Joint Notice of Privacy Practices
Arkansas Children's Hospital
University of Arkansas for Medical Sciences
ACH Medical Staff
Joint Notice of Privacy Practices
Effective Date: August 29, 2013
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE READ IT CAREFULLY.
This Notice is provided on behalf of Arkansas Children's Hospital (ACH) and the University of Arkansas Medical Sciences (UAMS) and the members of the ACH Medical Staff.
We understand that medical information about you and your health is personal and confidential, and we are committed to protecting your medical information. We create a record of the care and services you receive at ACH and our clinics. We need this record to provide you with quality care and to comply with certain legal requirements. This notice will tell you about the ways we may use and disclose your protected health information. We also describe your rights and certain obligations we have regarding the use and disclosure of protected health information.
Most of the patients at ACH are children. When we refer to "you" or "your" in this Notice, we refer to the patient. When we refer to types of disclosures of information to "you," we mean disclosures to the patient, the patient's guardian, or the person legally authorized to receive information about the patient.
This Notice of Privacy Practices describes how we may use and disclose your protected health information to carry out treatment, payment or health care operations and for other purposes permitted or required by law. "Protected Health Information" (PHI) is information about you or your minor child, including demographic data such as name, address, phone numbers, and other identifying information that may identify you and that relates to your past, present or future physical or mental health and related health care services.
We are required to give you this Notice and to maintain the Privacy of Protected Health Information. We must abide by this Notice, but we reserve the right to change the privacy practices described in it. This Notice may be accessed on the ACH web page www.archildrens.org and will be posted in prominent areas of our facility and on CareHub. You may receive a revised copy by sending a written request to the ACH Privacy Officer, Arkansas Children's Hospital, #1 Children's Way Slot 681, Little Rock, AR 72202. You may complain to us or to the U.S. Secretary of Health and Human Services if you believe your privacy rights have been violated. To file a complaint with us, you may send a letter describing the violation to the ACH Privacy Officer, Arkansas Children's Hospital, #1 Children's Way Slot 681, Little Rock, AR 72202. There will be no retaliation for filing a complaint.
If you have questions or need more information, contact the ACH Privacy Officer at 501-364-4368. This Notice applies at all clinics, departments and units on the ACH Campus; West Little Rock Clinic; Jonesboro Clinic and Lowell Clinic.
Who Will Follow This Notice?
This Notice describes the practices of:
- ACH healthcare professionals authorized to enter information into your records.
- ACH employees, ACH medical staff, volunteers and other ACH or clinic personnel.
- Students-in-training on the ACH campus.
- Members of the Organized Health Care Agreement: UAMS doctors, UAMS medical students, UAMS nurses, and other UAMS employees who work or provide health care services on the ACH campus.
You have the following rights relating to your protected health information.
- Obtain a paper copy of this Notice
- Request in writing a restriction on certain uses and disclosures of your information. We are not required to agree to the requested restrictions, unless you are requesting to restrict certain information from your health plan and you or someone on your behalf has paid for your ACH services in full. Both the request for the restriction and the payment in full must be made prior to any of the services being provided.
- Make a reasonable request to receive confidential communications of your PHI from us by alternative means or at alternative locations.
- Inspect or obtain a copy of records (in paper or electronic form) used to make decisions about you. You will be charged a fee for the cost of copying, mailing or other supplies. We are allowed to deny this request under certain circumstances. In some situations, you may ask for a review of this denial by a licensed healthcare professional identified by ACH who was not involved in the original denial decision. We will comply with the outcome of this review. We can deny access to psychotherapy notes.
- Request that we amend your record, if you feel the information is incomplete or incorrect; however, we are allowed to deny this request in certain circumstances. We may ask you to put these requests for amendments in writing and provide a reason that supports your request.
- Obtain a record of certain disclosures of your PHI.
- Provide us with written authorization (or permission) for uses and disclosures of your PHI that are not covered by the Notice or permitted by law. Except to the extent that the use or disclosure has already occurred, you may revoke (or cancel) this authorization. The request to cancel must be put in writing.
To inspect or obtain a copy of your records, send a written request to the Director of the ACH Medical Records Department. All other requests must be sent to the ACH Privacy Officer.
We are required to maintain the privacy of your PHI, abide by the terms of this Notice, make this Notice available to you, and notify you if a breach of your health information occurs.
Examples of Uses and Disclosures
We will use your PHI for treatment. Information obtained by a nurse, doctor, or other healthcare worker will be put into the medical record and used to plan and manage your treatment. We may communicate with and provide reports or other information to your doctor or other authorized persons who are involved in your care, including healthcare providers outside of ACH. We may disclose your PHI to other health care providers, public health reporting entities or health care plans for treatment, payment or operational purposes using the State Health Alliance for Records Exchange (SHARE) unless you have opted out of participation in SHARE. For more information on SHARE, you may visit the Arkansas Office of Health Information Technology website at http://ohit.arkansas.gov/Pages/default.aspx. PHI may also be shared between ACH and UAMS as necessary to carry out treatment.
We will use your PHI for payment. A bill will be sent to you and/or your insurance company with information about your diagnosis, procedures and supplies used. We may also disclose limited information about your bill to others to obtain payment. PHI may be shared between ACH and UAMS as necessary to carry out payment.
We will use your PHI for regular health care operations. ACH may use your PHI to check on the care you received, how you responded to it, and for other business purposes related to operating the hospital or clinic. Also, we may share your PHI, as necessary, to carry out the routine business functions. PHI may be shared between ACH and UAMS as necessary to carry out health care operations.
Business Associates. We may share some of your PHI with outside people or companies who provide services for us, such as typing physician reports.
Patient Directory. Unless you tell us not to, we may disclose your name, location in the facility, and general condition to people who ask for you by name. If provided by you, your religious affiliation may also be given to members of the clergy.
Notification. We may use or disclose PHI to notify a family member or other person involved in your care, your location and general condition unless you tell us not to do so.
Communication with family. A doctor, nurse or other healthcare worker may share PHI with a family member, a close personal friend, or a person that you identify, if they are involved in your care or in payment for your care, unless you tell us not to do so.
Research. Your PHI may be used for research purposes in certain circumstances with your permission, or after we receive approval from a special review board, known as an Institutional Review Board (IRB), whose members review and approve the research project. In certain circumstances, the IRB may determine your authorization is not necessary and issue a waiver. In all other instances, your authorization (permission) is required for the disclosure of your PHI for research.
Coroners, Medical Examiners, Funeral Directors. We may disclose PHI to these people, to the extent allowed by law, so that they may carry out their duties.
Organ Donor Organizations. If you are an organ donor, we may share your PHI with the organ donation agency for the purpose of tissue or organ donation in certain circumstances or as required by law.
Fundraising. Our Foundation may use information to notify you about fundraising campaigns or other charitable events to raise money for ACH. You have the right to opt out of fundraising communications and may do so by calling 1-800-880-7491 or emailing firstname.lastname@example.org or email@example.com.
Marketing. In certain circumstances, we may contact you as part of our marketing efforts. We may use your PHI for marketing purposes without your authorization only when we discuss such products or services with you face to face or provide you with a gift of nominal value related to the product or service. For other types of marketing activities, we will obtain your written authorization. Providing you information or refill reminders for a drug you are currently taking is not considered marketing.
Sale of Information: ACH will not sell your information without your prior written authorization or as otherwise allowed by law.
Food and Drug Administration (FDA). We may share your PHI with certain government agencies like the FDA so they can recall drugs or equipment.
Workers Compensation. We may disclose your PHI for workers’ compensation claims.
Public Health. We may give your PHI to public health agencies who are charged with preventing or controlling disease, injury or disability or as required by law.
Communicable Disease. We may disclose your PHI, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.
Correctional Institution. If you are an inmate of a correctional institution, we may disclose your PHI to the institution or law enforcement as needed for your health or the health and safety of others.
Law Enforcement. We may disclose your PHI for law enforcement purposes as required by law.
As Required by Law. We must disclose your PHI when required by federal, state or local law.
Health Oversight. We must disclose your PHI to a health oversight agency for activities authorized by law, such as investigations and inspections. Oversight agencies are those that oversee the health care system, government benefit programs, such as Medicaid, and other government regulatory programs.
Abuse or Neglect. We must disclose your PHI to government authorities that are authorized by law to receive reports of suspected child abuse or neglect involving children or endangered adults.
Legal Proceedings. We may disclose your PHI in the course of any judicial or administrative proceeding, in response to a court order, and in certain conditions, in response to a subpoena, discovery request or other lawful process, as allowed by law.
Required Uses and Disclosures. We must make disclosures when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the requirements of the HIPAA Privacy Regulations.
To Avoid Harm. We may use and disclose your information, when necessary, to prevent a serious threat to your health or safety or the health and safety of the public or another person.
For Specific Government Functions. In certain situations, we may disclose PHI of military personnel and veterans. We may disclose PHI for national security activities required by law.
Other Uses of Medical Information
Any use or disclosure of medical information not covered by this Notice or the laws that apply to such use or disclosure will be made only with your written authorization (permission.) You may cancel this authorization at any time, but you must put this in writing. If you cancel this authorization, we will no longer use or disclose medical information about you for the reasons covered by your written authorization unless we are required to do so by law. We are unable to withdraw any disclosures we have already made.
Revised June 2013