HIPAA and Privacy

Download this in PDF format. Select the Print button in the above navigation to print the following document.

Covenant HealthCare

Notice of Privacy Practices

Effective Date: September 23, 2013

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY. If you have any questions about this Notice, please contact the Privacy Officer at Covenant HealthCare, 1447 North Harrison, Saginaw, MI 48602.  Phone: 989.583.4142.

This Notice of Privacy Practices applies to the use and disclosure of your protected health information by the following organizations and individuals:

• Covenant Medical Center, Inc. (Covenant HealthCare) and the members of our workforce – including employees, volunteers, and trainees – at our hospitals, ambulatory or outpatient clinics and centers, physician offices, and home health agencies;
• The members of the Covenant Medical Staff and physicians holding temporary privileges at Covenant;
• Persons who have been granted clinical practice privileges by Covenant HealthCare; and
• Covenant HealthCare subsidiaries.

We are all covered entities subject to the HIPAA Privacy Rule. When we are working together in a Covenant HealthCare facility or location, we are part of an Organized Health Care Arrangement, or “OHCA,” that follows the same privacy policies and procedures. Our purpose in giving you this Notice is to tell you how we may use and disclose your protected health information both within and outside of the OHCA.

Understanding Your Protected Health Information

Each time you visit a hospital, physician or other healthcare provider, the provider makes a record of your visit. Typically, this record contains your name, address, age, health insurer, health history, examination, test results, diagnoses and treatment plan. This information is known under HIPAA as “Protected Health Information” or “PHI”. PHI also includes information received by Covenant HealthCare from other hospitals, healthcare providers, and health plans or health insurers. PHI is used for treatment, planning, communication, billing, and many other functions.

Obligations of Covenant HealthCare

We understand that your medical information is personal, and we are committed to protecting the privacy of your protected health information.

We are required by law to:

• Maintain the privacy of your protected health information 
• Give you this Notice of our legal duties and privacy practices regarding your protected health information
• Follow the terms of our Notice of Privacy Practices that is currently in effect
• Notify you following a breach of your unsecured PHI

How We May Use or Disclose Your Personal Health Information

Our use and disclosure of PHI must comply with the HIPAA Privacy Rule and with applicable federal and state law. Certain types of health information may have additional protection under federal or state law. For example, information about HIV/AIDS and genetic testing results is treated differently than other types of health information under state law. Also, federally-assisted alcohol and drug abuse programs are subject to federallyimposed restrictions on the use and disclosure of treatment information. To the extent applicable, Covenant HealthCare would need to get your written permission before disclosing that information to others. You may revoke such permission at any time by writing to our Privacy Officer at the address listed to the right.

We use and disclose PHI for a number of different reasons that may or may not require your prior written authorization; some require that we allow you an opportunity to object. We may only use or disclose your PHI which is necessary to accomplish the purpose of the use or disclosure.

Uses and Disclosures that Do Not Require Your Permission

In some situations, the law allows us to use or disclose your PHI without asking for your permission in advance or giving you an opportunity to object. These situations include:

For Treatment. We may use and disclose your PHI to physicians, nurses, medical students, nursing students, and other healthcare personnel who provide, coordinate, and manage your care. For example, if you are treated for a broken hip, we may disclose your PHI to the physical therapy provider and/or home health agencies to coordinate your care after discharge.

For Payment. We may use and disclose your PHI to others for billing and collecting payment for the services provided to you. For example, a bill may be sent to your health plan which contains information that identifies you, your diagnosis, and treatment or supplies used during the course of treatment.

For Health Care Operations. We may use and disclose your PHI to operate our hospital, clinics, physician offices, and other healthcare service facilities. For example, members of the Covenant HealthCare medical staff, Covenant Risk Management or Quality personnel, may use your PHI to evaluate performance of the healthcare staff caring for you, assess the quality of care on outcomes, and learn how to improve our facilities and the services we provide. Other examples include educational programs, resolution of grievances, business planning, defending legal matters, and participation in managed care plans.

If a covered entity outside of the Covenant Organized Health Care Arrangement (OHCA) also has a relationship with you, we may disclose relevant information to that entity to use in performing its own day-to-day operations.

Certain Other Uses and Disclosures That Do Not Require Your Permission

As Required by Law. We will disclose PHI about you to the extent that such disclosure is required by federal, state or local law. This may include reporting information related to victims of abuse, neglect or domestic violence, as well as providing information to judicial or administrative proceedings as ordered.

Public Health Activities. We may disclose PHI to a public health authority for public health related activities. These activities include disclosures to prevent or control disease, injury, or disability; to report births and deaths; to investigate potential instances of child abuse or neglect; to report reactions to medications or problems with products to the Food and Drug Administration (FDA); and to notify people of recalls of products they may be using. We may also release PHI to coroners, medical examiners, and funeral directors to enable them to carry out their duties. Under Michigan law we must report information about certain conditions, such as HIV/AIDS and cancer, to central registries. We are also required to report information about immunizations to schools, provided that we have received any required consents for such disclosure.

Appointment Reminders, Treatment Alternatives and Health Related Benefits and Services. We may use your PHI to provide appointment reminders. We may also use your PHI to provide you information about treatment alternatives or other health-related services that we offer which may be of interest to you.

Medical Research. Medical research is vital to the advancement of medical science. Federal regulations permit use of protected health information in medical research, either with your authorization or when the research study is reviewed and approved by an Institutional Review Board before any medical research study begins. In some situations, limited information may be used before approval of the research study to allow a researcher to determine whether enough patients exist to make a study scientifically valid.

To Avert a Serious Threat to Health or Safety. We may use and disclose PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Disclosures will be made only to someone who may be able to help prevent or lessen the potential threat.

Business Associates. We may disclose PHI to our business associates that perform functions on our behalf or provide us with services if the information is necessary for such functions or services. For example, we may use another company to perform billing services on our behalf. All of our business associates are obligated to protect the privacy of your PHI. Business associates are not allowed to use or disclose any information other than as specified in the “business associate agreement”.

Organ and Tissue Donation. If you are an organ donor, we may use or disclose your PHI to organ procurement organizations or other entities engaged in the procurement, banking or transplantation of cadaveric organs, eyes or tissues.

Specific Governmental Functions. We may use and disclose PHI of military personnel and veterans as required by military command authorities. We also may disclose PHI for national security purposes, such as protecting the President of the United States or conducting intelligence operations.

Workers’ Compensation We may release PHI about you to comply with laws and regulations related to workers’ compensation.

Health Oversight Activities. We may disclose PHI to health oversight agencies for activities authorized by law. These oversight activities may include audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the healthcare system, government programs, and compliance with state and federal laws.

Data Breach Notification Purposes. We may use or disclose your PHI to provide legally required notices of unauthorized access to or disclosure of your PHI.

Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose PHI in response to a court or administrative order. We also may disclose PHI in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.

Law Enforcement. We may release PHI if asked by law enforcement officials if the disclosure is:

• In response to a court order, subpoena, warrant, summons, or similar process;
• Limited to information required to identify or locate a suspect, fugitive, material witness, or missing person;
• About the victim of a crime even if, under certain very limited circumstances, we are unable to obtain the person’s agreement;
• About a death believed to be the result of criminal conduct;
• About criminal conduct on our premises; and
• In an emergency to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime.

Inmates or Individuals in Custody. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release PHI to the correctional institution or law enforcement official.

USES AND DISCLOSURES THAT REQUIRE US TO GIVE YOU AN OPPORTUNITY TO OBJECT AND OPT OUT

Individuals Involved in Your Care or Payment for Your Care. Unless you object, we may share PHI with a person who is involved in your medical care or payment for your care, such as a family member, a close friend, or any other person you identify. We may only disclose PHI that is directly relevant to such person’s involvement in your care. If you are unable to agree or object to such disclosure, we may disclose such information as necessary if we determine that it is in your best interest based upon our professional judgment. We also may notify your family or others responsible for your care about your location, general condition, or death, or disclose such information to an entity assisting in a disaster relief effort.

Medical Center Directories. We may include your name, general condition, location in the medical center, and religious affiliation (if any) in our patient directory for use by clergy and others who ask for you by name, unless you object in whole or part.

Fundraising. The Covenant OHCA includes charities. Accordingly, we may contact you to raise funds for our charitable activities. If you do not want to continue to receive these requests, simply tell us. Each fundraising communication we make or send will tell you how to opt out of receiving future fundraising material.

Marketing. We may use and disclose your PHI without your prior written authorization for limited marketing communications, if the marketing is in the form of:

• Face-to-face communications;
• A promotional gift of nominal value.

Covenant HealthCare will not use your PHI for any marketing activities other than those stated above without your written permission. In addition, we will not sell your PHI to third parties.

Disaster Relief. We may disclose your PHI to disaster relief organizations that seek your PHI to coordinate your care, or notify family and friends of your location or condition in a disaster. We will provide you with an opportunity to agree or object to such a disclosure whenever we can practically do so.

YOUR WRITTEN AUTHORIZATION IS REQUIRED FOR OTHER USES AND DISCLOSURES

Other uses and disclosures of PHI not covered by this Notice or the laws that apply to us will be made only with your written authorization. This includes, for example, most disclosures of psychotherapy notes, financially-supported marketing of third party products or services, and the sale of your PHI, unless otherwise specified by law. If you provide us authorization to use or disclose PHI about you, you may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose health information about you covered in the revocation. Understand that we are unable to take back any disclosures we have already made with your authorization.

YOUR RIGHTS:

You have the following rights regarding your PHI:

Right to Inspect and Copy. Subject to limited exceptions, you have the right to inspect and copy PHI that may be used to make decisions about your care or payment for your care. This includes medical and billing records, other than psychotherapy notes. To inspect and copy your PHI you must make your request, in writing, to the Health Information Management Department, Release of Information, 900 Cooper, Saginaw, MI 48602. We have up to 30 days to make your PHI available to you and we may charge you a reasonable fee for the costs of copying, mailing or other supplies associated with your request. We may not charge you a fee if you need the information for a claim for benefits under the Social Security Act or any other state or federal needs-based benefit program. In certain circumstances, we may deny your request in writing, explaining our reasons for denial and your right to have the denial reviewed.

Right to an Electronic Copy of Electronic Medical Records. If your PHI is maintained in an electronic format, you have the right to request that an electronic copy of your record be given to you or transmitted to another individual or entity. We will make every effort to provide access to your PHI in the form or format you request, if it is readily producible in such form or format. If the PHI is not readily producible in the form or format you request, your record will be provided in either our standard electronic format or if you do not want this form or format, a readable hard copy form. We may charge you a reasonable, cost-based fee for the labor associated with transmitting the electronic medical record.

Right to Get Notice of a Breach. You have the right to receive notice of any unauthorized disclosure of your unsecured PHI.

Right to Amend. If you feel that the PHI we have is incorrect or incomplete, you may ask us to amend the information. Your request must be in writing and must include the reason for your request. We will respond within 60 days of receiving your request (although we may obtain a 30 day extension under some circumstances). We may deny your request in writing if the PHI:

• Is accurate and complete;
• Was not created by Covenant HealthCare
• Is not allowed to be disclosed, or
• Is not part of our medical records.

Our denial will include the reason(s) for the denial and will explain your right to file a written statement of disagreement. If you file a statement of disagreement, your request, our denial, your statement of disagreement, and any rebuttal we prepare will be included with the affected PHI. If you don’t file a statement of disagreement, you have the right to request that your amendment request and our denial be attached to your PHI. If your amendment request is approved, we will make the change to your PHI, let you know it has been completed, and inform others as required under applicable regulations. To request an amendment, you must make your request, in writing, to the Health Information Management Department, Release of Information, 900 Cooper, Saginaw, MI 48602.

Right to an Accounting of Disclosures. You have the right to request a list of certain disclosures we made of PHI for purposes other than treatment, payment, and healthcare operations or for which you provided written authorization. To request an accounting of disclosures, you must make your request, in writing, to the Privacy Officer at the address listed on the back page. We will respond within 60 days (subject to a possible 30 day extension) of receiving your request by providing a list of disclosures made within the last six years from the receipt of your request, unless a shorter time period is requested. If you make more than one request in the same year, we may charge a fee to cover our costs of responding.

Right to Request Restrictions. You have the right to request a restriction on the use or disclosure of PHI we use or disclose for treatment, payment, or healthcare operations. You also have the right to request a restriction on the PHI we disclose to someone involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not share information about a particular diagnosis or treatment with your spouse. You must make your request, in writing, to the Health Information Management Department, Release of Information, 900 Cooper, Saginaw, MI 48602. We are not required to honor your request, unless you are asking us not to disclose your PHI to a health plan for payment or for healthcare operation purposes where the restricted information pertains solely to a healthcare item or service for which you have paid us “out-of-pocket” in full. If we agree, we will comply with your request unless the information is needed to provide you with emergency treatment.

Right to Request Confidential Communications. You have the right to request that we communicate with you about PHI in a certain way or at a certain location. For example, you can ask that we only contact you by mail or at work. To request confidential communications, you must make your request, in writing, to the Health Information Management Department, Release of Information, 900 Cooper, Saginaw, MI 48602. Your request must specify how or where you wish to be contacted. We will accommodate reasonable requests.

Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice. To obtain a paper copy of this Notice, contact the Privacy Officer and one will be sent to you. In addition, each time you register at or are admitted to Covenant HealthCare for treatment or healthcare services as an inpatient or outpatient, we will offer you a copy of the current Notice in effect. You may also obtain a copy of this Notice at our website, www.covenanthealthcare.com.

CHANGES TO THIS NOTICE:

We reserve the right to change this Notice and make the new Notice apply to PHI we already have, as well as any information we receive in the future. We will post a copy of our current Notice on our website. The Notice will contain the effective date on the first page, in the top right-hand corner.

COMPLAINTS:

If you believe your privacy rights have been violated, you may file a complaint with Covenant HealthCare by contacting the Privacy Officer using the information listed below. You may also contact the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, SW, Washington, DC, 20201, calling 1.877.696.6775, or visiting https://www.hhs.gov/hipaa/filing-a-complaint/index.html.

Covenant HealthCare honors your right to express your privacy concerns. We will not retaliate against you for filing a complaint.

Covenant HealthCare honors your right to express your privacy concerns.  We will not retaliate against you for filing a complaint.

About Us   |   Employer Services   |   HIPAA and Privacy   |   Our Locations   |   Links   |   Contact Us