NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW THIS NOTICE CAREFULLY.
I. JOINT NOTICE OF PRIVACY PRACTICES: AFFILIATED COVERED ENTITY
This Notice of Privacy Practices (“Notice”) describes the privacy practices of San Juan Regional Medical Center and San Juan Health Partners, each a “covered entity” under the Health Insurance Portability and Accountability Act (“HIPAA”), who have designated themselves as a single affiliated covered entity (“ACE”) for purposes of compliance with HIPAA. Members of the ACE will share your medical and health information (“protected health information” or “PHI”) with each other as necessary to carry out treatment, payment and health care operations and as permitted by HIPAA and this Notice. References to “we”, “our”, or “us” include all entities covered by this Notice.
You may have additional rights under New Mexico law. New Mexico laws that provide greater privacy protection or broader privacy rights will continue to apply.
II. OUR RIGHTS AND OBLIGATIONS
A. We are required by law to maintain the privacy of your PHI.
B. We are required to give you this Notice about our privacy practices, our legal duties, and your rights concerning your PHI.
C. We are required to follow the privacy practices described in this Notice. These privacy practices will remain in effect until we replace or modify them.
D. We are required to notify you following a breach of unsecured PHI.
E. We reserve the right to change our privacy practices and the terms of this Notice at any time, provided that the change is permitted by law. We reserve the right to have such a change apply to all PHI we maintain, including PHI we received or created before the change. The new notice will be available upon request, in our office, and on our web site.
III. HOW WE MAY USE AND DISCLOSE YOUR PHI.
A. Uses and Disclosures for Treatment, Payment, and Health Care Operations
1. For Treatment. We may use your PHI to provide you medical care. We may disclose PHI to our employees and others, including doctors, nurses, technicians, health students, or other hospital personnel, who are involved in your medical care. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. We may also provide your physician or a subsequent healthcare provider with copies of various reports that should assist him or her in treating you once you are discharged from a hospital or clinical setting.
2. For Payment. We may use and disclose your PHI about your treatment and services to bill and collect payment from you, your insurance company, or a third party payer. For example, we may need to give your insurance company information about your surgery so they will pay us or reimburse you for the treatment. We may also tell your health plan about treatment you are going to receive to determine whether your plan will cover it.
3. For Health Care Operations. We may use and disclose your PHI for all activities that are included within the definition of “health care operations” set out in the HIPAA Privacy Rule. For example, we may use and disclose your PHI to review and improve the quality of care we provide or the competence and qualifications of our professional staff. We may also use and disclose your PHI as necessary for medical reviews, legal services and audits, including fraud and abuse detection, compliance programs, business planning and management.
B. Uses & Disclosures to Other Entities
1. Business Associates. We may disclose your PHI to a “business associate,” such as our billing service, which performs administrative services on our behalf. Business associates are permitted to receive, create, maintain, use, or disclose PHI, but only as provided in the HIPAA Privacy Rule, and only after agreeing in writing to appropriately safeguard your PHI.
2. Other Covered Entities. We may disclose your PHI to other health care providers, health care clearinghouses or health plans, in connection with their treatment, payment, or health care operations.
C. Uses and Disclosures for Which Your Permission May Be Sought.
For purposes of this subsection only, the following conditions apply: If you are present and able to give your verbal permission, we will use or disclose your PHI with your permission. This verbal permission will only cover a single encounter, and is not a substitute for a written authorization. If you are not present or are unable to give your permission, we will use or disclose your PHI only if we determine (based on our professional judgment) that the use or disclosure is in your best interest.
1. To Others Involved in Your Care. We may use or disclose your PHI to a relative or other individual who you have identified as being involved in your health care. If you are not present, our disclosure will be limited to the PHI that directly relates to the individual’s involvement in your health care.
2. For Limited Notification Purposes. We may use or disclose your PHI to help notify a relative or other individual who is responsible for your health care, of your location, general condition or death.
3. To Assist in Disaster Relief. We may disclose your PHI to an authorized public or private entity in order to assist in disaster relief efforts or to coordinate uses and disclosures to relatives or other individuals involved in your health care.
D. Other Permitted Uses and Disclosures
1. To the Secretary. We may disclose your PHI to the Secretary of the Department of Health and Human Services, when required to do so, to enable the Secretary to investigate or determine our compliance with HIPAA.
2. As Required By Law. We may disclose your PHI when required to do so by federal, state or local law.
3. For Public Health Activities. We may use or disclose your PHI for public health activities that are permitted or required by law. For example, we may disclose your PHI to the Food and Drug Administration to report problems with products and reactions to medications and to report disease or infection exposure.
4. Disclosures About Abuse, Neglect, and Domestic Violence. We may disclose your PHI, consistent with applicable federal and state laws, if we believe that you have been a victim of abuse, neglect, or domestic violence. Such disclosure will be made to the governmental entity or agency authorized to receive such information.
5. Health Oversight Activities. We may disclose your PHI to a health oversight agency for activities authorized by law. The relevant agencies include governmental units that oversee or monitor the health care system, government benefit and regulatory programs, and compliance with civil rights laws. The relevant activities include, for example, audits, investigations, inspections, and licensure.
6. Legal Proceedings. We may disclose your PHI in the course of a judicial or administrative proceeding.
7. Law Enforcement. Under limited circumstances (such as identifying or locating a suspect, fugitive, material witness or missing person or complying with a court order, warrant or grand jury subpoena), we may disclose your PHI to law enforcement officials.
8. Coroners, Medical Examiners, and Funeral Directors. We may disclose your PHI to a coroner, medical examiner, or funeral director as necessary for them to carry out their duties.
9. Organ and Tissue Donation. If you are an organ donor, we may disclose your PHI to organizations that handle organ procurement or organ, eye or tissue transplantation, or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.
10. Research. We may disclose your PHI to researchers when an institutional review board or a privacy board has (a) reviewed the research proposal and established protocols to ensure the privacy of the information and (b) approved the research.
11. Serious Threat to Health or Safety. We may use and disclose your PHI when necessary to prevent a serious threat to your health and safety or to the health and safety of others. Any such disclosure will be made to someone who would be able to help prevent the threat.
12. Proof of Immunization. We will disclose proof of immunization to a school that is required to have it before admitting a student if you have agreed to the disclosure on behalf of yourself or your dependent.
13. Specialized Government Functions. We may disclose your PHI, if you are in the Armed Forces, for activities deemed necessary by appropriate military command authorities for determination of benefit eligibility by the Department of Veterans Affairs or to foreign military authorities if you are a member of that foreign military service. We may disclose your PHI to authorized federal officials for conducting national security and intelligence activities (including for the provision of protective services to the President of the United States) or to the Department of State to make medical suitability determinations. If you are an inmate at a correctional institution, then under certain circumstances we may disclose your PHI to the correctional institution.
14. Workers’ Compensation. We may disclose your PHI to the extent necessary to comply with laws concerning workers’ compensation or to comply with similar programs that are established by law and provide benefits for work-related injuries or illness.
15. Reminders. We may use and disclose your PHI by sending you a reminder for important services such as annual checkups.
16. Additional Services. We may use or disclose your PHI to send you information about alternative medical treatments and programs or about health-related products and services that may be of interest to you, provided that we do not receive financial remuneration for making such communications. When we see you face-to-face, we may also use your PHI to encourage you to maintain a healthy lifestyle and get recommended tests, suggest that you participate in a disease management program, provide you with promotional gifts of nominal value, or tell you about government sponsored health programs.
17. Fundraising. We may use or disclose your PHI to contact you for fundraising purposes. However, you have the right to opt-out of receiving such fundraising communications. If you opt-out, we will not contact you for fundraising purposes.
18. Directory. We may include certain limited information about you in the hospital directory while you are a patient at the hospital. The information may include your name, location in the hospital, your general condition (e.g., good, fair), and your religious affiliation. This information may be provided to members of the clergy and, except for religious affiliation, to other people who ask for you by name. If you would like to opt out of being in the facility directory, please inform the admission staff.
E. Health Information Exchanges. We may participate in certain Health Information Exchanges (HIEs) that permit health care providers or other health care entities, such as your health plan or health insurer, to share your health information for treatment, payment and other purposes permitted by law, including those described in this Notice. As of the effective date of this Notice, we participate in the following HIE(s): CommonWell and the New Mexico Health Information Collaborative. You are automatically opted in to such HIEs. If you wish to opt-out, please contact us.
F. Uses and Disclosures with an Authorization.
Before we can use or disclose your PHI for a reason that is not listed in this Section III, we are required to obtain your written authorization. In addition, we are required to obtain your authorization under the following circumstances:
1. Psychotherapy Notes. Most uses and disclosures of psychotherapy notes will require your authorization.
2. Marketing. Use and disclosure of PHI which result in our receiving financial payment from a third party whose product or services is being marketed will require your authorization. This does not include compensation that merely covers our cost of reminding you to take and refill your medication or otherwise communicate about a drug or biologic that is currently prescribed to you.
3. Sale of PHI. Disclosures that constitute a sale of PHI will require your authorization.
You may revoke your authorization at any time, but you must do so in writing. You can obtain an authorization form from the Contact Office (as provided below).
IV. YOUR RIGHTS REGARDING YOUR PHI
A. Right to Inspect and Copy.
You have the right to inspect and receive a copy of your PHI contained in records we maintain that may be used to make decisions about your care. These records usually include your medical and billing records that we may maintain, but do not include psychotherapy notes, information gathered or prepared for a civil, criminal, or administrative proceeding, or PHI that is subject to law that prohibits access.
To inspect and copy the PHI that may be used to make decisions about you, you must submit your request in writing to the Contact Office (as provided below). If you request a copy of your PHI, we may charge a reasonable fee for the costs of copying, mailing or other supplies associated with your request. We may deny your request to inspect and copy in certain very limited circumstances; if we deny you access to your PHI you may request that the denial be reviewed.
B. Right to Request an Amendment.
If you feel that the PHI we have about you is incorrect or incomplete, you may ask us to amend the PHI. You have the right to request an amendment for as long as we maintain the PHI. Your request must be in writing and must include a reason or explanation that supports your request. Request forms are available from and must be submitted to the Contact Office (as provided below).
If we approve your request, we will include the amendment in any future disclosures of the relevant PHI. If we deny your request for an amendment, you may file a written statement of disagreement, which we may rebut in writing. The denial, statement of disagreement, and rebuttal will be included in any future disclosures of the relevant PHI.
We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend PHI that: is not part of the PHI maintained by us; was not created by us, unless the person or entity that created the information is no longer available to make the amendment; is not part of the information which you would be permitted to inspect and copy; or is accurate and complete. All denials will be made in writing.
C. Right to an Accounting of Disclosures.
You have the right to request an “accounting” of the instances in which we disclosed your PHI. Certain disclosures are exempt from the accounting requirement, such as (but not limited to) disclosures made (i) for treatment, payment or health care operations, (ii) to you, (iii) pursuant to your written authorization and (vi) incidental to another permissible use or disclosure.
Your request must be in writing. Your request must include the time frame that you would like us to cover. Request forms are available from and must be submitted to the Contact Office (as provided below). We may charge you for the cost of providing the accounting. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
If your PHI was disclosed through an “electronic health record,” the accounting may include disclosures up to three years before the date of your request. If your PHI was not disclosed through an “electronic health record,” the accounting may include disclosures up to six years before the date of your request.
D. Right to Request Restrictions.
You have the right to request that we restrict the PHI about you we use or disclose for treatment, payment or health care operations. You also have the right to request that we restrict the PHI about you we disclose to someone who is involved in your care or the payment of your care, like a family member or friend. For example, you could ask that we not use or disclose information about a surgery you had.
Your request must be in writing. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply, for example, disclosure to your spouse.
While we will consider your request, we are not required to agree to it unless you obtained health care items and/or services from us, and if you paid for those items and/or services in full and out-of-pocket, in which case we must abide by a request that we disclose PHI about those items and/or services to your health plan.
E. Right to Request Confidential Communications.
You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. We will not ask you the reason for your request.
Your request must be in writing. In your request you must tell us how or where you wish to be contacted. Request forms are available from and must be submitted to the Contact Office (as provided below). We will make reasonable efforts to accommodate your request.
F. Right to a Paper Copy of This Notice.
You have the right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time during office hours.
V. COMPLAINTS
If you believe your privacy rights have been violated, you may file a complaint with us, or with the Secretary of the Department of Health and Human Services. To file a complaint with us, send a written complaint to the Contact Office listed at the end of this Notice. We will not retaliate against you for filing a complaint, and you will not be penalized in any other way for filing a complaint.
VI. CONTACT OFFICE
San Juan Regional Medical Center
Compliance & Privacy Officer
801 W. Maple Street
Farmington, New Mexico 87401
Phone: 505.609.6323
Effective: January 1, 2021
Revised: December 2020
