NOTICE OF HEALTH INFORMATION PRACTICES
Effective Date: January 15, 2018
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
PURPOSE: This Notice of Health Information Practices describes how we may use and disclose your Protected Health Information (PHI) to carry out treatment, payment, or healthcare operations and for other purposes permitted or required by law. “Protected Health Information” is information that may identify you and that relates to your past, present, or future physical or mental health, and may include your name, address, phone numbers, and other identifying information. That information is accessible to Cherokee Nation Health Services staff.
We understand that medical information about you and your health is personal and confidential, and we are committed to protecting the confidentiality of your PHI. We are required by law to protect your privacy and the confidentiality of your PHI. Proper safeguards are in place to discourage improper uses or access.
You will be asked to sign an acknowledgement when you come to a Cherokee Nation facility or program. Our purpose is to make you aware of the possible uses and disclosures of your PHI and your privacy rights. Cherokee Nation Health Services will care for you even if you refuse to sign the acknowledgement. Even if you REFUSE to sign the acknowledgement, we WILL use and disclose PHI as outlined in this notice.
As permitted by law, we reserve the right to amend or modify our privacy policies and practices. These changes in our policies and practices may be required by changes in law or regulations. Upon request, we will provide you with the most recently revised Notice at any time. The revised policies and practices will be applied to all PHI we maintain.
Federal Privacy Laws
This Notice is provided to you as a requirement of the Health Insurance Portability and Accountability Act (HIPAA). There are several other privacy laws which also apply. These laws have not been superseded and have been taken into consideration in developing our policies and this Notice of how we will use and disclose your PHI.
Understanding Your Health Record/Information
Each time you visit a Cherokee Nation Health Services facility, a record of your visit is made. This record typically contains your symptoms, examination and test results, diagnoses, treatment, and a plan for future care or treatment. This information is often referred to as your medical record or “chart” and includes your billing information. Your medical record or chart is systematically created and retained on a variety of media, which may include computers, paper, and films. If you are referred to another provider through Contract Health Services, a record is also kept of those services.
Your medical record is used as a:
- Basis for planning for your care and treatment;
- Communication source between health care professionals;
- Tool with which we can check results and continually work to improve the care we provide;
- Means by which Medicare, Medicaid, or private insurance payers can verify the services billed;
- Tool for education of health care professionals;
- Source of information for public health authorities charged with improving the health of the public;
- Source of data for facility planning;
- Legal document that describes the care you receive.
Understanding what is in your medical record and how the information is used, helps you to: ensure its accuracy, better understand why others may review your health information, and make an informed decision when authorizing disclosures.
Your Health Information Rights
The information contained in your health record belongs to you. However, the actual file itself and the paper or other medium it is written on, belong to Cherokee Nation. You have the right to:
- Obtain a paper copy of this Notice of Information Practices;
- Inspect and receive a copy of your health record, except as prohibited by law. Some records such as physical abuse, behavioral health, alcohol and substance abuse records may be exempt from disclosure;
- Request a restriction on certain uses and disclosures of your information. For example, you may ask that we not disclose information to a family member. We are not required to agree to your request, but if we do agree, we will comply with your request unless the information is needed to provide you with emergency services.
- Request confidential communications concerning your medical condition treatment. For example, you may ask that we send mail to you at a different address than your home or by a different means such as a telephone;
- Revoke your written authorization to disclose PHI. This does not apply to information already disclosed, or where we have acted in reliance on your authorization; or when an insurer has a legal right to contest a claim you have filed;
- Request a correction or amendment to your medical record if you believe the information we have about you is incomplete or incorrect;
- Receive a listing of certain disclosures we have made of your PHI. This record of disclosures is maintained for six (6) years.
- We are required by law to maintain the confidentiality of your PHI and to provide you with this Notice of Information Practices. We are also required to abide by the policies and practices outlined in this notice.
- If you request a restriction to your medical records, we must notify you if we are unable to agree to the requested restriction.
- We must accommodate reasonable requests you may have to communicate health information by alternative means or at alternative locations.
- Cherokee Nation Health Services will not use or disclose your PHI without your permission, except as described in this Notice.
Disclosure without Authorization. Cherokee Nation may use or disclose your PHI without your authorization for the following purposes:
Treatment and Treatment Alternatives
Information is recorded in your medical record and used to determine the course of treatment for you. Your health care provider will document his or her instructions to members of the healthcare team for the purpose of evaluating your health, diagnosing medical conditions and providing treatment. For example, results of laboratory tests and procedures will be recorded for use by all health professionals who treat you or who are consulted concerning your treatment. The actions taken and observations made by members of your healthcare team will be recorded in your medical record so your provider will know how you are responding to treatment. PHI may be provided to pharmacists about other drugs you are taking to identify potential interactions.
If you are referred or transferred to another health care provider, we may disclose your PHI to that provider for treatment decisions. We may disclose your PHI to medical students working within our facilities.
You may be required to sign-in for services and your name may be called in the waiting room or over the loudspeaker in order to let you know that the staff member is ready to see you.
We may contact you to provide information about treatment alternatives, management of your medical condition, or other types of health-related benefits and services that may be of interest to you. For example, we may contact you about availability of a new treatment or services for diabetes.
Payment. Your PHI may be used to seek payment from Medicare, Medicaid, grant programs (such as the CDC Breast and Cervical Cancer Detection Program and the Diabetes Program), private insurance or other sources of coverage such as an automobile insurer. The PHI on or accompanying the bill will include information that identifies you, as well as your diagnosis, procedures, and supplies used for your treatment. If you are referred to another provider under the Contract Health program, we may disclose PHI to that provider.
We are not required to obtain your permission to bill your insurance company; Medicare, Medicaid or other persons or entities (such as liability carriers) for your care. We may file a lien against any settlement which may compensate you for injuries or illnesses if we provided care to you for the injury or illness. If you receive a settlement for an accident or illness, we may release information to the settling party to obtain reimbursement for care we provided to you related to the injury or illness.
Health Care Operations
Your health information may be used as necessary to support the day-to-day activities and management of Cherokee Nation Health Services such as budgeting and financial reporting, evaluating your care and treatment outcomes and to continually improve the quality and effectiveness of the services we provide.
We may disclose your PHI to internal and external auditors, accreditation surveyors, and tribal, state, and federal employees acting within the scope of their official duties. We may use your PHI to detect, prevent or prosecute fraud, waste and abuse. We may use your PHI to prevent an injury to health care worker or to prevent a crime on Cherokee Nation property.
Appointment Reminders: We may use your PHI to remind you of an appointment or to contact you if you need to return earlier than scheduled. We may send you a postcard or letter, or may leave a message on your home answering machine or message phone, or in a message left with the person answering the telephone at the number you have provided.
Business Associates: We provide some healthcare services and related functions through the use of contracts with business associates. For example, we may have contracts for outside lab services and medical transcription. We may disclose PHI to business associates so they can perform their jobs. We require our business associates to protect and safeguard your PHI in accordance with all applicable laws.
Child and Elder Protective Services. We may use or disclose PHI to public health authority or other government authority authorized by law to receive reports of child or elder abuse or neglect. This includes Indian Child Welfare, Oklahoma Department of Human Services, and Adult Protective Services.
Correctional Institutions. If you are an inmate of a correctional institution or jail, we may disclose your PHI necessary for your health and the health and safety of other individuals.
Coroners, Medical Examiners, Funeral Directors, Decedents. We may use or disclose PHI to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law. We may also disclose PHI to funeral directors consistent with applicable law as necessary to carry out their duties. We may disclose PHI about decedents where required under the Freedom of Information Act or otherwise required by law.
Directory. If you are admitted to an inpatient facility, we may use or disclose your name, general condition, religious affiliation, and location within our facility, for facility directory purposes, unless you notify us that you object to the information being listed. We may provide your religious affiliation only to members of the clergy.
Disaster. We may disclose PHI about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.
Family. Unless you notify us of your objection, we may disclose to another person PHI relevant to that person’s involvement in your care or payment related to your care. We may use or disclose PHI to notify or assist in notifying a family member, personal representative, or another person responsible for your care, your location and general condition.
Food and Drug Administration (FDA). We may disclose your PHI to the FDA in connection with any FDA-regulated produce or activity. For example, we may disclose to the FDA information concerning adverse events to track FDA-regulated products to conduct product recalls, replacements, look backs (including locating people who have received products that have been recalled or withdrawn), or post marketing surveillance.
Foster Care. For children who are placed in foster care, we may disclose PHI to the foster parents and the foster care agency.
Health Oversight Activities. We may use or disclose PHI to health oversight agencies for investigations, audits, inspections, and other actions necessary for the government to monitor the health care system, government benefit programs, and entities subject to government regulatory programs and/or civil rights law for which health information is necessary to determine compliance.
Homeland Security. We may disclose PHI as required by the Homeland Security Act.
Immunization Information. We may disclose immunization information to schools and daycare.
Interpreters. If we use interpreters to facilitate your care, this may require the use or disclosure of PHI to the interpreter.
Judicial Proceedings. We may disclose PHI in the course of judiciary and administrative proceedings if required or authorized by law.
Law Enforcement. We may use or disclose PHI for law enforcement activities as authorized by law or in response to a court competent jurisdiction.
If we believe you are a victim of a crime and we are unable to obtain your authorization because of incapacity or other emergency circumstances, we may disclose information to law enforcement if we determine such disclosure would be in your best interests.
We may disclose PHI to report a crime committed on our premises or when we are providing emergency health care. When a healthcare worker is a victim of a crime, we may disclose information to law enforcement to assist in identifying and locating the perpetrator. We may also report circumstances pertaining to victims of crime, medical emergencies and death from criminal conduct.
Lawsuits and Disputes. If you are involved in a lawsuit or a dispute which puts your medical condition at issue, we may disclose PHI in response to a court order, administrative order, or other lawful process.
Legal Guardians. Subject to the limitations outlined below under the heading of "Minors," we may disclose PHI to a legal guardian of any individual who is a minor, or a person who has been declared incompetent due to physical or mental incapacity by a court of competent jurisdiction.
Military. If you are a member of the military, we may release PHI about you to the appropriate military command authorities.
Minors. Minors may access and control the PHI of any services which they are eligible to consent to. This includes family planning, alcohol and substance abuse treatment, and diagnosis and treatment of sexually transmitted diseases.
National Security. We may release PHI to authorized federal officials for national security activities authorized by law.
Notification. We may use or disclose PHI to notify or assist in notification of a family member; personal representative or other authorized person(s) responsible for your care, unless you notify us that you object.
Organ Procurement. We may disclose PHI to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs for the purpose of tissue donation and transplant.
Parents. Custodial and non-custodial parents have exactly the same rights to PHI concerning minor children.
Personal Representatives. We may disclose PHI to the personal representative designated by you in writing. For example, if an adult son or daughter accompanies you to appointments or assists in your healthcare, you may want to designate them as a personal representative to assure they will always be able to talk with your providers and access your health care information. Designation as a Personal Representative does NOT permit them to make health care decisions.
Protected Services for the President and Others. We may disclose PHI to authorized federal officials so they may provide protection to the President and other authorized persons or to conduct special investigations related to such protective services.
Public Health: We may disclose your health information to public health agencies that are authorized to collect or receive such information for the purpose of preventing or controlling disease, injury or disability, or conducting public health surveillance, investigations and interventions.
Research: We may disclose information to researchers when their research has been approved by an institutional review board (I.R.B.) that has reviewed the research proposal and established protocols to ensure the privacy of your PHI.
Threat to Health or Safety: We may disclose PHI if we believe that its use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public.
Whistleblowers: We are not in violation of this Notice or HIPAA if any of our employees or our contractors disclose PHI to an authority authorized by law to investigate or oversee our activities if the employee or contractor in good faith believe we have engaged in conduct that is unlawful or otherwise violates clinical and professional standards or that the care or services provided has the potential of endangering one or more patients or members of the workforce or the public.
Workplace: We may disclose PHI to your employer concerning a work-related illness or injury or workplace-related medical surveillance. We may disclose PHI to the extent authorized by and to the extent necessary to comply with laws relating to workers compensation.
Disclosures Requiring Your Authorization
Disclosure of your PHI for any purpose other than those listed above requires your specific written authorization. If you change your mind after authorizing a use or disclosure of your information, you may submit a written revocation of the authorization. However, your decision to revoke the authorization will not affect or undo any use or disclosure of information that occurred before you notified us of your decision to revoke your authorization.
Requests to Inspect Protected Health Information
You may generally inspect or receive a copy of the PHI that we maintain. We require that requests to inspect or copy PHI be submitted in writing. You may obtain a form to request access to your records by contacting the medical records department where you received care. Your request will be reviewed and will generally be approved unless there are legal or medical reasons to deny the request. We must respond to your request within 30 days or notify you in writing why your request cannot be granted.
Your Right to File a Complaint.
If you believe your privacy rights have been violated, please submit your complaint in writing to the address listed below.
Cherokee Nation Health Services
Health General Counsel
ATTN: Health Privacy Officer
P.O. Box 948
Tahlequah, OK 74465
You may also file a complaint with the Clinic Administrator or Chief Executive Officer of the facility where your record is kept, or with the Health Services Executive Director. You will not be penalized or otherwise retaliated against for filing a complaint.
To file a complaint with the Secretary of the Department of Health and Human Services, contact:
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201