What does HIPAA stand for?
"HIPAA" is the acronym for the federal legislation titled Health Insurance Portability and Accountability Act of 1996.
Who must comply with HIPAA?
HIPAA is applicable to:
- Health care providers (who transmit electronic transactions covered by the HIPAA regulations).
- Health plans (self-insured/insured, HMOs, health insurance companies, employer health plans, and similar arrangements).
- Health care clearinghouses.
Those who must comply with HIPAA are considered "covered entities."
What does HIPAA do?
Without question, HIPAA is complex and has many components, but basically it addresses three major areas:
- Privacy: Provides new rules in regard to how an individual's health information may be used and disclosed by covered entities.
- Transaction and code sets: Requires the use of standard transaction formats and code sets when an individual's financial health information is transmitted electronically by a covered entity for purposes of payment, coverage determinations, eligibility determinations, and similar business matters.
- Security: Requires covered entities to have specific security measures in place to protect an individual's health information that is sent or stored electronically.
Our pledge regarding your medical information
Humboldt General Hospital (HGH) is dedicated to protecting your personal medical information. When you receive care at HGH we create a record set necessary for:
- Your treatment.
- Our payment actions related to your treatment.
- Management of our health care operations related to your treatment.
Health records may be created by HGH personnel or by a doctor or other licensed professional who treats you at HGH but who is not an HGH employee. Non-employee doctors and other licensed professionals may have different policies or notices regarding use and disclosure of your medical information created in their private offices or clinics. They are responsible to provide you with their notice of privacy practices.
Required by law
This notice applies to how we may use and disclose your medical records while you are receiving care at HGH. It also describes your rights with respect to your personal medical information. We are required by law to:
- Make sure that medical information that identifies you is kept private.
- Give you this notice that describes why and how we may use or share your medical information.
- Have you sign a form signifying you received a copy of the notice.
- Follow the terms of this notice on its effective date and thereafter until modified.
There may be circumstances when state law supersedes HIPAA, for example HIV, drug and alcohol, and mental health information. In these situations, we will follow the provisions of the specific state law.
How we may use and disclose medical information about you
The following categories describe different ways we use and disclose medical information. For each category of uses or disclosures we explain what we mean and give some examples. All of the ways we use and disclose information will fall within one of the categories:
We may use and disclose medical information about you to another party on your behalf so that we can get paid for the treatment and services you receive at HGH. We may disclose medical information about you to doctors, nurses, technicians, medical students, or other HGH personnel who are involved in taking care of you. For example, a doctor treating you for depression may need to know if you have other health conditions that might be related to your depression. Also, different departments at HGH may share your medical information in order to coordinate the different things you need, such as prescriptions and lab work. We also may disclose medical information about you to people outside HGH who may be involved in your health care after you leave HGH, such as family members or others we use to provide services that are part of your care.
We may use and disclose medical information about you so that the treatment and services you receive at HGH may be billed to and payment collected from you or another party on your behalf. For example, we may need to give your health plan information about treatment that you received at HGH so your health plan will pay us for the treatment. We also may tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment.
For health care operations
We may use and disclose your medical information for HGH operations. Such uses and disclosures are necessary to run HGH and to make sure all of our clients receive quality care. For example, we may use medical information to review our treatment and services and to evaluate the performance of our staff in caring for you. We may also combine medical information about many HGH clients to decide what additional services we should offer, what services are not needed, and if certain new treatments are effective. We also may disclose information to doctors, nurses, technicians, medical students, and other HGH personnel for review and learning purposes. We may remove information that identifies you from this set of medical information so others may use it to study health care and health care delivery without knowing that your information is included.
We may use and disclose medical information to contact you as a reminder that you have an appointment for treatment at HGH.
We may use and disclose medical information to tell you about or recommend possible treatment options or alternatives that may be of interest to you.
Health-related benefits and services
We may use and disclose medical information to tell you about health-related benefits or services that may be of interest to you.
We may use your medical information to contact you in an effort to raise money for HGH and its operations. We may disclose contact information to a foundation related to HGH so that the foundation may contact you in raising money for HGH. Contact information consists of your name, address and phone number and the dates you received treatment or services at HGH. If you do not want HGH to contact you for fundraising, you must notify the Office of the Administrator at 118 E. Haskell Street, Winnemucca, Nevada 89445 in writing.
Individuals involved in your care or payment for your care
We may release medical information about you to designated parties who are involved in your care. We also may give information to someone who helps pay for your care. In addition, we may disclose medical information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.
Under certain circumstances, we may use and disclose medical information about you for research purposes. For example, a research project may involve comparing the health and recovery of all clients with the same condition who received one medication to those who received another medication. All research projects are subject to a special approval process. This process evaluates a proposed research project and its use of medical information to ensure client medical information is only used and disclosed as necessary for the research project. Normally we use or disclose medical information for research only after the project has been approved through the research approval process. However, we may disclose medical information about you to researchers to help them identify clients with specific medical needs. In these pre-research actions, we will not allow researchers to copy or otherwise transmit your medical information outside HGH. Also we will most often ask for your authorization if the researcher will have access to your name, address or other information that reveals who you are, or will be involved in your care at HGH.
As required by law
We will disclose medical information about you when required to do so by federal, state or local law.
To avert a serious threat to health or safety
We may use and disclose medical information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.
Special situations for release of medical information
Military and veterans
If you are a member of the armed forces, we may release medical information about you as required by military command authorities. We also may disclose medical information about you to the Department of Veterans Affairs upon your separation or discharge from military services. This disclosure may be necessary for the Department of Veterans Affairs to determine if you are eligible for certain benefits.
We may release medical information about you for workers' compensation or similar programs. These programs provide benefits for work-related injuries or illness.
Public health risks
We may disclose medical information about you for public health activities. These activities generally include the following: (i) To prevent or control disease, injury or disability; (ii) To report births and deaths; (iii) To report child abuse or neglect; (iv) To report reactions to medications or problems with products; (v) To notify people of recalls of products they may be using; (vi) To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; or, (vii) To notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence. We will only make this disclosure when required or authorized by law or if you authorize such disclosure.
Health oversight activities
We may disclose medical information to a health oversight agency for activities authorized by law.
These oversight activities include, for example:
- Audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
- Lawsuits and disputes: If you are involved in a lawsuit or a dispute, we may disclose medical information about you in response to a court or administrative order. We may also disclose medical information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.
- Law enforcement: We may release medical information if asked to do so by a law enforcement official: (i) In response to a court order, subpoena, warrant, summons or similar process; (ii) To identify or locate a suspect, fugitive, material witness, or missing person; (iii) About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person's agreement; (iv) About a death we believe may be the result of criminal conduct; (v) About criminal conduct at HGH; and, (vi) In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.
- Coroners, medical examiners and funeral directors: We may release health information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release medical information about a deceased person to funeral directors as necessary to carry out their duties.
- National security and intelligence activities: We may release medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
- Protective services for the President and others: We may disclose medical information about you to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.
- Inmates: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release medical information about you to the correctional institution or law enforcement official.
This release would be necessary for the following: (i) For the institution to provide you with health care; (ii) To protect your health and safety or the health and safety of others; or, (iii) For the safety and security of the correctional institution.
Other uses of medical information
Other uses and disclosures of medical information not covered by this notice or the laws that apply to us will be made only with your prior, fully informed, written authorization. If you provide us authorization to use or disclose medical information about you, you may revoke the authorization at any time by giving us written instructions to revoke. If so instructed, we will no longer use or disclose medical information about you for the reasons covered by the authorization you revoke. We will be unable to take back any disclosures already made prior to the authorization being revoked. We also are required to retain in your medical records such disclosures as may have been made during the time the authorization was in effect.
Your rights regarding medical information about you
You have the following rights regarding medical information we maintain about you:
Right to inspect and copy
You have the right to inspect and copy your medical information that may be used to make decisions about your care. Usually, this includes medical and billing records, but does not include any psychotherapy notes maintained by your provider. To inspect and copy medical information that may be used to make decisions about you, you must submit your request in writing to the Office of the Administrator. If you request a copy of the information, HGH may charge a fee for the costs of copying, mailing or other supplies associated with your request. We may deny your request to inspect and copy your medical information in certain very limited circumstances. If you are access to your medical information you may appeal the denial. Your appeal will be considered by a licensed health care professional chosen by HGH and not previously involved in the denial of your original request for denied inspection and copy. HGH will abide by the decision of the appeal reviewer.
Right to amend
If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for HGH. To request an amendment, you must make it in writing and submit it to the Office of the Administrator. You must provide justification and documentation that supports your amendment request. We may deny your request for an amendment if it is not in writing or does not include justification and documentation to support the request.
In addition, we may deny your request if you ask us to amend information that: (i) Was not created by us, unless the person or entity that created the information is no longer available to make the amendment; (ii) Is not part of the information kept by or for HGH; (iii) Is not part of the information which you would be permitted to inspect and copy; or, (iv) Is accurate and complete.
Right to an accounting of medical information disclosures
We keep a record of every time we share your medical information for purposes other than treatment, payment and operations. We generally classify these types of disclosures as "non-routine" and we control and track such disclosures. We do not maintain a record of disclosures made when you have given written authorization for such disclosures. To request an accounting of these "non-routine" disclosures, you must submit your request in writing to the Office of the Administrator. Your request must state a time period which may not be longer than six years and may not include dates before January 1, 2004. Your request also should indicate in what form you want the accounting (for example, on paper, electronically). The first accounting you request within a twelve (12) month period will be provided free of charge. For additional accountings within the same twelve (12) month period, we may charge you for the costs of providing the accounting. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
Right to request restrictions
You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment or operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not use or disclose information about your treatment at HGH to your family members. To request restrictions, you must make your request in writing to the Office of the Administrator. In your request, you must tell us: (i) What information you want us to limit; (ii) Whether you want to limit our use, disclosure or both; and, (iii) To whom you want the limits to apply; for example, disclosures to your family. We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide emergency treatment to you.
Right to request confidential communications
You have the right to request that we communicate with you about health matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. To request confidential communications, you must make your request in writing to the Office of the Administrator. Your request must specify how or where you wish to be contacted. You do not have to provide the reason for your request. HGH will accommodate all reasonable requests.
Right to a paper copy of this notice
You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. To obtain another paper copy of this notice, contact the Office of the Administrator. You may obtain an electronic copy of this notice at our website, www.hghospital.ws. Even if you have an electronic version of the Notice, you are still entitled to a paper copy if you want one.
The HIPAA Privacy Rule gives individuals a fundamental new right to be informed of the privacy practices of their health plans and of most of their health care providers, as well as to be informed of their privacy rights with respect to their personal health information. Health plans and covered health care providers are required to develop and distribute a notice that provides a clear explanation of these rights and practices. The notice is intended to focus individuals on privacy issues and concerns, and to prompt them to have discussions with their health plans and health care providers and exercise their rights.
How the rule works
General rule. The privacy rule provides that an individual has a right to adequate notice of how a covered entity may use and disclose protected health information about the individual, as well as his or her rights and the covered entity's obligations with respect to that information. Most covered entities must develop and provide individuals with this notice of their privacy practices. The privacy rule does not require the following covered entities to develop a notice:
- Health care clearinghouses, if the only protected health information they create or receive is as a business associate of another covered entity. See 45 CFR 164.500(b)(1).
- A correctional institution that is a covered entity (e.g., that has a covered health care provider component).
- A group health plan that provides benefits only through one or more contracts of insurance with health insurance issuers or HMOs, and that does not create or receive protected health information other than summary health information or enrollment or disenrollment information.
Changes to this notice
We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for medical information we already have about you as well as any medical information we create in the future. We will post a copy of the current notice at appropriate client access points in our treatment facilities. The notice will contain its effective date on the top of the first page. In addition, each time you register at or are admitted to HGH for treatment or health care services as an inpatient or outpatient, we will ask you if you want a copy of the current notice in effect.
If you believe your privacy rights have been violated, you may file a complaint with HGH, Office of the Administrator, at:
118 E. Haskell St.
Winnemucca, Nevada 89445
All complaints must be submitted in writing. Your complaint actions will be held in the strictest confidence. HGH will not take any actions to discourage you from filing a complaint nor will we act against you in any way because of filing a complaint.