Effective September 23, 2013
Revised February 26, 2015
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
We are required by law to protect the privacy of health information. “Protected Health Information” (PHI) is information about you that may reveal your identity, any personal information (including your address and telephone number), your health condition, any healthcare services, your insurance coverage and any other identifying information. We are also required to provide you with a copy of this notice, which describes the health information privacy practices of Cayuga Medical Associates, and affiliated healthcare providers. A copy of our current notice will always be posted in our reception areas. You may request a copy of this notice at the time of your visit or by contacting CMA’s privacy officer at (607) 277-2365.
HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION
1. Treatment, Payment and Business Operations
Cayuga Medical Associates may use and disclose your PHI in order to treat your condition, obtain payment for that treatment, and for normal business operations. Below are examples of how your information may be used.
Treatment – We may share your PHI with healthcare providers and/or other pertinent staff who are involved in your care, and they may use that information to diagnose or treat you. Cayuga Medical Associates may share your PHI with healthcare providers outside of our organization, including but not limited to medical students, nurse practitioners and or physician assistant students, or with another hospital to determine how to diagnose or treat you.
Payment – We may use and disclose your PHI in order to bill and collect payment for the treatment and services provided to you. For example, we may disclose portions of your health information to our billing department and your health insurance plan to get paid for the services we provide to you. We may also provide your health information to our business associates that assist us in processing our claims such as billing companies and claims processing companies.
Business Operations – We may disclose your PHI in order to operate Cayuga Medical Associates. For example, we may use your PHI in order to evaluate the quality of healthcare services that you received or to evaluate the performance of the healthcare professionals who provided healthcare services to you. We may also provide your PHI to our accountants, attorneys, consultants, and pharmacies. We may also request your PHI from other sources, including but not limited to pharmacies, hospitals and other treating providers.
Appointment Reminders, Treatment Alternatives, Benefits, and Services – We may use your PHI to remind you of an appointment, to recommend possible treatment alternatives or other health- related benefits and services.
2. Other Permitted Uses and Disclosures We may also use and disclose your PHI for the following purposes:
As Required by Law. We may make disclosures required by federal, state or local law.
As Required by Judicial or Administrative Proceeding. For example, as required by a court order.
As Required for Law Enforcement Purposes. For example, as required by grand jury subpoena or court-ordered warrant.
For Public Health Activities. We may disclose your PHI to authorized public health officials and government agencies responsible for controlling disease, injury, or disability. We may also disclose your health information to a person who may have been exposed to a communicable disease or be at risk for contracting or spreading the disease if permitted by law.
Emergencies. We may use or disclose your PHI if you need emergency treatment.
Communication Barriers. We may use and disclose your PHI if we are unable to obtain your consent because of substantial communications barriers, and we believe you would want us to treat you if we could communicate with you.
Victims of Abuse, Neglect or Domestic Violence. We may release your PHI to a public health authority that is authorized to receive reports of abuse, neglect or domestic violence.
Health Oversight Activities. We may release your PHI to government agencies authorized to conduct audits, investigations and inspections of Cayuga Medical Associates for compliance with benefit programs such as Medicare and Medicaid, regulatory programs, and civil rights laws.
Coroners, Funeral Directors and Organ Donation. We may disclose PHI to a coroner or medical examiner for identification purposes, determining cause of death or to perform other duties authorized by law. We may disclose PHI to a funeral director as authorized by law to carry out their duties. PHI may be used and disclosed for cadaveric organ, eye, or tissue donation purposes.
Criminal Activity. We may disclose your PHI consistent with applicable federal and state laws if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose PHI if it is necessary for law enforcement authorities to identify or apprehend an individual.
Military Activity and National Security. We may disclose PHI of individuals who are in the U.S. Armed Forces or foreign military for activities deemed necessary by appropriate military command authorities and, to the Department of Veterans Affairs for the purpose of a determination of your eligibility for benefits. We may disclose your PHI to authorized federal officials for conducting national security and intelligence activities.
Workers’ Compensation. We may disclose your PHI as authorized to comply with workers compensation laws and other similar legally-established programs.
Inmates and Correctional Institutions. We may use or disclose your PHI if you are an inmate or detained by a law enforcement officer if necessary to provide you with healthcare, or to maintain safety and security at the place where you are confined, or to protect the health and safety of other inmates or persons involved in supervising or transporting inmates.
Others involved in your Healthcare. We may disclose to a member of your family, a relative, a close friend or any other person you identify, your PHI that directly relates to that person’s involvement in your healthcare. If you are unable to agree or object to such a disclosure, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgment. We may use or disclose PHI to notify or assist in notifying a family member, personal representative or any other person that is responsible for your care of your location, general condition, or death. We may disclose your PHI to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in your healthcare.
Fundraising Activities. We may use or disclose your PHI, as necessary, in order to contact you for fundraising activities. You have the right to opt out of receiving fundraising communications.
3. Required Disclosures
We are required to disclose PHI upon the request of the U.S. Department of Health and Human Services, as required to determine our compliance with privacy rules.
4. Requirement for Written Authorization
Except as set forth above, we generally obtain your written authorization before using or disclosing your PHI. If you provide us an authorization, you may revoke it at any time by submitting a written revocation to our Privacy Officer and we will no longer disclose PHI under that authorization. We are unable to take back any disclosures we have already made with your permission.
Your Rights to Access and Control your Health Information
You have the following rights with respect to your PHI:
1. Right to Inspect and Copy Records
You have the right to inspect and obtain a paper or electronic copy of any of your PHI (if your PHI is maintained electronically) that may be used to make decisions about you and your treatment for as long as we maintain this information in our records. To inspect or obtain a copy of your PHI, please submit your request in writing to: Privacy Officer, c/o Cayuga Medical Associates, 1301 Trumansburg Road, Suite P, Ithaca, NY 14850. If you request a copy of your records we may charge a fee for the costs of copying, mailing or other supplies we use to fulfill your request. The standard fee is $ 0.75 per page and must generally be paid before or at the time we give the copies to you. We will respond to your request within 10 working days. if additional time is needed we will notify you in writing within 30 days to explain the reason for the delay and when you can expect to have a final answer to your request.
Under very limited circumstances, we may deny your request to inspect or obtain a copy of your information. if we do, we will provide you with a summary of the information instead. We will also provide a written notice that explains our reasons for providing only a summary and explain your rights to have the denial reviewed.
2. Right to Amend. Records
If you believe that the PHI we have about you is incorrect or incomplete, you may ask us to amend the information. To request an amendment, please write to: Privacy Officer, c/o Cayuga Medical Associates, 1301 Trumansburg Road, Suite P, Ithaca, NY 14850. Your request should include the reasons why you think we should make the amendment. Usually we will notify you within 10 working days. if additional time is needed we will notify you in writing within 30 days to explain the reason for the delay and when you can expect to have a final answer to your request.
If we deny part or all of your request, we will provide a written notice that explains our reasons for doing so. If you disagree with our decision, you will have an opportunity to submit a statement explaining your disagreement, which we will include in your records.
3. Right to an Accounting of Disclosures
You have the right to request an “accounting of disclosures” which is a list with information about how we have shared your information with others for a period of six years prior to the date you ask. The accounting list will not include disclosures relating to treatment, payment or business operations as described above, or uses or disclosures that you previously authorized, or disclosures made to you or your family or other persons who are involved in your care or the payment of your care. The list will also not include uses and disclosures made for national security purposes to corrections or law enforcement personnel, or uses and disclosures made before April 14, 2003. Your request must state a time period for the disclosures you want us to include. The list will include the date of the disclosure, to whom the PHI was disclosed, a description of the information disclosed, and the reason for the disclosure. You have a right to one list within every 12 month period for free. We may charge you for the cost of providing any additional lists. Usually we will notify you within 10 working days. If additional time is needed we will notify you in writing within 30 days to explain the reason for the delay.
4. Right to Request Additional Privacy Protections
You have the right to request that we limit how we use and disclose your PHI. We will consider your request but are not legally required to agree to it. If we agree to it we will put any limits in writing and abide by them except in emergency situations. You may not limit the uses and disclosures that we are legally required or permitted to make. If you pay for a service or health care item out-of- pocket in full, you have the right to ask us not to share that information for the purpose of payment or our operations with your health insurer.
5. Right to Request Confidential Communications
You have the right to request that you receive communications regarding PHI in a certain manner or at a certain location. We will try to accommodate all reasonable requests.
6. Right to Receive Notification of a Breach
CMA will notify you promptly if a breach occurs that may have compromised the privacy or security of your information.
Additional Notices and Complaint Procedures
1. How to Obtain a Copy of This Notice or Revised Notices
You have the right to a paper copy of this notice. You may request a paper copy at any time, even if you have agreed to receive the notice electronically. To do so please call (607) 277-2365. You may also obtain a copy at your next visit. We may change our privacy practices from time to time. If we do, we will post any revised notice in our reception areas. You will also be able to obtain your own copy of the revised notice by calling (607) 277-2365.
2. Changes to this Notice
We reserve the right to change this Notice. We reserve the right to make the revised or changed Notice effective for medical information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice at every CMA location.
3. How to File a Complaint
If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the Department of Health and Human Services. To file a complaint with us please contact our Privacy Officer at (607) 277-2365. No one will retaliate or take action against you for filing a complaint.