SCHC Notice of Privacy Practices

Effective Date: 04/14/2003
Revision Date: 10/11/2019

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

I. Summary of Your Privacy Rights

1. Understand Your Medical Record/ Information. Each time you visit SCHC for services, a record of your visit is made. If you are referred by SCHC through the Purchased/ Referred Care (PRC) program, SCHC also keeps a record of your PRC visit. Typically, this record contains your symptoms, examination, test results, diagnoses, treatment, and a plan for future care. This information, often referred to as your medical record, serves as a:
   1. Plan for your care and treatment.
   2. Communication source between health care professionals.
   3. Tool with which we can check results and continually work to improve the care we provide.
   4. Means by which Medicare, Medicaid, or private insurance payers can verify the services billed.
   5. Tool for education of health care professionals.
   6. Source of information for public health authorities charged with improving the health of the people.
   7. Source of data for medical research, facility planning, and marketing.
   8. Legal document that describes the care you receive.
2. Understanding what is in your medical record and how the information is used helps you to:
   1. Ensure its accuracy.
   2. Better understand why others may review your health information.
   3. Make an informed decision when authorizing disclosures.
3. Your Medical Record/Information Rights. Your medical record is the physical property of SCHC, but the information belongs to you. You have the right to:
   1. Inspect and receive a paper or electronic copy of your health information.
   2. Receive notification of a breach of your unsecured Protected Health Information (PHI).
   3. Request a restriction on certain uses and disclosures of your health information to include certain disclosures of PHI to your health plan. SCHC is not required to agree to the requested restriction except when the disclosure would be for the purpose of carrying out payment or health care operations and is not otherwise required by law and the PHI relates solely to a health care item or service for which the individual, or person other than the health plan on behalf of the individual, has paid the covered entity in full.
   4. Request a correction or amendment to your health information. SCHC may amend your record or include your Statement of Disagreement.
   5. Request confidential communications about your health information.
   6. Request and obtain a listing of certain disclosures SCHC has made on your health information.*
   7. Revoke your written authorization to use or disclose health information.
   8. Request and obtain a paper or electronic copy of SCHC Notice of Privacy Practices.
   9. Request and obtain a copy of the patient’s medical record.*

* The first request is at no charge. The charges for additional records within twelve months are $30 for first 10-pages, $.50 per page for pages 11-50 and $.25 per page thereafter.

II. SCHC Responsibilities

SCHC understands that health information about you is personal and is committed to protecting your health information. SCHC is required by law to:

1. Maintain the privacy of your health information.
2. Inform you about our privacy practices regarding health information we collect and maintain about you.
3. Notify you if we do not agree to a requested restriction.
4. Notify you of our decision regarding a request for correction or amendment.
5. Accommodate reasonable requests you may have to communicate health information by alternative means or to an alternative location.
6. Promptly notify you of a breach of unsecured PHI.
7. Honor the terms of this Notice and any subsequent revisions to this Notice.

SCHC reserves the right to change its privacy practices and to make the new provisions effective for all PHI it maintains. SCHC will post any revised Notice of Privacy Practices at public places within its facilities and on the CTSI website.

III. How SCHC May Use and Disclose Your Health Information

SCHC will not use or disclose your health information without your permission, except as described in this Notice and as permitted by state and federal law.

1. Treatment. We will use and/or disclose your health information to provide your treatment. For example:
   1. Your personal information will be recorded in your medical record and used to determine the course of treatment for you. Your health care provider will document in your medical record their instructions to members of your health care team. The actions taken and the observations made by the members of your health care team will be recorded in your medical record so your health care provider will know how you are responding to treatment.
   2. If you are referred or transferred to another facility or provider for further care and treatment, SCHC may disclose information to that facility or provider to enable them to know the extent of treatment you have received and other information about your condition.
   3. Your health care provider(s) may give copies of your health information to others, including health care professionals or personal representatives, to assist in your treatment.
2. Payment Purposes. We will use and disclose your health information for payment process. For example:
   1. If you have private insurance, Medicare, or Medicaid, a bill will be sent to your health plan for payment. The information on or accompanying the bill will include information that identifies you, as well as your diagnosis, procedures, and supplies used for your treatment.
   2. If you are referred to another health care provider under the Purchased/Referred Care (PRC) program, SCHC may disclose your health information to that provider for health care payment purposes.
3. Health Care Operations. We will use and disclose your health information for health care operations. For example, we may use your health information to evaluate your care and treatment outcomes with our quality improvement team. This information will be used to continually improve the quality and effectiveness of the services we provide.
4. Health Information Exchange (HIE). SCHC HIE may make your health information available electronically through an information exchange network to other providers involved in your care who request your electronic health information. Participation in the national eHealth Exchange network is voluntary. If you want your health information to be accessible to authorized health care providers through SCHC HIE to the national eHealth Exchange, you must authorize this use and disclosure.
5. Patient Portal. The Patient Portal is a secure web based application that provides patient access to their health care information. The Patient Portal is accessible to any patient who receives care at SCHC.
6. Business Associates. SCHC provides some healthcare services and related functions through the use of contracts with business associates. For example, SCHC may have contracts for medical transcription. When these services are contracted, they may disclose your health information to business associates so that they can perform their jobs. SCHC requires our business associates to protect and safeguard your health information in accordance with applicable Federal laws.
7. Notification. SCHC may use or disclose your health information to notify or assist in the notification of a family member, personal representative, or other authorized person(s) responsible for your care, unless you notify us that you object.
8. Communication with Family. All SCHC health providers may use or disclose your health information to others involved with and/or responsible for your care unless you object. For example, SCHC may provide your family members, other relatives, close friends, or any other person you identify, with health information that is relevant to that person’s involvement with your care or payment of such care.
9. Adults and Emancipated Minors with Personal Representatives. SCHC may disclose health information to a personal representative of an individual who has been declared incompetent due to physical or mental incapacity by a court of competent jurisdiction.
10. Interpreters. In order to provide you proper care and services, SCHC may use the services of an interpreter.
11. Research. SCHC does not participate in research. However, in the case SCHC does participate in research in the future, the organization will follow HIPAA Privacy Rules and Regulations.
12. Organ Procurement Organizations. SCHC may use or disclose your health information to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs for the purpose of facilitating organ, eye, or tissue donation and transplant.
13. Uses and Disclosures about Decedents. SCHC may use or disclose health information about decedents to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law. SCHC also may disclose health information to funeral directors consistent with applicable law as necessary to carry out their duties. In addition, SCHC may disclose health information about decedents where required under the Freedom of Information Act or otherwise required by law.
14. Treatment Alternatives and Other Health Related Benefits and Services. SCHC may contact you to provide information about treatment alternatives or other types of health related benefits and services that may be of interest to you. For example, we may contact you about the availability of new treatment or services for diabetes.
15. Food and Drug Administration. SCHC may disclose your health information to the Food and Drug Administration (FDA) in connections with a FDA regulated product or activity. For example, we may disclose to the FDA information concerning adverse events involving food, dietary supplements, product defects or problems, and information needed to track FDA regulated products or to conduct product recalls, repairs, replacements, or look-backs (including locating people who have received products that have been recalled or withdrawn), or post-marketing surveillance.
16. Appointment Reminders. SCHC may contact you with a reminder that you have an appointment for medical care at SCHC or to advise you of a missed appointment.
17. Workers Compensation. SCHC may disclose your health information for workers’ compensation purposes as authorized or required by law.
18. Public Health. SCHC may use or disclose your health information to public health or other appropriate government authorities (Federal, State, Local or Tribal) as follows:
    1. To government authorities that are authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, or conducting public health surveillance, investigations, and interventions;
    2. To government authorities that are authorized by law to receive reports of child abuse or neglect; and
    3. To government authorities that are authorized by law to receive reports of other abuse, neglect, or domestic violence, or as authorized by law if SCHC believes it is necessary to prevent serious harm. Where authorized by law, SCHC may disclose your health information to an individual who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition. In some situations, or as necessary to prevent or lessen a serious and imminent threat to the health and safety of an individual or the public, SCHC may disclose to your employer health information concerning a work related illness, injury, or a workplace related medical surveillance. For example, if you are employed by SCHC or another component of the Department of HHS.
19. Correctional Institution. If you are an inmate of a correctional institution, SCHC may disclose to the institution, health information necessary for your health and the health and safety of other individuals such as officers, employees, or other inmates.
20. Law Enforcement. SCHC may disclose your health information for law enforcement activities as authorized by law or in response to an order of a court of competent jurisdiction.
21. Health Oversight Authorities. SCHC may disclose your health information to health oversight agencies for activities authorized by law. These oversight activities may include investigations, audits, inspections, and other actions. These are necessary for the government to monitor the health care system, government, regulatory programs and/or civil rights laws for which health information is necessary to determine compliance. SCHC is required by law to disclose health information to the Secretary, HHS to investigate or determine compliance with the HIPAA privacy standards.
22. Members of the Military. If you are a member of the military service, SCHC may disclose your health information if necessary to the appropriate military command authorities as authorized by law.
23. Compelling Circumstances. SCHC may disclose your health information in certain other situations involving compelling circumstances affecting the health or safety of an individual. For example, in certain circumstances:
    1. SCHC may disclose limited health information where requested by a law enforcement official for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person;
    2. If you are believed to be a victim of a crime and a law enforcement official requests information about you and we are unable to obtain your agreement because of incapacity or other emergency circumstances, we may disclose the requested information if we determine that such
       disclosure would be in your best interest;
    3. SCHC may use or disclose health information that we believe is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person;
    4. SCHC may disclose health information in the course of judiciary and administrative proceedings if required or authorized by law;
    5. SCHC may disclose health information to report a crime committed on SCHC’s premises or when SCHC is providing emergency health care; and
    6. SCHC may use or disclose health information during a disaster and for disaster relief purposes.
24. Required by Law. SCHC may use or disclose health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.
25. Non-Violation of this Notice. SCHC is not in violation of this Notice or the HIPAA Privacy Rule if any of its employees or its contractors (business associates) disclosed health information under the following circumstances:
    1. Disclosures by Whistleblowers. If a SCHC employee or business associate in good faith believes that SCHC has engaged in conduct that is unlawful or otherwise violates clinical and professional standards or that the care or services provided by SCHC has the potential of endangering one or more patients, members of the workplace, or the public and discloses such information to:
       1. A Public Health Authority or Health Oversight Authority authorized by law to investigate or otherwise oversee the relevant conduct or conditions, or the suspected violation, or an appropriate health care accreditation organization for the purpose of reporting the allegation of failure to meet professional standards or misconduct by SCHC; or
       2. An attorney on behalf of the workforce member, or contractor (business associate) or hired by the workforce member or contractor (business associates) for the purpose of determining their legal options regarding the suspected violation.
    2. Disclosures by Workforce Member Crime Victims. Under certain circumstances, a SCHC workforce member (either an employee or contractor) who is a victim of a crime on or off SCHC premises may disclose information about the suspect to law enforcement officials provided that:
       1. The information disclosed is about the suspect who committed the criminal act.
       2. The information disclosed is limited to identifying and locating the suspect.
26. Any Other Uses and Disclosures. Most uses and disclosures of psychotherapy notes (where appropriate) require authorization. Other uses and disclosures of PHI not listed in this Notice will be made only with your written authorization, which you may later revoke in writing at any time. Such revocation would not apply where the health information already has been disclosed or used or in circumstances where SCHC has taken action in reliance on your authorization or the authorization was obtained as a condition of obtaining insurance coverage and the insurer has legal right to contest a claim under the policy or the policy itself.

IV. Rights under this Notice or to Request Information or Report a Problem

To exercise your rights under this Notice, to ask for more information or if you believe your privacy rights have been violated, you may file a written complaint to the SCHC’s Health Information & Privacy Officer at:

Siletz Community Health Clinic
PO Box 320
200 Gwee-Shut RD
Siletz, OR 97380

Telephone: 541-444-1030 or 800-648-0449 extension 1635

There will be no retaliation for filing a complaint. You may also file a written complaint to the U.S. Department of Health and Human Services.

Centralized Case Management Operations
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F HHH Bldg.
Washington, D.C. 20201