Notice of Privacy Practices - Silicon Valley Medical Development

Date of Adoption: February 2019

This notice describes how medical information about you may be used and disclosed and how you can get access to this information.

Please Review It Carefully

If you have any questions about this Notice, please contact the Privacy Officer, or designee, by dialing 650-940-7300 or by leaving a message on the Compliance Hotline at 650-988-7790.

Each time you visit a physician, or other health care provider, a record of your visit is made. Typically, this record contains your symptoms, examination and test results, diagnoses, treatment, a plan for future care or treatment, status as client research trial participant and billing-related information (“protected health information”). This Notice applies to all of the records of your care generated by the Clinic whether made by Clinic personnel, contractors of the Clinic, or your doctor. Your doctor may have different policies or notices regarding the doctor’s use and disclosure of medical information created in the doctor’s office or Clinic.

Our Responsibilities

We are required by law to maintain the privacy of your protected health information, to provide you with a description of our privacy practices and legal duties with respect to your protected health information and to notify affected individuals following a breach of unsecured protected health information.

This Notice covers the privacy practices of all health care professionals, employees, contract staff, students and volunteers for El Camino Health Medical Network (ECHMN) and all of its Clinics.

Within this Notice, a reference to the Clinic may also include the independent and group physician practices who provide services in the emergency room, radiology department, laboratory, anesthesiology and other service areas.

When the Clinic provides health care to you, we share your protected health information with these and other physicians as necessary to per-form treatment, to obtain payment or to carry out operational activities. The Clinic participates in secure electronic health information exchanges with other hospitals and care providers, and we routinely exchange protected health information electronically for the purpose of providing care and services. We share information allowed by state and federal law and limit exchange of sensitive health information as defined by ECHMN policies and procedures.

We exchange electronic health information if we are able to confirm your name, date of birth and basic information (like address and phone number) and match it correctly. When you come to ECHMN, we may also electronically obtain health information from your other care providers.

Please ask if you have any questions about our secure electronic health information exchange practices or if you have any concerns about participating in this exchange. You do not have to participate in the exchange to receive care. You may choose to have your information with-held from participating providers by personally opting out and completing an exemption form provided by the Clinic. If you choose to opt out of the electronic health information exchanges the Clinic will continue to use your medical information in accordance with this Notice and applicable laws, but will not make it available to other health care provides through the electronic health information exchange.

Whenever we use or disclose your protected health information, we are required to abide by the terms of this Notice of Privacy Practices. Please sign and return at your earliest convenience the “Acknowledgment of Receipt” form which will acknowledge your receipt of this Notice.

Uses and Disclosures

A. How We May Use and Disclose Health Information About You (No Authorization Required)

For Treatment: We may use your protected health information to provide treatment or services to you. We may disclose your protected health information to doctors, nurses, technicians, medical students, or other Clinic personnel who are involved in taking care of you at the Clinic. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. Different departments of the Clinic also may share your protected health information to coordinate the different things you may need, such as prescriptions, lab work, and X-rays.

We may also share protected health information with your designated primary care physician (“PCP”) or other subsequent health care provider in order for him or her to treat you once you are discharged from the Clinic. This information may be shared electronically, in a restricted, secure format.

For Payment: We may use and disclose medical information about your treatment and services to bill and collect payment from you, your insurance company, health plan or another third party payer (“Plan”). For example, we may need to give your Plan information about your surgery so they will pay us or reimburse you for the treatment. We may also inform your Plan about the treatment you are going to receive to determine whether your Plan will cover it.

For Health Care Operations: We will also use your protected health information to assist in running our operations. Members of the Medical Staff and/or a quality improvement team may use information in your health record to assess the care and outcomes in your case and others like it. The results will then be used to continually improve the quality of care for all patients we serve. For example, we may combine medical information about many patients to evaluate the need for new services or treatment. We may disclose information to doctors, nurses, and health care students for educational purposes. And we may combine medical information we have with that of other providers to determine where we can make improvements. We may remove information that identifies you from this set of medical information to protect your privacy.

We may also use and disclose your protected health information:

To our business associates who we contract with to perform services;
To assess your satisfaction with our services;
To contact you as part of the Clinic’s fundraising efforts (except Behavioral Health patients). You have the right to opt out of receiving any such communications;
For population-based activities relating to improving health or reducing health care costs;
To contact you to inform of possible relevant clinical research trials available; and
For conducting training programs or reviewing the competence of health care professionals.

To Business Associates: Some services are provided to us or on our behalf through contracts with third parties (“Business Associates”). For example, we may disclose your protected health information to a copy service we use when making copies of your health record or to a consultant who performs utilization reviews for the Clinic. When these services are contracted, we may disclose your protected health information to our Business Associates so that they can perform the duties we have asked them to do or to bill you or your Plan for the services rendered. To protect your protected health information, however, we require our Business Associates to appropriately safeguard your information in accordance with current legal requirements.

For Fundraising Activities (except Behavioral Health Patients): We may disclose limited information about you (such as your name, address, telephone number and the dates you received services at the Clinic) to raise money on behalf of the Clinic. This limited disclosure permits contact with you in an effort to expand and support the health care services we offer, the educational programs we provide to the community, and the research we conduct to find cure for life-threatening diseases. If you are contacted by the El Camino Health Foundation, you have the right to be excluded from further contact by making a written request to the El Camino Health Foundation.

For Clinic Patient Directory (except Behavioral Health Patients): We may include certain limited information about you in the Clinic patient directory while you are a patient at the Clinic. The information may include your name, your general condition (e.g., good, fair, etc.) and your religious affiliation. This information may be provided to members of the clergy even if they do not ask for you by name and, except for religious affiliation, to other people who ask for you by name. If you would prefer not to be listed in the Clinic patient directory, please request the “Request to Withhold Public Release of Information” form from the admission staff.

To Individuals Involved in Your Care or Payment for Your Care: Unless you instruct us otherwise, we may, in our professional judgment, use or disclose your protected health information to a family member, other relative, a friend or any other person identified by you who is involved in your medical care or who helps pay for your care (including your Plan). In an emergency situation or in the event of your incapacity, we may exercise our professional judgment to determine whether a disclosure to a particular person is in your best interest. We will disclose only the information that we believe is directly relevant to the person’s involvement with your health care or payment for your care. In addition, we may disclose your protected health information to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.

For Research if Certain Conditions are Satisfied: We may use or disclose protected health information for research purposes if we remove certain information that may directly identify you such as your name, telephone number, Social Security number, medical record number and account number. We may also disclose information to researchers when an institutional review board (“IRB”) has reviewed the research proposal, established protocols to ensure the privacy of your protected health information and has approved their research. Unless an IRB has issued a waiver of authorization, we will almost always ask for your written permission (“Authorization”) before a researcher will have access to your name, address or other information that already reveals who you are. In certain cases, prior to commencement of a study or prior to your enrollment as a subject in a study, your personal health information may be disclosed without your Authorization on a limited basis to further the Clinic’s research mission. For example, we may disclose medical information about you to people preparing to conduct a research project —to help researchers identify patients with specific medical conditions and/or to assess the viability of a research idea (subject recruitment and reviews preparatory to research) –so long as the medical information they review does not leave the Clinic.

For Organized Health Care Arrangement: ECHMN and the independent and group physician practices with which ECHMN are presenting you this Notice as a joint Notice. Protected health information will be shared as necessary to carry out treatment, payment and health care operations. Physicians and caregivers may have access to protected health information in their offices to assist in reviewing past treatment as it may affect your current treatment.

To Affiliated Covered Entity: Caregivers at other facilities may have access to protected health information at their locations to assist in reviewing past treatment information as it may affect your current treatment. Please contact the Privacy Officer, or designee, for further information on the specific sites included in this affiliated covered entity.

As Required or Permitted by Law: We will use or disclose your protected health information if we are required or permitted by law to do so, including the following:

Public Health Activities: We may disclose your protected health information for authorized public health activities: to public health officials to prevent or control disease, injury or disability; to the U.S. Food and Drug Administration (“FDA”) as required or permitted by the FDA; and to report to your employer as required under laws addressing work-related illnesses and injuries or workplace medical surveillance.
Victims of Abuse, Neglect or Domestic Violence: If we reasonably believe you are a victim of abuse, neglect or domestic violence, we may disclose your protected health information to a governmental authority, including a social services or protective services agency, authorized by law to receive reports of such abuse, neglect or domestic violence.
For Health Oversight Activities: We may disclose your protected health information to a health oversight agency that oversees the health care system and is charged with responsibility for ensuring compliance with the rules of government health programs such as Medicare or Medicaid or licensing and similar authorities.
To Law Enforcement Officials: We may disclose your protected health information to the police or other law enforcement officials in certain limited, allowable circumstances or in compliance with a warrant, a court order or a grand jury or an administrative subpoena.
For Legal Proceedings: We may disclose your protected health information in the course of a judicial or administrative proceeding in response to: (1)a court order; (2)a legally-valid order or warrant issued by a state or federal authority, administrative agency or licensing board; and (3)a subpoena, discovery request, or other lawful process in a third party action but only after efforts have been made to notify you that your protected health information is being sought so that you can obtain an order protecting the information requested.
Decedents: We may disclose your protected health information to a coroner, a medical examiner or a funeral director.
Organ & Tissue Procurement: We may disclose your protected health information to entities engaged in procurement, banking or transplantation of cadaveric organs, eyes or tissue for purposes of facilitating donation and transplantation.
Health or Safety: We may use or disclose your protected health information to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of others.
Specialized Government Functions: We may use and disclose your protected health information to units of the government with special functions, such as the U.S. military, the U.S. Department of State, under certain circumstances, and correctional institutions.
Worker’s Compensation: We may disclose your protected health information as authorized by and to the extent necessary to comply with laws and legal actions relating to workers’ compensation or other similar programs.
Limitations: There are special restrictions on the disclosure of health information relating to HIV/AIDS status, mental health treatment, developmental disabilities, and drug and alcohol abuse treatment. We comply with these restrictions in our use of your protected health information.

Uses and Disclosures

B. Uses and Disclosures Requiring Your Written Authorization

Marketing Activities (Marketing Authorization): We must also obtain your written authorization prior to using your protected health information to send you any marketing materials (“Marketing Authorization”).

However, no Marketing Authorization is required for the following informational communications (except Behavioral Health Patients): (1)information about health-related products or services we provide; (2)information about services or products relating to your treatment; (3)information about services or products for purposes of case management, or care coordination, or to recommend alternative treatments, therapies, providers or care settings; (4)to provide you with marketing materials in a face-to-face encounter; and (5)to give you a promotional gift of nominal value.

Marketing, if authorized or informational communications may be sent to you by e-mail or by regular mail using information you provide us at registration.

Highly Confidential Information: Federal and state laws require special privacy protections for certain highly sensitive information about you (“Highly Confidential Information”), including the subset of your protected health information that: (1)is maintained in psychotherapy notes; and (2)relates to alcohol and drug abuse prevention, treatment and referral. For purposes other than those permitted or required by law, we must obtain your written authorization in order for us to disclose your Highly Confidential Information.

C. Other Uses of Protected Health Information

Other uses and disclosures of protected health information not covered by this Notice or the laws that apply to us will be made only with your written authorization. If you authorized us to use or disclose your protected health information, you may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose your protected health information for the reasons covered by your written authorization. You understand that we are unable to take back any uses or disclosures we have already made in reliance on the authorization, and that we are required to retain our records of the care that we provided to you.

D. Reporting and Disclosure Duties

We are required by law to notify you if there has been improper access to your unsecured protected health information and there is a significant risk of financial, reputational, or other harm.

How You Can Access and Control Your Protected Health Information Uses and Disclosures

The following describes the actions you may take with respect to your protected health information that we maintain.

Inspect and Copy: You may ask to inspect and to obtain a copy of your protected health information that may be used to make decisions about you and your treatment so long as we maintain this information in our records. Usually, this includes medical and billing records. Under federal law, however, you may not inspect or copy the following:

(1)psychotherapy notes; (2)information compiled in reasonable anticipation of, or use in, legal proceedings; or (3)information subject to a federal law that prohibits access to protected health information. We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to your protected health information, you may request that the denial be reviewed in some situations. We will comply with the outcome of the review.

If you request a copy of your protected health information, we may charge a fee for the cost of copying, mailing, or other supplies we use to fulfill your request. If you wish to make a request, you may obtain a request form from, or submit your detailed request in writing, including the protected health information you are requesting access to and the relevant dates, to the Health Information Management Services Department.

Amendment: If you feel that your protected health information is incorrect or incomplete, you may ask us to amend the information so long as the information is kept by or for the Clinic. We may deny your request for an amendment and if this occurs, you will be notified of the reason for the denial. If you wish to make a request, you may obtain a request form from, or submit your detailed request in writing, to the Health Information Management Services Department. You must include your reasons for the request.

Accounting of Disclosures: You may request an accounting of disclosures. This is a list of certain disclosures we made of your protected health information for purposes other than treatment, payment or health care operations during any time period prior to the date of your request provided: (1)the period does not exceed six years or include any date before April 14, 2003; or (2)disclosures made for treatment, payment, health care operations and certain other limited purposes will not be included. If you wish to make a request, you may obtain a request form from, or submit your detailed request in writing, to the Health Information Management Services Department.

The first accounting you request within a 12-month period is free of charge. For additional accounting(s), we may charge you for the costs of providing the accounting(s). We will notify you of the cost involved in advance; you may choose to withdraw your request at that time before any cost is incurred.

Request Additional Restrictions: You may request a restriction or limitation on our use or disclose of your protected health information for purposes of treatment, payment or health care operations. You may also request a limit on your protected health information we disclose to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not use or disclose information about a surgery that you had. We are not required to agree to your request except if the restriction pertains to payment or health care operations related to a service you have paid in full without any Plan contribution. Even if disclosure is restricted, El Camino Health Medical Network may disclose if required by law. If we do agree, we will comply with your request unless the information is needed to provide you with emergency treatment. If you wish to make a request, you must submit your detailed request in writing, to your care provider or to the Privacy Officer, or designee; using the “Request to Restrict Use or Disclosure of Protected Health Information” form available at the Health Information Management Services department.

Request Confidential Communications: You may request that we communicate with you about medical matters in a certain way or at a certain location. For example, you may ask that we contact you at work or by U.S. Mail. We will accommodate reasonable requests for confidential communications at alternative locations and/or via alternative means only if the request is submitted in writing to your care provider or to the Privacy Officer and the written request includes a mailing address where you will receive bills for services rendered by the Providers and related correspondence regarding payment for services. Please realize, we reserve the right to contact you by other means and at other locations if you fail to respond to any communication from us that requires a response. We will notify you in accordance with your original request prior to attempting to contact you by other means or at another location.

A Paper Copy of This Notice: You may obtain a paper copy of this Notice, even if you have agreed to receive this Notice electronically. You may request a copy of this Notice at any time. You may also obtain a copy of this Notice at our web site.

Changes to This Notice

We reserve the right to change this Notice at any time and the revised Notice will be effective for all of the protected health information we already have about you as well as any information we receive in the future. The revised Notice will be effective for all protected health information that we maintain as of the effective date of such revised Notice, even if we collected or received the protected health information prior to the revised Notice’s effective date. The most current Notice will be posted in the El Camino Health locations and will include the date of adoption. In addition, each time you register at or are admitted to the Clinic for treatment or health care services as an outpatient, we will offer you a copy of the current Notice in effect. We will also post a copy of the current Notice on our web site:

Complaints

If you believe your privacy rights have been violated, you may file a complaint with the Enterprise Privacy Officer. To obtain information or be contacted by the Enterprise Privacy Officer, or designee, you may leave a message on the Corporate Compliance Hotline, or you may call Administration at 650-940-7300. You may file a complaint by contacting the Secretary of the U.S. Department of Health and Human Services. All complaints must be submitted in writing. You will not be penalized for filing a complaint.

State Specific Requirements

Many states, including California, have requirements for reporting including population-based activities relating to improving health or reducing health care costs. Some states have separate privacy laws that may apply additional legal requirements. If the California law is more stringent than the federal law, the California law will preempt the federal law.

Enterprise Privacy Officer

The Enterprise Privacy Officer, or designee, may be reached by dialing 650-940-7300. Or you can leave a message on the Compliance Hotline 650-988-7790 for a return call from the Enterprise Privacy Officer, or designee.