Privacy Policy
 

NOTICE OF PRIVACY PRACTICES OF VAIL VALLEY MEDICAL CENTER, SHAW REGIONAL CANCER CENTER
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.

I. INTRODUCTION
Vail Clinic, Inc., otherwise known as Vail Valley Medical Center (VVMC) is required by both federal and state law to limit the manner in which it uses or discloses information about a patient or a patient’s health information. In addition, we are required to notify you of our legal obligations with respect to our privacy practices concerning your protected health information and to abide by the notice then in effect. This notice is intended to describe both the obligations of VVMC with respect to information that it has about you and your rights with respect to that information. References to VVMC in this notice refer to Vail Clinic, Inc., Vail Valley Medical Center, VVMC Diversified Services, Edwards Medical Center, Beaver Creek Medical Center, hospitals, clinics, doctor offices, and other healthcare facilities owned by Vail Clinic, Inc., as well as VVMC employees and volunteers at those facilities, and our affiliated covered entities which include the Vail Valley Surgery Center. These entities may share information with each other for the purposes described in this notice. Our employees and agents and the other health care professionals providing services to you in our offices or facilities are subject to this notice, unless they provide you with a notice of their own specific privacy practices.

II. WHAT IS PROTECTED HEALTH INFORMATION?
Health information is broadly defined as any information, whether oral or recorded in any form or medium that is created or received by VVMC whether the information relates to your past, present or future physical or mental health or condition, the provision of health care to you, or the past, present or future payment for the provision of healthcare to you. Individually identifiable health information is information that includes health information and also includes demographic information collected from you that identifies you or which reasonably can be used to identify you. This is generally referred to throughout this notice as “Protected Health Information” or “PHI.” VVMC is required by law to maintain the privacy of your Protected Health Information and to provide you with this privacy notice setting forth our legal duties with respect to your Protected Health Information. VVMC is required to abide by the terms of its privacy notice in effect from time to time.

III. USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION PERMITTED BY LAW
The law permits us to use and share your Protected Health Information for treating you, billing for services, for healthcare operations, and other situations, all of which are explained below. Some health records, including confidential communications with a mental health professional, some substance abuse treatment records, some HIV test results, some genetic test results, and some health information of minors, may have additional restrictions for use and disclosure under state and federal laws. In general, we may disclose a minor patient’s Protected Health Information to a parent or guardian, but we may deny the parents’ access to the minor patients’ Protected Health Information in some situations. Your Protected Health Information may be used and disclosed without your authorization only for the following purposes:

A. Treatment. To provide treatment and other services to you – for example, to diagnose and treat your injury or illness, to send you appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you. If you do not wish to be reminded of appointments, please notify the scheduler;
B. Payment. To obtain payment for services provided to you – for example, to claim and obtain payment from your health insurer or Medicare, or to create bills that we submit to the insurance company;
C. Healthcare Operations. To conduct healthcare operations – for example, to evaluate the quality of treatment and services provided by our physicians, nurses, and other healthcare workers, or to cooperate with outside organizations that assess the quality of care we provide, such as government agencies or the Joint Commission;
D. Other Health Care Providers. To disclose your Protected Health Information to other health care providers, such as anesthesia providers, when such Protected Health Information is required for them to treat you, receive payment for services you receive at our site or conduct certain health care operations;
E. Business Associates. To share information with third parties who assist us with providing treatment, obtaining payment, and conducting healthcare operations. Our business associate must protect your information by following our privacy practices. For example, we may share certain Protected Health Information with our billing company or computer consultant in order to facilitate our healthcare operations or payment for services provided in connection with your care. In this connection, we will require our business associates to enter into an agreement to keep your Protected Health Information confidential and to abide by the terms set forth in this privacy notice;
F. Directory of Individuals in a VVMC Facility. To include your name, location in a VVMC facility, general health condition, and religious affiliation in a patient directory, unless you disagree or object. Information in the directory, except for religious affiliation, may be disclosed to anyone who asks for you by name. Directory information, including religious affiliation, may be disclosed to members of the clergy, even if they do not ask for you by name. If you do not wish to be listed in the directory, notify the admitting clerk;
G. Individuals Involved in Your Care or Payment of Your Care. To a family member, a close personal friend, or any other person identified by you if we (1) obtain your agreement; (2) provide you with an opportunity to object to the disclosure and you do not object; or (3) reasonably infer that you do not object to the disclosure. In an emergency or when you are
not capable of agreeing or objecting to the disclosure, we will disclose your Protected Health Information as determine is in your best interest, but we will tell you about it later, after the emergency, and give you the opportunity to object to future disclosures to friends and family;
H. Fundraising Communications. To request a tax-deductible contribution to support important activities of VVMC. Note: Only your name, address, phone number, and dates of healthcare service that we provided to you will be disclosed to VVMC’s fundraising office. If you do not want to receive any fundraising requests in the future, notify the VVMC Fundraising Department at 970-477-5177;
I. Healthcare Communications. To identify health-related services and products that may be beneficial to you and then contact you about the services and products;
J. Public Health and Safety Matters. To use or disclose your Protected Health Information for public health activities, including reporting communicable diseases, child abuse and neglect reports, FDA-related reports and disclosures, public health warnings to third parties regarding risk of communicable diseases or conditions, reports regarding victims of abuse, neglect or domestic violence, reports of elder abuse to the Department of Aging, reports of abuse of a nursing home patient to the Department of Public Welfare, reports to health oversight entities such as a drug enforcement agency, reports to prevent or lessen a serious threat to safety, or compliance with judicial and administrative proceedings;
K. Health Oversight Activities. To a health oversight agency that oversees the healthcare system and ensures compliance with the rules of government health programs such as Medicare or Medicaid;
L. Judicial and Administrative Proceedings. In the course of a judicial or administrative proceeding in response to a legal order or other lawful process. VVMC may use or disclose your Protected Health Information in response to court or administrative proceedings if you are involved in a lawsuit or a similar matter. We may disclose your Protected Health Information in response to a discovery request, subpoena or other lawful process by another party involved in a dispute, but only if we have received satisfactory assurances that the party seeking your Protected Health Information has made a good faith effort to inform you of the request to provide you with an opportunity to object;
M. Threat to Health and Safety. To reduce or prevent a serious threat to public health and safety;
N. Law Enforcement Officials; Specialized Government Functions. To: (a) the police or other law enforcement officials as required by law or in compliance with a court order; (b) military authorities the personal and health information of Armed Forces personnel under certain circumstances; or (c) authorized federal officials personal and health information required for lawful intelligence, counterintelligence, and other national security activities. VVMC may disclose your Protected Health Information for law enforcement purposes, such as compliance with legal process, search warrants, identification of crime victims, reports of death suspected to have resulted from criminal activities, information regarding crimes, emergencies, reports regarding identification of deceased patients, cause of death, providing information to funeral directors necessary to carry out their operations, information relating to threats to public safety, or specific government functions such as military and veterans activities, national security and intelligence and similar law enforcement matters;
O. Organ and Tissue Procurement. To organizations that facilitate organ, eye, or tissue procurement, banking, or transplantation;
P. Research. To an authorized researcher if our Institutional Review Board approves release under very strict government guidelines; and
Q. Workers’ Compensation. To comply with workers’ compensation laws and coordinate with insurers, state administrators, employers and other persons or entities involved in the workers’ compensation system and similar proceedings.

IV. INCIDENTAL DISCLOSURE
Certain disclosures may occur incidentally. For example, conversations regarding your medical care may be overheard by other persons or patients in an office or facility or someone may view your name on the sign-in sheet in the waiting area. VVMC will use its best efforts to limit these disclosures, but the efficient delivery of medical care in our offices or facilities will not permit incidental disclosures to be totally eliminated.

V. USES AND DISCLOSURES WITH YOUR AUTHORIZATION
VVMC cannot use your Protected Health Information for anything other than the reasons mentioned above, without your signed “Authorization”. An Authorization is a written document signed by you that permits VVMC to use your Protected Health Information for a specific purpose. You may revoke an Authorization by delivering a hand written revocation statement to the Compliance Office identified below. If you revoke an Authorization, VVMC will no longer use or disclose your Protected Health Information as permitted by that Authorization. Of course, your revocation of your Authorization will not reverse the use or disclosure of your Protected Health Information while your Authorization was in effect.

VI. YOUR PRIVACY RIGHTS
A. Right to Request Additional Restrictions. You have the right to request restrictions on uses or disclosures of your Protected Health Information to carry out treatment, payment and healthcare operations, but VVMC is not required to agree to such requested restrictions. You may request restrictions on our use and disclosure of Protected Health Information (1) for treatment, payment, and healthcare operations, (2) to individuals (such as a family member, other relative, close personal friend, or any other person identified by you) involved with your care or with payment related to your care, or (3) to notify or assist in the notification of such individuals regarding your location and general condition, as long as you are not asking us to limit uses and disclosures that we are required or authorized to make to the Secretary of the U.S. Department of Health and Human Services related to our facility’s patient directory of any of the disclosures in Section III above. The request must be documented in writing. To request additional restrictions, ask our Compliance Office for a request form and
submit the completed form to the Compliance Office. We will send you a written response of our decision on your request.
B. Right to Receive Confidential Communications. You may request, and we will accommodate, any reasonable written request for you to receive your Protected Health Information by alternative means of communication or at alternative locations, such as by mail to an address other than your home, or never by telephone. To make such a request, you must (i) make your request in writing, (ii) the request must specify the alternative address or other method of payment, if applicable, and (iii) information as to how payment will be handled if the request would vary the way in which VVMC routinely handles payment issues. We are not required to agree to requests for confidential communications that are unreasonable. We will not ask you for an explanation of why you are requesting alternative means of communication.
C. Right to Inspect and Copy Your Health Information. You may request access to our records that we use for decision-making purposes about you and contain your Protected Health Information. You may request access in order to inspect and ask for copies of the records. Under limited circumstances, we may deny you access to portions of your records. If your request is denied, you will receive a written response and may request that the denial be reviewed. If you medical information is maintained in an electronic health record, you also have the right to request that an electronic copy of your record be sent to you or another individual or entity, provided that such choice is clear, conspicuous and specific. To exercise your rights of access, (i) you must submit a written request to our Privacy Office, (ii) the request must state how you want to retrieve the information, such as by mail, pick up, etc., (iii) the request must include the mailing address, if applicable, and (iv) the request must be accompanied by the applicable copying charge. If you desire access to your records, please obtain a record request form from the Compliance Office and submit the completed form to the Compliance Office. If you request copies of your records, we are allowed to charge a fee for the costs of copying, mailing, electronically transmitting or other services associated with your request. Determination of the fee will be made at the time your request is processed. Alternatively, we may provide you with a summary of explanation of your Protected Health Information, as long as you agree to that and to the cost in advance. If you desire access to Protected Health Information maintained by an affiliated provider, please contact them directly. Access to your Protected Health Information may be temporarily suspended where you are participating in a research study that includes treatment and your consent to participate in the research provides for denial of access during the research. In these circumstances, your right of access will be reinstated upon completion of the research.
D. Right to Amend Your Records. You have the right to request that we amend your medical and billing record that we maintain about you and records that we use to make decisions about your care. We have the right to deny your request (i) if we did not create the record (unless you provide us a reasonable basis to believe that the originator of the Protected Health Information is no longer available to act on the request), (ii) the information requested to be amended is not part of your records, (iii) the information would not otherwise be subject to a right of access, or (iv) the information is accurate and complete. Requests to amend your Protected Health Information must be made in writing and must set forth the reason why you believe the amendment is warranted or appropriate. If you desire to amend your records, please obtain an amendment request form from the Compliance Office and submit the completed form to the Compliance Office. Within sixty days of your written request for an amendment of your Protected Health Information, we will either (i) implement the amendment and notify you in writing of this and take reasonable efforts to inform others who may have received the Protected Health Information about the amendment, or (ii) notify you in writing of the reasons why we are either unable to implement the requested amendment (including a statement of your rights in connection with the denial) or inform you of our need for an additional thirty days within which to make a determination and the reasons for such an extension.. If you desire to amend your Protected Health Information maintained by an affiliated provider, please contact them directly.
E. Right to Receive an Accounting of Disclosures. You may request an accounting of certain disclosures of Protected Health Information made by us. The accounting will not include disclosures for payment, treatment and healthcare operations, disclosures to you, disclosures incident to other uses or disclosures that are permitted without your prior authorization, disclosures pursuant to your authorization, disclosures to persons involved in your care, disclosures for national security purposes, to correctional institutions or law enforcement officials, or when your Protected Health Information is de-identified and used for research purposes. Your request must state the period of time desired for the accounting, which must be within the 6 years prior to the date of your request and exclude dates prior to April 14, 2003. If you desire to receive an accounting of disclosures, please obtain an accounting of disclosures request form from the Compliance Office and submit the completed form to the Compliance Office. If you request an accounting more than once during a 12 month period, we may charge a fee based on the cost of fulfilling your request. You will be notified of the fee at the time of your request and will be giving the opportunity to withdraw or modify your request.
F. Right to Receive Paper Copy of this Notice. Upon request, you may obtain a paper copy of this Notice, even if you agreed to receive such notice electronically. To obtain a copy, you may request one from the front desk at the time of any appointment or you may contact our Compliance Officer.
G. Right to Receive Notice of a Breach. We are required to notify you by first class mail or by e-mail, if you have indicated a preference to receive information by email, of any breaches of Unsecured Protected Health Information as soon as possible, but no later than 60 days following the discovery of the breach. “Unsecured Protected Health Information is information that is not secured through the use of a technology or methodology identified by the Secretary of the U.S. Department of Health and Human Services to render the Protected Health Information unusable, unreadable, and undecipherable to unauthorized users. The notice to you will include a brief description of the breach, including the date of the breach and the date of discovery if known; the type of information disclosed; any steps you should take to protect yourself from harm; the steps taken to investigate and mitigate the breach and to prevent further breaches; and contact procedures for you to ask questions or learn more information, including a toll-free number, an e-mail address Web site, or postal address. If the breach involves 10 or more patients whose contact information is out of date, we use a substitute form of notice that is either a conspicuous posting on our website or a conspicuous notice in a major print or broadcast media and will include a toll-free phone number. If more than 500 patients in a state or jurisdiction then we will send notices to prominent media outlets. If the breach involves more than 500 patients we are required to immediately notice the Secretary of the U.S. Department of Health and Human Services. We are also required to submit an annual report to the Secretary of breaches that involved less than 500 patients during the year.
H. For Further Information; Complaints. Please contact us (see address and telephone number in Section VIII, below) if you desire further information about your privacy rights, are concerned that your privacy rights have been violated, or disagree with a decision that we made about access to Protected Health Information. You may also file written complaints with the Director of Office of Civil Rights of the U.S. Department of Health and Human Services at OCRMail@hhs.gov. VVMC’s Privacy Office can provide you with the Director’s physical address. Be assured that no retaliation or diminution of service will result if you file a complaint with the Director or us.

VII. EFFECTIVE DATE AND DURATION OF THIS NOTICE
A. Effective Date. This Notice describes the privacy policy of VVMC that will become effective on April 14, 2003. Prior to that date, VVMC will continue to protect your Protected Health Information appropriately.
B. Right to Change Terms of This Notice. We reserve the right to change the terms of this privacy notice at any time. If we do, the new Notice may apply to any information (including Protected Health Information) created or received prior to issuing the new Notice. We post current Notices in waiting areas around VVMC facilities, and on our Internet site. You also may obtain a copy of any Notice by contacting the Compliance Office.

VIII. CONTACT INFORMATION FOR QUESTIONS OR COMPLAINTS
For more information, please contact VVMC’s Compliance Office: Compliance Office Vail Valley Medical Center PO Box 40,000 Vail, CO 81658 Phone: 1-970-479-7272 You may also send a written complaint to the U.S. Secretary of the Department of Health and Human Services.

IX. LEGAL EFFECT OF THIS NOTICE
This notice is not intended to create any contractual or other rights independent of those created in the federal privacy rule. If more than one entity appears on this notice, the notice is intended to serve as a joint notice under a unified privacy policy among affiliated entities that may share your Protected Health Information, but is not intended to create a relationship between you and an entity that is not applicable to your care or to make any of the listed entities responsible for the duties of another listed entity.