Brattleboro Memorial Hospital

NOTICE OF PRIVACY PRACTICES
Amended November 2007

THIS NOTICE OF PRIVACY PRACTICES DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

1. Introduction

This Notice of Privacy Practices describes how Brattleboro Memorial Hospital may use and disclose your protected health information (PHI) to provide treatment to you; to seek payment for the medical services you receive; and to support the legitimate health care operations of our facility.

PHI includes your demographic information such as name, address, telephone number, and family; past, present, or future information about your physical or mental health or condition; and information about the medical services provided to you, including
payment information, if any of that information may be used to identify you.

This notice describes uses and disclosures of PHI to which you have consented, that you may be asked to authorize in the future, and that are permitted or required by state or federal law. Also, it advises you of your rights to access and control your PHI.

We may amend this Notice of Privacy Practices periodically and you may obtain a
current copy of the Notice by contacting the Director of Patient Financial Services at (802) 257-8382.

We also post this notice on our hospital web page, www.bmhvt.org

We regard the safeguarding of your PHI as an important duty. The elements of this
Notice and any authorizations you may sign are required by state and federal law for your protection and to ensure your informed consent to the use and disclosure of PHI necessary to support your relationship with Brattleboro Memorial Hospital.

If you have any questions about Brattleboro Memorial Hospital’s Notice of Privacy
Practices, please contact the Compliance Officer at (802) 257-8247.

2. Organized Health Care Arrangement (OHCA) of Brattleboro Memorial Hospital

Brattleboro Memorial Hospital and the members of its organized medical staff have joined together as an Organized Health Care Arrangement to present this Notice of
Privacy Practices (NPP) to you as a joint document. Besides the individual members of our organized medical staff, this OHCA specifically includes Valley Pathology Group, Windham Radiology Associates, Brattleboro Anesthesia Associates, Just-So Pediatrics, Brattleboro Obstetrics and Gynecology, Cornerstone Pediatrics and Brattleboro Cardiol-ogy.

This joint NPP will be in effect for all inpatient and outpatient hospital-based services, and will allow the sharing of your PHI as appropriate between members of the OHCA for treatment, payment and health care operations. Even though an OHCA has been estab-lished, each member is responsible for its own compliance with confidentiality policies and with all federal and state regulations, and no one member is responsible for any violations carried out by another member.

3. Safeguarding PHI Within our Facility

We have in place appropriate administrative, technical, and physical safeguards to
protect and to secure the privacy and security of your PHI. We orient our staff to the regulations and policies developed to protect the privacy of your PHI, and review their obligation to maintain privacy and security annually. We hold medical records in a se-cure area within our facility. Only staff members who have a legitimate "need to know" are permitted access to your
medical records and other PHI. Our staff understands the legal and ethical obligation to protect your PHI and that a violation of this Notice of Privacy Practices may result in disciplinary action in accordance with our Human Resource policies.

4. Uses and Disclosures of PHI

Our facility will use and disclose your PHI for the following types of activities:

• Treatment. Treatment means the provision, coordination, or management of your health care and related services by Brattleboro Memorial Hospital and health care providers involved in your care. Brattleboro Memorial Hospital is a teaching hospital and students may be a member of the health care team. It includes the coordination or management of health care by a provider with a third party insurance carrier, consultation between BMH, our clinical staff and other health care providers relating to your care, or our referral of you to a specialist physician or other facility.
• Payment. Payment means our activities to obtain reimbursement for the medi-cal services provided to you, including billing, claims management, and collec-tion activities. Payment also may include your insurance carrier's efforts in de-termining eligibility, claims processing, assessing medical necessity, and utili-zation review. Payment may also include activities carried out on our behalf by one or more of our collection agencies or agents in order to secure payment on delinquent bills.
• Health Care Operations. Health care operations mean the legitimate business activities of our hospital. These activities may include quality assessment and improvement activities; fraud & abuse compliance; business planning & development; and business management & general administrative activities. These can also include our telephoning you to remind you of appointments, or using a translation service if we need to communicate with you in person, or on the telephone, in a language other than English. When we involve third parties in our business activities, we will have them sign a Business Associate Agreement obligating them to safeguard your PHI according to the same legal standards we follow.
• Patient Directory. We maintain a patient directory when you are an inpatient that includes your name, a general statement about your condition, your reli-gious preference, and your location in the hospital. You may also choose to have limited or no information about you listed in this directory by contacting the Director of Patient Financial Services at 257-8382.

5. Uses and Disclosures of PHI Based Upon Your Written Authorization

Other uses and disclosures of your PHI will be made only with your written authorization. This allows you to request that Brattleboro Memorial Hospital disclose limited PHI to specified individuals or companies for a defined purpose and timeframe. For example, you may wish to authorize disclosures to individuals who are not involved in treatment, payment, or health care operations, such as a family member or a school physical education program. If you wish us to make disclosures in these situations, we will ask you to sign an authorization allowing us to disclose this PHI to the designated parties.

6. Uses and Disclosures of PHI that are Permitted or Required by Law

In some circumstances, we may be legally bound to use or disclose your PHI without your consent or authorization. State and federal privacy law permit or require such use or disclosure regardless of your consent or authorization in certain situations, including, but not limited to:

• Emergencies. If you are incapacitated and require emergency medical treatment, we will use and disclose your PHI to ensure you receive the necessary medical services. We will attempt to obtain your consent as soon as practical following your treatment.
• Others Involved in Your Healthcare: Upon your verbal authorization, we may disclose to a family member, close friend or other person you designate only that PHI that directly relates to that individual’s involvement in your healthcare and treatment. We may also need to use PHI to notify a family member, personal representative or someone else responsible for your care of your location and general condition.
• Communication barriers. If we try but cannot obtain your consent to use or disclose your PHI because of substantial communication barriers and your physician, using his or her professional judgment, infers that you consent to the use or disclosure, or the physician determines that a limited disclosure is in your best interests, Brattleboro Memorial Hospital may permit the use or disclosure.
• Required by Law: We may disclose your PHI to the extent that its use or disclosure is required by law. This disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law.
• Public Health/Regulatory Activities: We may disclose your PHI to an authorized public health authority to prevent or control disease, injury, or dis-ability or to comply with state child or adult abuse or neglect law. We are obli-gated to report suspicion of abuse and neglect to the appropriate regulatory agency.
• Food and Drug Administration: We may disclose your PHI to a person or company as required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations as well as to track product usage, enable product recalls, make repairs or replacements or to conduct post-marketing surveillance.
• Health oversight activities. We may disclose your PHI to a health oversight agency for audits, investigations, inspections, and other activities necessary for the appropriate oversight of the health care system and government benefit programs such as Medicare and Medicaid.
• Judicial and administrative proceedings. We may only disclose your PHI in the course of any judicial or administrative proceeding in response to a court or-der expressly directing disclosure, or in accordance with specific statutory obli-gation compelling BMH to do so, or with the permission of the patient.
• Law enforcement activities. In accordance with Vermont state law, we may not disclose your PHI to a law enforcement officer for law enforcement purposes without court order, statutory obligation or patient authorization.
• Coroners, medical examiners, funeral directors and organ donation organizations: We may disclose your PHI to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other lawful duties. We also may disclose your PHI to enable a funeral director to carry out his or her lawful duties. PHI may also be disclosed to organ banks for cadaveric organ, eye, bone, tissue and other donation purposes.
• Research. We may disclose your PHI for certain medical or scientific research where the researchers have a protocol to ensure the privacy of your PHI.
• Serious threats to health or safety. We may disclose your PHI to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
• Military activity & national security. We may disclose the PHI of members of the armed forces for activities deemed necessary by appropriate military command authorities to assure proper execution of the military mission. We also may disclose your PHI to certain federal officials for lawful intelligence and other national security activities.
• Worker’s Compensation: We may disclose your PHI as authorized to comply with worker’s compensation law.
• Inmates of a Correctional Facility: We may use or disclose PHI if you are an inmate of a correctional facility and our facility created or received your PHI in the course of providing care to you while in custody.
• US Department of Health and Human Services: We must disclose your PHI to you upon request and to the Secretary of the United States Department of Health & Human Services to investigate or determine Brattleboro Memorial Hospital’s compliance with the privacy laws.
• Disaster Relief Activities: We may disclose your PHI to local, state or federal agencies engaged in disaster relief and to private disaster relief assistance organizations (such as the Red Cross if authorized to assist in disaster relief efforts).

7. Your Rights Regarding PHI

• Right to request restriction of uses and disclosures. You have the right to request that we not use or disclose any part of your PHI unless it is a use or dis-closure required by law. Please advise us of the specific PHI you wish restricted and the individual(s) who should not receive the restricted PHI. We are not re-quired to agree to your restriction request, but if we do agree to the request, we will not use or disclose the restricted PHI unless it is necessary for emergency treatment. In that case, we will ask that the recipient not further use or disclose the restricted PHI. You may specify the restricted parties in writing to the Direc-tor of Medical Information.
• Right of access to PHI. You have the right to inspect and obtain a copy of your PHI upon your written request. Your right of access may be limited if providing certain PHI, in the judgment of your physician or some other licensed health care professional, may endanger the health or safety of yourself or others. To request access to your medical record call the Medical Information Department during business hours. We will respond to your request as soon as possible, but no later than 30 days from the date of your request. If access is denied you will receive a denial letter within 30 days. There is an appeals process. We have the right to charge a reasonable fee for providing copies of your PHI.
• Right to confidential communications. You have the right to reasonable accommodation of a request to receive communication of PHI by alternative means or at alternative locations. For example, you may wish your bill to be sent to an address other than your home. Please make your request in writing to the Director of Patient Financial Services. We will not require an explanation of your reasons for the request, and will attempt to comply with reasonable requests, but you will be required to assume any costs associated with forwarding your PHI by alternate means.
• Right to amend PHI. You have the right to request that we amend your PHI. Your request must be made in writing to the Compliance Officer. We will respond to your request as soon as possible, but no later than 60 days from the date of your request. If we deny your request for amendment, you have the right to submit a written statement disagreeing with the denial; the hospital also has the right to submit a rebuttal statement. A record of any disagreement about amendment will become part of your medical record and may be included in subsequent disclosures of your PHI.
• Right to accounting of disclosures. Subject to certain limitations, you have the right to a written accounting of disclosures by us of your PHI for not more than 6 years prior to the date of your request. Your right to an accounting applies to disclosures other than those for treatment, payment, or health care operations; to yourself; for a facility directory; to your family or close friends involved in your care; or for notification purposes. Please make your request in writing to the Director of Medical Information. We will respond to your request as soon as possible, but no later than 60 days from the date of your request. We will provide you with one accounting every 12 months free of charge. We will charge a reasonable fee based upon our costs for any subsequent accounting requests.
• Right to a copy of our Notice of Privacy Practices. We will ask you to sign a written acknowledgement of receipt of our Notice of Privacy Practices. We may periodically amend this Notice of Privacy Practices and you may obtain an updated Notice at any time.

8. Complaint Procedure

• Within our Facility: If you have a complaint about the denial of any of the specific rights listed in Section 6 above, about our Notice of Privacy Practices, or about our compliance with state and federal privacy law you may get more information about the complaint process by contacting the Compliance Officer at (802) 257-8244. We will respond to your complaint in writing within the time-frames listed in Section 6 above or in any case within 30 days of the date of your complaint. We will not retaliate against you for filing a complaint.
• Outside our Facility: If you believe that BMH is not complying with its legal obligations to protect the privacy of your PHI, you may file a complaint with the Secretary of the U.S. Department of Health & Human Services, Office of Civil Rights. You must make your complaint to the Secretary in writing within 180 days of the act or omission forming the basis of your complaint.

9. Marketing & Fundraising

• Fundraising Use: BMH may use patient information for the express purpose of the organization’s own internal fundraising activities. The information used shall be limited to contact information and dates of services rendered.
• Patients Right to “Opt Out”: BMH shall provide all patients with an opportu-nity to “opt out” of having such information used for development purposes. In order to do so, we ask patients to contact our Development Office.
• Marketing Use: BMH shall obtain a patient authorization for use or disclosure of PHI for marketing purposes, unless the marketing efforts are limited to a form of face to face communications or a promotional gift of a nominal value. If the marketing is expected to result in direct or indirect remuneration from a third party, the individual shall be notified that such remuneration is expected,

Orig. 03/2003
Rev. 11/2007