Effective Date: 04-14-03 THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. UHHS/CSAHS is required by law to maintain the privacy of your health information and to provide you with notice of its legal duties and privacy practices with respect to your health information. UHHS/CSAHS is required to follow the privacy practices described in this Notice. This Notice describes how UHHS/CSAHS has extended certain protections to your protected health information (PHI) and how, when, and why we may use and disclosure your PHI. With certain exceptions, UHHS/CSAHS will use or disclose your PHI in the minimum necessary manner to accomplish the intended purpose of the use or disclosure. UHHS/CSAHS will share PHI as is necessary to provide quality health care and receive reimbursement for those services as permitted by law. We reserve the right to change our privacy practices and the terms of this Notice at any time. If we change our notice, we will post the revised notice in the facility and will have them available upon request. You can receive a copy of the current notice at any time. The effective date is listed just below the title. You will be asked to acknowledge in writing your receipt of this notice. You may view this Notice or any new notices on our website at www.sjws.net or www.svch.net. USES AND DISCLOSURES OF YOUR PROTECTED HEALTH INFORMATION UHHS/CSAHS is committed to maintaining the confidentiality of your health information. Your health information may be used and disclosed for purposes of treatment, payment, and health care operations. Outside of these permitted uses, we will not disclose your health information without a signed authorization from you, unless the law permits or requires us to use or disclose this information without your authorization. You have the right to revoke that authorization in writing except to the extent any action has been taken in reliance on the authorization. Treatment, Payment, and Health Care Operations. Except as otherwise provided, UHHS/CSAHS may use and disclosure your health information for purposes of treatment, payment, and as otherwise necessary and permitted by law, for our health care operations. This may include disclosure to another health care provider who, at the request of your physician, becomes involved in your treatment, for purposes of approval of reimbursement from your health plan, or for audit purposes, we may disclose to our accountant or attorney. Stricter Law. Certain provisions of Ohio law may be more stringent than the federal laws and regulations protecting the privacy of your medical information. UHHS/CSAHS will, as required by law, comply with the more stringent provisions of Ohio law. Business Associates. It may be necessary for us to provide your health information to certain outside persons or entities that assist us with our health care operations, such as auditing, accreditation, legal services, etc. These business associates are required to properly safeguard the privacy of your health information. Appointments, Services, and Fundraising Efforts. We may contact you to provide appointment reminder, information about treatment alternatives, or other health-related benefits and services that may be of interest to you. We may contact you to support our fundraising efforts. You may opt-out of receiving any further fundraising communications from our facility by notifying our Privacy Officer in writing of your name, address, and request to be removed from our fundraising mailing and contact lists. USE AND DISCLOSURES REQUIRING YOU TO HAVE AN OPPORTUNITY TO OBJECT Family and Friends. With your approval and using our professional judgment, your health information may be disclosed to family and friends who are directly involved in your care or in the payment for your care. If you are unavailable, incapacitated, or in an emergency medical situation, and we determine that a limited disclosure may be in your best interest, we may share limited health information with such individuals without your approval. Patient Directories. Your name, location, general condition, and religious affiliation may be put into our patient directory for disclosure to callers or visitors who ask for you by name. Your religious affiliation may be shared with clergy. You have the opportunity to restrict or prohibit some or all of the uses or disclosures in your patient directory. If you wish to restrict the information in our directory, please contact the Privacy Officer with the information concerning your restriction. USES AND DISCLOSURES OF PHI We may use or disclose medical information about you without your prior authorization for several other reasons. Subject to certain requirements, we may give out medical information about you without prior authorization for public health purposes, accrediting organizations such as JCAHO, required abuse or neglect reporting, health oversight audits or inspections, research studies, funeral arrangements and organ donations, worker's compensation purposes, and emergencies. We also disclose medical information when required by law, such as in response to a request from law enforcement in specific circumstances or in response to valid judicial or administrative orders. We may use or disclose your medical information for research purposes but only with your prior authorization or a proper waiver of authorization from the IRB or Privacy Board. YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION 1. Restrictions on Use and Disclosure of Individual Health Information. You have the right to request that we restrict how we use and disclosure your health information. These restrictions must be made in writing and signed by you or your representative. UHHS/CSAHS is not required to agree to your restrictions. We cannot agree to limit uses/disclosures that are required by law. In the event of a termination of an agreed-to restriction by us, we will notify you of such termination. You may terminate, in writing or orally, any agreed-to restriction by sending such termination notice to the Privacy Officer. 2. Access and/or Copying Your Health Information. You have the right to request to inspect and/or copy your health information. Your request must be in writing on an access form that you can obtain from the Director of Medical Records or the Privacy Officer. You or your legal representative must sign the form and return it to the Director of Medical Records. If you request copies, we may charge a fee for the cost of copying, mailing or other related supplies. There will also be a charge for postage if you request a mailed copy and, if requested, for preparation of a summary of the requested information. We will respond within 30 days unless an extension is taken. In certain circumstances, you may not be permitted access. Depending on the circumstances, you may request a review of the decision to deny access. If we deny your request, you will be given written notice that will explain the basis and your right to appeal. 3. Amendments to Individual Health Information. You have the right to request that your health information be amended or corrected. We will respond within 60 days unless an extension is taken. In certain cases, we may deny your request for amendment and you will be given written notice that will explain the basis and your right to appeal, which will be appended to your health information. You may also submit a statement of disagreement and we may prepare a rebuttal that will be provided to you. All amendment requests must be in writing, signed by you or your representative, and must state the reasons for the amendment. If we make an amendment, we may notify others who work with us and have copies of the un-amended record if we believe that such notification is necessary. You may obtain a Request for Amendment form from the Privacy Officer. 4. Accounting for Disclosures of Individual Health Information. You have the right to receive an accounting of certain disclosures of your health information made by us after April 14, 2003. Requests must be made in writing and signed by you or your representative. Request for Accounting forms are available from the Privacy Officer. The first accounting in any 12-month period is free; you will be charged a fee for each subsequent accounting within the same twelve-month period. 5. Right to Paper Copy. You have the right to receive a paper copy of this or any revised Notice and/or an electronic copy by email upon request to Privacy Officer. 6. Confidential Communications. You have the right to request that medical information about you be communicated to you in a confidential manner, such as sending mail to an address other than your home, by notifying us in writing of a specific way or location for us to use to communicate with you. If you have any questions about this Notice, please contact the UHHS/CSAHS Privacy Officer. HOW TO COMPLAIN ABOUT OUR PRIVACY PRACTICES If you believe that we may have violated your privacy rights, or you disagree with a decision about your PHI, you may file a complaint with the Privacy Officer at 2 Summit Park Drive, Independence, OH 44131, phone: 216-436-4640. You may also file a written complaint with the Secretary of the U.S. Department of Health and Human Services at 200 Independence Avenue, SW, Washington D.C. 20201 or call 1-877-696-6775. There will be no retaliation for filing a complaint. ORGANIZED HEALTH CARE ARRANGEMENT This Notice applies to St. John West Shore Hospital, St. Vincent Charity Hospital, Saint Luke's Medical Center, the Solon facility, physicians with medical staff privileges at our facilities, licensed professionals who treat patients at our facilities, our durable medical equipment company, home health agency, and clinics. These members work and practice at our hospitals, clinics and other facilities in which health care is provided. They may share personal health information concerning our patients to carry out treatment, payment, and health care operations as permitted by law.