected health information they receive from, or create and maintain on behalf of, KCC. For example, KCC may retain a company to aid in billing, a medical equipment company that services certain equipment, or a law firm to handle a litigation matter, and in each case, if those companies have access to protected health information in order to do their jobs, they would be Business Associates, and KCC would have to enter into agreements with them that requires them to protect that information in the same way KCC is required to.
- Prevent or control disease, injury or disability; report disease, injury, vital events such as birth or death and the conduct of public health surveillance, investigations and interventions.
- Report adverse events, product defects, to track products or enable product recalls, repairs and replacements and to conduct post-marketing surveillance and compliance with requirements of the Food and Drug Administration.
- Notify a person who has been exposed to a communicable disease or who may be at risk of contracting or spreading a disease.
- Notify an employer about an individual who is a member of the workforce as legally required.
To Individuals Involved With Your Care Or Payment For Your Care. KCC may disclose your protected health information to adult members of your family or another person identified by you who is involved in your care or payment for your care if: (i) you authorize KCC to do so; (ii) KCC informs you that it intends to do so and you do not object; or (iii) KCC infers from the circumstances, based upon its professional judgment, that you do not object to the disclosure. KCC will, whenever possible, try to get your written agreement or objection to these disclosures (as the case may be), but in certain circumstances it may rely on your oral agreement or disagreement to disclosures to family members.
To Personal Representatives. KCC may disclose your protected health information to someone who is your personal representative. Before KCC will give that person access to your protected health information or allow that person to take any action on your behalf, they will require him/her to provide proof that he/she may act on your behalf; for example, a court order or power of attorney granting that person such power. Generally, the parent of a minor child will be the child’s personal representative. In some cases, however, state law allows minors to obtain treatment without parental consent, and in those cases, KCC may not disclose certain information to the parents. KCC may also deny a personal representative access to personal health information to protect people, including minors, who may be subject to abuse or neglect.
To Report Abuse, Neglect Or Domestic Violence. KCC is allowed to notify government authorities if KCC believes a patient is the victim of abuse, neglect or domestic violence. KCC will make this disclosure only when specifically required or authorized by law or when the patient agrees to the disclosure.
To Conduct Health Oversight Activities. KCC may disclose your health information to a health oversight agency for activities including audits, civil administrative or criminal investigations, inspections, licensure or disciplinary action. KCC, however, may not disclose your health information if you are the subject of an investigation and your health information is not directly related to your receipt of health care or public benefits.
In Connection With Judicial And Administrative Proceedings. KCC may disclose your health information in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal as expressly authorized by such order or in response to a subpoena, discovery request or other lawful process, but only when KCC makes reasonable efforts to either notify you about the request or to obtain an order protecting your health information.
For Law Enforcement Purposes. As permitted or required by State law, KCC may disclose your health information to a law enforcement official for certain law enforcement purposes as follows:
To Coroners And Medical Examiners. KCC may disclose your health information to coroners and medical examiners for purposes of determining your cause of death or for other duties, as authorized by law.
- As required by law for reporting of certain types of wounds or other physical injuries pursuant to the court order, warrant, subpoena or summons or similar process.
- For the purpose of identifying or locating a suspect, fugitive, material witness or missing person.
- Under certain limited circumstances, when you are the victim of a crime.
- To a law enforcement official if KCC has a suspicion that your death was the result of criminal conduct, including criminal conduct at KCC.
- In an emergency in order to report a crime.
To Funeral Directors. KCC may disclose your health information to funeral directors consistent with applicable law, and, if necessary, to carry out their duties with respect to your funeral arrangements. If necessary to carry out their duties, KCC may disclose your health information prior to and in reasonable anticipation of your death.
For Organ, Eye Or Tissue Donation. KCC may use or disclose your health information to organ procurement organizations or other entities engaged in the procurement, banking or transplantation of organs, eyes or tissue for the purpose of facilitating the donation and transplantation.
For Research Purposes. KCC may, under very select circumstances, use your health information for research. Before KCC discloses any of your health information for such research purposes, the project will be subject to an extensive approval process.
In the Event of A Serious Threat To Health Or Safety. KCC may, consistent with applicable law and ethical standards of conduct, disclose your health information if we believe, in good faith, that such disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety or to the health and safety of the public.
For Specified Government Functions. In certain circumstances, the Federal regulations authorize KCC to use or disclose your health information to facilitate specified government functions relating to military and veterans, national security and intelligence activities, protective services for the President and others, medical suitability determinations and inmate and law enforcement custody.
For Worker's Compensation. KCC may release your health information for worker's compensation or similar programs.
For Limited Data Sets. KCC may disclose protected health information in a limited data set for purposes of research, public health or health care operations, but only if a data use agreement has been signed.
For Emergencies and Disaster Relief. KCC may disclose protected health information to organizations engaged in emergency and disaster relief efforts.
AUTHORIZATION TO USE OR DISCLOSE HEALTH INFORMATION
Other than as stated above, KCC will not disclose your health information other than with your written authorization. This requirement for your written authorization applies especially to most uses or disclosures of psychotherapy notes, for KCC to disclose your protected health information for remuneration, or to use or disclose your protected health information for marketing purposes. If you or your representative authorizes KCC to use or disclose your health information, you may revoke that authorization in writing at any time.
YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION
You have the following rights regarding your health information that KCC maintains:
Right to request restrictions. You may request restrictions on certain uses and disclosures of your health information. You have the right to request a limit on KCC’s disclosure of your health information to someone who is involved in your care or the payment of your care. However, KCC is not required to agree to your request; provided, however, that KCC must agree to your request for a restriction on disclosure if done for payment or health care operations, and the disclosure pertains only to a health care item or service which has already been paid for. If you wish to make a request for restrictions, please contact the Customer Service Department.
Right to receive confidential communications. You have the right to request that KCC communicate with you in certain ways. We will accommodate reasonable requests. We may condition this accommodation by asking you for information as to how payment will be handled or specification of an alternative address or other method of contact. We will not require you to provide an explanation for your request. Requests must be made in writing to our Customer Service Department.
Right to inspect and copy your health information. You have the right to inspect and copy your health information, including billing records. A request to inspect and copy records containing your health information may be made to the Customer Service Department. If you request a copy of your health information, KCC may charge a reasonable fee for copying and assembling costs associated with your request.
Right to amend health care information. You or your representative has the right to request that KCC amend your records, if you believe that your health information is incorrect or incomplete. That request may be made as long as KCC maintains the information. A request for an amendment of records must be made in writing to the Customer Service Department. KCC may deny the request if it is not in writing or does not include a reason for the amendment. The request also may be denied if (i) your health information records were not created by KCC, (ii) the records you are requesting are not part of KCC‘s records, (iii) the health information you wish to amend is not part of the health information you or your representative are permitted to inspect and copy, or (iv), in the opinion of KCC, the records containing your health information are accurate and complete.
Right to an accounting. You or your representative have the right to request an accounting of disclosures of your health information made by KCC. This right applies to disclosures for purposes other than treatment, payment or health care operations as described in this Notice of Privacy Practices. We are also not required to account for disclosures that you requested, disclosures that you agreed to by signing an authorization form, disclosures for a facility directory, to friends or family members involved in your care, or certain other disclosures we are permitted to make without your authorization. The request should specify the time period for the accounting starting on or after April 14, 2003. Accounting requests may not be made for periods of time in excess of six (6) years. KCC would provide the first accounting you request during any 12-month period without charge. Subsequent accounting requests in that same 12-month period may be subject to a reasonable cost-based fee.
Right to Receive Notice of a Breach. If for any reason your unencrypted protected health information is improperly disclosed, you have a right to receive notice of that breach, unless it is determined, based on an adequate risk assessment, that the probability that the protected health information has been compromised is low. The notice will include (i) a brief description of the event, (ii) a description of the unsecured protected health information involved, (iii) a brief description of the steps taken by KCC to mitigate the consequences of the breach, (iv) mitigation steps you might take, and (v) KCC contact information so you can find out more about what occurred.
Right to a paper copy of this notice. Upon request, we will provide a separate paper copy of this notice even if you have already received a copy of the notice or have agreed to accept this notice electronically.
DUTIES OF KCC
KCC is required by law to maintain the privacy of your health information and to provide to you and your representative this Notice of its duties and privacy practices. KCC is required to abide by the terms of this Notice as may be amended from time to time. KCC reserves the right to change the terms of its Notice and to make the new Notice provisions effective for all health information that it maintains. If KCC changes its Notice, KCC will provide a copy of the revised Notice to you or your appointed representative.
INFORMATION & COMPLAINTS
If you or your representative believe that your privacy rights have been violated, you or your personal representative have the right to express complaints to KCC and/or to the Secretary of the Department of Health and Human Services.
If to the Secretary of the DHHS, send your complaint to:
The U.S. Department of Health and Human Services,
200 Independence Avenue, S.W.
Washington, D.C. 20201
Toll Free: 1-877-696-6775.
Any complaints to KCC should be made in writing to the Customer Service Department. KCC encourages you to express any concerns you may have regarding the privacy of your information, and KCC strictly adheres to its Non-Retribution/Non-Retaliation Policy for those who file complaints. You will not be retaliated against in any way for filing a complaint.
Privacy complaints must be submitted to KCC in writing at:
KCC Privacy Official,
4100 John R
Detroit, MI 48201
For further information concerning this notice, contact the KCC Privacy Official at (877) 857-6007.
OTHER USES OF MEDICAL INFORMATION
Other uses and disclosures of medical information not covered by this notice or the laws that apply to KCC will be made only with your written permission. If you provide KCC permission to use or disclose medical information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, KCC will no longer use or disclose medical information about you for the reasons covered by your written authorization. You understand that KCC is unable to take back any disclosures already made with your permission, and that KCC is required to retain records of care provided to you.
This Notice is effective June 1, 2013.