Effective Date: April 14, 2003
Revised Date: May 22, 2013
January 22, 2019
September 28, 2020
September 6, 2023
If you have any questions about this Notice, please contact the facility Privacy Officer by dialing 715-294-5749.
HEALTH CARE PROVIDERS COVERED BY THIS NOTICE
This Notice describes the practices of the following health care providers who are part of Osceola Medical Center (“OMC”) and will apply to you to the extent you receive care at or from the following OMC units:
The Osceola Clinic
The Scandia Clinic
OMC Pharmacy
Osceola Medical Center Hospital
Osceola Medical Center Specialty Clinic
Osceola Medical Center Medical Staff
These health care providers may share protected health information for the treatment, payment, and health care operations. Each time you visit a hospital, long term care facility, physician, or other healthcare provider, as a part of Osceola Medical Center, a record of your visit is made. Typically, this record contains your symptoms, examination and test results, diagnoses, treatment, plan for future care or treatment, and billing related information. In addition to health information, it can include demographic information such as your name, address, phone number, patient ID, social security or other identification number and date of birth. This Notice applies to all the records of your care generated by the hospital facility whether made by hospital personnel, agents of the hospital, or your personal doctor.
OUR RESPONSIBILITIES
We are required by law:
to maintain the privacy and security of your health information;
provide you with this Notice which describes our legal duties and privacy practices with respect to your health information;
abide by the terms of this Notice;
notify you if we are unable to agree to a requested restriction on how your information is used or disclosed;
accommodate reasonable requests you may make to communicate health information by alternative means or at alternative locations; and
obtain your written authorization to use or disclose your health information for reasons other than those listed above and permitted under law.
HOW WE MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU
The following categories describe examples of the way we use and disclose medical information:
For treatment: We may use medical information about you to provide you treatment or services. We may disclose medical information about you to doctors, nurses, technicians, medical students, or other hospital personnel who are involved in taking care of you at Osceola Medical Center. For example, a doctor treating you for an injury may need to know if you have diabetes, because diabetes may slow the healing process; or if your doctor orders physical therapy, the nursing staff will need to discuss your care and treatment with the Physical Therapist. Different departments of Osceola Medical Center also may share medical information about you in order to coordinate the different things you may need, such as prescriptions, lab work, meals, and x-rays. We may also provide your physician or a subsequent healthcare provider with copies of various reports that should assist him or her in treating you once you are discharged from Osceola Medical Center. There are several methods for sharing your information for treatment, including by phone, fax, paper records and secure electronic exchange with other health care providers.
For Payment: We may use and disclose medical information about your treatment and services to bill and collect payment from you, your insurance company or a third party payer. For example, we may need to give your insurance company information about your surgery so they will pay us or reimburse you for the treatment. We may also tell your health plan about the treatment you are going to receive to determine whether your plan will cover it.
For Health Care Operations: We may use and disclose medical information about you for health care operations which include things like quality assurance activities; granting medical staff credentials to physicians; administrative activities, including the hospital financial and business planning and development; customer service activities, including investigation of complaints; and education and training activities. For example, members of the medical staff and/or quality improvement team may use information in your health record to assess the care and outcomes in your case and others like it. The results will then be used to continually improve the quality of care for all patients we serve. For example, we may combine medical information about many patients to evaluate the need for new services, treatment, or equipment. We may disclose information to doctors, nurses, and other students for educational purposes. We may also use and disclose medical information to business associates we have contracted with to perform the agreed upon service and billing for it. We may use and disclose health information to remind you that you have an appointment for medical care, to assess your satisfaction with our services, to tell you about possible treatment alternatives or about health-related benefits or services. We may also use information for population-based activities relating to improving health or reducing health care costs and for conducting training programs and reviewing the competence of health care professionals.
Business Associates: There are some services provided in our organization through contracts with business associates. Examples may include physician services in the emergency department and radiology, certain outside laboratories, or a copy service we use when making copies of your health record. Other examples include disclosures to our lawyers or accountants needed for legal or audit purposes. When these services are contracted, we may disclose your health information to our business associate so that they can perform the job we’ve asked them to do and bill you or your third party for services rendered. To protect your health information, however, we require the business associate to appropriately safeguard your information.
Directory: We may include certain limited information about you in the facility directory while you are here. The information may include your name, location in the facility, your general condition (e.g. fair, stable, etc,) and your religious affiliation. This information may be provided to members of the clergy and, except for religious affiliation, to other people who ask for you by name. If you would like to opt out of being in the facility directory, please request the Directory Opt Out Form from the admission staff or facility Privacy Officer.
Fundraising: We may contact you as part of a fundraising effort for Osceola Medical Center of the affiliated foundation. If you receive communication from us for fundraising purposes, you will be informed on how to clearly opt out of any further fundraising communications.
Individuals Involved in Your Care or Payment for Your Care: We may release medical information about you to a friend or family member who is involved in your medical care or who helps pay for your care. In addition, we may disclose medical information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status, and location.
Research: We may disclose information to researchers when an institutional review board that has reviewed the research proposal and established protocols, to ensure the privacy of your health information has approved their research.
Future Communications: We may communicate to you via newsletters, mail outs, or other means regarding treatment options, health related information, disease-management programs, wellness programs, or other community-based initiatives or activities our facility is participating in. We will be sending out results of tests on folded cards or in envelopes via the mail unless you decline to not have results mailed to you.
Organized Health Care Arrangement: This facility and its medical staff members have organized and are presenting to you this document as a joint notice. Information will be shared as necessary to carry out treatment, payment, and health care operations.
Physicians and caregivers may have access to protected health information in their offices to assist in reviewing past treatment as it may affect treatment at the time.
Sale of Protected Health Information: It is prohibited for Osceola Medical Center to sell protected health information to anyone except in very limited exceptions provided under law. For example, we may sell information if you expressly authorize us to do so. An authorization is not needed if the purpose of the exchange is for health care operations related to the sale, merger or consolidation of OMC; treatment of the individual; public health activities; research purposes where the price charged reflects the cost of preparation and transmittal of the information; performance of services by a business associate on behalf of the covered entity; providing the individual with a copy of the protected health information maintained about him/her.
SITUATIONS THAT DO NOT REQUIRE YOUR VERBAL AGREEMENT OR WRITTEN AUTHORIZATION
The following uses of your health information are permitted by law without any oral or written permission from you:
Funeral Directors: We may disclose health information to funeral directors consistent with applicable law to carry out their duties.
Organ Procurement Organizations: Consistent with applicable law, we may disclose health information to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs for the purpose of tissue donation and transplant.
Food and Drug Administration (FDA): We may disclose to the FDA health information relative to adverse events with respect to food, supplements, product and product defects or post marketing surveillance information to enable product recalls, repairs or replacement.
Workers Compensation: We may disclose health information to the extent authorized by and to the extent necessary to comply with laws relating to workers compensation or other similar programs established by law.
Public Health and Safety: As required by law, we may disclose your health information to public health or legal authorities charged with preventing or controlling disease, injury or disability. These activities generally include the following:
To report births and deaths;
To report child abuse or neglect;
To report reactions to medications or problems with products;
To notify people of recalls of products they may be using;
To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; and
To notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence. We will only make this disclosure if you agree or when required by law.
Correctional Institution: Should you be an inmate of a correctional institution, we may disclose to the institution or agents thereof, health information necessary for your health, and the health and safety of other individuals.
Law Enforcement: We may disclose health information for law enforcement purposes as required by law, or in response to a valid subpoena. These situations include:
When we receive a court order, subpoena, warrant, summons or similar process;
to identify or locate a suspect, fugitive, material witness or missing person;
when the patient is the victim of a crime if we are unable to obtain the patient’s agreement;
when we believe the patient’s death may be the result of criminal conduct;
when there is criminal conduct at our facility; or
Federal law makes provision for your health information to be released to an appropriate health oversight agency, public health authority or attorney, provided that a workforce member or business associate believes in good faith that we have engaged in unlawful conduct or have otherwise violated professional or clinical standards and are potentially endangering one or more patients, workers, or the public.
Healthcare Oversight Activities: We may disclose medical information to a health oversight agency for activities authorized by the law. These oversight activities include, for example, audits, investigations, inspections, and licensure.
SPECIFIC DISCLOSURES WHICH REQUIRE AUTHORIZATION UNDER HIPAA
Uses and Disclosures You Specifically Authorization: You may give us written authorization to use your protected health information or to disclose it to anyone for any purpose. If you give us authorization, you may revoke it in writing at any time. If you revoke your permission, we will stop using or disclosing your protected health information in accordance with that authorization, except to the extent we have already relied on it. Without your written authorization, we may not use or disclose your protected health information for any reason except those described in this Notice.
Psychotherapy Notes: We must obtain an authorization for any use or disclosure of psychotherapy notes, except in limited circumstances as provided in 45 C.F.R. §164.508(a)(2).
Marketing: We must obtain an authorization for any use or disclosure of protected health information for marketing (as defined under HIPAA), except if the communication is in the form of a face-to-face communication made by use to an individual; or a promotional gift of nominal value provided by us. If marketing involves financial remuneration as defined in paragraph (3) of the definition of marketing at 45 C.F.R. §164.501, to us from a third party, the authorization must state that such remuneration is involved. Marketing is defined as a communication about a product or service that encourages the purchase or use of the product or service, except for communications:
made to describe a health-related product or service that is provided by the covered entity making the communication.
for the treatment of the individual; or
for case management or care coordination of the individual, or to direct or recommend alternative treatments, therapies, providers, or setting of care to the individual.
The communications described in those three exceptions often are considered to be within the definition of the “health care operations” under HIPAA, and thus permissible without the individual’s authorization.
Sale of Protected Health Information: Except in limited circumstances covered by the transition provisions in 45 C.F.R. §164.532, we must obtain an authorization for any disclosure of protected health information which is a sale of protected health information, as defined in 45 C.F.R. §164.501. Such authorization must state that the disclosure will result in remuneration to the covered entity.
YOUR HEALTH INFORMATION RIGHTS
Although your health record is the physical property of the healthcare practitioner or facility that compiled it, you have the right to:
Inspect and Copy: You have the right to inspect and copy medical information that may be used to make decisions about your care. Usually, this includes medical and billing records, but does include psychotherapy notes. We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to medical information, you may request that the denial be reviewed. Another licensed health care professional chosen by the hospital will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.
Amend: If you feel that medical information, we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment as long as the information is kept by our facility. We may deny your request for an amendment and if this occurs, you will be notified of the reason for the denial.
An Accounting of Disclosures: You have the right to request an accounting of disclosures. This is a list of the disclosures we made of medical information about you. You must submit this request in writing to the Release of Information department at Osceola Medical Center. The request must state a time period which may not be longer than six (6) years.
Request Restrictions: You have the right to request a restriction or limitations on the medical information we use or disclose about you for treatment, payment, or health care operations. You have the right to restrict certain disclosures of protected health information if you paid us for the service in full. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or payment for your care, like a family member or friend. For example, you could ask that we not use or disclose information about a surgery you had. We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you with emergency treatment.
Request Confidential Communications: You have the right to request that we communicate about medical matters in a certain way or at a certain location. We will agree to the request to the extent that it is reasonable for us to do so. For example, you can ask that we use an alternative address for billing purposes.
A Paper Copy of This Notice: You have the right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of this Notice. You may obtain a copy of this Notice at our website, www.myomc.org. To exercise any of your rights, please obtain the required forms from the Privacy Officer and submit your request in writing.
Fundraising: You have the right to opt out of receiving fundraising communications if the facility intends to make such communications.
Notification of a Breach: If your unsecured protected health information is involved in a breach, you have the right to be notified of the breach.
CHANGES TO THIS NOTICE
We reserve the right to change this Notice and the revised or changed Notice will be effective for information we already have about you as well as any information we receive in the future. The current Notice will be posted in the hospital and clinic and include the effective date. In addition, each time you register at or are admitted to Osceola Medical Center for treatment or health care services, we will offer you a copy of the current Notice in effect.
COMPLAINTS
If you believe your privacy rights have been violated, you may file a complaint with the Osceola Medical Center by contacting the Privacy Officer at the address listed below; or with the Secretary of the Department of Health and Human Services. All complaints must be submitted in writing. You will not be penalized for filing a complaint.
OTHER USES OF MEDICAL INFORMATION
Other uses and disclosures of medical information not covered by this Notice or the laws that apply to us will be made only with your written permission. If you provide us permission to use or disclose medical information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose medical information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided you.
CONTACT INFORMATION:
Privacy Officer
Osceola Medical Center
P.O. Box 218
2600 65th Avenue
Osceola, WI 54020
Telephone: 715-294-5749