Privacy Notices & Legal Information + -

Effective Date:
AUGUST 2016

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

If you have further questions, please contact the Privacy Officer by dialing the main number 757-312-8121.

Each time you visit a hospital, physician or other health care provider, a record of your visit is made. The record will contain your symptoms, examination and test results, diagnoses, treatment, a plan for future care or treatment and billing-related information. This notice applies to all of the records of your care generated by CRH, whether made by CRH personnel, agents of CRH or your personal doctor. Your personal doctor may have different policies or notices regarding the doctor’s use and disclosure of your health information created in the doctor’s office or clinic. We are required by law to maintain the privacy of your health information and provide you a description of our legal duties and privacy practices with respect to protected health information, and to notify affected individuals following a breach of unsecured protected health information. The notice also describes your rights with respect to protected health information. Protected health information, or PHI, is the information about you, including basic demographic information, that may identify you and that relates to your past, present or future physical or mental health condition and related health care services. CRH is required to abide by the terms of the notice currently in effect. We will not use or disclose your protected health information without your written permission, except as described in this notice.

You will be asked to sign a written statement acknowledging that you have been offered an opportunity to review this notice and to receive a copy upon request. The acknowledgement only serves to create a record that you have been offered a copy of this notice for review.

We reserve the right to change our practices and this notice and to make the new notice effective for all protected health information we maintain. The notice in effect at any given time will be posted in waiting areas throughout CRH, and on our web site, chesapeakeregional.com. Upon your request, we will provide you with a revised notice. This privacy notice is available throughout the hospital, physician offices and surgery center.

You will be asked to sign a written statement acknowledging that you have been offered an opportunity to review this notice and to receive a copy upon request. The acknowledgement only serves to create a record that you have been offered a copy of this notice for review.

Your PHI may be used and disclosed without your prior authorization by doctors, nurses, our office staff and others outside CRH that bare involved in your care and treatment for the purpose of  providing health care services to you, to pay your health  care bills, to support the operation of CRH, and any other  use required by law. The following categories describe the different ways that CRH may use and disclose your PHI without your prior authorization. Examples of these situations are also provided. These examples are not meant to describe every circumstance, but to give you an idea of the types of uses and disclosures that may be made by CRH. Other uses and disclosures of your PHI that are not listed or described in this notice will be made only with your prior written authorization. You may revoke this authorization at any time in writing, but it will not apply to any actions we have already taken.

Uses and Disclosures That May be Made Without Your Prior Written Authorization

• Treatment: Your PHI may be used and disclosed by us  for the purpose of providing medical treatment to you or  for another health care provider providing medical treatment to you. For example, a nurse obtains treatment information about you and documents it in your medical record, and the physician has access to that information.  If you require an X-ray to be taken, the X-ray technician also has access to your PHI. In addition, your PHI may be provided to a physician to whom you have been referred  or are otherwise seeing to ensure that the physician has the necessary information to diagnose or treat you. This  may also include your primary care physician, a physician who referred you to CRH or pharmacy employees involved  in filling or managing your prescriptions.
• Payment: Your PHI may be used and disclosed by us to obtain payment for your health care bills or to assist another health care provider in obtaining payment for its health care bills. For example, we may submit requests for payment to your health insurance company for the medical services that you received. We may also disclose your PHI as required by your health insurance plan before it approves or pays for the health care services we recommend for you.
• Health Care Operations: Your PHI may be used and disclosed by us to support our daily operations. These  health care operation activities include, but are not limited  to, quality assessment activities, employee review activities, educational purposes, licensing and conducting or arranging for other business activities. For example, we may disclose your PHI to the Performance Improvement Department to assess care and outcomes in your case and others like it.
• Health Care Operations of Other Health Care Providers: We may also use or disclose your PHI to assist other health care providers treating you with its quality improvement activities, evaluation of the health  care professionals or for fraud and abuse detection or  compliance. For example, we may disclose your PHI to another practice to assist in its efforts with complying with all rules related to operating a medical practice.
• Appointment Reminders: We may use or disclose your PHI to contact you to remind you of your appointment by mail or by telephone.
• Treatment Alternatives: We may use or disclose your PHI to provide you with information about treatment alternatives or other health-related benefits and services  that may be of interest to you. For example, we may communicate to you via newsletters, mail outs or other  means regarding treatment options, health-related information, disease management programs, wellness programs or other community-based initiatives or activities CRH is participating in.
• To Our Business Associates: We will share your PHI with third party “business associates” that perform various activities (e.g., billing or transcription services) for CRH. Whenever an arrangement between our office and a business associate involves the use or disclosure of your PHI, we will have a written agreement with that business associate that contains terms that will protect the privacy of your PHI. For example, CRH may hire a billing company to submit claims to your health care insurer. Your PHI will  be disclosed to this billing company, but a written agreement between our office and the billing company will prohibit the billing company from using your PHI in any way other than what we allow.
• Emergencies: We may use or disclose your PHI in an emergency treatment situation. If this happens, we will try to  obtain your consent as soon as reasonably practicable after the delivery of treatment. If a health care provider at CRH is required by law to treat you, and the health care provider has attempted to obtain your consent but is unable to obtain your consent, he or she may still use or disclose your PHI to treat you.

Uses or Disclosures That Require Us to Give You an Opportunity to Object

• Others Involved in Your Health Care or Payment  for Your Health Care: Unless you object, we may disclose to a member of your family, a relative, a close friend or any other person you identify, your PHI that directly relates to that person’s involvement in your health care. You will be asked to identify such individuals in writing for our medical records. Failure to provide this written notice may result in family members or others involved in your care being denied access to your information. If this written indication is absent, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgment. We may use or disclose your PHI to notify a family member or any other person that is responsible for your care of your location and general health condition. If we are unable to reach your family member or personal representative, then we may leave a message for them at the phone number that you or they have provided us.
• Disaster Relief: We may use or disclose your PHI to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or others involved in your health care.
• Directory: We may include certain limited information about you in the Facility Directory while you are a patient at Chesapeake Regional Medical Center. The information may include your name, location in CRMC, your general condition (good, fair) and your religious affiliation. This information may be provided to members of the clergy and, except for religious affiliation, to other people for ask for you by name. If you would like to opt out of being in the Facility Directory, please request the Opt Out Form from the Registration staff or Privacy Officer.
• Health Information Exchange: CRH participates in the MedVirginia Health Information Exchange (HIE), a secure, internet-based virtual health record that allows participating health care providers access to your health information. Benefits to using an HIE include a more complete and accurate health record, timely access for providers, better collaboration among providers, more informed decisions made about your care, and a reduction in mistakes. Information that will be included in the HIE includes medications, allergies present and past test results, summaries of past and current health problems, etc. Psychotherapy notes or other information that requires your specific authorization to release under federal law will not be included in the HIE. Unless you inform CRH that you opt out of sharing your information with the HIE, your health information will be submitted and visible to your providers through the HIE.

If you would like to opt out, please ask the registrar for an Opt Out Form or download one from our website here. Your choice to opt out of the HIE will not affect your ability to access medical care or prevent your providers from receiving your lab results, radiology reports and other test results they previously received by mail, fax or other electronic communication. Opting out of the HIE means your providers will not be able to search for your health information through the HIE while treating you. Opting out will not prevent your providers from sharing your health information when necessary for public health that is permitted and/or required by Virginia and federal law. You can email hie@chesapeakeregional.com to receive more information or ask any questions.

Other Permitted and Required Uses and Disclosures That May Be Made Without Your Authorization or Opportunity to Consent or Object

• As Required by Law: We may use or disclose your PHI to the extent that the use or disclosure is required by law. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. You will be notified, if required by law, of any such uses or disclosures.
• Public Health Activities: We may disclose your PHI for public health activities and purposes to a public health authority that is permitted by law to collect or receive the information. For example, the disclosure may be made for the purpose of controlling disease, injury or disability. We may also disclose your PHI, if directed by the public health authority, to any other government agency that is collaborating with the public health authority.
• Food and Drug Administration: We may disclose your PHI to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations, or to track products to enable product recalls; to make repairs the operating room replacements; or to conduct post marketing surveillance, as required.
• Communicable Diseases: We may disclose your PHI, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.
• Abuse or Neglect: We may disclose your PHI to a public health authority that is authorized by law to receive reports of child or adult abuse or neglect. In addition, we may disclose your PHI if we believe that you have been a victim of abuse, neglect or domestic violence as may be required or permitted by Virginia and/or federal law.
• Health Oversight: We may disclose your PHI to a health oversight agency for activities authorized by law. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs (such as Medicare or Medicaid), other government regulatory programs and civil rights laws.
• Legal Proceedings: We may disclose your PHI in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), and in certain conditions in response to a subpoena or other lawful request.
• Law Enforcement: We may disclose your PHI, so long as all legal requirements are met, for law enforcement purposes. Examples of these law enforcement purposes include (1) legal processes and otherwise required by law, (2) limited information requests for identification and location purposes, (3) pertaining to victims of a crime, (4) suspicion that death has occurred as a result of criminal conduct, (5) in the event that a crime occurs on the premises of CRMC, and (6) when responding to a medical emergency (not on CRMC’s premises) and it is likely that a crime has occurred.
• Coroners, Funeral Directors and Organ Donation: We may disclose your PHI to a coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose PHI to a funeral director in order to permit the funeral director to carry out his or her duties. We may disclose such information in reasonable anticipation of death. Your PHI may be used and disclosed for cadaveric organ, eye or tissue donation purposes.
• Research: We may disclose your PHI to researchers when their research has been approved by an Institutional Review Board that has reviewed the research proposal and established protocols to ensure the privacy of your PHI.
• Criminal Activity or Threats to Health and Safety: Consistent with applicable federal and state laws, we may disclose your medical information if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose your medical information if it is necessary for law enforcement authorities to identify or apprehend an individual.
• Military Activity and National Security: When the appropriate conditions apply, we may use or disclose PHI of individuals who are Armed Forces personnel (1) for activities deemed necessary by appropriate military command authorities, (2) for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits, or (3) to foreign military authority if you are a member of that foreign military service. We may also disclose your PHI to authorized federal officials for conducting national security and intelligence activities, including for the provision of protective services to the President or others legally authorized.
• Sponsors of Group Health Plans: We may disclose your PHI to the sponsor of a self-funded group health plan, as defined under ERISA. We may also give your employer information on whether you are enrolled in or have unenrolled from a health plan offered by the employer.
• Workers’ Compensation: Your PHI may be disclosed by us as authorized to comply with workers’ compensation laws and other similar legally-established programs.
• Inmates and Individuals in Police Custody: We may use or disclose your PHI if you are an inmate of a correctional facility or in police custody and that your health care, the health and safety of others, law enforcement of the correctional facility, or the administration and maintenance of the correctional facility.
• Fundraising: We may contact you to raise funds. We may use and disclose your PHI, including your demographic data, dates of health care provided, the department from which you received the services, the name of the treating physician, outcome information and health insurance status to a business associate or institutionally related foundation for fundraising purposes with your authorization. You have the right to opt out of receiving fundraising communications from us, our business associates and our institutionally related foundations. Each fundraising communication will provide you with a clear opportunity to elect not to receive further fundraising communications.
• Required Uses and Disclosures: Under the law, we must make certain disclosures to you as described below and, when required by the Secretary of the Department of Health and Human Services, to investigate or determine our compliance with the requirements of the Health Insurance Portability and Accountability Act and its regulations.

Uses and Disclosures Based Upon Your Written Authorization

Other uses and disclosures of your PHI will be made only with your written authorization, unless otherwise permitted or required by law. You may revoke this authorization, at any time, in writing, except to the extent we have already taken an action in reliance on the use or disclosure indicated in the authorization. The following uses and disclosures will be made only with your written authorization: (1) most uses and disclosures of psychotherapy notes, (2) uses and disclosures of PHI for marketing purposes, including subsidized treatment communications, (3) uses and disclosures that constitute a sale of PHI, and (4) other uses and disclosures not otherwise described in this Notice of Privacy Practices.

Following is a statement of your rights with respect to your medical information and a brief description of how you may exercise these rights:

You have the right to inspect and copy your PHI. 

You may inspect and obtain a copy of your PHI so long as we maintain the PHI. The information may contain medical and billing records and any other records that we use for making decisions about you. As permitted by federal and state law, we may charge you a fee for the costs of copying, mailing, or other supplies that are necessary to grant your request. However, under federal law, you may not inspect or copy the following records: psychotherapy notes; information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action; and medical information that is subject to law that prohibits access to medical information in certain circumstances. We may deny your request to inspect your medical information. In some circumstances, you may have a right to have this decision reviewed. Please contact our Privacy Officer if you have questions about access to your medical record.

You have the right to request a restriction of your PHI.

This means you may ask us not to use or disclose any part of your PHI for the purposes of treatment, payment or health care operations. You may also request that any part of your PHI not be disclosed to family members or friends who may be involved in your care or for notification purposes as described in this Notice of Privacy Practices. Your request must state the specific restriction requested and to whom you want the restriction to apply. Except as provided below, we are required to agree to a restriction that you may request. All requests for restrictions of your PHI must be made in writing to our Privacy Officer.  We are required to agree to a request to restrict certain disclosures of your PHI to a health plan if you have paid in full out-of-pocket for the health care item or service; however, there are Medicare, Medicaid and other exemptions by law that apply. You have the right to request to receive confidential communications from us by alternative means or at an alternative location.

You may ask that we contact you at work instead of home.

CRH will grant reasonable requests for confidential communications at alternative locations and/or via alternative means only if the request is submitted in writing and the written request includes a mailing address where the individual will receive bills for services provided by CRH and related correspondence regarding payment for services. Please realize we reserve the right to contact you by other means and at other locations if you fail to respond to any communication from us that requires a response. We will notify you in accordance with your original request prior to attempting to contact you by other means or at another location.

You may have the right to ask us to amend your PHI.

If you feel the health information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by CRH. Any request for an amendment must be sent in writing to the Privacy Officer. In addition, you must include a reason that supports your request. In certain cases, we may deny your request for amendment. If we deny your request for an amendment, you have the right to file a statement of disagreement and we may provide you with a rebuttal to your statement. You have the right to receive an accounting of certain disclosures we have made, if any, of your PHI. This right applies to disclosures for purposes other than treatment, payment, or health care operations as described in this notice. It excludes disclosures we may have made directly to you, disclosures pursuant to a valid authorization, for a facility directory, to family members or friends involved in your care or for appointment notification purposes.

You have the right to receive specific information regarding these disclosures that occurred six (6) years prior to the date of the request.

The right to receive this information is subject to certain exceptions, restrictions and limitations. To request an accounting, you must submit your request in writing to the Privacy Officer. Your request must specify the time period for which you are seeking an accounting of disclosure. The first accounting you request within a 12-month period will be provided free of charge, but you may be charged for the cost of providing additional accountings. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time.

You have the right to obtain a paper copy of this Notice from us.

You have a right to obtain a paper copy of this notice from us, upon request, even if you have agreed to accept this notice electronically.

You have the right to receive notifications of a data breach.

We are required to notify you upon a breach of any unsecured PHI. PHI is “unsecured” if it is not protected by a technology or methodology specified by the Secretary of Health and Human Services. A breach is the acquisition, access, use or disclosure not permitted by law that compromises the security or privacy of the PHI.

You may complain to us or to the Secretary of Health and Human Services if you believe your privacy rights have been violated by us. To file a complaint, you must follow the process outlined in CRH Patient Rights documentation and submit a complaint in writing to our Privacy Officer. We will not retaliate against you for filing a complaint.

If you have any questions about this notice or require additional information, you may dial the main number at 757-312-8121 and request the Privacy Officer.  Or you may contact the Privacy Officer by mail at:

Privacy Officer
Health Information Department
Chesapeake Regional Medical Center
736 Battlefield Blvd., North, Chesapeake, Virginia
23320

Effective Date

This revised Notice became effective on AUGUST 2016.