Notice of Privacy Practices

Effective Date: April 2, 2018

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Mid-Columbia Medical Center (MCMC) is committed to preserving the privacy of your health information. In fact, we are required by law to do so for any health information created or received by us. MCMC is required to provide this Notice of Privacy Practices (“Notice”) to you. The Notice tells you how we can and cannot use and disclose the health information that you have given to us or that we have learned about you when you were a patient in our system. It also tells you about your rights and our legal duties concerning your health information.

MCMC is required to abide by this Notice and any future changes to the Notice that we are required or authorized by law to make at all MCMC locations, including the hospital and all affiliated clinics and services. This notice applies to the practices of:

• All MCMC employees, volunteers, students, and clinicians who have access to health information.
• Any health care professional authorized to enter information into your MCMC health record.

For the rest of this Notice, “MCMC,” “we” and “us” will refer to all services, service areas and workers of MCMC. When we use the words “your health information,” we mean any information that you have given us about you and your health, as well as information that we have received while we have taken care of you (including health information provided to MCMC by those outside of MCMC).

We will have a copy of the current Notice with an effective date in clinical locations and on our website at www.mcmc.net.

Privacy-related laws and rules allow us to use and disclose your protected health information for purposes of treatment, payment and health care operations.

Treatment – Information obtained by a nurse, physician, or other member of our health care team will be recorded in your medical record and used or disclosed to help decide what medical care and services may be right for you. For example, a physician treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. We may also provide health information to other health care professionals providing you with medical care to help them stay informed about the progress of your treatment.

Payment – We may use and disclose your health information so that we may bill and collect payment from you, an insurance company, or someone else for health care services you receive from MCMC. For example, we may need to give your health plan medical information about surgery you received at MCMC so your health plan will pay us or reimburse you for the surgery. We may also tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment.

Health Care Operations – We may use and disclose medical information about you for our operations. We may use and disclose medical information to conduct or arrange for services, including: business planning, development and management; medical review; legal services; risk management; auditing functions, including fraud and abuse detection and compliance programs. These uses and disclosures are necessary to run MCMC and ensure that our patients receive quality care. For example, we use and disclose your health information to assess quality and improve services. We may also use and disclose medical information to review the qualifications and performance of our health care providers and to train our employees.

Fundraising Activities – As part of MCMC’s healthcare operations, we may use and disclose a limited amount of your health information internally, or to the Mid-Columbia Health Foundation to allow them to contact you to raise money for MCMC. The health information released for these fundraising purposes can include your name, address, other contact information, gender, age, date of birth, dates on which you received service, health insurance status, the outcome of your treatment at MCMC and your treating physician’s name. Any fundraising communications you receive from MCMC or its Foundation will include information on how you can elect not to receive any further fundraising communications from MCMC.

Facility Directory – Unless you notify us that you object, we may include certain information about you in the hospital directory, in order to respond to inquiries from friends, family, clergy and others who inquire about you when you are a patient in the hospital. Specifically, your name, location in the hospital and your general condition (e.g., good, fair, serious, critical) may be released to people who ask for you by name. In addition, your religious affiliation may be given to a member of the clergy, such as a priest or rabbi, even if they don’t ask for you by name.

Family and Friends – Unless you notify us that you object, we may provide your health information to individuals, such as family and friends, who are involved in your care or who help pay for your care. We may do this if you tell us we can do so, or if you know we are sharing your health information with these people and you don’t stop us from doing so. There may also be circumstances when we can assume, based on our professional judgment, that you would not object. For example, we may assume you agree to our disclosure of your information to your spouse if your spouse comes with you into the exam room during treatment.

Also, if you are not able to approve or object to disclosures, we may make disclosures to a particular individual (such as a family member or friend), that we feel are in your best interest and that relate to that person’s involvement in your care. For example, we may tell someone who comes with you to the emergency room that you suffered a heart attack and provide updates on your condition. We may also make similar professional judgments about your best interests that allow another person to pick up such things as filled prescriptions, medical supplies and x-rays.

Appointment Reminders; Treatment Alternatives; and Health-Related Benefits and Services – We may contact you to remind you about appointments and provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you.

Health Information Exchange – Unless you notify us that you object, we may make your medical information available electronically through an information exchange to other health care providers, health plans and health care clearinghouses that request your records. Participation in information exchange services also lets us see their information about you. We share an electronic medical record system with Oregon Health and Science University.

Medical Research – We may use and disclose health care information about you for research purposes if the research has been properly approved by an Institutional Review Board (or Privacy Board) and has policies to protect the privacy of your health information. We may also share your medical information with researchers preparing to conduct a research project.

To Funeral Directors / Coroners – We will disclose health care information to a coroner, medical examiner or funeral director as required by or applicable to law.

To Organ Procurement Organizations – We will disclose health care information as is necessary to facilitate organ or tissue donation and transplantation if an appropriate consent is presented by you or your immediate family.

To the Food and Drug Administration – (FDA) – We may disclose health care information relative to problems and adverse events with food, supplements, medications, and products and product defects, or post marketing surveillance information to enable product recalls, repairs, or replacement.

To Workers’ Compensation Program – We may disclose health care information to the state workers’ compensation program to the extent authorized by law.

For Work-Related Injuries or Illnesses or Workplace Medical Surveillance – We may disclose health care information where your employer has a duty under state or federal law, to keep records or act on such information.

To the Military – As required by military command authorities if you are a member of the armed forces, we may disclose health care information. We may disclose to the Department of Veteran Affairs about your eligibility for benefits. We may also disclose medical information about foreign military personnel to the appropriate foreign military authority.

For Specialized Government Functions – We may disclose health care information about you to authorized federal officials for activities including intelligence, counterintelligence, and other national security activities authorized by law.

Incidental Disclosures – Certain incidental disclosures of your medical information may occur as a byproduct of lawful and permitted use and disclosure of your medical information. For example, patients who share rooms may overhear information during their stay when family and care providers enter the room and discuss patient information. Reasonable safeguards will be used to protect information.

Disclosures to Business Associates – In certain circumstances, we may need to share your medical information with a business associate (such as a transcription company or medical device supplier) so it can perform a service on our behalf. We will have a written contract in place with the business associate requiring it to protect the privacy of your medical information.

Uses and disclosures not in this Notice of Privacy Practices will be made only as allowed or required by law or with your written authorization. Special circumstances that require an authorization include most uses and disclosures of your psychotherapy notes, certain disclosures of your test results for the human immunodeficiency virus or HIV, genetic information, uses and disclosures of your health information for marketing purposes that encourage you to purchase a product or service, and for sale of your health information with some exceptions. If you give us an authorized revocation, you can withdraw this written authorization at any time. To withdraw your authorization, deliver or fax a written revocation to MCMC Health Information Management Department, 1700 E. 19^th Street, The Dalles, Oregon 97058; fax: (541) 296-7617. If you revoke your authorization, we will no longer use or disclose your health information as allowed by your written authorization, except to the extent that we have already relied on your authorization.

You have certain rights regarding your health information which we list below. In each of these cases, if you want to exercise your rights, you must do so in writing. Forms can be obtained from the Health Information Management Department, 1700 E. 19^th Street, The Dalles, OR 97058. In some cases, we may charge you for the costs of providing materials to you. You can get information about how to exercise your rights and about any costs that we may charge for materials by contacting the Health Information Management Department at (541) 296-7294.

• Right to Inspect and Copy. With some exceptions, you have the right to inspect and get a copy of the health information that we use to make decisions about your care. For the portion of your health record maintained in our electronic health record, you may request we provide that information to or for you in an electronic format. If you make such a request, we are required to provide that information for you electronically (unless we deny your request for other reasons). We may deny your request to inspect and/or copy in certain limited circumstances, and if we do this, you may ask that the denial be reviewed.
• Right to Amend. You have the right to ask us to amend your health information maintained by or for MCMC, or used by MCMC to make decisions about you. We will require that you provide a reason for the request, and we may deny your request for an amendment if the request is not properly submitted, or if it asks us to amend information that (a) we did not create (unless the source of the information is no longer available to make the amendment); (b) is not part of the health information that we keep; (c) is already accurate and complete.
• Right to an Accounting of Disclosures. You have the right to request a list and description of certain disclosures by MCMC of your health information, other than those used for treatment, payment or operations.
• Right to Request Restrictions. You have the right to request a restriction or limitation on the health information we use or disclose about you (a) for treatment, payment or health care operations, (b) to someone who is involved in your care or the payment for it, such as a family member or friend, or (c) to a health plan for payment or health care operations purposes when the item or service for which MCMC has been paid out of pocket in full by you or someone on your behalf (other than the health plan). For example, you could ask that we not use or disclose information about a surgery you had, a laboratory test ordered or a medical device prescribed for your care. Except for the request noted in (c) above, we are not required to agree to your request. Any time MCMC agrees to such a restriction, it must be in writing and signed by the MCMC Privacy Officer or his or her designee.
• Right to Request Confidential Communications. You have the right to request that we communicate with you about health matters in a certain way or at a certain place. MCMC will accommodate reasonable requests. For example, you can ask that we only contact you at work or by mail.
• Right to a Paper Copy of This Notice. You have a right to a paper copy of this Notice, whether or not you may have previously agreed to receive the Notice electronically.
• Right to be Notified of a Breach. You have the right to be notified if there is a breach – a compromise to the security or privacy of your health information – due to your health information being unsecured. MCMC is required to notify you within 60 days of discovery of a breach.

We have the right to change this Notice and to make the revised or changed Notice effective for health information we already have about you, as well as any information we receive in the future. Except when required by law, a material change to any term of the Notice may not be implemented prior to the effective date of the Notice in which the material change is reflected. MCMC will post the revised Notice at MCMC clinical locations and on its website and provide you a copy of the revised notice upon your request.

If you have any questions about this Notice, please contact MCMC at 541-296-7671. If you believe your privacy rights have been violated, you may file a complaint with the MCMC Privacy Officer. To file a complaint with MCMC, write to MCMC Privacy Officer at 1700 E 19^th St, The Dalles, OR 97058 or call 541-296-7671. If we cannot resolve your concern, you have the right to file a written complaint with the Secretary of the Department of Health and Human Services. You will not be penalized for filing a complaint.