HIPAA Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed, and how you can get access to this information.

Shriners Hospitals for Children (SHC) prepared this booklet to explain to you some very important information about the Protected Health Information (PHI) of our patients and what we do with that information.

We Are Required by Law To:

• Maintain the privacy of your health information.
• Provide you with this detailed notice of our legal duties and privacy practices with respect to your health information. This notice will tell you about ways in which we may use and disclose health information about you. It also describes your rights with respect to the use and disclosure of your health information.
• Abide by the terms of the notice that is currently in effect.

Important

For the rest of this booklet we will use short forms of some words. Those words are:

“You” means the patient. If you are the parent or guardian of a patient, please remember we are talking about your child’s health information.

“SHC” or "we" means Shriners Hospitals for Children. It means not only the hospital that you are at, but all of the hospitals that we operate.

“PHI” stands for Protected Health Information. Protected Health Information means information about a person’s health that can be related to that person that concerns:

• The individual's past, present or future physical, or mental health, or condition,
• The provision of healthcare to the individual, or,
• The past, present or future payment for the provision of health care to the individual.

Common individual identifiers of health information include names, social security numbers, addresses and birth dates.

For example, “I know a boy with a broken leg.” is not PHI because the person you’re talking to cannot recognize a particular person. On the other hand, “Sue Smith is seeing Dr. Jones for her broken leg.” is PHI.

Understanding Your Health Record

Each time you visit SHC, a record of your visit is made. SHC will maintain these records for no less than 20 years after your discharge or after your final treatment, or as required by state law. After this time frame, any medical record or personal health information that will no longer be retained will be destroyed in compliance with SHC’s policies and Hospital Regulations.

This record may contain your symptoms, exam and test results, diagnosis, treatment, and a plan for future care or treatment. This information, which we call your health or medical record, serves as:

• A basis for planning your care and treatment.
• A way that the many health professionals who care for you can share information on what each is doing.
• A way that you or a third party can make sure that services were actually provided.
• A tool for teaching health professionals.
• A legal document describing the care you received.
• A source of data for medical research.
• A source of information for public health workers who are trying to improve the health of the nation.
• A tool we can use to improve the care we give and the results we achieve.

Understanding what is in your record and how your health information is used helps you to:

• Make sure it is correct.
• Better understand who, what, when, where, and why others may see your health information.
• Make better decisions about allowing others to see your health record.

Your PHI Rights

Your PHI is kept in your health record (sometimes called your medical record). It includes information about your condition, what treatments you have received, and how you are reacting to those treatments. This record is kept partly on paper and partly in computers. You have these rights regarding the PHI in your health record:

• You may ask us to restrict how PHI is used and when it is disclosed. That means you can ask us not to send it to certain persons or not to send certain parts of the information. We must tell you whether we agree or disagree with your request. We are generally not required to agree to your requested restriction. We must agree to your request to restrict disclosure of PHI to a health plan if the disclosure is for the purpose of carrying out payment or healthcare operations and the PHI pertains solely to a healthcare item or service for which you or someone on your behalf paid us out of pocket in full.
• You may review your health record and ask to have a copy of it. We may be allowed to charge you for the cost of making the copy.
• You may ask to have corrections made to your health record if you think it is wrong by submitting a request in writing to the Hospital Privacy Officer and include in the request the reason for the correction.
• You may request a list from SHC of who SHC has provided health information to. This list will not include the people who you authorized to receive the information.
• You may ask us to send your PHI to you at another place or by another means.
• If you have given us permission to send your PHI to someone else, you can take back that permission. However, we will not get back any information we have already sent.
• If you want help in understanding any of these rights, you may ask to talk to the Hospital Privacy Officer. If you dial “0” on any hospital phone, the operator can page the Privacy Officer for you or you may contact the Hospital’s headquarters office at 813-281-0300 and ask to talk to the Compliance Officer.

Our Responsibilities

SHC will do these things:

• Give you this Notice of Privacy Practices.
• Keep your health information private.
• Notify you if you are affected by a breach of unsecured PHI.
• Follow the rules that we have set out in this Notice.
• Let you know if we do not agree to something you ask us to do or not do with your PHI.
• Send your PHI to another place or by another means if it is reasonable for us to do that.

We may change the way we handle PHI. If so, we may apply that change to all SHC PHI even if received prior to that change. If we do make changes, we will prepare a new Notice of Privacy Practices. The new Notice will be posted in the hospital and on our website. Also, if you ask, we will give you a copy of the revised Notice.

Using and Sharing Your PHI

Most of the time, we cannot share your PHI with other people unless you authorize us in writing to do so. If you want somebody else to see your PHI, you must complete an authorization form before we release your PHI to that person. Your authorization may be revoked at any time by sending to SHC a written request to revoke addressed to the Hospital Privacy Officer, except in limited situations for the following disclosures:

1. Psychotherapy Notes: A signed authorization or court order is required for any use or disclosure of psychotherapy notes except to carry out certain treatment, payment or healthcare operations or for use by SHC for treatment, for training programs or for defense in a legal action.
2. Marketing: A signed authorization is required for the use or disclosure of your PHI for a purpose that encourages you to purchase or use a product or service except for a face-to-face communication made by SHC to you or a promotional gift of nominal value provided by SHC. We may also provide refill reminders or communicate with you about a drug or biologic that is currently prescribed to you so long as any payment we receive for making the communication is reasonably related to our cost of making the communication. If SHC were ever to receive any payment from a third party for our marketing, we must tell you when we request your authorization.
3. Sale of PHI: SHC may not sell or disclose in exchange for payment your PHI without your signed authorization. If SHC were ever to receive payment for the sale of your PHI, we must tell you when we request your authorization.
4. Publicity: We may ask you to let us use your patient story to tell others about Shriners Hospitals for Children. If we do ask you to share your patient story, we will ask you to sign a written authorization.

However, we are allowed to use your PHI and share it with others without your authorization for certain reasons. Those reasons are explained below. Other uses and disclosures not described in this booklet will not be made without your written authorization.

1. Treatment: In order to provide the most appropriate medical care, we will use your PHI at SHC to treat you. Each person involved in your treatment such as doctors, nurses, physical therapists and others, will write in your medical record to explain what care is being provided. This way, each person taking care of you will know what the others are doing during your course of treatment. We may also share PHI with other doctors or specialists outside of SHC who care for you, so proper medical treatment can be rendered. You must advise us if you do not wish to have your PHI released to any medical professionals who care for you outside of SHC.
2. Payment: SHC bills outside third parties, such as insurance or Medicaid, for services provided at select hospitals. We may also utilize information about your care in order to bill your insurance or Medicare or Medicaid if available, for your treatment at SHC. In addition, patients sometimes need services at another hospital or outside facility. If we send you for those services, we may give that other facility information about your treatment at SHC and your insurance information to help them with their billing process.  
3. Operations: We may use your PHI for healthcare operations. “Healthcare operations” means all of the things the hospital does to improve the quality of care for all patients. For example, someone may look at the records for all the children who had the same operation. They might then compare the information to see similarities and differences. Another part of operations is making sure our employees do their jobs correctly. Managers may need to look at PHI to make sure that your treatment was provided correctly.
4. Business Associates: Business Associates are people or companies who provide some of the services needed for your care. For instance, some hospitals hire a group of people called a transcription service to type up the notes dictated by the doctors. When they perform the services we request, the Business Associates need to see some of your PHI. However, both federal law and SHC require Business Associates to protect the privacy of your PHI.
5. Directory: Unless you tell us not to, we will use your name, room number and general condition in the hospital directory. We can then give this information to people who ask for you by name. We may also give this information, along with your religion, to ministers, priests and other religious leaders.
6. Notification: We may tell a family member or guardian your location and general condition.
7. Communication with Family: We will tell your parents or guardian information that would help them to take part in your care. If you want, we may also share this information with other friends or family members.
8. Subpoena: We may have to share your PHI with a court or attorney if we receive a subpoena or court order. We will try to let you or your attorney know about the subpoena before we send the information.
9. Research: We may share your PHI with researchers when an Institutional Review Board (IRB) has approved their research project and your condition or treatment is one they want to study. The IRB must first review the plans for the research study and set forth guidelines to make sure the PHI used in the study remains private. The IRB will also decide if a special consent form for the study is needed. In the future, researchers may also look at your medical record to see if your condition or treatment is one that they plan to study. If so, they may ask for your permission to include your information in their study.
10. Organ donation groups: Sometimes we may share PHI with organ donation groups or other similar groups, such as skin banks.
11. Training: Many colleges and other schools send students to SHC hospitals as part of their training. These students and their teachers may be able to see your PHI as they learn how to take care of patients.
12. Medical Care: We may use some of your PHI, including your name and address, to remind you about appointments.
13. Treatment Alternatives: We may send you information about other treatments and services that might help you. If, however, we want to send you information about other treatments and services from a third party and SHC will receive payment for sharing this information with you, we will request your authorization.
14. Fundraising Activities: We may use or disclose a limited amount of demographic information to SHC staff in order to contact you about our fundraising efforts. We may also disclose this information to certain Business Associates, who, at our request, will invite you to participate in raising money for SHC. All donations will be used to expand, improve and support SHC’s healthcare services, operations, educational programs and research activities. You have the right to opt out of these communications. Information on how to opt out of receiving fundraising materials or requests will be provided on all communications sent from SHC or our Business Associates.
15. Food and Drug Administration (FDA): The FDA is an agency of the government that keeps track of drugs and medical devices. If anything goes wrong with a drug or medical device we used in your care, we have to send a notice to the FDA and the maker of the drug or device. We will also send in the warranty cards that come with devices. We will use only the least information needed to fill out these forms.
16. Work and Safety Laws: We may need to give PHI to state and federal health and safety agencies such as workers compensation commissions.
17. Public Health: We may have to share PHI with public agencies that work to prevent or control disease, injury, or disability. For example: If a child develops measles or mumps while in our care, we may be required to report that information to the state or local health department.
18. Record-keeping agencies: We send information about patients' injuries and treatment to private or public agencies that keep track of statistics. For instance, we send information about burn cases to the National Burn Registry and information about spinal cord injuries to the National Trauma Registry. We also may have to share information with agencies that license hospitals or providers.
19. Law enforcement: We may disclose health information for law enforcement purposes as required by law or in response to a valid subpoena. We may also be required, by law, to make PHI available to offices that:
    1. Investigate abuse or neglect or
    2. Involve threats to health or safety
20. Whistleblowers: If a person who works for us thinks we are breaking the privacy laws, they might tell an attorney or a government agency about their concern. We would need to cooperate in any follow-up inquiry, which may require disclosure of PHI.

For More Information or to Report a Problem

If you have questions or would like to know more about these rules, please ask to speak to the Hospital Privacy Officer. If you believe we violated your privacy rights, you can file a complaint with the Hospital Privacy Officer or the Hospital Administrator. You can also call 813-281-0300 and ask for the Compliance Officer. You may also visit SHC’s Corporate Compliance website or call the Hotline at 866-290-7637. SHC takes these matters very seriously and will investigate the issues identified in the complaint. No one will be upset with you or treat you differently if you file a complaint. 

To file a complaint with the Department of Health and Human Services, send your complaint to:

OCR
200 Independence Ave. SW
Humphrey Building, Mail Stop Room 506F
Washington, DC 20201

Your medical care at SHC will not be impacted if you file a complaint.

Changes to This Notice

We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for medical information we already have about you as well as information we receive in the future. We will post a summary of the current notice in the hospital. The notice will contain the effective date on the first page, in the top right hand corner. In addition, each time you register at or are admitted to the hospital for treatment or healthcare services, as an inpatient or outpatient, we will offer you a copy of the current notice in effect.