Our Pledge to Protect Your Privacy
We understand that medical information about you is personal, and we are committed to protecting that information. We create a record of the care and the services that you receive, to provide high-quality care and to comply with legal requirements. This notice applies to all of the records of your care that we maintain, whether created by our facility staff or your personal doctor. We are required by law to:
- Keep medical information about you private
- Give you this notice of our legal duties and privacy practices with respect to medical information about you
- Follow the terms of the notice that are currently in effect
For More Information or to Report a Problem
If you have any questions about this notice, please contact our privacy
officer at (541) 789-5668.
Organized Healthcare Arrangement
We are part of an organized healthcare arrangement (OHCA). An OHCA is (i) a clinically integrated setting in which individuals typically receive healthcare from more than one healthcare provider or (ii) an organized system of healthcare in which more than one health care provider participates. The healthcare providers who participate in the OHCA will share medical and billing information about you with one another as may be necessary to carry out treatment, payment, and healthcare operations activities. This Joint Notice of Privacy Practices constitutes the Notice of Privacy Practices for the OHCA and all the healthcare providers participating in the OHCA. The healthcare providers who participate in the OHCA and to which this Joint Notice of Privacy Practices applies include this facility, the members of its medical staff, and other covered entities and allied health professionals who provide clinical services in Asante facilties.
Who Will Follow This Notice
The following individuals and organizations shares our commitment to protecting your privacy and will comply with this notice:
- Any healthcare professional authorized to enter information into your Asante health record
- Members of our medical staff, employees, volunteers, trainees, students, and other hospital personnel providing services in all departments and units of the hospitals, including our outpatient clinics.
- Patient care locations affiliated with Asante and all medical staff, employees, volunteers, trainees, students, or other personnel providing services in these patient care locations, which include: Asante Rogue Regional Medical Center and all outpatient locations, Asante Three Rivers Medical Center and all outpatient locations, Asante Work Health, Rogue Valley Rx, Asante Diabetes Care Center, Rogue Valley Sleep Center, and Asante Physician Partner clinics. Also included are all physicians credentialed to practice at our facilities and all units or departments within Asante. A complete listing of all Asante locations can be found on the Asante website, https://www.asante.org/locations/.
Note: Asante may provide services to you in an integrated way with our medical staff and the affiliated patient care locations referenced above.
Asante accepts no legal responsibility, however, for activities solely attributable to these other providers or care settings.
Electronic Health Record
We use electronic health record systems to more efficiently and safely coordinate your care across many individual providers and locations. Physical and technical safeguards, policies, and training are used to protect the information in these systems.
Doctors and other professionals who are not employed by Asante may share information about you with us to provide your care. All of these hospitals, clinics, doctors, and other caregivers, programs, and services may share your medical information with one another for treatment, payment and healthcare operations purposes. The general ways that we can share your information are described below.
Health Information Exchanges
We participate in health information exchanges to facilitate the secure exchange of your electronic health record among several healthcare providers or other healthcare entities for your treatment, payment, and healthcare operations purposes. This means we may share information that we obtain or create about you with outside entities (such as hospitals, doctors’ offices, pharmacies, and insurance companies), or we may receive information they create or obtain about you (such as medication history, medical history, and insurance information) so that each of us can provide better treatment and coordination of your healthcare services via these health information exchanges.
How We May Use and Disclose Your Medical Information
Members of our medical staff, appropriate hospital employees, and other participants in our patient care system, such as affiliated clinics and hospitals, may share your medical information as necessary for your treatment, for payment for services provided, and for healthcare operations without your express permission. Other uses require your specific authorization.
The following describes how we may use and disclose your information
without express permission. Other parts of this notice describe uses and disclosures that require your authorization and the rights you have
to restrict our use and disclosure of your medical information.
Uses and Disclosures without Your Express Permission
This section discusses the requirements of federal privacy laws.
- Treatment. We are permitted to use and disclose your medical information within Asante and within our affiliated clinics and hospitals as necessary to provide you with medical treatment and services. We also are permitted to disclose your medical information to other healthcare providers outside this hospital and its affiliated clinics and hospitals as necessary for those providers to provide you with medical treatment and services. For example, physicians and other health professionals treating you in this hospital will document information about your treatment in your medical record. This record will be released to other health professionals assisting in your treatment to ensure that they are fully informed about your medical condition and treatment needs.
- Payment. We are permitted to use and disclose your medical information for our payment purposes or the payment purposes of other healthcare providers and health plans. For example, our billing department may release medical information to your health insurer to allow the insurer to pay us or reimburse you for your treatment. We also may release medical information to emergency responders to allow them to obtain payment or reimbursement for services provided to you.
- Healthcare operations. We are permitted to use and disclose your medical information for purposes of our own operations. We are also permitted to disclose your medical information for the healthcare operations of another healthcare provider or health plan so long as it has a relationship with you and needs the information for its own quality assurance purposes, for purposes of reviewing the qualifications of its healthcare professionals, or for conducting skill improvement programs. For example, our quality assurance department may use your medical information to assess the quality of your care and to ensure that our hospital continues to provide the quality of care that you and other patients deserve. We may use your medical information to ensure that we are complying with all federal and state requirements. We also may disclose your medical information to a community physician to assist him or her in assessing the quality of care provided in your case and for other similar purposes.
Uses and Disclosures That We May Make Unless You Object
Family or friends involved in your care. Health professionals, using their best judgment, will disclose to a family member, close personal friend, or anyone else you identify medical information relevant to that person’s involvement in your care. We may also give information to someone who helps pay for your care.
- Fundraising activities. We depend extensively on private fundraising to advance our healthcare mission. In our efforts to reach out to the community, the Asante Foundation may contact you to invite you to events or share information with you. Information regarding specific diagnosis and treatment is not used for fundraising purposes. If you do not want your information used in this way, notify the Foundation office at (541) 789-5025.
- Celebratory activities. We may use and disclose limited information about you (name, address, and dates of treatment) to invite you to a celebratory activity, such as a reunion event. Information regarding diagnosis and treatment will not be used to notify you of celebratory events. Any communication sent to you will advise you of how to opt out of receiving similar communications in the future.
- In the event of a disaster. We may disclose medical information about you to other healthcare providers and to an entity assisting in a disaster relief effort to coordinate care and so that your family can be notified about your condition and location.
- Notice of any security breach.
We have physical, administrative, and technical safeguards to protect your data. If a breach of that security occurs, however, we will notify you if the security of your protected health information has been compromised. We may use a “Substitute Notice,” which will be conspicuously posted on our website at asante.org. In addition we may notify major statewide media of the breach. We may also share your information with any consultants we may hire to help us contain and manage a breach. When you see these notices, you may contact the privacy officer to determine if information about you was included in the breach. You will be required to submit your request in writing with adequate information to confirm your identity. If you do not want us to make any or all of the five disclosures listed above, you must notify your care provider that you wish to sign an opt-out form.
- Providing information from our inpatient hospital directory. Asante’s inpatient directory information includes your name, location in the hospital, religious affiliation, and general condition. We may release location and general condition information to individuals who ask for you by name. This may include your family and friends or even the media in some circumstances. We are allowed to release all facility directory information to members of the clergy, even if they do not ask for you by name. If you do not want us to make hospital directory disclosures, at the time of registration you must notify Patient Registration that you wish to sign an opt-out form.
- Appointment reminders. We may use and disclose medical information to contact you as a reminder that you have an appointment for treatment or medical care.
- Treatment alternatives. We may use and disclose medical information to tell you about or recommend possible treatment options or alternatives that we offer that may be of interest to you.
- Health-related benefits and services. We may use and disclose medical information to tell you about health-related benefits or services that may be of interest to you.
Uses and Disclosures That Do Not Require Your Authorization
We may use and disclose your medical information for the following purposes.
- Research when approved by the Institutional Review Board. Under certain circumstances we may use and disclose medical information about you for research purposes. For example, a research project may involve comparing the health and the recovery of all patients who received one medication with those who received another for the same condition. All research projects, however, are subject to an approval process through the Institutional Review Board.
Before we use or disclose medical information for research without your authorization, the project will have been approved through this research approval process.
- To organ procurement organizations for purposes of organ and tissue donation. If you are an organ donor, we may release medical information to organizations that handle organ procurement or organ, eye, or tissue transplantation or to an organ donation bank as necessary to facilitate organ or tissue donation and transplantation.
- To the military as required by military command authorities. If you are a member of the armed forces, we may release medical information about you as required by military command authorities. We may also release medical information about foreign military personnel to the appropriate foreign military authority.
- As authorized by law in connection with the workers’ compensation program. We may release medical information about you for workers’ compensation or similar programs to the extent authorized by law. These programs provide benefits for work-related injuries or illness.
- To support public health activities. These activities typically include reports to such agencies as the Oregon Department of Human Services as required or authorized by state law.
These reports may include but are not necessarily limited to the following:
• To prevent or control disease, injury, or disability
• To report births and deaths
• To report child abuse or neglect
• To report animal bites
• To notify a person who may have been exposed to a disease or may be at risk of contracting or spreading a disease or condition
• To notify the appropriate government authority if we believe that a patient has been the victim of abuse or neglect (we will make this disclosure only if the patient agrees or when required or authorized by law)
• To the Food and Drug Administration relative to adverse events concerning food, supplements, products and product defects, or postmarketing surveillance information to enable product recalls, repairs, or replacement
- To health oversight agencies such as state and federal regulatory agencies. We may disclose medical information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the healthcare system, government programs, and compliance with civil rights laws.
- Pursuant to lawful subpoena or court order. If you are involved in a lawsuit or dispute, we may disclose medical information about you in response to a court or administrative order. We may also disclose medical information about you in response to a civil subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell patients about the request or to obtain an order protecting the information requested.
- To law enforcement officials for certain law enforcement purposes. We may disclose your medical information to law enforcement officials as required by law or as directed by court order, warrant, criminal subpoena, or other lawful process and in other limited circumstances for purposes of identifying or locating suspects, fugitives, material witnesses, missing persons, or crime victims.
- To coroners, medical examiners, and funeral directors. We may release medical information to a coroner or medical examiner as necessary to identify a deceased person or to carry out his or her professional duties as required by law. Oregon law specifically requires us to report to the medical examiner when an injury apparently resulted from a gunshot wound.
- For national security and intelligence activities. We may release medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
- When required to avert a serious threat to health or safety. We may use and disclose medical information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.
- For protective services for the president and others. We may disclose medical information about you to authorized federal officials so that they may provide protection to the president, other authorized persons, or foreign heads of state or conduct special investigations.
- Regarding inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release medical information about you to the correctional institution or law enforcement official.
- As required by federal, state, or local law. We will disclose medical information about you when required to do so by federal, state, or local law.
- Incidental disclosures. Certain incidental disclosures of your medical information occur as a byproduct of lawful and permitted use and disclosure of your medical information. For example, a visitor may inadvertently overhear a discussion about your care occurring at the nurses’ station. These incidental disclosures are permitted if we apply reasonable safeguards to protect your medical information.
- Limited data set information. We may disclose limited health information to third parties for purposes of research, public health, and healthcare operation. This limited data set will not include any information which could be used to identify you directly.
Uses and Disclosures Requiring Your Authorization
Other uses and disclosures for purposes other than previously described require your express authorization.
For example, Asante must obtain your authorization before disclosing your medical information to a life insurer or to an employer, except under certain circumstances such as when disclosure to the employer is required by law. You have the right to revoke an authorization at any time, except to the extent we have already relied on it in making an authorized use or disclosure.
Your revocation of an authorization must be in writing.
Asante requests that, if you choose to revoke an authorization, you will help us comply with your wishes by identifying the authorization you are choosing to revoke. Ways of telling us which authorization you are revoking might include indicating whom you authorized to receive information or the approximate time frame in which you signed the authorization.
Specially Protected Health Information
Unless otherwise required or permitted by law, we may need your authorization to disclose your health information regarding treatment for AIDS/HIV/ ARC, mental health, drug addiction, alcoholism, other substance abuse treatment, developmental disabilities, and genetic information or records.
Disclosures to Business Associates
Asante contracts with outside companies that perform business services for us, such as billing companies, management consultants, quality assurance reviewers, accountants, and attorneys. In certain circumstances we may need to share your medical information with a business associate so that it can perform a service on our behalf. Asante will limit the disclosure of your information to a business associate to the amount of information that is the minimum necessary for the company to perform services for Asante. In addition, we will have a written contract in place with the business associate requiring it to protect the privacy and the security of your medical information.
- You have the right to request to inspect and copy medical information used to make decisions about your care. You have a right to copies of records to be provided to you in electronic or paper format, depending on your request and the technology with which the records are maintained. Usually, this includes medical and billing records but does not include psychotherapy notes. To inspect and copy medical information that may be used to make decisions about you, you must submit a request in writing. If you request a copy of the information, we may charge a fee for copying, mailing, or other costs associated with fulfilling your request. We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to medical information, you may request that the denial be reviewed.
- You have the right to request an amendment to your medical record. If you believe that medical information that may be used to make decisions about your care is incorrect or incomplete, you may ask us to amend the information. This request must be in writing. Your request must include a reason for the amendment. We may deny your request if we believe that the records are complete and accurate, if the records were not created by us and the creator of the records is available, or if the records are otherwise not subject to patient access. We will put any denial in writing and explain our reasons for denial. You have the right to respond in writing to our explanation of denial and to require that your request, our denial, and your statement of disagreement, if any, be included in future disclosures of the disputed record.
- You have the right to request that we send you confidential communications by alternative means or at alternative locations.
For example, you may ask that we contact you only at work or by mail. A request for confidential communication must be made in writing. We will honor all reasonable requests.
- You have the right to request additional restrictions, to the extent the law allows, on the use and the disclosure of your medical record. You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment, or healthcare operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend.
For example, you could ask that we not use or disclose information about a particular procedure you underwent. We are not required to agree to your request except under limited circumstances. If you do not want us to disclose to your health plan your information about a specific visit, you must notify Patient Access at the facility where you received care and pay for the visit in full. If we do agree, we will comply with your request unless the information is needed to provide you with emergency treatment.
- You have the right to request an accounting of disclosures. You may request, in writing, an accounting of disclosures we made of your medical information to the extent the law requires.
- Please direct requests discussed above to your physician or to Medical Records at (541) 789-4204 or (541) 472-7130.
We reserve the right to change our health information practices and the terms of this notice and to make the new provisions effective for all protected health information we maintain, including health information created or received prior to the effective date of any such revised notice. If our health information practices change, we will post the revised notice at our service delivery sites and make the revised notice available to you at your request.
If you believe that your privacy rights have been violated, you may file a complaint with the Asante privacy officer at (541) 789-5668. You may also file a complaint with the Office of Civil Rights, US Department of Health and Human Services, 2201 6th Avenue, Mail Stop RX-11, Seattle, WA, 98121-1831. The toll-free telephone number is (800) 368-1019.
The complaint form is available online at www.hhs.gov/ocr/privacy/hipaa/complaints/hipcomplaint.pdf. There will be no retaliation for filing a complaint.
Effective date: April 6, 2013