Privacy Policy

NOTICE OF PRIVACY RIGHTS & PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Because you receive care from a Steward Health Care System provider, we have Personal Health Information (PHI) about you. PHI is information that could identify you and relates to your past, present or future physical or mental health condition(s). We are required by law to maintain the privacy of your PHI and to provide you with notice of our legal duties and privacy practices with respect to your PHI.

Steward Health Care entities, including our hospitals, physician practices and home health services, are members of an organized health care arrangement (OHCA) with other health care providers who are participants in Steward Health Care Network and Steward Integrated Care Network for the purpose of better serving patients. The OHCA members share PHI, as necessary, in order to manage joint operational activities. The OHCA members may use and disclose PHI to provide joint services for the affiliated members, such as integrated information system management, payment activities, quality assessment and improvement and risk management activities. A full list of OHCA members is available at www.steward.org/OHCA. A paper copy is available upon request.

How We Use and Disclose Your PHI

We use and disclose PHI to carry out our responsibilities as a health care provider in various ways. Examples of how we can use or disclose your information without your written authorization include:

• Treatment: We keep a record of each visit and/or admission. These records may include your test results, diagnoses, medications or other therapies. We may share this information with health care providers to help them treat you.
• Payment Purposes: We use and disclose your PHI for payment purposes, such as getting paid for covered services from you, an insurance company, or a third party. We may tell your health plan and other payers about an upcoming treatment or service, which requires their prior approval and authorization.
• Health Care Operations: We use and disclose your PHI for operations purposes, such as training staff and students, business management, customer service and quality review.

Additional Uses & Disclosures

• We may also use or disclose your PHI without your written authorization in the following circumstances:
• In emergency situations,
• To assist incommunicative patients or communicate with those involved in your care.
• To report suspected abuse or neglect,
• To prevent or lessen a serious and imminent threat to you or others,
• For public health activities such as tracking diseases or medical devices,
• For health oversight such as fraud investigation,
• If required by law or for certain judicial or administrative proceedings,
• For law enforcement,
• For government functions such as national security & intelligence,
• For research after appropriate review or waiver of authorization by an institutional review board to ensure the privacy of your PHI,
• To coroners, medical examiners and in connection with organ donation,
• To a correctional institution or entity with lawful custody for inmates,
• In connection with workers’ compensation laws, and
• With business associates that perform activities on our behalf.

We may also use or disclose your PHI to:

• Recommend treatment alternatives to you;
• Send or call you with appointment reminders;
• Include you in the patient facility directory when admitted to the hospital, unless you request otherwise; and
• Tell you about health benefits and/or services, for example, a new program.

Except as otherwise permitted by law, all other uses and disclosures not described above will be made only with your written authorization. You may revoke any authorization you provide by sending a written notice to the Privacy Officer. Please Note: We cannot take back any health information we used or shared when we had your permission.

In addition, federal and state law require special privacy protections for certain highly confidential information such as information related to substance abuse treatment, HIV tests, psychotherapy notes, and genetic testing. We will not disclose this information without your written permission, unless otherwise permitted by law.

As required by state law, Steward Health Care System hospitals maintain medical records for at least 20 years after the patient's discharge or after the final treatment. A copy of the hospital's medical record retention policy is available upon request.

Your Rights

For the PHI maintained by Steward Health Care System, you have the right:

• To request a restriction on how we use or disclose your PHI. We will accommodate a request to restrict disclosures of PHI pertaining solely to health care for which you or a person other than a health plan has paid in full at time of service. We will consider other requests, but are not always required to agree to them. Please note that in certain cases, federal law does not permit a restriction.
• To receive confidential communications at a phone number or address other than your home. We will accommodate your request if you state that disclosure of your PHI through our usual means could endanger you; your request is reasonable; you specify an alternative means or location; and you provide information as to how any payment will be handled.
• To see and get a copy of your PHI, subject to federal and state laws (fees may apply). Under certain circumstances, we may deny your request. If we do so, we will send you a written notice describing the basis of our denial.
• To request a change to your PHI if you think it is wrong or incomplete. We may deny your request under certain circumstances. If we deny your request, we will send you a written notice of denial. This notice will describe the reason for our denial and your right to submit a written statement disagreeing with the denial.
• To receive an accounting of disclosures for purposes other than for treatment, payment or health care operations or based on your written authorization, within the previous six years.
• To receive a paper copy of this notice, upon request, even if you have agreed to receive it electronically.
• To revoke any previous authorization obtained for use or disclosure of your PHI.
• Requests should be made in writing to the Privacy Officer at the address noted below. Describe the information you would like to access, restrict or amend.

Effective Date of Notice

This Notice takes effect September 1, 2012. We are required to follow the privacy practices described in this Notice while it is in effect. This Notice will remain in effect until we change it in accordance with the procedure described below.

Changes to this Notice

We reserve the right to change this Notice and our privacy practices and to make the new provisions effective for all information we maintain. If we make any changes, we will publish the revised Notice on the Steward Health Care System website at www.steward.org.

Who to Contact for Questions or File Complaints

Please contact the Steward Health Care System Privacy Officer to request a copy of this Notice, to obtain help understanding this notice or to obtain more information. Additionally, you may also contact the Privacy Officer, if you are concerned that your privacy rights have been violated or if you disagree with a decision that was made about access to your PHI. The Privacy Officer can be reached by phone at 1-617-419-4732, or in writing at Privacy Officer, Steward Health Care System, 500 Boylston Street, Boston, MA 02116.

Written complaints may also be filed with the Secretary of Health and Human Services. We will not retaliate against you for filing a complaint or exercising your rights nor will your benefits be affected.