Privacy Policy (HIPAA) notice of privacy practices hipaa

 THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.
Your health information is personal, and Carter County Emergency & Rescue Squad, Inc. is committed to protecting it.  We are required by law to maintain the privacy of health information that could be used to identify you (PHI).  The law requires us to provide you with a copy of this Notice of Privacy Practices (Notice), which describes our privacy practices and our legal duties with respect to PHI.  Under certain circumstances, we may also be required to notify you following a breach of unsecured PHI.  HOW WE MAY USE OR DISCLOSURE YOUR PHI: Treatment.  We may use or disclose your PHI in connection with our treatment or transportation of you.  For example, we may disclose your PHI to doctors, nurses, technicians, medical students or any other health care professional involved in taking care of you.  We may also provide information about you to a hospital or dispatch center via radio, telephone or other electronic means.  We may provide a hospital or other health care facility with a copy of the medical records created by us in the course of treating or transporting you.  Payment.  We may use and disclose your medical information to obtain payment from you, an insurance company or other third parties.  For example, we may provide PHI to your health insurance plan in order to receive payment for our services.   Health care operations.  We may use and disclose your PHI for quality assurance activities, licensing and training programs to ensure that our personnel meet our standards for care, and to ensure that our personnel follow our established policies and procedures.  We may also use your information for obtaining legal, financial or accounting services, conducting business planning, processing complaints, and for the creation of reports that do not individually identify you.  Other uses or disclosures that do not require authorization.  The law permits us to use or disclose your PHI without your authorization in the following circumstances:  

• When required by law, but only to the extent required by law.  
• For public health activities, including disclosures to public health authorities authorized by law to collect information for the purpose of preventing or controlling disease, injury or disability, for reporting births and deaths, and for the conduct of public health investigations.  We may also be required by law to disclose information related to possible child abuse or neglect.
• To a social service or other protective services agency authorized by law to receive reports about victims of abuse, neglect or domestic violence.  We will make every effort to obtain your permission before releasing this information; however, in some cases, we may be required or authorized by law to act without your permission.
• For health oversight activities.
• For judicial and administrative proceedings, in response to a court order, subpoena, discovery request or other lawful process. 
• For law enforcement purposes, including disclosures: (i) to comply with laws requiring the reporting of certain types of injuries, (ii) made pursuant to a court order, warrant, subpoena, grand jury subpoena or other lawful process, (iii) to assist law enforcement in identifying or locating a suspect, fugitive, material witness or missing person, (iv) about the victim of a crime, if, under the circumstances, we are unable to obtain your permission, (v) about a death we reasonably believe may be the result of a crime, (vi) about a crime committed on our premises, or (vii) to notify law enforcement of the commission of a crime, the location of a victim or to identify the perpetrator of a crime, but only in emergency situations.
• To coroners, medical examiners and funeral directors.
• To organ procurement organizations.
• For approved medical research projects.
• To avert a serious threat to health or safety.
• For military and veterans activities, national security and other specialized government functions.
• To comply with laws relating to workers’ compensation or similar programs.

 USES OR DISCLOSURES WHERE YOU HAVE THE RIGHT TO OBJECT: Unless you object, we may provide relevant portions of your PHI to a family member, friend or other person that you indicate is involved in making decisions about your health care, or in paying for your health care.  We may use or disclose PHI to notify your family member, friends or personal representative about your condition.  In an emergency or when you are not capable of agreeing or objecting to these disclosures, we will disclose your PHI only to the extent we reasonably believe such disclosure to be in your best interest, and we will tell you about such disclosure after the emergency has passed, and give you the opportunity to object to future disclosures to family, friends or personal representatives.  Unless you object, we may also disclosure your PHI to persons involved in providing disaster relief, for example, the American Red Cross.    

 USES OR DISCLOSURES THAT REQUIRE YOUR WRITTEN CONSENT: Any other use or disclosure of PHI, other than those listed above will only be made with your written authorization.  The law also requires your written authorization before we may use or disclose: (i) psychotherapy notes, other than for the purpose of carrying out our treatment, payment or health care operations purposes, (ii) any PHI for our marketing purposes or (iii) any PHI as part of a sale of PHI.  You may revoke a previous written authorization in writing at any time.  If you elect to revoke a previously authorization, we will immediately stop any further uses or disclosures of your PHI for the purposes set out in the written authorizations to the extent we have not already acted in reliance on your authorization; however, we will be unable to retract any disclosures previously made with your permission.    YOUR RIGHTS WITH RESPECT TO YOUR PHI: You have the following rights with respect to your PHI:  

• The right to request restrictions on the use and disclosure of your PHI.  To exercise this right, you must submit a written request to our Privacy Officer.  We are not required to agree to your request; however, if we do agree, we will put our agreement in writing, and will abide by that agreement exception to the extent the use or disclosure of such PHI is necessary to provide you treatment in an emergency. Notwithstanding the foregoing, we must agree to a restriction on the use or disclosure of your PHI if: (i) the disclosure is for our payment or health care operations purposes and is not otherwise required by law and (ii) you or another person acting on your behalf has paid for our services in full.  
• The right to request to receive your PHI in a specific location (for example, at your work address rather than your home) or in a specific manner (for example, by email rather than regular mail). We will comply with all reasonable requests.  Any such request should be made in writing to our Privacy Officer.  
• The right to inspect and copy your PHI, except in limited circumstances.  Any such request should be made in writing to our Privacy Officer.  We will respond to your request within 30 days.  The law gives us the right to deny your request in certain instances; in which case, we will notify you in writing of the reasons for the denial and explain your rights with regard to having the denial reviewed.  A reasonable fee may be charged for making copies.   
• The right to request that we amend your PHI to the extent you believe it is inaccurate or incomplete.  Any such request should be made in writing to our Privacy Officer, and should include the reasons you believe that your information is inaccurate or incomplete.  We will respond to your request within 60 days.  We are not required to change your information, but if we do not agree to change your information, we will notify you of the reasons for our decision, and will explain your rights to submit a written statement of disagreement, to file a complaint, or to request that your requested change be included in any future disclosures of your PHI.  If we agree to a change, we will ask you who else you would like us to notify of the change.   
• The right to receive an accounting of any disclosures of your PHI made within the 6 years immediately preceding your request.  We are not required to provide you an accounting of disclosures: (i) made for our treatment, payment or health care operations purposes, (ii) made to directly to you, your family or friends, (iii) made for national security purposes, to law enforcement or certain other governmental purposes.  We are also not required to provide an accounting of disclosures made prior to April 14, 2003.  If you request more than one accounting within a 12 month period, we may charge you a reasonable fee for each additional accounting.   
• The right to receive a paper copy of this Notice.   

 NOTIFICATION IN THE EVENT OF AN UNAUTHORIZED USE OR DISCLOSURE: [Optional Provision] The law may require us to notify you in the event of an unauthorized use or disclosure of your unsecured PHI.  To the extent we are required to notify you, we must do so no later than 60 days following our discovery of such unauthorized use or disclosure.  This notification will be made by first class mail or email (if you have indicated a preference to be notified by email), and must contain the following information:  

•  A description of the unauthorized use or disclosure, including the date of the unauthorized use or disclosure and the date of its discovery, if known.  
• A description of the type of unsecured PHI that was used or disclosed. 
• A description of the steps you should take to protect yourself from potential harm resulting from the unauthorized use or disclosure.
• A brief description of what we are doing to investigate the breach, to protect against future breaches, and to mitigate the harm to you. 
• A way to contact us to ask questions or obtain additional information. 

 CHANGES TO THIS NOTICE: Carter County Emergency & Rescue Squad, Inc. is required to comply with the terms of this Notice as currently in effect.  We reserve the right to change or amend our privacy practices at any time in the future, and to make any changes applicable to PHI already in our possession.  This Notice will be revised to reflect any changes in our privacy practices.  You may obtain a copy of our revised Notice by contacting our Privacy Officer.  We will also make any revised Notice available on our website at: http://www.cartercountyems.com  CONTACT: If you would have questions or comments about our privacy practices, or if you would like to obtain additional information regarding your privacy rights, please contact our Privacy Officer at: Carter County Emergency & Rescue Squad, Inc.  P.O. Box 776   Elizabethton, Tennessee 37644.  You may also contact our Privacy Officer by phone at: 423-543-5445  COMPLAINTS: If you believe that your privacy rights have been violated, you may file a complaint with Carter County Emergency & Rescue Squad, Inc. or with Secretary of the Department of Health and Human Services (DHHS).  To file a complaint with us, please put your complaint in writing and mail it to the following address: Privacy Officer, Carter County Emergency & Rescue Squad, Inc.  105 Iodent Way Elizabethton, Tennessee  37643.  You may also contact our Privacy Officer by phone at: 423-543-5445.  To file a complaint with the DHHS, you must put your complaint in writing and mail it to: Office for Civil Rights,U.S. Department of Health and Human Services 200 Independence Avenue   S.W.  Washington, D.C. 20201.  You will not be retaliated against or denied any health services if you elect to file a complaint.    [Note: you may substitute the corresponding OCR Regional Office for the OCR Headquarters.  The addresses for the 10 Regional Offices can be found at: http://www.hhs.gov/ocr/office/about/rgn-hqaddresses.html  

Effective Date: April 14, 2003      

Revision Date: March 26, 2