Notice of Privacy Practices
I. Introduction to the Privacy Notice
This Notice describes the privacy practices of Aria Health including its medical facilities. Aria Health Physician Services, Professional Home Health Services, and the physicians that are on the Medical Staff of Aria Health when these individuals are providing services to you as a patient of Aria Health.
This Notice also relates to:
- Any health care professional authorized to enter information into your Aria Health patient record.
- All departments, units and programs of Aria Health.
- Any member of a volunteer group we allow to help you while you are in an Aria Health hospital.
- All employees, staff and other Hospital personnel.
- All Aria Health sites and locations.
In addition, these entities, sites and locations may share medical information with each other for treatment, payment and health care operations as described in this Notice.
II. Our Duties to Safeguard Your Protected Health Information (PHI)
We understand that medical information about you and your health is personal and we are committed to protecting medical information about you. This Notice applies to all of the records of your care generated by the entities described above. Your personal doctor may have different policies or Notices regarding the doctor’s use and disclosure of your medical information created in the doctor’s office.
This Notice will tell you about the ways in which we may use and disclose your medical information (sometimes called Protected Health Information or PHI). It also describes your rights and certain obligations we have regarding the use and disclosure of your medical information. We are required by law to:
- make sure that medical information (PHI) that identifies you is kept private;
- give you this Notice of our legal duties and privacy practices with respect to your PHI; and
- follow the terms of the Notice that is currently in effect.
III. How Aria Health May Use and Disclose Medical Information (PHI) About You
Except in an emergency or other special circumstance, we will ask you to sign a general authorization, as required by Pennsylvania law, so that we may use and disclose your PHI for Treatment, Payment and Health Care Operations as described below:
We may use your PHI to provide you with medical treatment or services. We may disclose your PHI to doctors, nurses, technicians, medical students, or other hospital personnel who are involved in taking care of you at an Aria Health facility. We also may disclose your PHI to people outside Aria Health who may be involved in your medical care. In addition, we may use your PHI to provide appointment reminders or information about treatment or other health-related benefits and services.
We may use and disclose PHI about you either prior to or following your care so that the treatment and services you receive at Aria Health may be billed and payment may be collected from you, an insurance company or a third party. We may also tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment.
If you choose to pay for services out-of-pocket, in full, you may request that Aria Health not disclose PHI related solely to those services to a health plan. If you wish to exercise this right, please let the staff know immediately.
For Health Care Operations
We may use and disclose PHI about you for Aria Health operations. These include internal administration and planning, teaching and learning purposes and various activities that improve the quality and cost effectiveness of the care that we deliver to you. We may also disclose PHI to your other health care providers when such PHI is required for them to receive payment for services they render to you, or conduct certain health care operations, such as quality assessment and improvement activities, reviewing the quality and competence of health care professionals, resolving complaints or for health care fraud and abuse detection or compliance.
Use or Disclosure for the Aria Health Inpatient Directory
If you are admitted to an Aria Health hospital, we may include your name, room number, general health condition, and religious affiliation in our hospital patient directory without obtaining your written authorization, unless you object to inclusion in the directory. Information in the hospital directory (other than religious affiliation) may be disclosed to anyone who asks for you by name, either in person or by telephone. Religious affiliation will only be disclosed to members of the clergy.
Disclosure to Relatives, Friends and Other Caregivers
We may disclose your PHI to a family member, other relative, friend or any other person if we
- obtain your agreement;
- provide you with the opportunity to object to the disclosure and you do not object; or
- we reasonably assume that you do not object. If we provide information to any individual(s) listed above, we will release only information that is directly relevant to that person’s involvement with your health care or payment related to that health care. We may also disclose your PHI in the event of an emergency or to notify (or assist in notifying) such persons of your location, general condition or death.
Public Relations / Surveys / Fundraising
We may contact you regarding the satisfaction of services received at Aria Health. We may disclose to our Public Relations staff non-medical information about you (e.g. your name, address and phone number) and dates on which we provided health care to you. We may contact you to request a tax-deductible contribution to support important activities of Aria Health. In connection with any fundraising, we may disclose to our fundraising staff demographic information about you (e.g., your name, address and phone number) without your written authorization. If you do not want to receive any fundraising requests in the future, you may contact our Marketing Office at 215-710-3765.
Health Information Exchange
We participate in a Health Information Exchange (HIE) that allows us to electronically share protected health information with local health care providers that are participating in the HIE to coordinate your care. You may also access your test results and other PHI electronically through the HIE. HIEs are being developed at the hospital, regional, state and national levels so that providers will have prompt access to your records for your care. Currently we only share information with your providers through the HIE, although in the future we may participate in HIEs with other providers, plans and billing companies.
IV. Special Situations in Which We May Use or Disclose Your Medical Information Without a Written Authorization
When conducting research, in most cases, we will ask for your written authorization before your PHI is used. However, we may use or disclose your PHI without your specific authorization if Aria Health’s Institutional Review Board (IRB) has waived the authorization requirement. The IRB is a committee that oversees and approves research involving living humans.
Disaster Relief Efforts
We may disclose your PHI to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.
As Required by Law
We will disclose your PHI when required to do so by federal, state or local law.
To Avert a Serious Threat to Health or Safety
We may use and disclose your PHI to prevent or lessen a serious and imminent threat to a person’s or the public’s health and safety.
Organ and Tissue Donation
We may disclose your PHI to organizations that facilitate organ, eye or tissue procurement, banking or transplantation.
Military and Veterans
If you are a member of the armed forces, we may release your PHI as required by military command authorities.
We may release your PHI for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illnesses.
Public Health Risks
We may disclose your PHI for public health activities. These activities include:
- to prevent or control disease, injury or disability;
- to report child abuse or neglect;
- to report reactions to medications or problems with products;
- to notify people of recalls or products they may be using;
- to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
- to notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence. We will only make this disclosure if you agree or when required or authorized by law;
- to report information to your employer as required under laws addressing work-related illnesses and injuries or workplace medical surveillance.
Health Oversight Activities
We may disclose your PHI to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure.
Lawsuits and Disputes
If you are involved in a lawsuit or a dispute, we may disclose your PHI in response to a court or administrative order, a subpoena, a discovery request, or other lawful process by someone else involved in the dispute.
We may release your PHI if asked to do so by a law enforcement official in response to a court order, subpoena, warrant, summons or similar process.
National Security and Intelligence Activities
We may disclose your PHI to units of the government with special functions, such as the U.S. military and other national agencies as authorized by law.
Coroners, Medical Examiners and Funeral Directors
We may release PHI to a coroner or medical examiner. We may also release PHI about patients of an Aria Health hospital to funeral directors as necessary to carry out their duties.
If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release your PHI to the correctional institution or law enforcement official.
V. Uses and Disclosures Requiring Your Written Authorization
A. Use or Disclosure with Your Authorization
For any purpose other than the ones described above in Section III and IV, we only may use or disclose your PHI when you grant us your written authorization on the Aria Health Authorization Form. For instance, you will need to execute an Authorization form before we can send your PHI to your life insurance company or to the attorney representing the other party in litigation in which you are involved.
We must also obtain an Aria Health written authorization prior to using your PHI to send you any marketing materials. (We can, however, provide you with marketing materials in a face-to-face encounter without obtaining an authorization. We are also permitted to give you a promotional gift of nominal value, if we so choose, without obtaining an authorization.) In addition, we may communicate with you about products or services relating to your treatment, case management or care coordination, or alternative treatments, therapies, providers or care settings without an authorization.
Aria Health may send communications to you concerning treatment alternatives or other health-related products or services where Aria Health receives financial remuneration from a third party in exchange for making the communication. You have the right to opt out of receiving such communications.
C. Uses and Disclosures of Your Highly Confidential Information
Federal and State laws require special privacy protections for certain highly confidential information about you. This includes PHI that is:
- maintained in psychotherapy notes;
- documentation related to mental health or developmental disabilities services;
- drug and alcohol abuse, prevention, treatment and referral information;
- information related to HIV status, testing, treatment as well as any information related to the treatment or diagnosis of sexually transmitted diseases; and
- PHI related to genetic testing.
Generally, we must obtain your specific authorization to release this type of information. However, there are limited circumstances under the law when this information may be released without your consent. For example, certain sexually transmitted diseases must be reported to the Department of Health.
D. Other Uses and Disclosures of Medical Information
Other uses and disclosures of medical information not covered by this Notice or the laws that apply to us will be made only when you sign an Aria Health Authorization Form.
E. Right to Revoke Your Authorization
If you provide us permission to use or disclose medical information about you, you may revoke that permission, in writing, at any time by completing and signing an Aria Health Revocation of an Aria Health Authorization Statement.
Please note that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided to you.
VI. Your Rights Regarding Medical Information About You
You have the following rights regarding medical information we maintain about you:
Right to Inspect and Copy Your Medical Information
You may request access to your medical record file and billing records in order to inspect and request copies of these records. Under limited circumstances, we may deny you access to a portion of your records, as mandated by other laws (example: psychotherapy notes). If you desire access to your records, please obtain an Aria Health Record Request Form and submit the completed form. If you request copies of your medical records, we will charge you in accordance with current Pennsylvania Law. We will also charge you for our postage costs, if you request that we mail the copies to you. We may deny your request to inspect and copy in certain very limited circumstances. You may request that the denial be reviewed by contacting the Privacy Officer.
Right to Amend
If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for Aria Health.
To request an amendment, your request must be made in writing using the Aria Health Request for Amendment. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:
- Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
- Is not part of the medical information kept by or for Aria Health;
- Is not part of the information which you would be permitted to inspect and copy; or is accurate and complete.
Right to Request Restrictions
You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment or health care operations. We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment.
To request restrictions, you must make your request in writing. In your request, you must tell us
- what information you want to limit;
- whether you want to limit our use, disclosure or both; and
- to whom you want the limits to apply, for example, disclosures to your spouse.
- If you have paid out of pocket, you may request your information not be shared with your health plan.
Right to Request Confidential Communications
You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. To request confidential communications, you must make your request in writing using the Aria Health Request for Confidential Communication. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.
Right to an Accounting of Disclosures
You have the right to request an “accounting of disclosures.” To request this list or accounting of disclosures, you must submit your request in writing using the Aria Health Request for an Accounting of Disclosures. Your request must state a time period, which may not be longer than six years, and may not include dates before April 14, 2003.
Right to a Paper Copy of This Notice
You have the right to a paper copy of this Notice.
You may obtain a copy of this Notice at our web site, www.ARIAHEALTH.org.
For Further Information; Complaints
If you desire further information about your privacy rights, are concerned that we have violated your privacy rights or disagree with a decision that we made about access to your PHI, you may contact our Privacy Officer or Administration. All complaints must be in writing. You may also file written complaints with the Director, Office for Civil Rights of the U.S. Department of Health and Human Services. Upon request, the Privacy Officer will provide you with the correct address for the Director. We will not retaliate against you if you file a complaint with us or the Director.
VII. Effective Date and Duration of This Notice
A. Effective Date
This Notice is effective on September 23, 2013.
B. Right to Change Terms of this Notice
We may change the terms of this Notice at any time. If we change this Notice, we may make the new Notice terms effective for all Protected Health Information that we maintain, including any information created or received prior to issuing the new Notice. If we change this Notice, we will post the new Notice in waiting areas around Aria Health and on our Internet site at www.ARIAHEALTH.org. You also may obtain any new Notice by contacting the Privacy Officer.
VIII. Privacy Officer
Chief Compliance Officer
10800 Knights Road
Philadelphia, PA 19114