Notice of Privacy Practices
Effective Date: May 29, 2019
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
If you have any questions about this notice, please contact Bianca Felts, Privacy Officer at (608) 339-8403 or firstname.lastname@example.org.
Gundersen Moundview Hospital and Clinics maintain a common healthcare record for you and all other patients. This Notice of Privacy Practices describes how we may use and disclose your protected health information to carry out treatment, payment or healthcare operations and for other purposes that are permitted or required by law. It also describes your rights to access and control your protected health information. “Protected health information” is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related healthcare services.
Gundersen Moundview Hospital and Clinics is required by law to maintain the privacy of protected health information and to provide you with notice of our legal duties and privacy practices with respect to protected health information. We are required by law to abide by the terms of this Notice of Privacy Practices. We may change the terms of our notice, at any time. Any new notice will be effective for all protected health information that we maintain at that time.
OUR PLEDGE REGARDING YOUR PROTECTED HEALTH INFORMATION
We understand that health information about you and your health is personal. We are committed to protecting your health information. We create a record of the care and services you receive at Gundersen Moundview Hospital and Clinics. We need this record to provide you with quality care and to comply with certain legal requirements. This Notice applies to all records of your care generated by Gundersen Health System.
HOW WE MAY USE AND DISCLOSE PROTECTED HEALTH INFORMATION ABOUT YOU FOR TREATMENT, PAYMENT, OR HEALTHCARE OPERATIONS
The following categories describe different ways that we use and disclose health information. For each category of uses or disclosures, we will explain what we mean and try to give some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.
We may use your health and/or mental health information to provide you with medical treatment or services. In accordance with the 2014 Mental Health Care Coordination Bill, we may disclose your health and/or mental health information to doctors, nurses, technicians, graduate medical education, nursing and other students, or other hospital or clinic personnel who are involved in taking care of you at Gundersen Moundview Hospital and Clinics. For example, a doctor treating you for a broken leg may need to know if you have diabetes because he/she may need to inform the Dietitian so that we can arrange for appropriate meals. We also may disclose your health and/or mental health information to people outside the hospital or clinic who may be involved in your health care after you leave Gundersen Moundview Hospital and Clinics.
Health Information Exchange
We electronically exchange healthcare information to facilitate access to health and/or mental health information that may be relevant to your care. For example, if you are admitted to a hospital on an emergency basis and cannot provide important information about your health condition, health information exchange will allow us to make your medical information available to those who need it to treat you at the hospital. Access to your health and/or mental health information is readily available, when needed, which means better care for you. You have the right to opt-out of the health information exchange by contacting our Privacy Officer.
Your health and/or mental health information will be used, as needed, to obtain payment for your healthcare services. This may include certain activities that your health insurance plan may undertake before it approves or pays for the healthcare services we recommend for you such as: making a determination of eligibility or coverage for insurance benefits; reviewing services provided to you for medical necessity; and undertaking utilization review activities. For example, relevant health information may be disclosed to the health plan in order to obtain approval for a hospital admission.
For Healthcare Operations
We may use or disclose, as needed, your health and/or mental health information for certain administrative, financial, legal, quality assessment and improvement, accreditation, credentialing and training activities. For example, we may use health information to review our treatment and services, and to evaluate the competence, qualifications and performance of our staff in caring for you. We may use health information to conduct training programs in which students, trainees or practitioners in areas of healthcare learn to practice or improve their skills. We may also combine and use health information about many of our patients for business planning and development purposes including, for example, cost management, formulary development and decisions on what additional services Gundersen Moundview Hospital and Clinics should offer, what services are not needed, and whether certain new treatments are effective. We may also disclose health information to doctors, nurses, technicians, students, and other Gundersen Health System hospital or clinic personnel for review and learning purposes. Further, we may disclose health information to referring doctors, clinics, hospitals and emergency medical transportation companies that previously cared for you to facilitate their quality improvement and other healthcare operations activities. In addition, we may disclose health information to other outside organizations for healthcare operations and research purposes including, for example, data aggregation, quality assessment and peer review functions permitted by 42 CFR 164.504(e)(2)(i)(B) and other applicable federal and state laws. Finally, we may use health information for business management and general administrative purposes including, for example, implementation and compliance with federal and state laws, customer service, and resolution of patient complaints and grievances.
THIS NOTICE ALSO DESCRIBES THE PRIVACY PRACTICES OF AN ORGANIZED HEALTHCARE ARRANGEMENT (“OHCA”) BETWEEN GUNDERSEN AND CERTAIN HEALTHCARE PROVIDERS AND ORGANIZATIONS.
An OHCA allows legally separate covered entities to use and disclose PHI for the joint operation of the arrangement. We participate in such an arrangement of healthcare organizations who have agreed to work with each other to facilitate access to health information relevant to your care. For example, if you present to a hospital for emergency care and cannot provide important information about your health, the OHCA will allow us to use your PHI from our OHCA participants to treat you. When it is needed, ready access to your PHI means better care for you. We store health information about our patients in a joint electronic health record with other healthcare providers who participate in this OHCA. Members of the OHCA must be able to share your health information freely for treatment, payment and healthcare operations purposes. For information about organizations participating in our OHCA, please contact our Privacy Officer.
HOW WE MAY USE AND DISCLOSE PROTECTED HEALTH INFORMATION ABOUT YOU WITHOUT YOUR WRITTEN AUTHORIZATION
We may use and disclose health and/or mental health information to contact you as a reminder that you have an appointment for treatment or medical care at Gundersen Moundview Hospital and Clinics.
We may share your health and/or mental health information with third party “business associates” that perform various activities for Gundersen Health System including, for example, billing, collection, and patient satisfaction survey and transcription services. Whenever an arrangement between Gundersen Health System and a business associate involves the use or disclosure of your health information, we will have a written contract that contains terms that will protect the privacy of your health information.
Treatment Alternatives and Other Programs
We may use or disclose your health and/or mental health information, as necessary, to provide you with information about treatment alternatives or other health-related programs, benefits and services that may be of interest to you. We may also use your name and address to send you newsletters about the programs and services we offer including, for example, smoking cessation, weight loss, and other health-related programs. Further, we may use your name, address and health information to send you notices and invitations to celebration events offered by Gundersen Health System for patients who have received cardiac, cancer, neonatal and other care. We may also send you information about health-related products or services that we believe may be beneficial to you. You may contact our Privacy Officer to request that these materials not be sent to you.
We may use certain information (name, address, telephone number or e-mail information, age, date of birth, gender, health insurance status, dates of service, department of service information, treating physician information or outcome information) to contact you for the purpose of raising money for Gundersen Moundview Hospital and Clinics and you will have the right to opt-out of receiving such communications with each solicitation. For the same purpose, we may provide your name to our institutionally related foundation – Moundview Memorial Healthcare Foundation. The money raised will be used to expand and improve the services and programs we provide the community. You are free to opt-out of fundraising solicitation, and your decision will have no impact on your treatment or payment of services at Gundersen Moundview Hospital and Clinics.
If you wish to opt-out of fundraising, you may contact the Foundation by calling 608-339-8391 or you may email the Foundation at the following email address: email@example.com.
Unless you object, we may use information, such as your name, location in our facility, and your religious affiliation for our directory. It is our duty to give you enough information, so you can decide whether or not to object to the disclosure of this information for our directory. The information about you contained in our directory will be disclosed to people who ask for you by name. However, the information about your religious affiliation will only be disclosed to clergy. You will be allowed to agree or object verbally regarding the use of your health information for directory purposes.
Others Involved in Your Care
Unless you object, we may disclose to a member of your family, a relative, a close friend or any other person you identify, your health and/or mental health information that directly relates to that person’s involvement in your health care. If you are unable to agree or object to such a disclosure, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgment. We may use or disclose health information to notify or assist in notifying a family member, personal representative or any other person that is responsible for your care of your location, general condition or death. Finally, we may use or disclose your health information to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in your health care.
As Required By Law
We may use or disclose your health information to the extent that federal, state or local law requires the use or disclosure. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. For example, we may disclose health information to report child abuse or to respond to a court order.
Consistent with applicable federal and state laws, we may use or disclose your health information, if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose your health information if it is necessary for law enforcement authorities to identify or apprehend an individual.
We may disclose your health information as authorized to comply with workers’ compensation laws and other similar legally established programs.
Public Health Risks
We may disclose your health information for public health activities and purposes to a public health authority that is permitted by law to collect or receive the information. These activities generally include, for example, the following:
- To prevent or control disease, injury or disability;
- To report births and deaths;
- To report child abuse or neglect;
- To report reactions to medications or problems with products;
- To notify people of recalls of products they may be using;
- To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
- To notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect, domestic violence, gunshot or knife wound, or other mandatory reportable incidents. We will only make this disclosure if required or authorized by law.
Health Oversight Activities
We may disclose your health information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
Lawsuits and Disputes
We may disclose your health information in response to a court or administrative order, discovery request, or another lawful process by someone else involved in the dispute.
We may disclose your health information if asked to do so by a law enforcement official; for example, in the response to a court order, warrant, summons or similar process; to identify or locate a suspect, fugitive, material witness, or missing person. Under some limited circumstances we will request your authorization prior to permitting disclosure.
Coroners and Medical Examiners
We may disclose your health information to coroners and medical examiners. For example, this may be necessary to determine the cause of death.
Cadaveric, Organ, Eye or Tissue Donation
We may disclose your health information to organizations involved in procuring organs and tissues for transplantation.
To Avert a Serious Threat to Health or Public Safety
We may disclose your health information if it is necessary to prevent or lessen a serious threat to your health and safety, the health and safety of another person, or to the general public.
Health information Availability After Death
We may use or disclose information without your authorization 50 years after the date of your death.
SPECIAL GOVERNMENT FUNCTIONS
Military Activity and National Security
When the appropriate conditions apply, we may use or disclose health information of individuals who are Armed Forces personnel: (1) for activities deemed necessary by appropriate military command authorities; (2) for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits; or (3) to foreign military authority if you are a member of that foreign military services.
We may disclose your health information to authorized federal officials for conducting national security and intelligence activities, including the provision of protective services to the President or others legally authorized.
If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose your health information to the correctional institution or law enforcement official. This disclosure would be necessary: (1) for the institution to provide you with healthcare; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
Medical Suitability Determinations
We may disclose your health information to a state or federal agency for use in making medical suitability determinations.
HOW WE MAY USE AND DISCLOSE PROTECTED HEALTH INFORMATION ABOUT YOU THAT REQUIRES YOUR AUTHORIZATION
Except as described in this notice; Gundersen Moundview Hospital and Clinics will not use or disclose your protected health information without written authorization from you. Uses and disclosures made for the purpose of some marketing activities and the sale of protected health information (PHI) require your authorization. Other uses and disclosures of your health information not covered by this notice will only be made with your written authorization. You may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer be able to use or disclose health information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your authorization.
YOUR RIGHTS REGARDING PROTECTED HEALTH INFORMATION ABOUT YOU
Although your health care record is the physical property of Gundersen Moundview Hospital and Clinics, the information belongs to you.
You have the following rights regarding the health information we maintain about you:
Right to Inspect and Copy
You have the right to inspect and receive a copy of the billing and health information that may be used to make decisions about your care. You have the right to request that the copy be provided in an electronic form or format. If the form or format is not readily producible, Gundersen Moundview Hospital and Clinics will work with you to provide it in a reasonable electronic form or format. You also have the right to request that the electronic copy of your health information be sent to a third party in an electronic form or format agreed upon between you and Gundersen Moundview Hospital and Clinics.
To inspect or receive a copy of the health information that may be used to make decisions about you, please contact Medical Records in the Health Information Management Department, 402 West Lake Street, Friendship, Wisconsin 53934, (608) 339-8375. Please note that a request to inspect your health care record means that you may examine them at a convenient time, upon making an appointment with Medical Records.
We may deny your request to inspect and receive a copy in certain, very limited, circumstances. If you are denied access to your health information, you may request that the denial be reviewed. Another licensed health care professional chosen by Gundersen Moundview Hospital and Clinics will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.
Right to Amend Your Protected Health Information
If you feel that health information we have about you is incorrect or incomplete, you may ask us to amend that information. You have the right to request an amendment for as long as the information is kept by or for Gundersen Moundview Hospital and Clinics.
In certain cases, we may deny your request for an amendment if information: (1) was not created by us or if the person or entity that created the information is no longer available to make the amendment; (2) is not part of the health information kept by or for Gundersen Moundview Hospital and Clinics; (3) is not part of the information which you would be permitted to inspect and copy; or (4) is accurate and complete.
To request an amendment, please contact our Privacy Officer.
Right to Receive an Accounting of Disclosures
You have the right to request an "accounting of disclosures." This is a list of the disclosures we made containing your health information.
To request an accounting of disclosures, you must submit your request in writing to our Privacy Officer. Your request must state a time period, which may not be longer than six years from your requested date. The first list you request within a 12-month period will be free. For additional lists, we may charge you for the cost of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred. This will not include disclosures made for the purpose of treatment, payment, or healthcare operations.
Right to Request Restrictions of Your Protected Health Information
You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on your health information we disclose to someone who is involved in your care or for the payment of your care, like a family member or friend. For example, you could ask that we not use or disclose information about a surgery you had to your spouse. We are not required to agree with your request. If we do agree, we will comply with your request unless the information is needed to provide emergency treatment. If you wish to request restrictions regarding your health information, please contact our Privacy Officer for additional information.
You have a right to request a restriction on the health information we disclose to your health plan if the disclosure is for the purpose of carrying out payment or healthcare operations and is not otherwise required by law; and the health information pertains solely to a healthcare item or service for which you, or the person other than the health plan on your behalf, has paid Gundersen Moundview Hospital and Clinics in full for that healthcare item or service. If you wish to request restrictions on the health information we disclose to your health plan, please contact: Executive Director of Revenue Cycle, 1900 South Avenue, NCA3-02, La Crosse, Wisconsin 54601, (608) 775-4370.
Right to Request Confidential Communications
We will accommodate reasonable requests. We may also condition this accommodation by asking you for information as to how payment will be handled or specification of an alternative address or other method of contact. For example, you can ask that we only contact you at home or only at work or only by mail. We will not require an explanation from you for the basis of the request.
To request confidential communications, you must specify how or where you wish to be contacted. Your request must be submitted in writing to our Privacy Officer.
Right to a Paper Copy of This Notice
Upon request, even if you have agreed to accept this Notice electronically you are still entitled to a paper copy. You may print a copy of this Notice and future amendments to it by accessing the Gundersen Health System Web site, www.gundersenhealth.org, or by contacting our Privacy Officer.
Right to be Notified of a Breach
You have the right to be notified following a breach of your unsecured health information. Gundersen Moundview Hospital and Clinics is required by law to maintain the privacy of health information and provide you with notice of its legal duties and privacy practices with respect to health information.
CHANGES TO THIS NOTICE
We reserve the right to change this notice and reserve the right to make the revised or changed notice effective for health information we already have about you as well as any information we receive in the future. A copy of the current notice and future changes will be made available to you and posted in the hospital, the clinic or on the Gundersen Health System Web site www.gundersenhealth.org. In addition, each time you are registered or are admitted to Gundersen Moundview Hospital and Clinics for treatment or health care services, as an inpatient or outpatient, if requested, we will offer you a copy of the current notice then in effect.
If you believe your privacy rights have been violated, you may file a complaint with Gundersen Moundview Hospital and Clinics or with the Secretary of the Department of Health and Human Services. To file a complaint with Gundersen Moundview Hospital and Clinics, contact either our Privacy Officer, 402 West Lake Street, Friendship, WI 53934, (608) 339-8403, or General Counsel, Legal Department, 1900 South Avenue, BELL-04, La Crosse, Wisconsin 54601, (608) 775-6619. All complaints must be submitted in writing. To file a complaint with the Secretary, please contact our Privacy Officer to obtain more information. We will not retaliate against you for filing such a complaint.
Gundersen Moundview Hospital and Clinics contact person for issues regarding patient privacy and the Privacy Rule is: Bianca Felts, Privacy Officer, 402 West Lake Street, Friendship, WI 53934 (608) 339-8403, firstname.lastname@example.org or the Privacy Office at Gundersen Health System at (608)775-7439, PrivacyOffice@gundersenhealth.org.