Privacy Policy

Cookies & Embedded Content

If you visit pages on our site, some features may set temporary cookies for your convenience; these contain no personal data beyond what you choose to provide. Pages on this site may include embedded content (e.g. videos, images, articles). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website. These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Your Rights Over Your Data

You can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

SMS

Protected Health Information (PHI)

1) Use and Disclosure of PHI for Treatment, Payment, or Healthcare Operations

PHI may be disclosed without individual authorization for treatment, payment, or healthcare operations (TPO). This includes the following:

• The Company's own treatment, payment, or healthcare operations (TPO).
• Treatment activities of another health care provider.
• The payment activities of another covered entity or healthcare provider.
• The healthcare operation activities of another covered entity or health care provider, if each entity has or had a relationship with the individual who is the subject of the PHI being requested, and the disclosure is: a) for a purpose listed in the definition of health care operations; or b) for the purpose of health care fraud and abuse detection or compliance.

2) Disclosures for Payment

• Only the minimum necessary PHI shall be disclosed for payment functions, as provided through contractual agreement.
• Persons handling PHI in a payment context shall refrain from publicizing individual diagnosis information.
• This policy shall apply to checks collected, credit card paper receipts, and envelopes.

3) Use and Disclosure of PHI for non-TPO Purposes

The Company may not use and disclose PHI for non-TPO purposes, unless the Company has obtained a valid authorization for disclosure of PHI signed by the individual or personal representative of the individual that meets the requirements of Quality Management.

4) Inappropriate Use and Disclosure of PHI

Company personnel must only use individual PHI when it is directly related to their work duties. Any use or disclosure of individual information outside the scope of employment is a breach of confidentiality. Medical records are not to be used as reading material or accessed out of curiosity. Examples of inappropriate use of PHI resulting in a breach of individual confidentiality include:

• Discussing individuals in public areas — i.e. restrooms, elevators, hallways, etc.
• Reviewing treatment information on a peer, colleague, or friend who is not actively engaged as an individual in this facility.
• An employee who uses an electronic system to look up the phone number and address of an individual for personal reasons.
• An employee involved in a family dispute who accesses information about the welfare of a family member, including information about when their next appointment at the Company is.
• An employee asked by a visitor for the location of an individual, who looks up the information even though it is not part of the employee's job.
• An employee who accesses the Company bed census to find out where an individual is being treated.

Company personnel are responsible for all information accessed under their username and password. Sharing passwords or leaving computers unattended and logged in to a program containing PHI while unattended jeopardizes individual confidentiality and will be considered a breach of confidentiality if the information is accessed inappropriately.

5) Disclosure Responsibility

Company personnel are responsible for all disclosures of PHI. The disclosure of PHI, whether written, oral, or electronic, must be done solely for TPO purposes associated with the individual in accordance with this policy. Communicating confidential individual information inappropriately, carelessly, or negligently is a breach of confidentiality. Professional discussion of individual conditions or medical plans should be limited to private areas and should not be discussed in public areas such as hallways or waiting areas.

Examples of inappropriate disclosure of PHI resulting in a breach of individual confidentiality include:

• An employee treating a well-known person in the community telling other employees (not on the individual's treatment team) about the treatment of the individual.
• An employee who learns about the condition of an individual who is also a family member while at work, then tells other family members about the individual's condition.
• An employee who sends an email to a spouse containing PHI on individuals the employee was treating.
• An employee who discloses identifying information and talks about the medical condition of an individual in the dining hall with friends at lunch.
• An employee who accidentally leaves detailed medical notes on individuals on a table next to a soft drink machine while on break.

6) Transmission of PHI

It is this facility's policy that PHI may only be transmitted by the following:

• Mail — priority or certified mail; or
• Facsimile — faxing of PHI is the preferred method.
• Password-protected files are allowed to be transmitted electronically in extreme instances. In certain circumstances, encrypted email may be utilized if required to comply with federal regulations.
• Transmission of documentation and records for virtual programming will be facilitated through an end-to-end encrypted patient portal.
• Email is prohibited for exchange of PHI, except through the use of encryption software.

The Minimum Necessary Rule prevails with all record requests. For any release of PHI where multiple items are requested, Records Management, in collaboration with the Director of Quality Management and Compliance, will evaluate which items will be sent based upon the minimum necessary rule and purpose of the request. Just because all items are requested, not all items will be sent.

All requests for PHI must be submitted in writing utilizing the "Authorization for Release" form and be signed by the individual or the individual's authorized representative. Requests not submitted on this form will not be accepted, and the requestor will be made aware of this form. The Director of Quality Management will verify information to confirm it is a legitimate request.

A record of all transmissions of PHI will be recorded by the Medical Records department and will document the date the PHI was requested, the requestor/entity, verification of requestor, and date the PHI was released.