Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Your Personal Medical Information Is Private

Craig Hospital acknowledges the significance of your medical data and your concerns regarding its usage, disclosure, and accessibility. Hence, we provide this document, the Notice of Privacy Practices (Notice), to assure you of our commitment to safeguarding your personal medical information.

Our Pledge to You

We understand that your medical information is personal and confidential. We create a medical record of the care you receive because it is our legal obligation, but more importantly because we want to provide you with quality care. Please know we are committed to protecting your personal medical information from any use for which it was not intended.

In short, the law requires us to:

• Keep your medical information private and secure
• Notify you of our legal duties and privacy practices with respect to your medical information
• Only use or share your information as described in this Notice, unless we get your written permission

What This Notice Is All About

The information in this document applies to your medical records. Non-Craig Hospital providers may have different policies regarding the use and disclosure of medical information created in their offices. This notice explains how Craig Hospital may use and disclose your medical information, as well as your rights and our duties concerning its use and disclosure.

Adhering to Privacy Practices

The U.S. Department of Health and Human Services sponsored the Health Insurance Portability and Accountability Act (HIPAA). HIPAA dictates the medical information privacy practices that health care organizations and their partners are obligated to follow. Craig Hospital provides health care to our patients in partnership with many physicians, advanced practice providers, and other professionals and organizations. This notice describes Craig Hospital practices and that of:

• Any health care professional who treats you at Craig Hospital
• All departments and units of our organization
• All employees, staff or volunteers of our organization. This includes staff at our sponsor organizations with whom we may share information
• Any business associate or partner with whom we share health information

Be assured that these individuals and organizations understand that the privacy of your medical information is important and are all obligated to follow HIPAA requirements.

How Your Personal Medical Information Can Be Used and Disclosed

The following outlines the permissible uses and disclosures of your personal medical information under HIPAA provisions. We assure the utmost discretion in handling your data.

Disclosure for Health Care Related Purposes

We may use and disclose your medical information for health care related purposes including:

• Treatment, such as sending your medical information to a specialist as part of a referral or notifying your primary care provider that you have had a hospital admission, discharge, or transfer
• Obtaining payment for treatment, such as sending billing information to your insurance company or Medicare
• Supporting our health care operations, such as comparing patient data to improve treatment methods
• Communication with business partners so they may help us to do our jobs. These business partners are required by contract and by law to comply with the provisions of HIPAA

Craig Hospital, the members of its medical staff, and other affiliated health care providers participate in an Organized Health Care Arrangement (OHCA). Participation in an OHCA allows covered entities to, among other things, exchange protected health information with other OHCA participants to provide patient care in a more effective and efficient manner.

Additionally, Craig Hospital participates in health information exchange (HIE) networks. These networks provide a way to securely and electronically share patients’ clinical information with other health care providers participating in the HIE network to provide safer, more timely, efficient, and higher quality care. If you do not wish for your information to be included, please contact the hospital’s main number and ask for the health information management department.

Disclosure for Public Interest and Benefit Purposes

Subject to certain requirements, we may give out your medical information without prior authorization for:

• Public health purposes such as:
  • Preventing disease
  • Helping with product recalls
  • Reporting adverse reactions to medications
• Health research studies
• Organ, eye or tissue donation
• Serious and imminent threat to a person or the public
• Abuse, neglect or domestic violence reporting
• Funeral arrangements, coroner or medical examiner purposes
• Workers’ compensation purposes
• Health oversight audits or inspections
• Uses and disclosures required by federal, state, or local law such as:
  • Some requests from law enforcement agencies
  • Judicial and administrative orders
• Special government functions (e.g., national security and intelligence, health and safety of inmates, military command authorities)

Disclosure for Contact With You

We also may use your medical information to contact you for:

• Appointment reminders
• Possible treatment options and alternatives
• Health-related benefits or services that may be of interest to you

Disclosure for Fundraising Purposes

We may disclose medical information to the Craig Hospital Foundation so that the Foundation may contact you in raising money for the hospital. We may use your name, address, age, date of birth, gender, dates of service, other contact information, department of service, treating physician/provider, outcome information and health insurance status to raise funds for Craig Hospital.

Please know that the Foundation is required by law to comply with HIPAA regulations and state confidentiality laws. If you are contacted in our fundraising efforts, you will have the opportunity to opt out of receiving further fundraising communications from us.

Disclosure When You Are a Patient

If admitted as a patient, we may list the following information in our facility directory, unless you tell us otherwise:

• Your name
• Your location in the facility
• Your general condition (good, fair, etc.)
• Your religious affiliation

We will release all but your religious affiliation to anyone who asks about you by name. Your religious affiliation may be disclosed only to a clergy member, even if they do not ask for you by name. If you want to opt out of being in the facility directory, please request the Opt Out Form from the admission staff or Privacy Officer.

Disclosure to Friends, Family and Others

We may disclose medical information about you to:

• A friend or family member who is involved in your medical care
• Someone who helps pay for your care
• Disaster relief authorities to notify your family of your location and condition

Disclosure in Special Circumstances

Most uses and disclosures of psychotherapy notes, uses and disclosures of your medical information for marketing purposes, and disclosures that constitute a sale of your medical information require authorization. In any other situation not covered by this notice, we will ask for your written authorization before using or disclosing your medical information. If you choose to authorize use or disclosure you can later revoke that authorization by notifying us in writing of your decision.

Your Rights

Can You See a Copy of Your Medical Information?

In most cases, we will provide a copy or allow you to review your health information if you submit a written request, usually within 30 days of your request. If we deny your request to review or obtain a copy you may submit a written request for a review of that decision. You also have the ability to access your medical information through Craig Hospital’s patient portal free of charge.

If you request an electronic copy of your protected health information, you have the right to be provided that information in the form or format that you request, if it is readily producible by us in the requested form or format.

What If Your Medical Records Are Inaccurate?

If you believe that information in your record is incorrect or if important information is missing, you have the right to request correction of the records by submitting a request in writing along with your reason for requesting the amendment. We could deny your request to amend a record if the information was not created by us; if it is not part of the medical information we maintained; if it is not part of the information you would be permitted to review or copy; or if we determine that the record is accurate. You may appeal, in writing, a decision by us not to amend a record.

Can You Know With Whom We Have Shared Your Records?

You have the right to a list of those instances where we have disclosed your medical information, other than for treatment, payment, health care operations or where you specifically authorized a disclosure, by submitting a written request. The request must state the time period desired for the accounting, during the six years prior to the request. You may receive the list in paper or electronic form. The first disclosure list request in a 12-month period is free; other requests will be charged according to our production cost. We will inform you of the cost before you incur any expenses.

Can You Specify the Way in Which We Communicate Your Medical Records to You?

You have the right to request that your medical information be communicated to you in a confidential manner, such as sending mail to an address other than your home. Your request must specify how or where you wish to be contacted. If you request that we provide your electronic information in an unencrypted format (e.g. unsecure email), we will require your agreement to the risks of such transmission. If you so request, we will transmit your electronic information to a third party designated by you. We will attempt to honor all reasonable requests.

Can You Request That Your Medical Information Only Be Released With Your Permission?

You may request in writing that we do not use or disclose your medical information for treatment, payment and health care operations, or to persons involved in your care except when specifically authorized by you, or when required by law or in an emergency. Unless your request is to restrict disclosing your medical information to your health plan for health care services for which you pay out of pocket in full, we will consider your request but are not legally required to agree to it. We will inform you of our decision on your request.

Will You Be Notified If There Has Been a Breach of Your Medical Information?

You have the right to, and will, be notified following a breach that compromises the security or privacy of your personal medical information.

If You Have Received This Notice Electronically, Can You Receive a Paper Copy?

You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. You may obtain a copy of this notice from the Admissions Department at our website at craighospital.org or by contacting the hospital’s Privacy Officer.

Where Can You Express a Concern?

If you are concerned that your privacy rights may have been violated or disagree with a decision we made about access to your records, you may contact the Craig Hospital Privacy Officer to register a complaint. You also may send a written complaint to the U.S. Department of Health and Human Services Office for Civil Rights. Under no circumstance will you be penalized or retaliated against for filing a complaint.

Will the Policies in This Notice Change?

We may change our policies at any time. Changes will apply to medical information we already hold, as well as new information after the change occurs. When we make a significant change to our policies, we will change this notice and post the current notice in our hospital and on our website. The notice will contain the effective date. In addition, you will be offered a copy of the current notice each time you register at our hospital for treatment.

For a downloadable and printable PDF of this Notice, please click here.

Revised/Effective 6/13/2024