Notice of Privacy Practices

JOINT NOTICE OF PRIVACY PRACTICES:

This joint Notice of Privacy Practices describes the privacy practices of our facilities that make up The Queen’s Health Systems (QHS) affiliated covered entity (“ACE”), including The Queen’s Medical Center, Hamamatsu/Queen’s PET Imaging Center, CareResource Hawaii, Molokai General Hospital, Queen’s North Hawaii Community Hospital, Diagnostic Laboratory Services Inc., EmPower Health, Queen’s University Medical Group and Queen’s Development Corporation, and of:

• All departments, units, clinics, and independent providers of each of the above-named facilities;
• All employees, medical staff members, allied health professionals, and other authorized workers who may need access to your information;
• All volunteers at our facilities; and
• All residents, postgraduate fellows, medical students, and students of other health care professions or educational programs at our facilities.

For purposes of complying with federal privacy and security requirements, the above-described facilities have designated themselves as an ACE. These are facilities under common ownership and control that have agreed to treat themselves as a single “covered entity” under these federal laws. Additionally, the independent providers who are providing health care services at or through QHS, or who share electronic health records with QHS as Queen’s Connect partners, have agreed to follow this Notice when providing services at or through that facility. They are legally separate and responsible for their own acts. The Queen’s Health Systems will coordinate privacy practices among these facilities and will have access to some protected health information as a business associate of these facilities.

USES AND DISCLOSURES OF YOUR HEALTH INFORMATION FOR TREATMENT, PAYMENT OR HEALTH CARE OPERATIONS:

Each time you visit a facility, a record of your visit is made. Typically, this record contains your symptoms, examination and test results, diagnoses, treatment, a plan for future care or treatment, and billing information. We need this record to provide you with quality care and to comply with certain legal requirements. To promote continuity and consistency of care, QHS has an integrated electronic health record. This means information created in the course of your care will reside in the integrated health record and may be available to others involved in your care through Queen’s Connect and/or Health Information Exchanges (HIE).

QUEEN’S CONNECT:

QHS has implemented technologies that allow QHS and physicians in the community to create, maintain and share a common electronic health record of their patients for the purpose of coordinating the care of these patients. Queen’s Connect creates a common health record of your visits that may be shared with participating healthcare providers that are treating you.

HEALTH INFORMATION EXCHANGES (HIE):

QHS may also participate in one or more HIEs which allows disclosure of your electronic health record via electronic transfer to other facilities and providers for your treatment purposes. Your health information and basic identifying information regarding your visits to our facilities may be shared with the HIEs for the purposes of diagnosis and treatment. This includes health information for your continuing care as well as unrelated care you may seek at other locations. Other providers participating in these HIEs may access this information as part of your treatment.

We understand that your health information is personal, and we are committed to protecting health information about you.

The following categories describe different ways we use and disclose health information. For each category of uses or disclosures we will explain what we mean and give some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

Treatment: We may use health information about you to provide treatment or services. We may disclose health information about you to doctors, nurses, technicians, medical students, or other facilities’ personnel who are involved in taking care of you at or through our facilities. For example: a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. The doctor may need to tell the dietician about your diabetes so that appropriate meals can be arranged. Different departments of our facilities also may share health information about you to arrange the different things that you may need, such as prescriptions, lab work, meals, and x-rays.

Payment: We may use and disclose your health information to bill and collect payment from you, your insurance company, or a third party payor for the services you received. For example, we may need to give information about your surgery to your health plan so your health plan will pay us or reimburse you for the treatment. We also may tell your health plan about treatment that you are going to receive so your plan can decide if it will cover the treatment. Our facilities also may share your information with other providers who are involved in your care for their payment purposes. For example, we may provide your insurance information to an ambulance company that delivered you to our facility.

Health Care Operations: We may use and disclose your health information for our facility operations. These uses and disclosures are necessary to run our facilities and make sure that all our patients receive quality care. For example, members of the medical staff and/or quality improvement team may use information in your health record to assess the care and outcomes in your case and others like it. The results then will be used to continually improve the quality of care for all patients that we serve. We may combine information about many patients to determine the need for new services or treatment. We may disclose information to doctors, nurses, technicians, medical students, and other health care professionals for educational purposes. We also may combine health information we have with that of other hospitals to see where we can make improvements. We may remove information that identifies you from this set of health information so others may use it to study health care and patient care. We may disclose your health information to a health plan or another health care provider for their own health care operations as long as: they have or had a relationship with you; the information disclosed pertains to that relationship; and the information is used for one of the following health care operations: quality assessment and improvement; population-based activities; protocol development; case management and care coordination; contacting patients and providers with treatment alternatives; reviewing performance and competence of professionals, providers, health plans; training programs, accreditation, certification, licensing, and credentialing; or corporate compliance.

Appointment Reminders: We may use and disclose health information to contact you as a reminder that you have an appointment at our facilities.

Health-Related Benefits and Services: We may communicate to you about a product or service related to your treatment, management or coordination of your care, and recommendations about alternative treatment therapies, providers, or settings of care. We also may talk to you personally about some services and products or may give you small promotional gifts, from time to time.

Fundraising: We may use limited health information about you in an effort to raise money for our facilities and its operations. We may disclose limited contact information, such as your name, address, phone number, and dates of service, to a foundation related to our facilities or to a business associate so that they may contact you to raise money for our facilities. You have the right to opt out from receiving fundraising communications.

Business Associates: We may disclose health information to those that we contract with as business associates so that they may do their jobs on behalf of our facilities. Examples include translator services and transcription services. Business Associates are required under federal law to implement appropriate physical and technical safeguards to protect your health information.

USES AND DISCLOSURES THAT WE MAY MAKE WITH YOUR AGREEMENT OR UNLESS YOU OBJECT:

Hospital Directory: Unless you object, we may include certain limited information about you in our hospital’s directory while you are a patient in our hospitals. This information may include your name, location in our hospital, your general condition (e.g., fair, stable, etc.), and your religious affiliation. Directory information, except for your religious affiliation, may be released to people who ask for you by name. Directory information may be provided to members of the community-based and hospital-based clergy, whether or not they ask for you by name. If you wish to opt out of the directory, please notify either the hospital’s Admitting or Patient Relations departments. If you choose to opt out of the hospital directory, we will not disclose your presence or location at our hospitals to anyone, including your family and/or friends.

Disaster Relief: We may disclose PHI such as your condition, status and location, to disaster relief agencies, such as the Red Cross, for disaster relief purposes.

Individuals Involved in Your Care or Payment for Your Care: We may disclose your health information to a family member, other relative, close personal friend, or any other person you identify as participating in your care or payment for that care. We may disclose:

• Health information that is relevant to that person’s involvement in your care or payment related to your care
• Health information that is necessary to notify or assist in notifying those close to you of your location or condition.

For example, we may teach your family how to provide for your needs after your discharge or notify your family that an ambulance has brought you to our hospitals. We may also disclose health information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status, and location.

If you object to the sharing of your health information with those involved in your care or payment for that care, please discuss your concerns with your caregivers.

USES AND DISCLOSURES THAT WE MAY MAKE WITHOUT YOUR SPECIFIC AUTHORIZATION:

As Required by Law: We will disclose health information about you when required to do so by federal, state, or local law.

Public Health Activities: We may disclose health information about you for public health activities. These activities generally include disclosures for:

• Prevention or control of disease, injury, or disability
• Reporting of births and deaths
• Reporting of child abuse and dependent adult abuse/neglect
• Reporting of reactions to medications or problems with products or medical devices
• Notification to people about recalls of medications/products/medical devices they may be using
• Notification to a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition
• Public health surveillance, investigations, and interventions.

We may disclose health information to your employer where services are provided to you at the request of your employer for the purposes of:

• An evaluation relating to medical surveillance of the workplace, or
• An evaluation whether you have a work-related injury.

Health Oversight: We may disclose health information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Lawsuits and Disputes: If you are involved in a lawsuit, a dispute, or some other legal action, we may disclose health information about you in response to a court or administrative order. We also may disclose health information about you in response to a subpoena, discovery request, or other lawful process, but only if the requesting party states that efforts have been made to tell you about the request or to obtain an order protecting the information requested.

Law Enforcement Activities: We may release health information if asked to do so by a law enforcement official:

• Where required by federal, state, or local law
• In response to a court order, subpoena, warrant, summons, or similar process
• To identify or locate a suspect, fugitive, material witness, or missing person (but we will give only limited information)
• About the victim of a crime
• About a death we believe may be the result of criminal conduct
• About criminal conduct at our facilities
• In emergency circumstances to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime.

Medical Examiners and Funeral Directors: We may release health information to the medical examiner as necessary, or required, to identify a deceased person or determine the cause of death. We also may release health information about patients of our hospitals to funeral directors as necessary to perform their duties.

Organ and Tissue Donations: We may release health information to organizations that handle organ procurement or organ, eye, or tissue transplants or to an organ donation bank, as required and necessary to facilitate organ or tissue donation and transplants.

Research: Under certain circumstances, we may use and disclose health information about you for research purposes. Research projects are subject to a special review process that evaluates uses of health information, trying to balance the research needs with the need for patient privacy. Before we use or disclose health information for research, the project will have to be approved through this review process.

To Avert a Serious Threat to Health or Safety: We may use and disclose health information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure would only be to someone who is likely to help prevent the threat.

Workers’ Compensation: We may release health information about you to your employer, your employer’s workers’ compensation insurer and administering government agencies for purposes of compliance with workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.

National Security and Intelligence Activities: We may release medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

Protective Services for the President and others: We may disclose health information about you to authorized federal officials if required for the protection of the President, other authorized persons, or foreign heads of state.

Military Personnel: If you are a member of the armed forces, we may release health information about you as required by your military command authorities. We also may release health information about foreign military personnel to the appropriate foreign military authority.

Inmates: If you are an inmate of a correctional institution or under custody of a law enforcement official, we may release health information about you to the correctional institution or a law enforcement official. This release would be necessary for the correctional institution to provide you with health care, to protect your health and safety or the health and safety of others, or for the safety and security of the correctional institution.

OTHER USES AND DISCLOSURE OF YOUR HEALTH INFORMATION:

Authorization: Most uses and disclosures of psychotherapy notes, uses and disclosures of protected health information for marketing purposes, and disclosures that constitute a sale of protected health information require your written authorization. Other uses and disclosures of health information not covered by this Notice or the laws that apply to us will be made only with your written permission. If you provide our facilities with an authorization to use and disclose health information about you, you may revoke that permission at any time by sending a request in writing to the facility’s medical records department or Privacy Officer / Privacy Officer Designee. If you revoke your permission, we will no longer use or disclose health information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission and that we are required to retain our records of the care that we provided to you. If the authorization was to permit disclosure of your information to an insurance company as a condition of obtaining coverage, other laws may allow the insurer to continue to use your information to contest claims or your coverage, even after you have revoked the authorization.

YOUR HEALTH INFORMATION RIGHTS:

Although your health record is the physical property of our facilities, you have the rights described below with respect to your health information:

Right to Inspect and Copy: You have the right to inspect and obtain copies of health information that may be used to make decisions about your care. Usually, this includes health and billing records, but does not include psychotherapy notes, information we put together to prepare for a legal action or incomplete test reports. If your health information is maintained electronically, you have the right to obtain a copy of such information in an electronic format.

To inspect or obtain a copy of your health information, please submit a request in writing to the facility’s Medical Records department or staff. Our facilities may charge you a reasonable fee for the costs of supplying a copy of your health records. We will respond to your request within 30 days.

We may deny your request to inspect and copy your records in certain, very limited circumstances. We will notify you in writing if we deny your access and explain how you may appeal the decision. In certain limited situations, we will have to deny you access and you will not have the right to appeal that decision.

Right to Amend: If you feel that health information we have about you is incorrect or incomplete, you may ask us to amend this information. You have the right to request a reasonable amendment for as long as this information is kept by, or on behalf of, our facilities. We may deny your request for an amendment in certain situations. If this occurs, you will be notified of the reason for the denial. If you disagree with our denial, you may submit a statement of disagreement or ask that your request become part of your record. In response, we may prepare a rebuttal statement. These will be made a part of your record. To request an amendment, please contact The Queen’s Health Systems Privacy Officer. Requests must be in writing and must provide reasons for requesting the amendment. We will respond to your request within 60 days.

Right to an Accounting of Disclosures: You have the right to request an accounting of certain disclosures of your health information made by our facilities. This accounting will not include disclosures:

• For treatment, payment, or health care operations
• For facility directory purposes, to persons involved in your care, or for notification purposes
• Incidental to an otherwise permitted use or disclosure
• To correctional institutions or other custodial law enforcement officials
• As part of a limited data set
• For national security or intelligence purposes
• For any use or disclosure that you specifically authorized or requested
• For any disclosure that occurred before April 14, 2003.

To request this list or accounting, please submit your request in writing to The Queen’s Health Systems Privacy Officer. Your request must state a time period, which may not be longer than six years and may not include dates before April 14, 2003. The first list you request within a 12-month period will be free. We may charge you a reasonable fee for the cost of providing subsequent lists. We will notify you of the cost involved, and you may choose to withdraw or modify your request at that time before you are charged any of these costs. We will respond to your request for an accounting of disclosures within 60 days of receipt of your request.

Right to Request Restrictions: You have the right to request a restriction or limitation on the health information we use about you for treatment, payment, or health care operations. You also have the right to request a limit on the health information we disclose about you to someone who is involved in your care or the payment of your care.

Our facilities are not required to agree to restriction requests related to treatment or health care operations. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment. To request a restriction on the use or disclosure of your health information for treatment or health care operations, you must make your request in writing to The Queen’s Health Systems Privacy Officer. In your request you must tell us: what information you want to limit; whether you want to limit our use, disclosure or both; and to whom you want the limits to apply.

To request a restriction on the use or disclosure of your health information to your health plan for payment or health care services, you must contact the facility’s admitting staff before or on the date of service. We will comply with your request to restrict the disclosure of health information to your health plan where the purpose of the disclosure is for payment or the health plan’s health care operations and the health information pertains solely to an item or service for which you paid out of pocket in full.

To request a restriction on disclosure of your health information to family or others involved in your care or payment for that care, please talk with your caregiver.

Right to Request Confidential Communications: You have the right to request that we communicate with you about health matters in a certain way or at a certain location. For example, you may request that our facilities use an alternative address for billing purposes.

To request confidential communications regarding billing, you must discuss your request with The Queen’s Heath System Privacy Officer on or by the date of service. Requests for confidential communications in regards to appointment reminders, mailings of test results or other such communications must be discussed with the facility and/or department from which you are receiving the service. We will agree to the request to the extent that it is reasonable for us to do so. Agreements for confidential communications are conditioned upon obtaining information about how payment, if any, will be handled. Our facilities may terminate its agreement to the request if payment arrangements are not honored.

Right to Breach Notification: You have the right to or will receive notifications of breaches of your unsecured protected health information.

Right to a Copy of this Notice: You will be provided a copy of The Queen’s Health Systems Notice of Privacy Practices the first time you come to our facilities. You have the right to receive a paper copy of this Notice at any time. Copies of the current Notice are available from our facilities’ admission areas and The Queen’s Health Systems Privacy Officer. You also may access our website at www.queens.org to print a copy of this Notice.

OUR RESPONSIBILITIES REGARDING YOUR HEALTH INFORMATION:

We are required by law to:

• Maintain the privacy of your health information
• Give you this Notice of our legal duties and privacy practices with respect to the information we collect and maintain about you
• Follow the terms of the Notice that is currently in effect.

CHANGES TO THIS NOTICE:

We reserve the right to change our privacy practices as described in this Notice at any time. Except when required by law, we will write and make available upon request a new Notice before we make any changes in our privacy practices. The privacy practices in the most current Notice will apply to information we already have about you as well as any information we receive in the future. The Notice will contain an effective date.

COMPLAINTS:

If you believe that your privacy rights have been violated, you may file a complaint with The Queen’s Health Systems by contacting The Queen’s Health Systems Privacy Officer at the phone number listed below. In addition, you may file a complaint with the Office for Civil Rights. We will not retaliate against you if you file a complaint.