Privacy Policy

CalvertHealth Privacy Notice - Effective Date: 09/23/2013

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. (To download a copy, click here)

WHO WILL FOLLOW THIS NOTICE
This Notice describes CalvertHealth's practices regarding the use of your Protected Health Information (PHI) and that of: (1) Any health care professional authorized to enter information into your hospital chart or medical record; (2) All departments and units of the hospital, clinics or doctors’ offices you may visit; (3) Any member of a volunteer group we allow to help you while you are in the hospital; (4) All employees, staff and other personnel who may need access to your information and (5) All entities, sites and locations of CalvertHealth follow the terms of this Notice. In addition, these entities, sites and locations may share medical information with each other for treatment, payment or health care purposes described in this Notice.

OUR PLEDGE REGARDING MEDICAL INFORMATION:
CalvertHealth is committed to protecting the privacy of medical information that we create or obtain about you. CalvertHealth may use this medical information about you for treatment, to obtain payment, to evaluate the quality of care you receive and for other administrative and operational purposes. This Notice will tell you about the ways in which CalvertHealth may use and disclose Protected Health Information (PHI) about you. It also describes your rights and certain obligations we have regarding the use and disclosure of your (PHI).

If you have any questions about this Notice, please contact our Privacy Officer at the address located at the end of this document. This Notice applies to all of the records of your care generated by CalvertHealth, whether made by health care professionals or other personnel.

We are required by law to: (1) Keep your Protected Health Information private; (2) Give you this Notice of our legal duties and privacy practices with respect to your Protected Health Information and (3) Follow the terms of the Notice that is currently in effect.

HOW WE MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU

The following categories describe different ways that we may use and disclose your Protected Health Information (PHI). We are giving examples of ways we will/may disclose PHI. If a method of disclosure doesn’t fall into one of the categories, we won’t disclose that information without the patient’s written permission. Not every use or disclosure in a category will be listed.

For Treatment - We may use and disclose PHI for your treatment and to provide you with treatment related health care services. We may disclose protected health information about you to doctors, nurses, technicians, other medical personnel, students and volunteers who are involved in taking care of you, inside or outside the hospital. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. In addition, the doctor may need to tell the dietician you have diabetes so that we can arrange for special meals. We may also disclose medical information about you to people outside the hospital who may be involved in your medical care after you leave the hospital, such as family members, clergy or others who provide services that are part of your care, such as a therapist or physicians.

For Payment - We may use and disclose protected health information (PHI) about you so that the treatment and services you received may be billed to and payment may be collected from you, an insurance company or a third party. For example we may give your health plan information about you so that they will pay for treatment or your insurance may require copies of your record as proof for treatment you received so they will pay us or reimburse you for the treatment. We may also use and disclose PHI about you to obtain prior approval or to determine if your insurance will cover the treatment.

For Health Care Operations - We may use and disclose PHI about you for administrative and operational purposes. This is done to make sure that all of our patients receive quality care and to coordinate your care with affiliated healthcare providers. For example, we may use your PHI to review our treatment and to evaluate the performance of our staff in caring for you.

For Health Information Exchange (HIE) - We may share your protected health information via health information exchanges to better coordinate your care and to participate in quality-based initiatives. We participate in two health information exchanges – the hospital’s community-based Calvert Health Information Exchange (C-HIE), which shares information among our local providers, and the Chesapeake Regional Information System for Our Patients, Inc. (CRISP), an internet-based, state-wide, Maryland approved health information exchange. This means we may share information we obtain or create about you with outside entities (such as hospitals, doctors’ offices, pharmacies, labs, and imaging centers) or we may receive information they create or obtain about you (such as medication history, medical history, lab results, and imaging studies) so each of us can provide better treatment and coordination of your healthcare services. The C-HIE or exchange of health information can provide faster access, better coordination of care and assist healthcare providers and public health officials in making more informed treatment decisions. Although we believe that sharing health information among providers of care leads to better health care, we want you to be comfortable with how we share your information. You may “opt-out” of participation in either or both of the health information exchanges. If you wish to “opt-out” of participation in the C-HIE, please submit the C-HIE opt-out form at any point during registration. This form is also available on-line at www.calverthealthmedicine.org. If you wish to “opt-out” of participation in the State of Maryland HIE, contact the Chesapeake Regional Information System for our Patients (CRISP) at www.crisphealth.org or (877) 952-7477. Please note that even if you “opt-out”, a certain amount of your information will be retained by the exchange for the purposes of treatment, and your ordering or referring physicians may access diagnostic information about you, such as reports of imaging and lab results.

Fund-raising Activities - CalvertHealth may contact you to provide information about our efforts to raise money for the hospital and its operations. These CalvertHealth-sponsored activities include fundraising programs and events to support research, education or patient care. For this purpose, we may use your contact information, such as your name, address, phone number, the dates on which and the department from which you received treatment or services at CalvertHealth, your treating physician’s name, your treatment outcome and your health insurance status. If we do contact you for fundraising activities, the communication you receive will have instructions on how you may ask for us not to contact you again for such purposes, also known as an “opt-out”. CalvertHealth must honor such opt-out requests. CalvertHealth will treat an opt-out request as the individual’s revocation of authorization to use their information for fundraising communications. Unless otherwise specified, such should be interpreted as applying to all fundraising communications and not just the most recent communication sent.

Appointment Reminders. We may use and disclose your PHI to remind you that you have an appointment for treatment or medical care.

Treatment Alternatives. We may use and disclose your PHI to tell you about or recommend possible treatment options or alternatives that may be of interest to you.

Health-Related Benefits and Services. We may use and disclose your PHI to tell you about health-related benefits, services, fairs, workshops and screenings that may be of interest to you.

Individuals Involved in Your Care or Payment for Your Care. Unless you object, CalvertHealth may release medical information about you to a family member, other relative, friend or any other person you identify who is involved in your medical care. We may also give information to someone who helps pay for your care.

Disaster Relief. In the event of a disaster, CalvertHealth may disclose your PHI to organizations assisting in disaster relief efforts so that your family can be notified of your condition and location.

Research. We may use or disclose PHI about our patients to a researcher or research organization if our Institutional Review Committee has reviewed and approved the research proposal, after establishing protocols to ensure the privacy of your PHI. These studies will not effect your treatment or welfare, and your PHI will continue to be protected.

Hospital Directory. We may include certain limited information about you in the hospital directory while you are a patient at the hospital. This information may include your name, your doctor, your location in the hospital, your general condition (e.g. fair, stable, etc.) and your religious affiliation. This directory information, except for your religious affiliation, may also be released to people who ask for you by name. This is so your family, friends and clergy can visit you in the hospital and generally know how you are doing. Your religious affiliation may be given to a member of the clergy, such as a priest or rabbi, even if they don’t ask for you by name. If you do not wish to have your information included in this directory, it is important that you inform the hospital staff when you register that you wish to opt-out of the hospital directory.

Business Associates. We may disclose PHI to our business associates that perform functions on our behalf or provide CalvertHealth with services if the information is necessary for such functions or services. For example we may use another company to perform billing services on our behalf. When these services are contracted, we may disclose your PHI to our business associates so they can perform the job we have asked them to do. All of our business associates are obligated to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract.

As Required By Law. CalvertHealth will disclose medical information about you when required to do so by federal, state or local law. An example would be to public authorities, for purposes such as tracking and controlling health care costs as well protecting public safety and national security.

To Avert a Serious Threat to Health or Safety. CalvertHealth may use and disclose your PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Disclosures, however, would only be made to someone or some entity that may be able to help prevent the threat.

Organ and Tissue Donation. Consistent with applicable law, CalvertHealth may release your PHI to organizations that handle such organ procurement or transplantation or to an organ bank, as necessary to help with organ procurement, transplantation or donation.

Military and Veterans. If you are a member of the armed forces, we may release PHI as required by military command authorities. We also may release PHI to the appropriate foreign military authority if you are a member of a foreign military.

Workers’ Compensation. CalvertHealth may release your PHI to workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.

FDA. CalvertHealth may disclose to the Food and Drug Administration (FDA) your PHI relative to any adverse events with respect to food, supplements, products and product defects, post-marketing surveillance information to enable a product recall, repair or replacement.

Public Health Risks. CalvertHealth may disclose PHI for public health activities. These activities generally include disclosures: (1) To prevent or control disease, injury or disability; (2) To report births and deaths; (3) To report birth defects; (4) To report victims of abuse, neglect or other crimes; (5) To report reactions to medications or problems with products; (6) To notify people of recalls of products they may be using; (7) To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; (8) To notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence.

Health Oversight Activities. CalvertHealth may disclose your PHI to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections and licensure. These activities are necessary for the government to monitor the health care system, government programs and compliance with civil rights laws.

Lawsuits and Disputes. CalvertHealth may disclose your PHI in response to a subpoena, discovery request, court order or other lawful order from a court.

Law Enforcement. CalvertHealth may release your PHI if asked to do so by a law enforcement official as part of a law enforcement activity. These include: (1) in investigations of criminal conduct; (2) in investigations or searches for victims of crime (when unable to obtain a patient’s consent); (3) in response to court orders, subpoenas, warrants, summons or in emergency circumstances; (4) to identify or locate a suspect, fugitive, material witness or missing person; (5) investigation of a death CalvertHealth may believe is a result of criminal conduct; (6) investigation of criminal conduct at CalvertHealth; (7) in emergency circumstances to report a crime, location of a crime or victims, or the identity, description or location of a person who committed the crime and (8) when required to do so by law.

Coroners, Medical Examiners and Funeral Directors. CalvertHealth may release your PHI to a forensic investigator, coroner or medical examiner as authorized or required by law. For example, to identify a deceased person or determine the cause of death. We may also release your PHI to funeral directors as necessary to carry out their duties.

National Security and Intelligence Activities. We may use or disclose protected health information about you to specialized government functions, such as protection of public officials, national security and intelligence activities, or other national security activities authorized by law.

Inmates or Individuals in Custody. If you are an inmate of a correctional institution or under the custody of a law enforcement official, CalvertHealth may release your PHI to the correctional institution or law enforcement official. This release would be necessary: (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

Genetic Information. CalvertHealth is not permitted to use genetic information about you for underwriting purposes.

Proof of Immunization. CalvertHealth may disclose proof of immunization to a school when legally required for attendance. CalvertHealth must receive permission from the adult student, parent or guardian of a child or other person acting on the student’s behalf. Permission does not have to be made in writing; it can be made orally and we will document permission appropriately.

Marketing Activities. We will never allow third parties to market goods or services to you based on your PHI without your explicit written permission. Marketing is defined as a communication that encourages the use of a product or service, unless, the communication is made for one of the following three reasons: (1) To describe a health-related product or service provided by the hospital making the communication; (2) For treatment of the individual, or (3) For case management/care coordination of the individual or to recommend alternative treatments, therapies, providers or care settings. In those circumstances when we directly send you information about such goods or services, we do not accept payment for doing so unless: (a) the communication describes only a drug or biologic that is currently being prescribed for the recipient of the communication and any related payment is reasonable or (b) you have explicitly authorized it. When a communication is made by a business associate on the hospital’s behalf and in accordance with a business associate agreement with the hospital it is as if the hospital made it itself.

Other Uses of PHI
Other uses and disclosures of your PHI not covered by this Notice or the laws that apply to CalvertHealth will be made only with your written permission/authorization. Most uses and disclosures of psychotherapy notes and most uses and disclosures for marketing purposes fall into this category and require your authorization before we may use your PHI for these purposes. Additionally with certain limited exceptions as of September 23, 2013, we are not allowed to sell or receive anything of value in exchange for your PHI without your written authorization. If you provide us an authorization to use or disclose your PHI, you may revoke it at any time by submitting a written revocation to CalvertHealth’s Privacy Officer and we will no longer disclose PHI under the authorization. However, uses and disclosures we have made before your withdrawal are not affected by your action and we cannot take back any disclosures we may have already made.

YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION (PHI)
You have the following rights regarding the Protected Health Information we maintain about you:

Right to Inspect and Copy. You have the right to inspect and copy PHI that may be used to make decisions about your care or payment for your care. This includes medical and billing records, but does not include psychotherapy notes and certain other health records protected by law (i.e. notes from a private, group, joint or family counseling session recorded by a mental health professional such as a psychiatrist, clinical psychologist or clinical social worker). To inspect and copy the PHI, you must submit your request in writing to our Privacy Officer at the address on the last page. CalvertHealth has up to 30 days to make your PHI available to you but does try to turn around such requests within three (3) days. We may charge you a reasonable fee for the costs of copying, mailing or other supplies associated with your request. We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to your PHI, you may request that the denial be reviewed by a licensed health care professional chosen by CalvertHealth who was not directly involved in the denial of your request, and CalvertHealth will comply with the outcome of the review.

Right to an Electronic Copy of Electronic Medical Records. If your PHI is maintained in an electronic format (known as an electronic medical record or an electronic health record), you have the right to request that an electronic copy of your record be given to you or transmitted to another individual or entity. We will make every effort to provide access to your PHI in the form or format you request, if it is readily producible in such a format. If the PHI is not readily producible in the form or format you request, your record will be provided in either our standard electronic format or if you do not want this form or format, a readable hard copy form. We may charge you a reasonable, cost-based fee for the labor associated with transmitting the electronic medical record.

Right to be Notified in the Event of a Breach. CalvertHealth will notify you if your PHI has been “breached”, which means that your PHI has been used or disclosed in a way that is inconsistent with law and results in it being compromised.

Right to Request an Amendment. If you feel that your PHI is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as your PHI is kept by us. You are required to submit your request in writing to our Privacy Officer with an explanation as to why the amendment is needed. If we accept your request, we will tell you what we have agreed to amend. We cannot change what is in the record, only add supplemental information by an addendum. We will assist in notifying others who have the incorrect or incomplete PHI. If we deny your request, we will give you a written explanation of why we did not make the amendment and explain your rights.

We may deny your request if you ask us to amend information that: (1) was not created by us, unless the person or entity that created the information is no longer available to make the amendment; (2) is not part of the medical and billing information kept by CalvertHealth; (3) is not part of the information which you would be permitted to inspect and copy; or (4) is determined to be accurate and complete.

Right to an Accounting of Disclosures. You have the right to request a list of disclosures we have made of your PHI for purposes other than treatment, payment and health care operations or for which you provided written authorization. To request an accounting of disclosures, you must submit your request in writing to our Privacy Officer at the address located at the end of this document. Your request must state the time frame you are interested in examining. This period cannot be any longer than six (6) years and may not include any dates prior to April 13, 2003. The first accounting of disclosures you request in a 12 month period is free. Additional requests will be billed to you. CalvertHealth will inform you of the costs associated with providing you with the requested list and ask if you still want it.

Right to Request Restrictions. You have the right to request a restriction or limitation on the PHI CalvertHealth uses or discloses for treatment, payment or health care operations. You also have the right to request a limit on the PHI we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not share information about a particular diagnosis or treatment with your spouse. CalvertHealth is not required to agree to your request unless as of September 23, 2013, you are asking us to restrict the use and disclosure of your PHI to a health plan for payment or health care operations purposes and such information you wish to restrict pertains solely to a health care item or service for which you paid us “out-of-pocket” in full. If we agree, we will comply with your request unless the information is needed to provide you emergency treatment.

To request restrictions, you must make your request in writing to our Privacy Officer at the address listed at the end of this Notice. In your request, you must tell us: (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and to whom you want the limits to apply.

Withholding Information from Your Health Plan. You have the right to ask that your PHI with respect to a discrete encounter not be disclosed to a health plan for purposes of payment or health care operations. If you wish to not have that encounter reported to your health plan or insurer, you must request, complete and submit, during the registration process, CalvertHealth’s “Exclusionary Form”. In addition, you must pay for all services rendered during that encounter in full at time of service (or under other pre-agreed arrangements).

Right to Request Confidential Communications. You have the right to request that CalvertHealth communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. To request confidential communications, you must make your request in writing to our Privacy Officer at the address located at the end of this document. We will not ask you the reason for your request. Your request must specify how and/or where you wish to be contacted. We will accommodate all reasonable requests.

Right to a Paper Copy of This Notice. You have the right to a copy of this Notice at any time. To obtain a paper copy of this Notice, please ask at registration or contact our Privacy Officer at the address or phone number located at the end of this document. An electronic version is always available at our website, www.calverthealthmedicine.org.

CHANGES TO THIS NOTICE
CalvertHealth reserves the right to change our privacy practices and this Notice. We reserve the right to make the revised or changed Notice effective for your PHI we already have as well as any information we receive in the future. We will post a copy of the current Notice. The Notice will contain on the first page, the effective date of the Privacy Notice.

COMPLAINTS
If you believe your privacy rights have been violated, you may file a complaint with the Privacy Officer at CalvertHealth or with the Secretary of the Department of Health and Human Services. All complaints must be in writing and sent to the address provided at the end of this Notice. You will not be penalized for filing a complaint.

ADDITIONAL INFORMATION
PRIVACY OFFICER AT CalvertHealth:
Director of Health Information Management
Richard O. Mapp RHIA, ASQ CQIA
100 Hospital Road
Prince Frederick, MD 20678

FOR QUESTIONS REGARDING THIS NOTICE, PLEASE LEAVE A MESSAGE AT:
Telephone: 410-535-8282 (Option 4)