Dear Health Care Consumer:

Attached is a Privacy Notice that provides the details of a new regulation that is intended to protect the privacy of your health information. Staten Island University Hospital is required by law to provide you a copy of this notice. The Privacy Notice tells you how your Protected Health Information (PHI) may be used or disclosed, and about your right to access and control your health information.

We are committed to protecting the privacy of information gathered about you while providing your health care, and to that end have policies and procedures in place that comply with the confidentiality and privacy laws of the State of New York and the Federal Government, including the Health Insurance Portability and Accountability Act (HIPAA).

Staten Island University Hospital wants you to feel that your privacy is being respected in all aspects of our relationship with you. We hope that the attached Privacy Notice will help you understand how we use your health information within the SIUH system to better care for you, and under what circumstances we may disclose your information to others. If you have any questions, please call 1-888- 586-2950.

Very truly yours,
Anthony C. Ferreri
President & Chief Executive Officer

NOTICE OF PRIVACY PRACTICES

Effective Date: April 14, 2003

Revised: September 2006

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.

This Notice of our privacy practices explains:

  1. How we may use and disclose your health information in the course of providing treatment and services to you.

  2. What rights you have with respect to your health information.  These include the right:

  1. How to file a complaint if you believe your privacy rights have been violated.

If you have any questions about this document or any other questions regarding the privacy of your medical information, please contact the Privacy Officer at 888-586-2950.

WHO WILL FOLLOW THIS NOTICE?

Staten Island University Hospital (SIUH) provides health care to patients jointly with physicians and other health care professionals and organizations.  The privacy practices described in this notice will be followed by:

PROTECTED HEALTH INFORMATION OR PHI

We are committed to protecting the privacy of information we gather about you while providing health-related services. This includes any information that may identify you in connection with your health care. Some examples of protected health information are:

USE AND DISCLOSURE OF YOUR HEALTH INFORMATION

1.   Treatment, Payment And Health Care Operations

SIUH and its medical staff, other health care professionals and professional trainees may use your PHI or share it with others to the extent that such information is necessary in order to treat your medical condition, obtain payment for that treatment, and carry out the hospitals normal health care operations.

Treatment.  We may share your PHI with caregivers at the hospital, who are involved in your care, and they may in turn use that information or share it with others outside the hospital in order to diagnose or treat you.  In addition, with your consent the hospital may share your PHI with other health care providers or facilities that need to know with respect to your treatment outside of the hospital. Also, we may contact you to provide you with appointment reminders and may also provide information about treatment alternatives or health care related benefits or services, which may be of interest to you. While we take reasonable steps to safeguard the privacy of your PHI, certain disclosures may occur during or as an unavoidable result of our otherwise permissible uses or disclosures. This is known as an incidental disclosure and is permissible. For example, during the course of a treatment session other patients in the treatment area may see or overhear discussion of your PHI.

Communication Barriers. SIUH may use and disclose your PHI if we are unable to obtain your consent because of substantial communication barriers, and we believe you would want us to treat you if we could communicate with you.

Payment.  We may use your PHI or share it with others so that we may obtain payment for your health care services the hospital provides to you. For example, we may share information about you with your health insurance company in order to obtain reimbursement after we have treated you. We might also need to inform your health insurance company about your health condition in order to obtain pre-approval for your treatment, such as admission to the provider for a particular type of surgery. In addition, we may share your PHI with other health care providers so that they can obtain payment for services they provide to you.

HealthCare Operations. We may use or disclose your PHI in order to conduct our health care operations, which include internal administration and planning and various activities to improve the quality and cost effectiveness of the care that we deliver to you. For example, we may use your PHI to evaluate the quality and competence of our physicians, nurses and other health care workers. We may also use your PHI to educate students and trainees in health related professions. Other examples of health care operations include legal, accounting and transcription services which may be performed through contracts with outside organizations designated as Business Associates. All such contracts will include assurances that the Business Associate also protects the privacy of your PHI. In addition, we may share your PHI with other health care providers who have provided services to you in order for them to conduct certain business activities such as activities designed to improve the quality of care or reduce health care costs, to conduct clinical training programs, and to evaluate the experience and performance of its medical staff.

Fundraising. We may use demographic information, for example, your name, where you live or work and the dates that you received treatment, in order to contact you to raise money to help support our operations. We may also share this information with a charitable foundation that will contact you to raise money for our organization.

2.   Hospital Directory

We may include certain limited information about you in the hospital directory while you are a patient at the hospital so your family, friends and clergy can visit you in the hospital and generally know how you are doing. This information may include your name, location in the hospital, your general condition (e.g., undetermined, fair, good, etc.) and your religious affiliation. The information in the directory, except for your religious affiliation, may be released to people who ask for you by name. This information, including your religious affiliation, may be given to a member of the clergy, such as a priest or rabbi, even if they do not ask for you by name. You may specifically request that we not include you in the directory when you register and in the case it is a medical emergency we will discuss your preference as soon as the emergency is over.

3.   Family and Friends Involved In Your Care

We may disclose your PHI to a family member, personal friend or any other person identified by you provided that you are present for, or otherwise available prior to the disclosure, you have the capacity to make your own health care decisions, you have been given an opportunity to object to the disclosure and have not done so.  If you are not present, you are incapacitated, or in an emergency circumstance, we may exercise our professional judgment to determine whether a disclosure is in your best interests, provided that we only disclose information that is directly relevant to the person’s involvement with your health care or payment related to your health care.  We may also disclose PHI to disaster relief organization in order to notify (or assist in notifying) such family members or friends of your location, general condition or death.  Information may also be shared with a legally authorized Personal Representative, such as the parent or guardian of a minor, a health care agent, DNR surrogate, or court appointed guardian with health care decision making authority.  However, portions of the medical record relating to sexual activity, sexual conduct, tests for sexually transmitted diseases, contraception, family planning, abortion or mental health services may not be accessible to the parent or guardian of a minor unless specific written authorization from the minor patient is received, except as otherwise provided in this Notice.  Moreover, we will not share PHI with third parties, including parents or legally appointed guardians of children or adults if the attending physician determines that access to the information requested would pose a serious risk to the mental or physical well-being of the patient or third party, or be detrimental to the relationship between the parents or guardians and the patient.

4.   As Permitted or Required By Law

We may use your PHI and share it with others, as required by law.  For example, the Provider will disclose information if required to do so pursuant to a court order.  In addition we may use or share PHI concerning mental health services patients as noted below:

Pursuant to a Court Order. We may disclose your PHI pursuant to an order of a court of record requiring disclosure upon a finding by the court that the interest of justice significantly outweighs the need for confidentiality.

Mental Hygiene Legal Service.  We may disclose your PHI to the mental hygiene legal service if they are acting as your personal representative.

Involuntary Hospitalization Proceedings.  We may disclose your PHI to the attorney(s) who may represent you in any involuntary hospitalization proceeding if the attorney has made a good faith attempt to provide you with a written notice that explains the proceeding and gives you the opportunity to object to the proceeding.

Medical Review Board of the State Commission of Correction.  We may disclose your PHI to the medical review board of the New York State Commission of Correction when the board has requested such information in the event of your death.

Endangered Individuals and Law Enforcement Agencies.  If your treating psychiatrist or psychologist has determined that you may present a serious and imminent danger to an individual we may disclose your PHI to that individual and a law enforcement agency.

As Authorized by the Department of Mental Health.  We may disclose your PHI to:

Director of Community Services.  We may disclose your PHI to a director of community services or his or her designee in order to provide post-providerization oversight of your care.

5.   Public Health Activities  

Public Health Activities. We may disclose your PHI to authorized public health officials (or a foreign government agency collaborating with such officials) so they may carry out their public health activities.  For example, we may share your health information with government officials that are responsible for controlling disease, injury or disability.  We may also disclose your PHI to a person who may have been exposed to a communicable disease or be at risk for contracting or spreading the disease if a law permits us to do so. 

Reports to Employers Regarding Work Related Illness or Injuries. Excluding mental health services patients, we may disclose relevant PHI to your employer if we provide health care services to you at the request of your employer related to medical surveillance of the workplace or to evaluate whether you have a work related illness or injury and the employer is required by law (such as Workers Compensation rules) to obtain such information.

Reports to School Districts.  We may disclose PHI for a psychiatric patient under the age of 21 years who has been discharged from an inpatient psychiatric unit to the patient’s school district in order for the school to continue to provide or arrange for appropriate services to the patient.

Victims Of Abuse, Neglect Or Domestic Violence.   We may release your PHI to a public health authority that is authorized to receive reports of abuse, neglect or domestic violence.  For example, we may report your information to government officials if we reasonably believe that you have been a victim of such abuse, neglect or domestic violence.  We will make every effort to obtain your permission before releasing this information, but in some cases we may be required or authorized to act without your permission.

Health Oversight Activities.  We may release your PHI to government agencies authorized to conduct audits, investigations, and inspections of our facility.  These government agencies monitor the operation of the health care system, government benefit programs such as Medicare and Medicaid, and compliance with government regulatory programs and civil rights laws.

Product Monitoring, Repair And Recall.  We may disclose your PHI to a person or company that is required by the Food and Drug Administration to: (1) report or track product defects or problems; (2) repair, replace, or recall defective or dangerous products; or (3) monitor the performance of a product after it has been approved for use by the general public.

Judicial and Administrative Proceedings.  Excluding mental health services patients; we may disclose your PHI in the course of a judicial or administrative proceeding in response to a legal order or other lawful process.

Law Enforcement.  Excluding mental health services patient’s, we may disclose your PHI to law enforcement officials for the following reasons:

To Avert A Serious And Imminent Threat To Health Or Safety.  We may use your PHI or share it with others as necessary to prevent a serious threat to your health or safety, or the health or safety of another person or the public. We may also disclose your PHI to law enforcement officers if you tell us that you participated in a violent crime that may have caused serious physical harm to another person (unless you admitted that fact while in counseling), or if we determine that you escaped from lawful custody (such as a prison or mental health institution).

National Security And Intelligence Activities Or Protective Services.   Excluding mental health services patients, we may disclose your PHI to authorized federal officials who are conducting national security and intelligence activities or providing protective services to the President or other important officials.

Military And Veterans.  Excluding mental health services patients, if you are in the Armed Forces, we may disclose PHI to appropriate military command authorities for activities the military deems necessary to carry out their military mission. We may also release PHI about foreign military personnel to the appropriate foreign military authority.

Inmates And Correctional Institutions.  If you are an inmate or a law enforcement officer detains you, we may disclose your PHI to the prison officers or law enforcement officers if necessary to provide you with health care, or to maintain safety, security and good order at the place where you are confined.  This includes sharing information that is necessary to protect the health and safety of other inmates or persons involved in supervising or transporting inmates.

Workers’ Compensation.  We may disclose your PHI to the extent legally required for workers’ compensation or similar programs that provide benefits for work-related injuries.

Coroners, Medical Examiners And Funeral Directors.   In the event of your death, we may disclose your PHI to a coroner or medical examiner.  This may be necessary, for example, to determine the cause of death.  We may also release this information to funeral directors as necessary to carry out their duties.

Organ And Tissue Donation.   In the event of your death, we may disclose your PHI to organizations that procure or store organs, eyes or other tissues so that these organizations may investigate whether you are a candidate for organ or tissue donation under applicable laws.

Research.  In most cases, we will ask for your written authorization before using your PHI or sharing it with others in order to conduct research.  However, under some circumstances, we may use and disclose your PHI without your authorization if we obtain approval through a special process to ensure, among other things, that research without your written authorization poses minimal risk to your privacy and could not reasonably be performed without waiving your consent.  Under no circumstances, however, would we allow researchers to use PHI publicly.  We may also release your PHI without your written authorization to people who are preparing a future research project, so long as any information identifying you does not leave the facility. In the event of your death, we may share your PHI with people who are conducting research using the information of deceased persons, as long as they agree not to remove from the facility any information that identifies you.

 6.  Completely De-identified Or Partially De-identified Information

We may use and disclose your PHI if we have removed any information that has the potential to identify you so that the health information is “completely de-identified.”  We may also use and disclose “partially de-identified” PHI about you if the person who will receive the information signs an agreement to protect the privacy of the information as required by federal and state law.  Partially de-identified PHI will not contain any information that would directly identify you (such as your name, street address, social security number, phone number, fax number, electronic mail address, website address, or license number).

 

USE AND DISCLOSURES REQUIRING YOUR WRITTEN AUTHORIZATION

1.  Use or Disclosure with Your Authorization.  For any purposes other than the ones described in this Notice we may only use or disclose PHI when you give us your authorization on our authorization form.  For instance, you will need to execute an authorization form before we can send your PHI to your life insurance company or to the attorney representing the other party in litigation in which you are involved.

2.   Special Authorization.  Confidential HIV-related information (for example, information regarding whether you have ever been the subject of an HIV test, have HIV infection, HIV-related illness or AIDS, or any information which could indicate that you have ever been potentially exposed to HIV) will not be used or disclosed to any person without your specific written authorization, except to certain other persons who need to know such information in connection with your medical care, and, in certain limited circumstances, to public health or other government officials (as required by law), to persons specified in a court order, to insurers as necessary for payment for your care or treatment, or to public authorities in order to contact persons with whom you have had sexual contact or have shared needles or syringes (in accordance with a specified process set forth in New York State law).  Federal regulation requires special authorization with respect to the disclosure of substance abuse treatment records.

3.   Marketing Communications.  We must obtain your written authorization prior to using your PHI to engage in marketing activities.  We can, however, provide you with marketing materials in a face-to-face encounter, without obtaining your authorization.  We may also give you a promotional gift of nominal value.  In addition, we may communicate with you about products or services relating to your treatment, case management or care coordination, or alternative treatments, therapies, providers or care settings.  Further, we may use or disclose your PHI to identify health-related services and products that may be beneficial to your health and then contact you about the services and products, or we may describe to you the products, services or staff.

  YOUR RIGHTS TO ACCESS AND CONTROL YOUR HEALTH INFORMATION

1.  Right To Inspect And Copy Records

You, or your legally authorized representative, have the right to inspect and obtain a copy of any records that are used to make decisions about your care and treatment, and any billing records, for as long as we maintain this information. To inspect or obtain a copy of these records, your must submit a request in writing to the Staten Island University Hospital Director of Health Information Management, 475 Seaview Avenue, Staten Island, New York 10305.  If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies we use to fulfill your request.  The fee at the time of the publication of this notice is $0.75 per page and must generally be paid before or at the time we give the copies to you.  

We will respond to your request for inspection of records within 10 days.  We ordinarily will respond to requests for copies within 30 days if the information is located in our facility and within 60 days if it is located off-site.  If we need additional time to respond to a request for copies, we will notify you in writing within the time frame above to explain the reason for and the expected duration of the delay.

Note.  Under 415.3(c)(IV), residents of nursing homes may request to inspect their records orally or in writing.  This request must be honored within 24 hours of the time of the request.  After inspection, residents can request copies of these records at a cost, which is the lower of the cost incurred by the facility in production of the record or 75 cents per page.

Under certain very limited circumstances, we may deny your request to inspect or obtain a copy of your record.  If we do, we will provide you with a summary of the information instead; or if we have a reason to deny only part of your request we will provide to you access or copies of the other parts of the record. We will provide a written notice that explains our reasons for providing only a summary or limited portions of the records requested, and a description of your rights to have that decision reviewed and how you can exercise those rights.  The notice will also include information on how to file a complaint about these issues with us or with the Secretary of the Department of Health and Human Services. 

Note.  A parent or legal guardian of a minor may be denied access to certain portions of the minor’s medical record (for example, records relating to mental health services, venereal disease, abortion, or care and treatment to which the minor is permitted to consent himself, such as HIV testing, sexually transmitted disease diagnosis and treatment, chemical dependence treatment, prenatal care, contraception and/or family planning services).

2.   Right To Amend Records

If you believe that the health information we have about you is incorrect or incomplete, you may ask us to amend the information.  You have the right to request an amendment for as long as the information is kept in our records.  To request an amendment, please write to the Staten Island University Hospital Director of Health Information Management, 475 Seaview Avenue, Staten Island, New York 10305.  Your request should include the reasons why you think we should make the amendment.  Ordinarily we will respond to your request within 60 days.  If we need additional time to respond, we will notify you in writing within 60 days to explain the reason for the delay and when you can expect to have a final answer to your request.

If we deny part of or your entire request, we will provide a written notice that explains the reasons for doing so.  You will have the right to have certain information related to your requested amendment included in your records.  For example, if you disagree with our decision, you will have an opportunity to submit a statement explaining your disagreement, which we will include in your records.  The written denial notice also will include information on how to file a complaint with us or with the Secretary of the Department of Health and Human Services.

3.   Right To An Accounting Of Disclosures

You have a right to request an “accounting of disclosures” made within the last 6 years but not prior to April 14, 2003, which is a list with information about certain disclosures of your PHI that we have made to others. An accounting of disclosures will not include:

The accounting of disclosures may be obtained by writing to the Staten Island University Hospital Director of Health Information Management, 475 Seaview Avenue, Staten Island, New York 10305. Your request must state a time period for the disclosures you want included. You have a right to receive one accounting within every 12-month period at no charge to you. However, we may charge you for the cost of providing more than one accounting of disclosures in any 12-month period.  We will always notify you of any such charge prior to fulfilling your request.

Ordinarily we will respond to your request for an accounting within 60 days.  If we need additional time to prepare the accounting you have requested, we will notify you in writing about the reason for the delay and the date when you can expect to receive the accounting.  In rare cases, we may have to delay providing you with the accounting without notifying you because a law enforcement official or government agency has asked us to do so.

4.   Right To Request Additional Privacy Protections

You have the right to request that we restrict our use and disclosure of your PHI for purpose related to treatment, payment or health care operations. You may also request that we limit how we disclose information about you to family or friends involved in your care.  For example, you may request that we withhold information about services you received. Request for restrictions must be in writing and should include (1) what information you want to limit; (2) whether you want to limit how we may use the information, how we share it with others, or both; and (3) to whom you want the limits to apply.

We are not required to agree to your request for a restriction, and in some cases the restriction you request may not be permitted under law.  However, if we do agree, we will be bound by our agreement unless the information is needed to provide you with emergency treatment or comply with the law.  Once we have agreed to a restriction, you have the right to revoke the restriction at any time.  Under some circumstances, we will also have the right to revoke the restriction as long as we notify you before doing so; in other cases, we will need your permission before we can revoke the restriction.

5.   Right To Request Confidential Communication

You have the right to request that you receive PHI by alternative means of communication or at alternative locations.  For example, you may ask that we contact you at work instead of at home. Such requests must be in writing. We will not ask you the reason for your request, and we will try to accommodate all reasonable requests.

6.   How to File a Privacy Complaint

You may register a privacy complaint with the Staten Island University Hospital Privacy Officer.  Complaints to the Privacy Officer must be in writing and submitted to:

Staten Island University Hospital Privacy Officer

One Edgewater Plaza, 6th Floor

 Staten Island, New York 10305

You will not be retaliated against or denied any health services if you file a complaint.

If you are not satisfied with the our response to your privacy complaint or otherwise wish to file a privacy complaint with the Secretary of Health and Human Services (“HHS”), the HIPAA privacy regulations require your complaint to:

Send your complaint to either the Office for Civil Rights (“OCR”) regional office listed below or to the OCR headquarters.  The addresses are:

Region II - New York

Michael Carter, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
Jacob Javits Federal Building
26 Federal Plaza - Suite 3312
New York, NY 10278
Voice Phone (212) 264-3313
FAX (212) 264-3039
TDD (212) 264-2355

OCR Headquarters

Winston A. Wilkinson, Director
Office for Civil Rights
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F HHH Bldg.
Washington, D.C. 20201