Updated every 5 minutes
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
*Should you have a communication need or should you require this Notice in a different format, please contact the Compliance Department*
Purpose of the Joint Notice of Privacy Practices
This Joint Notice of Privacy Practices (the “Notice”) is applicable to Eastern Connecticut Health Network (“ECHN”) and its wholly owned subsidiaries and affiliates. It is meant to inform you of the uses and disclosures of protected health information that we may make. It also describes your rights to access and control your protected health information and certain obligations we have regarding the use and disclosure of your protected health information.
Your protected health information (“PHI”) is individually identifiable health information or healthcare payment information maintained or transmitted in any medium which identifies you or can be used to identify you. PHI includes all demographic information collected from you and all information related to your past, present or future physical/mental health or condition.
We are required by law to maintain the privacy of your PHI. We are also required to provide you with this Notice of our legal duties and privacy practices with respect to your PHI and to follow the terms of the Notice that are currently in effect. However, we may change our Notice at any time. The revised Notice applies to all PHI we maintain. We will post a copy of the most current notice in the ECHN Facility. If you would like to receive a copy of any revised Notice, you can find it on our website, you can contact the ECHN Facility or you can ask for a copy at your next appointment.
Uses and Disclosures for Which an Authorization is Required
Psychotherapy Notes: ECHN must obtain a special authorization for any use or disclosure of psychotherapy notes, except in some limited and special circumstances.
Marketing: A signed authorization is required for the use or disclosure of your PHI for a purpose that encourages you to purchase or use a product or service except for certain limited circumstances such as when the marketing communication is face-to-face or when marketing includes the distribution of a promotional gift of nominal value provided by the ECHN Facility or ECHN. Any treatment or communication by the ECHN Facility or ECHN for the marketing of a third party’s product or service requires authorization if the ECHN Facility will receive remuneration in exchange for making the communication.
Other uses and disclosures of your PHI not described below in this Notice or permitted by law will be made only with your written authorization. For any of the items described below, when consent for disclosure of your PHI is required by law, your consent will be obtained prior to any such disclosure. You may revoke your authorization or consent at any time by contacting the respective ECHN Facility or the ECHN Compliance Department. When you revoke your authorization or consent it will only apply to future uses of your PHI.
When State Law Offers More Protection than Federal Law: The State of Connecticut may from time to time adopt privacy laws that are stricter than federal law. If this is the case, ECHN will follow the law that provides more protection and will not disclose your PHI for any purpose prohibited by these laws without your consent.
How We May Use or Disclose Your PHI Each ECHN Facility will ask you to sign a consent form that allows the Facility to use and disclose your PHI for treatment, payment and healthcare operations. You will also be asked to acknowledge receipt of this Notice. As permitted by law, ECHN affiliates may share PHI with each other for treatment, payment and certain healthcare operations. The following categories describe some of the different ways that we may use and disclose your PHI. Even if not specifically listed below, the ECHN Facility may use and disclose your PHI as permitted or required by law or as authorized by you. We will make reasonable efforts to limit access to your PHI to those persons in our workforce who need access to carry out their duties. In addition, if required, we will make reasonable efforts to limit the use and disclosure of your PHI to the minimum amount necessary to accomplish the intended purpose.
For Treatment: We may use and disclose PHI about you to provide, coordinate or manage your medical treatment or services. We may disclose PHI about you to doctors, nurses, technicians, students or other ECHN personnel involved in taking care of you. If we are permitted to do so, we may also disclose your PHI to non-ECHN healthcare providers, agencies or facilities in order to provide or coordinate the different services you may need, such as prescriptions, lab work and X-rays. We also may disclose your PHI to people outside of ECHN who may be involved in your continuing medical treatment after you leave our care, such as other healthcare providers, home health agencies and transport agencies. We may also use or disclose your PHI in an emergency situation.
For Payment: We may use and disclose PHI about you so that we can bill and receive payment for the treatment and related services you receive. For billing and payment purposes, we may disclose your health information to your payment source, including insurance or managed care companies, Medicare, Medicaid or another third party payer. We may also share your PHI with another doctor, facility or service provider, such as an ambulance company or subcontractor that has treated you or has provided services to you, so that they can bill you, your insurance company or a third party. For example, in order for your insurance company to pay for your health-related services at ECHN, we must submit a bill that identifies you, your diagnosis and the treatment we provided. We may also tell your health plan about a proposed treatment to determine whether your plan will cover the treatment.
For Healthcare Operations: We may use and disclose your health information as necessary to support the business activities of ECHN and improve the quality of care. For example, we may use your protected health information to review the treatment and services that we gave you and to see how well our staff cared for you. We may share your information with our students, trainees and staff for review and learning purposes. Your protected health information may also be used or disclosed for accreditation purposes, to handle patients’ grievances or lawsuits and for healthcare contracting relating to our operations.
Business Associates: We may share your PHI with a business associate that we hire to help us (e.g., billing services, consultants, etc.). To protect your PHI, we require our business associates to enter into a written contract that requires them to appropriately protect your information.
Appointment Reminders: We may use and disclose your PHI to remind you of your appointment for treatment or medical care. For example, if your doctor has sent you for a test, the testing site may call you to remind you of the date you are scheduled.
Treatment Alternatives and Other Health-Related Benefits and Services: We may use your information to contact you about treatment options and other health-related benefits and services provided by ECHN that may be of interest to you. This may include information about our staff, medical education classes or about health-related products and services offered by ECHN that may be beneficial for you. However, we will not use your information to engage in marketing activities (other than face-to-face communications) without your written authorization. We also will never sell your PHI to third parties without your written authorization to do so. However, we may receive payment to disclose your PHI for certain limited purposes permitted by law.
Facility Directory: Unless you object, we may include limited information about you in our Facility Directory while you are a patient at an ECHN Facility, including your name, location in the facility, your general condition (e.g., fair, stable, etc.), and your religious affiliation. This is so your family, friends and clergy can visit you and generally know how you are doing. Your room location and general condition will be released to people who ask for you by name only. Your religious affiliation will be given only to a member of the clergy, such as a priest, minister or rabbi, etc. even if they do not ask for you by name. If you object to being included in the hospital directory, we will not disclose your information to anyone who asks for you unless required by law. If you do not want your information listed in the Facility Directory, you must notify personnel during registration.
We will NOT include your PHI in ECHN Facility’s directory if you are receiving mental health services or are part of a substance abuse treatment program at any ECHN Facility.
Individuals Involved In Your Care or Payment for Your Care: We will always attempt to seek your permission before speaking to other individuals who may be involved in your care or payment for your care. If you do not object, are unconscious, or are otherwise unresponsive we may disclose your PHI to a family member, a relative, a close friend, or any other person you previously identified. The information disclosed will be related to the person’s involvement in your healthcare and will be used to notify the person of your location or general condition or to determine the status of payment related to your healthcare. If you have an authorized legal representative who has the authority under state law to make healthcare decisions for you, we will treat the legal representative the same way we would treat you with respect to your PHI. Parents and legal guardians are generally legal representatives for minors unless the minors are permitted under limited circumstances by state law to act on their own behalf and make their own medical decisions.
Incidental Disclosures: While we will take reasonable steps to safeguard the privacy of your protected health information, certain disclosures of your information may occur during or as an unavoidable result of our otherwise permissible uses or disclosures of your information. For example, during the course of a treatment session, other patients in the treatment area may see or overhear discussion of your information (e.g., semi-private rooms or Emergency Department triage area). These “incidental disclosures” are permissible; however ECHN will attempt to limit these disclosures from occurring.
As Required By Law: We will share your PHI when federal, state or local law requires us to do so. This includes to the Secretary of the U.S. Department of Health and Human Services for HIPAA rules compliance and enforcement purposes.
Public Health Activities: We may disclose your PHI to a public health authority that is authorized by law to collect or receive such information, such as for the purpose of preventing or controlling disease, injury, or disability; reporting births, deaths, or other vital statistics; reporting child abuse or neglect; elder abuse or neglect; reporting domestic violence; reporting reactions to medications or problems with products; notifying individuals about recalls, repairs or replacements of products they may be using; notifying a person who may have been exposed to a disease or may be at risk of contracting or spreading a disease or condition and reporting to your employer findings concerning work-related illness or injury so that your workplace may be monitored for safety.
Disaster Relief Efforts: We may disclose your PHI to a public or private entity authorized by law to assist in disaster relief efforts, such as the American Red Cross so that your family can be notified about your condition, status and location in the event of a disaster. If you are unable to agree or object to such a disclosure we may disclose such information if we determine that it is in your best interest based on our professional judgment or if we reasonably infer that you would not object.
Health Oversight Activities: We may disclose your PHI to local, state or federal governmental authorities responsible for the oversight of medical matters as authorized by law. This includes licensing, auditing and accrediting agencies and agencies that administer public health programs such as Medicare and Medicaid.
Judicial and Administrative Proceedings: If you are involved in a lawsuit or a dispute, we may disclose your PHI in response to your authorization or in response to a court or administrative order. We may also disclose your PHI in response to a subpoena, discovery request, or other lawful process if the law permits such disclosure and patient notification requirements have been met.
Law Enforcement: We may disclose your PHI for certain law-enforcement purposes if permitted or required by law. For example, we may disclose your PHI to report gunshot wounds, emergencies, or suspicious deaths; to comply with a court order, warrant, or similar legal process; or to answer certain requests for information concerning crimes, provided under certain circumstances the information is limited.
Coroners, Medical Examiners, Funeral Directors and Organ, Eye or Tissue Procurement Organizations: We may release your PHI to a coroner or medical examiner as necessary to identify a deceased person or to determine the cause of death. We also may release PHI to funeral directors so they can carry out their duties.
If you are an organ donor, we may release your PHI to organizations that obtain organs or handle organ, eye or tissue transplantation. We also may release your information to an organ donation bank as necessary to facilitate organ, eye or tissue donation and transplantation.
Research Purposes: All research projects conducted must be approved through a special review process to protect patient safety, welfare and confidentiality. Your PHI may be important to research efforts and may be used for research purposes. Researchers may contact you regarding your interest in participating in certain research studies after receiving your authorization or approval of the contact from a special review committee called an Institutional Review Committee (IRC). An IRC is a special committee that protects the rights and welfare of people who participate in research studies. Enrollment in most studies may occur only after you have been informed about the study, had an opportunity to ask questions and indicated your willingness to participate by signing an authorization or consent form that has been reviewed and approved by an IRC. In some instances, federal law allows us to use your PHI for research without your authorization, provided we get approval from an IRC or other special review board. These studies will not affect your treatment or welfare, and your PHI will continue to be protected. For example, a research study may involve a chart review to compare the outcomes of patients who received different types of treatment. Federal law also allows researchers to look at your PHI when preparing future research studies, so long as any information identifying you does not leave the ECHN Facility.
To Avert a Serious Threat to Health or Safety: We may use and disclose your PHI when necessary to prevent or lessen a serious threat to your health or safety or the health or safety of the public or another person. Any disclosure, however, would be to someone able to help prevent the threat from being carried out.
Specialized Governmental Functions (Military and National Security): If required by law and you are a member of the armed forces (of either the United States or of a foreign government), we may use and disclose your PHI as required by military command authorities or the Department of Veterans Affairs. If required by law, we may disclose your PHI to authorized, federal officials for the purposes of conducting of lawful intelligence, counter-intelligence, medical suitability determinations and other national security activities; or providing protection to the President, other authorized persons or foreign heads of state or to conduct special investigations.
Correctional Institutions and Other Law Enforcement Custodial Situations: If you are an inmate of a correctional institution or in the custody of a law enforcement official, we may disclose your PHI to the correctional institution or law officer as authorized or required by law. This includes sharing information that is necessary to protect the health and safety of other inmates or persons involved in supervising or transporting inmates.
Workers’ Compensation: We may use or disclose your PHI for workers’ compensation or similar programs that provide benefits for work-related injuries or illness, as permitted by law.
For disclosures of PHI related to care for mental health conditions, substance abuse or HIV-related testing and treatment, special restrictions may apply. For example, we generally may not disclose this specially protected information in response to a subpoena, warrant, or other legal process unless you sign a special authorization or a court orders the disclosure. We will follow state and/or federal law and obtain a special authorization to release this type of information about you.
Mental Health Information: Certain mental health information may be disclosed for treatment, payment and healthcare operations as permitted or required by law. Otherwise, ECHN will only disclose such information pursuant to an authorization, court order or as otherwise required by law. For example, all communications between you and a psychologist, psychiatrist, social worker and certain therapists and counselors will be privileged and confidential in accordance with federal and state law (e.g., psychotherapy notes).
Substance Abuse Treatment Information: If you are treated in a specialized substance abuse program, federal law protects the confidentiality of alcohol and drug abuse patient records. These records may be disclosed if:
Violation of these federal laws is a crime. Suspected violations may be reported to appropriate authorities in accordance with Federal regulations. Federal law does not protect any information about a crime committed by a patient in a substance abuse program or against any person who works for the program or about any threat to commit such a crime. Federal laws do not protect any information about suspected child abuse or neglect from being reported under state law to appropriate state or local authorities.
HIV-related Information: We may disclose HIV-related information as permitted or required by state law. For example, your HIV-related information, if any, may be disclosed without your authorization for treatment purposes, certain health oversight activities, pursuant to a court order, or in the event of certain exposures to HIV by personnel of the ECHN Facility, another person, or a known partner.
Minors: We will comply with Connecticut law when using or disclosing PHI of minors. For example, if you are an unemancipated minor consenting to a healthcare service related to HIV/AIDS, venereal disease, abortion, outpatient mental health treatment or alcohol/drug dependence, and you have not requested that another person be treated as a legal representative; you may have the authority to consent to the use and disclosure of your health information. For these special exceptions relating to minors there are certain criteria that must be met in order for a minor to control their PHI. All questions related to section shall be answered by the ECHN’s Chief Compliance and Privacy Officer, or designee.
Your Rights Concerning Your PHI
You have certain rights with respect to your PHI. The following briefly describes how you may exercise these rights.
Right to Access, Inspect and Copy Your PHI: You have the right to access, inspect and obtain a copy of (including digital or electronic copy if available) your PHI that is used to make decisions about your care for as long as the PHI is maintained by the ECHN Facility. To access, inspect and copy your PHI that may be used to make decisions about you, you must submit your request in writing to the respective Facility’s Health Information Management (“HIM”) Department. There may be a reasonable cost based fee associated with the request. We may deny, in whole or in part, your request to access, inspect and copy your PHI under certain limited circumstances. If we deny your request we will provide you with a written explanation of the reason for the denial. You may have the right to have this denial reviewed by an independent healthcare professional designated by ECHN to act as a reviewing official. This individual will not have participated in the original decision to deny your request. A description of the process to have a denial reviewed, as well as information on how to file a complaint with the Secretary of the U.S. Department of Health and Human Services, will be included in the correspondence informing you of our decision to deny your request. You may also have the right to request a review of our denial of access through a court of law. All requirements, court costs and attorney’s fees associated with a review of denial by a court are your responsibility. You should seek legal advice if you are interested in pursuing your rights through a court.
Right to Request an Amendment/Addendum to Your PHI: If you feel that the PHI that we have about you is incorrect or incomplete, you may ask us to amend the information. You should know that amending a record does NOT mean that the original entry in your legal health record will be deleted or altered. Instead it is a separate entry or an addendum that is made to correct or clarify the original documentation. Amendments, when approved, will become part of the permanent record. Under no circumstance will an ECHN Workforce Member remove or attempt to delete information which is part of your legal health record. You have the right to request an amendment to your PHI for as long as the information is maintained by or for the ECHN Facility. Your request must be made in writing to the Facility’s HIM Department and must state the reason for the requested amendment. You can obtain a Request for Amendment of Health Information form from the Facility’s HIM Department or the Compliance Department.
If we deny your request for amendment, we will give you a written denial, including the reasons for the denial and your right to submit a written statement disagreeing with the denial. We may rebut your statement of disagreement. If you do not wish to submit a written statement disagreeing with the denial, you may request that your request for amendment and our denial be disclosed with any future disclosure of your PHI.
Right to Receive an Accounting of Disclosures of PHI: You have the right to ask us for a listing of those individuals or entities who have received PHI from ECHN in the six years prior to your request. It is important to note that an accounting of disclosures of your PHI is not an audit log of Workforce Members who may have had access to your PHI, rather an accounting of certain disclosures of your PHI by the ECHN Facility or by others on your behalf. This listing will NOT cover disclosures made:
To request an accounting of disclosures, you must submit a request in writing, stating a time period beginning on or after April 14, 2003 that is within six (6) years of the date of your request. The first accounting provided within a twelve (12) month period will be free. We may charge you a reasonable, cost-based fee for each future request for an accounting within a single twelve-month period.
Right to Request Restrictions on the Use and Disclosure of Your PHI: You have the right to ask us to restrict or limit the PHI we use or disclose about you. In most cases, we must consider your request, but we are not required to agree to it. However, we must agree to limit disclosures made to your health insurer or other third-party payer about services we provided to you if, prior to receiving the medical services, you pay for the services in full, unless the disclosure of that information is required by law. If multiple medical services are provided to you at one time by ECHN, you will have to pay for all of the services in order to restrict the disclosure of any one of them to your health insurance company. If you require follow-up care related to the undisclosed service and you decide you do not want to pay for that follow-up care at the time it is provided to you, it may be necessary for us to tell your health insurer about the previously undisclosed service. This will be done only to the extent necessary to receive payment for subsequent medical treatment. If we do agree to accept your requested restriction, we will comply with your request except as needed to provide you with emergency treatment. If restricted PHI is disclosed to a healthcare provider for emergency treatment, we will request that such healthcare provider not further use or disclose the information.
You also have the right to request a limit on the PHI we disclose about you to someone who is involved in your care or the payment of your care, such as a family member or a friend. For example, you could ask that we not disclose information to a family member about a surgery you had. To restrict information, you must notify an ECHN staff member at the time of registration and fill out a Request for Restriction on Use and Disclosure of PHI form indicating this preference. ECHN may terminate this restriction if you agree in writing or if ECHN informs you of the reason for the termination.
Right to Receive Confidential Communications: You have the right to request a reasonable accommodation that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we contact you only at home or only by mail. If you want us to communicate with you in a special way, you will need to give us details about how to contact you, including a valid alternate address. You will also need to give us information about where your bills may be sent. Your request must be made in writing to the respective ECHN Facility’s HIM Department utilizing the Request for Confidential Communication of PHI by Alternative Means form. You do not need to provide a reason for your request. We will comply with all reasonable requests. However, if we are unable to contact you using the requested means or locations, we may contact you using whatever information we have. This request will only apply to communications from ECHN; if you wish to request confidential communications from your physician’s office or your insurance company, you must contact them separately.
Right to Receive Notice of a Breach of Your PHI: You have a right to be notified in the event of a breach of the privacy of your PHI by ECHN or its business associates. You will be notified as soon as reasonably possible, but no later than 60 days following our discovery of the breach. The notice will provide you with the date we discovered the breach, a brief description of the type of information that was involved and the steps we are taking to investigate and mitigate the situation, as well as contact information for you to ask questions and obtain additional information.
Right to Obtain a Paper Copy of This Notice (NOPP): Upon request, you may at any time obtain a paper copy of this Notice, even if you previously agreed to receive this Notice electronically. To request a copy, please ask the registrar/receptionist for one at the time of your next visit or contact the ECHN Compliance Department. You may also obtain a copy by visiting our website at www.echn.org.
Right to File a Complaint: If you believe that your privacy rights have not been followed as directed by federal regulations and state law or as explained in this Notice, you may contact us by telephone, submit a complaint via the Compliance Hotline, or file a written complaint with us at the address below. We will make every reasonable effort to resolve your complaint with you.
Chief Compliance and Privacy Officer Eastern Connecticut Health Network 71 Haynes Street Manchester, CT 06040 (860) 646-1222, ext. 3652
If you are not satisfied with our response to your privacy complaint or you otherwise wish to file a complaint, you may also file a complaint with the Secretary of the U.S. Department of Health and Human Services. The complaint must be filed in writing by mail, fax, e-mail or via the OCR Complaint Portal online. The complaint must be filed within 180 days of when you were made known the issue occurred.
Office for Civil Rights
U.S. Department of Health and Human Services
Centralized Case Management Operations
200 Independence Ave., S.W.
Suite 515F, HHH Building
Washington, D.C. 20201
Customer Response Center: (800) 368-1019
Fax: (202) 619-3818
TDD: (800) 537-7697
The Connecticut Office of the Attorney General also has authority to enforce HIPAA protections for Connecticut state residents. To file a complaint with the Office of the Attorney General, please fill out the form located on the Office of the Attorney General website at: http://portal.ct.gov/AG/Health-Issues/Health-Information--Services/Your-Rights-Under-HIPAA and send to:
The Connecticut Office of the Attorney General
55 Elm Street
Hartford, CT 06141
You Will Not Be Retaliated Against or Denied Health Services if You File a Complaint: Under HIPAA an entity cannot retaliate against you or deny healthcare services to you for filing a complaint in good faith. ECHN will not retaliate against you for filing a complaint or for bringing your concerns to our attention. Every complaint is taken seriously and will be fully investigated. Should you feel as if these rights have been violated, please contact the Compliance Department.
Future Changes to ECHN’s Joint Notice of Privacy Practices and This Notice
ECHN reserves the right to change this Notice and the privacy practices of the entities covered by this Notice without first notifying you. We reserve the right to make the revised or changed Notice effective for PHI we already have about you as well as any information we receive in the future. You may request a copy of the most recent notice at any time per the steps outlined above under “Right to Obtain a Paper Copy of This Notice (NOPP)”.
The Eastern Connecticut Health Network entities listed below will follow the terms of this Notice. In addition, these entities may share medical and billing information with each other for treatment, payment or healthcare operations purposes described in this Notice.
LABORATORY SERVICE LOCATIONS
MEDICAL PRACTICES AND CLINICS