Effective Date: September 23, 2013
NORTHWELL HEALTH SYSTEM
Notice of Privacy Practices
This Notice describes how protected health information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
What is the Notice of Privacy Practices?
The Notice explains how we fulfill our commitment to respect the privacy and confidentiality of your protected health information. This Notice tells you about the ways we may use and share your protected health information, as well as the legal obligations we have regarding your protected health information. The Notice also tells you about your rights under federal and state laws. The Notice applies to all records held by the Northwell Health facilities and programs listed at the end of this Notice, regardless of whether the record is written, computerized or in any other form. We are required by law to make sure that information that identifies you is kept private and to make this Notice available to you. In this Notice, when we use the term “protected health information” we are referring to individually identifiable information about you, which may include:
- Information about your health condition (such as medical conditions and test results you may have);
- Information about health care services you have received or may receive in the future (such as a surgical procedure);
- Information about your health care benefits under an insurance plan (such as whether a prescription is covered);
- Geographic information (such as where you live or work);
- Demographic information (such as your race, gender, ethnicity, or marital status);
- Unique numbers that may identify you (such as your social security number, your phone number, or your driver’s license);
- Biometric identifiers (such as finger prints); and Full-face photographs.
Who Follows the Northwell Health Notice of Privacy Practices
This Notice describes the practices of Northwell Health (collectively referred to as “we” or “us” in this Notice). The privacy practices described in this Notice will be followed by all health care professionals, employees, medical staff, trainees, students, volunteers and business associates of the Northwell Health organizations specified at the end of this Notice.
For your convenience, what follows is a summary of the key provisions in our Notice. This summary is not a complete listing of how we use and disclose your protected health information. If you have any questions about any of the information contained in this summary, please read this full Notice of Privacy Practices or contact a Northwell Health staff member for more information.
Northwell Health may use and disclose your protected health information without your consent to:
- Provide you with medical treatment and other services;
- Carry out certain operations necessary to the operation of our facilities and programs, such as quality improvement studies, medical education and verifying the qualifications of doctors;
- Coordinate your care, which may include such things as giving you appointment reminders and telling you about other treatment options available through Northwell Health;
- Talk to family or friends involved in your care, unless otherwise indicated by you;
- Ensure that we follow the rules of regulatory agencies regarding the quality of care we provide;
- Comply with all legal requirements, subpoenas, and court orders;
- Engage in certain pre-approved research activities;
- Request payment from you, your insurance company, or some other third-party payer;
- Include information in our hospital directory, such as name and room number, for the benefit of visitors or members of the clergy;
- Contact you for fundraising activities unless otherwise indicated by you; and
- Meet special situations as described in this Notice such as public health and safety.
You have a right to:
- See and obtain a copy of your medical record in the format of your choosing, with certain restrictions;
- Ask us to amend the protected health information we have about you, if you feel the information we have is wrong or incomplete;
- Ask us to restrict or limit the protected health information we use and share about you;
- Ask us to communicate with you about medical matters in a certain way or at a specific location;
- Obtain a list of individuals or entities that have received your protected health information from Northwell Health,
- subject to limits permitted by law;
- Be notified if your protected health information is improperly disclosed or accessed;
- Obtain a paper copy of the Notice; and
- Submit a complaint.
How We May Use and Share your Protected Health Information with Others
The following categories describe different ways that we may use and disclose your protected health information. For each category of uses or disclosures, we will explain what we mean and try to give some examples. Not every use or disclosure will be listed. However, all of the ways we are permitted to use and disclose your information will fall within at least one of the following categories.
For Treatment. We may use or disclose protected health information about you to provide, coordinate or manage your medical treatment or services. We may disclose protected health information about you to doctors, nurses, technicians, students or other Northwell Health personnel involved in taking care of you. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. In addition, the doctor may need to tell the hospital’s food service if you have diabetes so that we can arrange for appropriate meals. We may share protected health information about you with non-Northwell Health health providers, agencies or facilities in order to provide or coordinate the different things you need, such as prescriptions, lab work and X-rays. We also may disclose your protected health information to people outside Northwell Health who may be involved in your continuing medical treatment after you leave our care, such as other healthcare providers, home healthagencies, and transport companies.
For Payment. In order to receive payment for the services we provide to you, we may use and share your protected health information with your insurance company or a third party, such as Medicare and Medicaid. We may also share your protected health information with another doctor, facility or service provider, such as an ambulance company or subcontractor within our facilities, that has treated you or has provided services to you so that they can bill you, your insurance company or a third party. For example, in order for your insurance company to pay for your health-related services at Northwell Health, we must submit a bill that identifies you, your diagnosis and the treatment we provided. We may also tell your health plan about a proposed treatment to determine whether your plan will cover the treatment. In addition, insurance companies and other third parties may require that we provide your social security number for verification and payment purposes.
For Healthcare Operations. We may use your protected health information to support our business activities and improve the quality of care. For example, we may use your protected health information to review the treatment and services that we gave you and to see how well our staff cared for you. We may share your information with our students, trainees and staff for review and learning purposes. Your protected health information may also be used or disclosed for accreditation purposes, to handle patients’ grievances or lawsuits, and for health care contracting relating to our operations.
Appointment Reminders. We may use and share your protected health information to remind you of your appointment for treatment or medical care. For example, if your doctor has sent you for a test, the place where the testing will be done may call you to remind you of the date you are scheduled.
Hospital Directory. If you are admitted to the hospital, your name, room location, general condition (such as fair or stable) and religious affiliation may be listed in the hospital’s patient directory. This is so your family, friends, and clergy can visit you in the hospital and generally know how you are doing. Unless you object, we will include this limited information about you in the directory while you are a patient. Your room location and general condition will be released to people who ask for you by name. Your religious affiliation will be given only to a member of the clergy, such as a priest, minister or rabbi, even if they do not ask for you by name. If you object to being included in the hospital directory, we will not disclose your information to anyone who asks for you unless required by law. If you do not want your information listed in the hospital directory, you must notify personnel during registration or tell your caregivers after you have been admitted to the hospital.
Business Associates. We may share your protected health information with a “business associate” that we hire to help us, such as a billing or computer company, or transcription service. Business associates will have assured us in writing that they will safeguard your protected health information as required by law.
Treatment Options and Other Health-Related Benefits and Services. We may use your information to contact you about treatment options and other health-related benefits and services provided by Northwell Health that may be of interest to you. This may include information about our staff or about health-related products and services offered by Northwell Health that we think might be beneficial for you. However, we will not use your information to engage in marketing activities (other than face-to-face communications) without your written authorization. We also will never sell your protected health information to third parties without your written authorization to do so. However, we may receive payment to disclose your protected health information for certain limited purposes permitted by law, such as public health reporting, treatment or research.
Fundraising Activities. We may contact you to provide information about Northwell Health sponsored activities, including fundraising programs and events. We may use your protected health information, such as the department where you were seen or the name of the physician you saw, in order to contact you to ask you to make a charitable contribution to support research, teaching, or patient care at Northwell Health related to your specific treatment. If you do not want to be contacted about our fundraising opportunities and events, you can let us know at any time, and we will no longer reach out to you. You can let us know by calling (855) 621-2844. Please give your name and address so that we may suppress your name from all future fundraising.
Individuals Involved in Your Care or Payment for Your Care. Unless you say no, we may release protected health informationto people such as family members, relatives, or close personal friends who are helping to care for you or helping to pay yourmedical bills. Additionally, we may disclose information to a patient representative. If a person has the authority under the law tomake health care decisions for you, we will treat that patient representative the same way we would treat you with respect to yourprotected health information. Parents and legal guardians are generally patient representatives for minors unless the minors arepermitted by law to act on their own behalf and make their own medical decisions in certain circumstances. If you do not wantprotected health information about you released to those involved in your care, please notify us.
Disaster-Relief Efforts. We may disclose your protected health information to an organization, such as the American Red Cross,assisting in a disaster relief effort, so that your family can be notified about your condition, status and location. If we can reasonably do so while trying to respond to the emergency, we will try to find out if you want us to share this information.
Research. Northwell Health conducts research to advance science both to prevent disease and to cure patients. All researchprojects conducted by Northwell Health must be approved through a special review process to protect patient safety, welfare andconfidentiality. Your protected health information may be important to research efforts and may be used for research purposes inaccordance with state and federal law.
Researchers may contact you regarding your interest in participating in certain research studies after receiving your authorization(permission) or approval of the contact from a special review board called an Institutional Review Board (IRB). An IRB is a specialcommittee that protects the rights and welfare of people who participate in research studies. Enrollment in most studies mayoccur only after you have been informed about the study, had an opportunity to ask questions and indicated your willingness toparticipate by signing an authorization or consent form that has been reviewed and approved by an IRB. In some instances, federallaw allows us to use your protected health information for research without your authorization, provided we get approval from an IRB or other special review board. These studies will not affect your treatment or welfare, and your protected health informationwill continue to be protected. For example, a research study may involve a chart review to compare the outcomes of patientswho received different types of treatment. Federal law also allows researchers to look at your protected health information whenpreparing future research studies, so long as any information identifying you does not leave a Northwell Health facility. If you have any questions about how your medical record information could be used in a research protocol, please call the Northwell Health System Office for Human Research Protections at (516) 719-3101.
As Required By Law. We will share your protected health information when federal, state, or local law requires us to do so.
Legal Proceedings, Lawsuits, and Other Legal Actions. We may share your protected health information with courts, attorneys and court employees when we get a court order, subpoena, discovery request, warrant, summons or other lawful instructions from those courts or public bodies, and in the course of certain other lawful, judicial or administrative proceedings, or to defendourselves against a lawsuit brought against us.
Law Enforcement. If asked to do so by law enforcement, and as authorized or required by law, we may release protected health information:
- To identify or locate a suspect, fugitive, material witness or missing person;
- About a suspected victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement;
- About a death suspected to be the result of criminal conduct; and
- About criminal conduct at Northwell Health.
To Avert a Serious Threat to Health or Safety. We may use and disclose your protected health information when necessary toprevent or lessen a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure would be to help stop or reduce the threat.
Public Health Risks. As required by law, we may disclose your protected health information to public health authorities forpurposes related to: preventing or controlling disease, injuries or disability; reporting vital events, such as births and deaths;reporting child abuse or neglect; reporting domestic violence; reporting reactions to medications or problems with products; notifying people of recalls, repairs or replacements of products they may be using; notifying a person who may have been exposedto a disease or may be at risk for contracting or spreading a disease; and reporting to your employer findings concerning workrelatedillness or injury so that your workplace may be monitored for safety.
Worker’s Compensation. We may share your protected health information for Worker’s Compensation or similar programs thatprovide benefits for work-related injuries or illness.
Specialized Government Functions. If you are a member of the armed forces (of either the United States or of a foreign government), we may share your protected health information with military authorities so they may carry out their duties underthe law. We may also disclose your protected health information if it relates to national security and intelligence activities, or toproviding protective services for the President or for other important officials, such as foreign heads of state.
Health Oversight Activities. We may disclose your protected health information to local, state or federal governmental authorities responsible for the oversight of medical matters as authorized by law. This includes licensing, auditing, and accrediting agencies andagencies that administer public health programs such as Medicare and Medicaid.
Coroners, Medical Examiners and Funeral Directors. We may release your protected health information to a coroner ormedical examiner as necessary to identify a deceased person or to determine the cause of death. We also may release protectedhealth information to funeral directors so they can carry out their duties.
Organ, Eye and Tissue Donation. If you are an organ donor, we may release your protected health information to organizations that obtain organs or handle organ, eye or tissue transplantation. We also may release your information to an organ donation bankas necessary to facilitate organ, eye or tissue donation and transplantation.
Inmates. If you are an inmate of a correctional institution or in the custody of a law enforcement official, we may disclose your protected health information to the correctional institution or law officer as authorized or required by law. This includes sharing information that is necessary to protect the health and safety of other inmates or persons involved in supervising or transportinginmates.
Incidental Disclosures. While we will take reasonable steps to safeguard the privacy of your protected health information, certain disclosures of your information may occur during or as an unavoidable result of our otherwise permissible uses or disclosures ofyour information. For example, during the course of a treatment session, other patients in the treatment area may see or overheardiscussion of your information. These “incidental disclosures” are permissible.
Uses and Disclosures Requiring Your Written Authorization
Uses and Disclosures Not Covered in This Notice. Other uses and disclosures of your protected health information not described above in this Notice or permitted by law will be made only with your written authorization. In addition, we will obtainyour authorization for most uses and disclosures of psychotherapy notes. When consent for disclosure is required by law, yourconsent will be obtained prior to such disclosure. If you give us authorization to use or share protected health information aboutyou, you may revoke that authorization in writing at any time. Please understand that we are unable to retract any disclosuresalready made with your authorization.
Stricter State Laws. New York has adopted medical privacy laws that are stricter than Federal law. For example, New York prohibits the disclosure of HIV-related information and the records of licensed mental health facilities for certain purposes that arepermitted by HIPAA. We will follow these stricter state laws, and we will not disclose your protected health information for anypurpose prohibited by these laws without your consent.
Your Rights Concerning Your Protected Health Information
Right to Ask to See and Obtain a Copy. You have the right to ask to see and copy the protected health information we used to make decisions about your care. This includes medical and billing records, but does not include psychotherapy notes. If the record is maintained electronically by Northwell Health, you have the right to obtain an electronic copy of the record. Your request must be inwriting and must be given to the Health Information Management Correspondence Unit. We may charge you a reasonable fee for thecosts of copying, mailing, or other expenses associated with complying with your request. We may deny access under certain, limited circumstances. If we deny your request, we may provide you a written summary of your record or we may provide you with limitedportions of your record. If we deny your request, in part or in its entirety, you may request that the denial be reviewed. A descriptionof the process to have a denial reviewed, as well as information on how to file a complaint with the Secretary of the U.S. Department ofHealth and Human Services, will be included in the correspondence informing you of our decision to deny your request.
Right to Ask for an Amendment or Addendum. If you feel that the protected health information that we have about you isincorrect or incomplete, you may ask us to amend the information. You have a right to request an amendment as long as theinformation is kept by or for Northwell Health. You are required to submit this request in writing by completing a “Request forAmendment to Health Information” form. We may deny your request if it is not in writing or does not include a reason to supportthe request. In addition, we may deny your request if you ask us to amend information that:
- Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
- Is not part of the protected health information kept by or for Northwell Health;
- Is not part of the information you would be permitted to see and copy; or
- Is determined by us to be accurate and complete.
If we deny your request, we will give you a written explanation of why we did not make the amendment. You will have theopportunity to have certain information related to your request included in your medical records, such as your disagreementwith our decision. We will also provide you with information on how to file a complaint with Northwell Health or with the U.S.Department of Health and Human Services.
Right to Ask for an Accounting of Disclosures.You have the right to ask us for a listing of those individuals or entities whohave received your protected health information from Northwell Health in the six years prior to your request. This listing will notcover disclosures made:
To you or your personal representative; To provide or arrange for your care; To carry out treatment, payment or healthcare operations; Incident to a permitted use or disclosure; To parties you authorize to receive your protected health information; To those who request your information through the hospital directory; To your family members, relatives, or friends who are involved in your care; For national security or intelligence services; To correctional institutions or law enforcement officials; and As part of a “limited data set” for research purposes.
You must submit your request in writing to the Office of Corporate Compliance at 200 Community Drive, Great Neck, New York11021. Your request must state the time period for the requested disclosures. The first list requested within a 12-month period willbe free. We may charge you for responding to any additional requests in that same period.
Right to Request Restrictions.You have the right to ask us to restrict or limit the protected health information we use or discloseabout you for treatment, payment or healthcare operations. In most cases, we must consider your request, but we are not requiredto agree to it. However, we must agree to limit disclosures made to your health insurer or other third-party payer about services weprovided to you, if, prior to receiving the medical services, you pay for the services in full, unless the disclosure of that informationis required by law. If multiple medical services are provided to you at one time by Northwell Health, you will have to pay for all ofthe services in order to restrict the disclosure of any one of them to your health insurance. If you require follow-up care related tothe undisclosed service and you decide you do not want to pay for that follow-up care at the time it is provided to you, it may benecessary for us to tell your health insurer about the previously undisclosed service. This will be done only to the extent necessary to receive payment for subsequent medical treatment. To restrict information provided to your health insurer or to another third party payer, you must notify a Northwell Health staff member at the time of registration and fill out a form indicating this preference. You also have the right to request a limit on the protected health information we disclose about you to someone who is involved in your care or the payment of your care, such as a family member or a friend. For example, you could ask that we not discloseinformation to a family member about a surgery you had. Your request for any restriction must be made in writing and given to the Office of Corporate Compliance at 200 Community Drive, Great Neck, New York 11021.
Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we contact you only at home or only by mail. Ifyou want us to communicate with you in a special way, you will need to give us details about how to contact you, including avalid alternate address. You will also need to give us information about where your bills may be sent. Your request must be madein writing by filling out a Northwell Health form requesting confidential communications. As indicated on the form, this requestmust be sent to the Office of Corporate Compliance at 200 Community Drive, Great Neck, New York 11021. You do not need toprovide a reason for your request. We will comply with all reasonable requests. However, if we are unable to contact you using the requested means or locations, we may contact you using whatever information we have.
Right to Receive Notice of a Breach. You have a right to be notified in the event of a breach of the privacy of your unsecuredprotected health information by Northwell Health or its business associates. You will be notified as soon as reasonably possible, butno later than 60 days following our discovery of the breach. The notice will provide you with the date we discovered the breach, abrief description of the type of information that was involved, and the steps we are taking to investigate and mitigate the situation,as well as contact information for you to ask questions and obtain additional information.
Right to a Paper Copy of this Notice. Upon request, you may at any time obtain a paper copy of this Notice, even if youpreviously agreed to receive this Notice electronically. To request a copy, please contact the Office of Corporate Compliance at(516) 465-8097 or ask the registrar/receptionist for one at the time of your next visit.
How to File a Privacy Complaint. If you believe that your privacy rights have not been followed as directed by federalregulations and state law or as explained in this Notice, you may file a written complaint with us. Please submit your complaint tothe Office of Corporate Compliance at the following address:
Corporate Compliance Privacy Officer
200 Community Drive
Great Neck, New York 11021
You will not be retaliated against or denied any health services if you file a complaint. If you are not satisfied with ourresponse to your privacy complaint or you otherwise wish to file a complaint, you may also file a complaint with the Secretary ofthe U.S. Department of Health and Human Services. The complaint must be in writing, it must describe the subject matter of thecomplaint and the individuals or organization that you believe violated your privacy and it must be filed within 180 days of whenyou knew or should have known that the violation occurred. The complaint should then be sent to:
Region II: New York
Att: Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
Jacob Javits Federal Building
26 Federal Plaza, Suite 3312
New York, NY 10278
Future Changes to Northwell Health’s Privacy Practices and this Notice
We reserve the right to change this Notice and the privacy practices of the organizations covered by this Notice without firstnotifying you. We reserve the right to make the revised or changed Notice effective for protected health information we already haveabout you as well as any information we receive in the future. Copies of the current Notice will be available by contacting Northwell Health’s Office of Corporate Compliance at (516) 465-8097 or ask the registrar/receptionist for one at the time of your next visit.The current Notice will also be posted to the Northwell Health Web site, http://www.northshorelij.com/hospitals/home. At anytime you may request a copy of the Notice currently in effect.
|Organizations that will follow this Notice include all Northwell Health’s health care providers providing health care tothe public at all of their delivery sites, including, but not limited to:
Northwell Health System, Inc.
Northwell Health Care, Inc.
North Shore Community Services, Inc.
Northwell Health System Laboratories, Inc.
The Feinstein Institute for Medical Research
The Elmezzi Graduate School of Molecular Medicine
Northwell Health System Foundation
North Shore University Hospital
Forest Hills Hospital
Glen Cove Hospital
Northwell Health Stern Family Center for Rehabilitation
North Shore University Hospital Housing, Inc.
North Shore University Hospital at Glen Cove Housing
Hillside Hospital Houses, Inc.
Long Island Jewish Medical Center
Northwell Health at Home Pharmacy, Inc.
Northwell Health Medical Care, Inc.
Lenox Hill Hospital
Huntington Hospital Association
Huntington Hospital Dolan Family Health Center
SIUH Systems Inc.
Staten Island University Hospital
Staten Island University Hospital Foundation
The Heart Institute
Hospice Care Network
Northwell Health Foundation, Inc.
Sports Physical Therapy and Rehabilitation Servicesof North Shore, PLLC
The Long Island Home
The Long Island Home Foundation
Aletta CorporationNorth Shore Health System Enterprises, Inc. (TOPCON)
North Shore Health System Enterprises, Inc. (parent)
North Shore Health Enterprises
Care Management Group of Greater New York, Inc.
Krasnoff Consultative Services, LLC
Northwell Health Physician Insurance Company
Risk Retention Group
Northwell Health Network, Inc.
Northwell Health Clinical Integration Network IPA, LLC
North Shore Radiology at Glen Cove, PC
Northwell Health Radiology Services, PC
Autoimmune Research Therapeutics
Palliative Care Medical Services, PC
Northwell Health Medical Group at Syosset, PC
Activity Works, LLC
Northwell Health Medical Group, PC
Northwell Health Medical Group at Huntington, PC
Northwell Health Medical Group at North Nassau, PC
Northwell Health Physicians Group, PC
Northwell Health Cardiovascular Medicine, PC
Northwell Health Cardiology at Deer Park, PC
Northwell Health Heart Surgery, PC
Northwell Health Internal Medicine, PC
Northwell Health Medical Group Urgent Medical Care, PC
Lenox Hill Hospital Medical, PC
Northwell Health Medical, PC
Northwell Health Occupational Medicine, PC
Lenox Hill Physician Hospital Organization
Park Lenox Pediatrics, PC
Park Lenox Medical, PC
Park Lenox Orthopedics, PC
Park Lenox Surgical, PC
Manhattan Minimally Invasive & Bariatric Surgery, PC
Lenox Otolaryngology Head & Neck Surgery, PC
Park Lenox OB/GYN, PC
Advanced Imaging and Radiology of Lenox Hill Hospital, PC
Park Lenox Emergency Medicine, PC
Advanced Heart Physicians & Surgeons Network, PC
Lenox Hill Cardiology Associates, PC
Lenox Hill Interventional Cardiac & Vascular Services, PC
Lenox Hill Pathology, PC
Park Lenox Psychiatry, PC
Population Health Management, LLC
Long Island Behavioral Health, LLC
Vivo Health Plan, Inc.
Northwell Health OB-GYN, PC
Northwell Health Ventures, LLC
Northwell Health Anesthesiology, PC
Northwell Health Internal Medicine at New Hyde Park, PC
Northwell Health OB-GYN at Garden City, PC