Notice of Privacy Practices
Effective Date: April 2, 2018
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND
DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW
PURPOSE OF THIS NOTICE
Mid-Columbia Medical Center (MCMC) is committed to preserving the privacy
of your health information. In fact, we are required by law to do so for
any health information created or received by us. MCMC is required to
provide this Notice of Privacy Practices (“Notice”) to you.
The Notice tells you how we can and cannot use and disclose the health
information that you have given to us or that we have learned about you
when you were a patient in our system. It also tells you about your rights
and our legal duties concerning your health information.
MCMC is required to abide by this Notice and any future changes to the
Notice that we are required or authorized by law to make at all MCMC locations,
including the hospital and all affiliated clinics and services. This notice
applies to the practices of:
- All MCMC employees, volunteers, students, and clinicians who have access
to health information.
- Any health care professional authorized to enter information into your
MCMC health record.
For the rest of this Notice, “MCMC,” “we” and “us”
will refer to all services, service areas and workers of MCMC. When we
use the words “your health information,” we mean any information
that you have given us about you and your health, as well as information
that we have received while we have taken care of you (including health
information provided to MCMC by those outside of MCMC).
We will have a copy of the current Notice with an effective date in clinical
locations and on our website at www.mcmc.net.
USES AND DISCLOSURES FOR TREATMENT, PAYMENT, AND HEALTH CARE OPERATIONS
Privacy-related laws and rules allow us to use and disclose your protected
health information for purposes of treatment, payment and health care
Treatment – Information obtained by a nurse, physician, or other member of
our health care team will be recorded in your medical record and used
or disclosed to help decide what medical care and services may be right
for you. For example, a physician treating you for a broken leg may need
to know if you have diabetes because diabetes may slow the healing process.
We may also provide health information to other health care professionals
providing you with medical care to help them stay informed about the progress
of your treatment.
Payment – We may use and disclose your health information so that we may
bill and collect payment from you, an insurance company, or someone else
for health care services you receive from MCMC. For example, we may need
to give your health plan medical information about surgery you received
at MCMC so your health plan will pay us or reimburse you for the surgery.
We may also tell your health plan about a treatment you are going to receive
to obtain prior approval or to determine whether your plan will cover
Health Care Operations – We may use and disclose medical information about you for our
operations. We may use and disclose medical information to conduct or
arrange for services, including: business planning, development and management;
medical review; legal services; risk management; auditing functions, including
fraud and abuse detection and compliance programs. These uses and disclosures
are necessary to run MCMC and ensure that our patients receive quality
care. For example, we use and disclose your health information to assess
quality and improve services. We may also use and disclose medical information
to review the qualifications and performance of our health care providers
and to train our employees.
Fundraising Activities – As part of MCMC’s healthcare operations, we may use and disclose
a limited amount of your health information internally, or to the Mid-Columbia
Health Foundation to allow them to contact you to raise money for MCMC.
The health information released for these fundraising purposes can include
your name, address, other contact information, gender, age, date of birth,
dates on which you received service, health insurance status, the outcome
of your treatment at MCMC and your treating physician’s name. Any
fundraising communications you receive from MCMC or its Foundation will
include information on how you can elect not to receive any further fundraising
communications from MCMC.
Uses and Disclosures You Can Limit
Facility Directory – Unless you notify us that you object, we may include certain information
about you in the hospital directory, in order to respond to inquiries
from friends, family, clergy and others who inquire about you when you
are a patient in the hospital. Specifically, your name, location in the
hospital and your general condition (e.g., good, fair, serious, critical)
may be released to people who ask for you by name. In addition, your religious
affiliation may be given to a member of the clergy, such as a priest or
rabbi, even if they don’t ask for you by name.
Family and Friends – Unless you notify us that you object, we may provide your health
information to individuals, such as family and friends, who are involved
in your care or who help pay for your care. We may do this if you tell
us we can do so, or if you know we are sharing your health information
with these people and you don’t stop us from doing so. There may
also be circumstances when we can assume, based on our professional judgment,
that you would not object. For example, we may assume you agree to our
disclosure of your information to your spouse if your spouse comes with
you into the exam room during treatment.
Also, if you are not able to approve or object to disclosures, we may make
disclosures to a particular individual (such as a family member or friend),
that we feel are in your best interest and that relate to that person’s
involvement in your care. For example, we may tell someone who comes with
you to the emergency room that you suffered a heart attack and provide
updates on your condition. We may also make similar professional judgments
about your best interests that allow another person to pick up such things
as filled prescriptions, medical supplies and x-rays.
Appointment Reminders; Treatment Alternatives; and Health-Related Benefits
and Services – We may contact you to remind you about appointments and provide
you with information about treatment alternatives or other health-related
benefits and services that may be of interest to you.
Health Information Exchange – Unless you notify us that you object, we may make your medical
information available electronically through an information exchange to
other health care providers, health plans and health care clearinghouses
that request your records. Participation in information exchange services
also lets us see their information about you. We share an electronic medical
record system with Oregon Health and Science University.
OTHER PERMITTED USES AND DISCLOSURES OF HEALTH CARE INFORMATION WITHOUT
Medical Research – We may use and disclose health care information about you for
research purposes if the research has been properly approved by an Institutional
Review Board (or Privacy Board) and has policies to protect the privacy
of your health information. We may also share your medical information
with researchers preparing to conduct a research project.
To Funeral Directors / Coroners – We will disclose health care information to a coroner, medical
examiner or funeral director as required by or applicable to law.
To Organ Procurement Organizations – We will disclose health care information as is necessary to facilitate
organ or tissue donation and transplantation if an appropriate consent
is presented by you or your immediate family.
As Required by Federal, State, or Local Law – We will disclose minimum necessary health care information when
required to do so under federal, state or local law.
For Law Enforcement Purposes – We may disclose health care information as required by law or
as directed by a court order, warrant, criminal subpoena, or other lawful
process, and in other limited circumstances for purposes of identifying
or locating suspects, fugitives, material witnesses, missing persons or
Pursuant to Lawful Subpoena or Court Order – We may disclose health care information in response to a court
or administrative order. We also may disclose health care information
about you in response to a civil subpoena, discovery request, or other
lawful process by someone involved in the disagreement, but only if efforts
have been made to tell you about the request or to obtain an order protecting
the information requested.
To Avert a Serious Threat to Health or Safety – We will use and disclose health care information when it involves
a serious threat to your health or safety or the health and safety of
the public or another person. Disclosure will be made to a person able
to prevent or lessen the threat.
For Disaster Relief Purposes – We may share health care information about you with disaster relief
agencies to assist in notification of your condition to family or others.
To Correctional Institutions – If you are an inmate or under the custody of a law enforcement
official, we may release health care information about you to the correctional
institution or law enforcement official. This disclosure would be necessary
for the institution to provide you with health care, to protect your health
or the health and safety of others, or for the safety and security of
the correctional institution.
To Health and Oversight Agencies – We may disclose health care information about you to a health
oversight agency for activities authorized by law. These activities are
necessary to monitor the health care system, government programs, and
compliance with civil rights laws. These oversight activities may include
audits, investigations, inspections, and licensure.
For Public Health Purposes – We may disclose health care information about you for public health
activities as authorized by law. This would include notifying a person
who may have been exposed to a disease or may be at risk for contracting
or spreading a disease or condition; to prevent or control disease, injury
or disability; or to report births and deaths.
To Report Suspected Abuse or Neglect – If you agree or when required or authorized by law, we may disclose
health care information to appropriate government authorities.
To the Food and Drug Administration - (FDA) – We may disclose health care information relative to problems and
adverse events with food, supplements, medications, and products and product
defects, or post marketing surveillance information to enable product
recalls, repairs, or replacement.
To Workers' Compensation Program – We may disclose health care information to the state workers'
compensation program to the extent authorized by law.
For Work-Related Injuries or Illnesses or Workplace Medical Surveillance – We may disclose health care information where your employer has
a duty under state or federal law, to keep records or act on such information.
To the Military – As required by military command authorities if you are a member
of the armed forces, we may disclose health care information. We may disclose
to the Department of Veteran Affairs about your eligibility for benefits.
We may also disclose medical information about foreign military personnel
to the appropriate foreign military authority.
For Specialized Government Functions – We may disclose health care information about you to authorized
federal officials for activities including intelligence, counterintelligence,
and other national security activities authorized by law.
Incidental Disclosures – Certain incidental disclosures of your medical information may
occur as a byproduct of lawful and permitted use and disclosure of your
medical information. For example, patients who share rooms may overhear
information during their stay when family and care providers enter the
room and discuss patient information. Reasonable safeguards will be used
to protect information.
Disclosures to Business Associates – In certain circumstances, we may need to share your medical information
with a business associate (such as a transcription company or medical
device supplier) so it can perform a service on our behalf. We will have
a written contract in place with the business associate requiring it to
protect the privacy of your medical information.
WHEN WRITTEN AUTHORIZATION IS REQUIRED
Uses and disclosures not in this Notice of Privacy Practices will be made
only as allowed or required by law or with your written authorization.
Special circumstances that require an authorization include most uses
and disclosures of your psychotherapy notes, certain disclosures of your
test results for the human immunodeficiency virus or HIV, genetic information,
uses and disclosures of your health information for marketing purposes
that encourage you to purchase a product or service, and for sale of your
health information with some exceptions. If you give us an authorized
revocation, you can withdraw this written authorization at any time. To
withdraw your authorization, deliver or fax a written revocation to MCMC
Health Information Management Department, 1700 E. 19th Street, The Dalles, Oregon 97058; fax: (541) 296-7617. If you revoke your
authorization, we will no longer use or disclose your health information
as allowed by your written authorization, except to the extent that we
have already relied on your authorization.
YOUR HEALTH INFORMATION RIGHTS
You have certain rights regarding your health information which we list
below. In each of these cases, if you want to exercise your rights, you
must do so in writing. Forms can be obtained from the Health Information
Management Department, 1700 E. 19th Street, The Dalles, OR 97058. In some cases, we may charge you for the
costs of providing materials to you. You can get information about how
to exercise your rights and about any costs that we may charge for materials
by contacting the Health Information Management Department at (541) 296-7294.
- Right to Inspect and Copy. With some exceptions, you have the right to
inspect and get a copy of the health information that we use to make decisions
about your care. For the portion of your health record maintained in our
electronic health record, you may request we provide that information
to or for you in an electronic format. If you make such a request, we
are required to provide that information for you electronically (unless
we deny your request for other reasons). We may deny your request to inspect
and/or copy in certain limited circumstances, and if we do this, you may
ask that the denial be reviewed.
- Right to Amend. You have the right to ask us to amend your health information
maintained by or for MCMC, or used by MCMC to make decisions about you.
We will require that you provide a reason for the request, and we may
deny your request for an amendment if the request is not properly submitted,
or if it asks us to amend information that (a) we did not create (unless
the source of the information is no longer available to make the amendment);
(b) is not part of the health information that we keep; (c) is already
accurate and complete.
- Right to an Accounting of Disclosures. You have the right to request a
list and description of certain disclosures by MCMC of your health information,
other than those used for treatment, payment or operations.
- Right to Request Restrictions. You have the right to request a restriction
or limitation on the health information we use or disclose about you (a)
for treatment, payment or health care operations, (b) to someone who is
involved in your care or the payment for it, such as a family member or
friend, or (c) to a health plan for payment or health care operations
purposes when the item or service for which MCMC has been paid out of
pocket in full by you or someone on your behalf (other than the health
plan). For example, you could ask that we not use or disclose information
about a surgery you had, a laboratory test ordered or a medical device
prescribed for your care. Except for the request noted in (c) above, we
are not required to agree to your request. Any time MCMC agrees to such
a restriction, it must be in writing and signed by the MCMC Privacy Officer
or his or her designee.
- Right to Request Confidential Communications. You have the right to request
that we communicate with you about health matters in a certain way or
at a certain place. MCMC will accommodate reasonable requests. For example,
you can ask that we only contact you at work or by mail.
- Right to a Paper Copy of This Notice. You have a right to a paper copy
of this Notice, whether or not you may have previously agreed to receive
the Notice electronically.
- Right to be Notified of a Breach. You have the right to be notified if
there is a breach – a compromise to the security or privacy of your
health information – due to your health information being unsecured.
MCMC is required to notify you within 60 days of discovery of a breach.
REVISIONS TO THIS NOTICE
We have the right to change this Notice and to make the revised or changed
Notice effective for health information we already have about you, as
well as any information we receive in the future. Except when required
by law, a material change to any term of the Notice may not be implemented
prior to the effective date of the Notice in which the material change
is reflected. MCMC will post the revised Notice at MCMC clinical locations
and on its website and provide you a copy of the revised notice upon your request.
QUESTIONS OR COMPLAINTS
If you have any questions about this Notice, please contact MCMC at 541-296-7671.
If you believe your privacy rights have been violated, you may file a
complaint with the MCMC Privacy Officer. To file a complaint with MCMC,
write to MCMC Privacy Officer at 1700 E 19th St, The Dalles, OR 97058 or call 541-296-7671. If we cannot resolve your
concern, you have the right to file a written complaint with the Secretary
of the Department of Health and Human Services. You will not be penalized
for filing a complaint.