HIPAA

NOTICE OF PRIVACY PRACTICES

Effective: August 30, 2013

Who Will Follow this Notice

This joint notice applies to the staff, volunteers, business associates, and physicians who provide services on behalf of any BayCare Health System hospital, outpatient center, behavioral health center, home care/durable medical equipment (DME) service, skilled nursing facility or affiliated physician group (BayCare Health System Entities and Providers). BayCare Health System entities and providers are located throughout west central Florida. This joint notice describes how we will use and share your information, how we are required by law to maintain the privacy of your health information and to provide you with notice of our legal duties and privacy practices with respect to your protected health information (PHI). PHI is information about you, including demographic information, that may identify you and that relates to your health or condition and related health care services. We will tell you if your PHI has been breached. We are required to abide by the terms of the notice currently in effect. If you have questions about any part of this notice or if you want more information about our privacy practices, contact our Privacy Department at (855) 466-6677.

How We (Including Our Affiliated Entities and Other Physicians Who Are Treating You) May Use or Share Your Health Information

We are committed to protecting the privacy of your health information. The law permits us to use or share your health information for the following purposes:

  • Treatment: We may use or share your PHI with physicians, nurses, students and other health care personnel to provide you treatment or services. For example, your PHI may be provided to a physician to whom you have been referred to ensure that the physician has the necessary information to diagnose and treat you.
  • Payment: We may use or share your PHI to obtain payment for your health care services, including with a collection agency or credit bureau. We may also share your PHI with other providers so they may obtain payment for services. We may also use or share your PHI so that we may locate you for collection purposes, including using services with change of address information to ensure your statements are mailed to the most current address on file with the postal service. For example, obtaining approval for payment of services from your health plan may require that your PHI be shared with your health plan. We may also provide your PHI to our business associates or other providers’ business associates, such as billing companies, transcriptionists, collection agencies, and vendors who mail billing statements.
  • Health Care Operations: We may use or share your PHI or a limited data set to operate our facilities. BayCare Health System entities and providers have an organized health care arrangement and may use or share your PHI for the operations of the organized health care arrangement. For example, we may use your PHI to evaluate the quality of health care services that you received, to evaluate the performance of the health care professionals who provided health care services to you, for medical review purposes or auditing. In addition, the hospitals report traumas, birth defects and cancer cases (Florida Cancer Registry) to the Departments of Health for quality improvement and licensing purposes and quarterly data to the Agency for Health Care Administration (AHCA) as required for licensing. We may also provide your PHI to accountants, attorneys, consultants, accrediting agencies, outside funding sources and others to make sure we’re complying with the laws that affect us.
  • Directory: In our hospitals, we will generally use and share your name, the location at which you are receiving care, your condition (in general terms) and your religious affiliation in our facility directory unless you object. All of this information, except religious affiliation, will be given to people that ask for you by name, such as visitors. Members of the clergy will be told your religious affiliation. Certain “no information” category patients, including behavioral health patients, are excluded from our facility directory. The opportunity to consent may be obtained retroactively in emergency situations.
  • Notification and Communication with Family: Unless you object, we may release to a relative, close friend or any other person you identify, information that directly relates to that person’s involvement in your health care or who helps pay for your care. We may also use or release PHI to notify or assist in notifying a family member, personal representative or any other person responsible for your care to tell them your location or general condition. In our Behavioral Health facilities, your written authorization is required to provide these disclosures. If you are unable to provide written authorization, agree or object to the release, we may release information as necessary if we determine that it is in your best interest based on our professional judgment, such as emergency situations. Finally, we may use or share your PHI to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and releases to family or other individuals involved in your health care.
  • Required by Law, Court or Law Enforcement: We may release PHI when a law requires that we report information to government agencies and law enforcement personnel about victims of abuse, neglect or domestic violence, when dealing with crime or when ordered by a court.
  • Public Health: As required or permitted by law, we may release PHI or a limited data set to public health authorities for purposes related to preventing or controlling disease, injury or disability, reporting to the Food and Drug Administration problems with products and reactions to medications and reporting disease or infection exposure. Our hospitals are required to report all births and deaths to the Office of Vital Statistics for certificate purposes.
  • Health Oversight Activities: We may release PHI to health agencies for activities authorized by law. These oversight activities include audits, investigations and inspections, as necessary for our licensure and for the government to monitor the health care system, government programs and compliance with civil rights laws. For example, we may release PHI to the Secretary of the Department of Health & Human Services so they can determine our compliance with privacy laws.
  • Deceased Person Information: We may release your health information to coroners, medical examiners and funeral directors.
  • Organ Donation: The hospitals may release your health information to organizations involved in procuring, banking or transplanting organs and tissues, such as Lions Bank and Life Link.
  • Research: We may, in certain situations, release your health information or limited data set to researchers conducting research that has been approved by an Institutional Review Board or a Privacy Board.
  • Public Safety: We may release your health information to appropriate persons to prevent or lessen a serious and near threat to the health or safety of a particular person or the general public.
  • Specific Government Functions: We may share your health information for military or national security purposes or in certain cases if you are in law enforcement custody.
  • Workers’ Compensation: We may share your health information as necessary to comply with workers’ compensation laws. We report any injuries referred to us from an employer to the Department of Workers’ Compensation and any work-related deaths to OSHA. All employers are given health information regarding work-related injuries they have referred to us.
  • Appointment Reminders and Health-Related Benefits: We may use your PHI to contact you to provide appointment reminders or to give information about other treatments or health-related benefits and services that may be of interest to you.
  • Fundraising, Marketing and the Sale of PHI: We may contact you to participate in fundraising activities. You have a right to opt out of receiving such fundraising communications. We will not sell your PHI or use or disclose it for marketing purposes without your specific permission.
  • Florida State-Specific Requirements: When Florida’s laws are stricter than federal privacy laws, we are required to follow the state law.
  • Organized Health Care Arrangement: BayCare Health System entities and providers participate in an Organized Health Care Arrangement. Information may be shared as necessary to carry out treatment, payment and health care operations. Physicians not employed by BayCare Health System may have access to PHI in their offices to assist in reviewing past treatment as it may affect treatment at the time. These physicians may have different policies or notices regarding the physician’s use and disclosure of your health information created in their office or clinic.
  • Affiliated Covered Entity: PHI will be made available to staff at local affiliated entities as necessary to carry out treatment, payment and health care operations. Caregivers at other facilities may have access to PHI at their locations to assist in reviewing past treatment information as it may affect treatment at this time. You may contact the Privacy Department for more information on specific sites included in this affiliated covered entity.
  • Treatment of Sensitive Information: Psychotherapy notes and diagnostic and therapeutic information regarding mental health, drug/alcohol abuse or sexually transmitted diseases (including HIV status) will not be disclosed without your specific permission, unless required or permitted by law.

Your Health Information Rights

  • You have the right to request a limit on certain uses and releases of your health information. We will consider your request, but are not required to accept it unless you do not want information about an item or service sent to your health plan and you have paid for the item or service in full. These requests must be in writing and submitted to our Privacy Department.
  • You have the right to choose how you receive your health information. You have the right to ask that we send information to you at an alternative address or by other means (for example, telephone instead of mail, post office box instead of home address). We must agree to your request as long as we can easily provide it in the format you requested. These requests must be in writing.
  • You have the right to see and get copies of your health information, in most cases. These requests must be in writing. You may request copies of your records from your provider. If your records are maintained in an electronic format, you have the right to obtain an electronic copy of your records. Florida law may restrict access for behavioral health patients.
  • You have a right to request that we correct or update information that is incorrect or incomplete. We are not required to change your health information. If we deny your request, we will provide you with information about our denial and how you can disagree with the denial. These requests must be in writing.
  • You have a right to receive a list of disclosures we have made. We do not have to account for the disclosures described under treatment, payment, health care operations, information provided to you, information released incident to an allowed disclosure (see Incidental Disclosures section in this notice), information released based on your written authorization, directory listings, information released for certain government functions, disclosures of a limited data set (which may only include date information and limited address information) and disclosures to correctional institutions or law enforcement in custodial situations. These requests must be in writing and must state a time period, which may not be longer than six years.
  • You have a right to get a paper copy of this notice. You may request a copy of this notice at any time.

Changes to this Notice

We reserve the right to change this notice at any time in the future. We reserve the right to make the changed notice effective for health information we already have about you, as well as any we receive in the future. We will post a current copy of the notice. Upon request, you may obtain a copy of the current notice by contacting our Privacy Department at (855) 466-6677. View answers to frequently asked questions about HIPAA. 

When We May Not Use or Disclose Your Health Information

Except as described in this notice, we will not use or disclose your health information without your written authorization. If you do authorize us to use or disclose your health information for another purpose, you may revoke your authorization in writing at any time. We will be unable to apply your request to revoke your authorization to information disclosed prior to the request.

Incidental Disclosures 

We make reasonable efforts to avoid incidental disclosures of your PHI. An example of an incidental disclosure is conversations that may be overheard between you and our team members at a BayCare Health System facility.

Privacy Complaints

If you believe your privacy rights have been violated, you may file a complaint with our Chief Privacy Officer or with the Secretary of the Department of Health & Human Services. To file a complaint with our Privacy Department, call (855) 466-6677.

You will not be penalized for filing a complaint.