This notice describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.
The HIPAA Privacy Rule (HIPAA) gives you the right to be informed of the privacy practices of Carle Health and some of its affiliates and subsidiaries (Carle). Carle uses health information for the treatment of patients, to obtain payment for treatment, and for purposes of healthcare operations.
This notice explains our legal duties to protect your protected health information (PHI) and describes how Carle may use and disclose your medical information. If you have any questions, contact Carle Corporate Compliance at (217) 902-5391.
I. What Is Protected Health Information?
Protected Health Information (PHI) is information that can identify you as a patient of Carle. The information can be paper, electronic, or another format. Examples of PHI include:
II. Who Will Follow This Notice?
This notice describes the privacy practices of all clinical organizations providing medical services that are owned or controlled by Carle Health which are required to have a Notice of Privacy Practices. A complete listing of organizations is available by contacting Compliance. Our Affiliated Covered Entities (legally separate covered entities under common ownership or control), our medical staff, employees, volunteers, and students may share PHI for the joint management and operation of these entities for your treatment, payment of your claims, and for health care operational purposes. This sharing does not mean that one organization is responsible for the activities of another, but means we are all committed to protecting our patients’ privacy rights.
III. Our Pledge Regarding Medical Information
We are required by law to create and maintain medical records, charts, and files of the care and services you receive at Carle. We also use this information to provide quality care to our patients. We understand that your health and medical care are personal. We are committed to protecting your information.
We are required by law to:
IV. How We May Use and Share Your Medical Information
The following categories summarize ways we may use and share your medical information without your permission:
For Treatment: We may use and share your medical information to provide treatment or services to you. We may disclose your health information to doctors, therapists, clinical students, office staff or other personnel involved in your care, whether at Carle or at another facility.
For example, a provider treating you for high blood pressure may need to know if you have other medical conditions or if you are taking medications that impact your care.
Individuals Assisting with Your Care: We may share your medical information to people involved in your care, such as family members, close friends, clergy, parents, legal guardians or another person you identify as someone to contact in an emergency or being involved in your care.
For Payment: We may use and share your information to obtain payment from you, your insurance company, or another person/entity you identify for services received.
For example, we may disclose PHI regarding a service you received from us so your health plan will pay us or reimburse you for the service. We may also tell your health plan about a service you are going to receive to obtain prior approval, or to determine whether your plan will cover the treatment.
For Health Care Operations: We may use and share information about you for business tasks necessary for our operations. Examples of how we may use and disclose our patients’ information for our internal operations include:
Community Connect Partners: Carle shares its electronic medical record system with other health care providers, called Community Connect Partners, in the region. Use of a common system allows providers to better coordinate patient care, share medical information for treatment, obtain payment, and carry out healthcare operations. Once a patient’s medical information is combined into one system, it cannot be separated.
Health Information Exchanges: Carle participates in Health Information Exchange (HIE) networks that enable the sharing of electronic health records with other participating providers for the purpose of our patients’ treatment. Carle may share your health information with other providers when they request it or Carle may request medical information about you to provide your care. Information typically available from the HIE includes demographics, diagnoses, allergies, medications, laboratory results and radiology reports. Information available through the HIE may be limited to electronic health records and may not include older health records collected on paper. Health records will be available to the HIE unless an individual chooses to opt-out. Any patient registration representative can assist you or you can contact Carle’s Health Information Management department (contact information located at the end of this document) to opt-out. An individual’s decision to opt-out of HIE participation will not adversely affect his or her ability to receive care. However, it may affect the ability of the provider to obtain medical information to provide care. It does not affect the sharing of health information for treatment through more traditional methods, such as having records faxed or mailed. After choosing to opt-out of HIE participation, an individual may later decide to opt back in by contacting the Health Information Management department.
Publicly-Available Data: Carle may collect publicly-available information to inform the best care and support possible for you. This information allows us to help you address limitations you may have in getting services you need or taking steps to maintain and improve your health.
Business Associates: We may disclose PHI to our business associates to enable them to perform services for us, or on our behalf, relating to our operations. Some examples of business associates are auditors, accrediting agencies, consultants, and billing and collections companies. Our business associates are required to maintain the same standards of safeguarding your privacy that we require of our own employees and affiliates.
Facility Directory: If you are admitted to Carle, we may list information about you in our facility directory, including your name, location in the facility, and general condition. We will only disclose this information to those who ask for you by full name. If you provide your religious affiliation, we will only share your religious affiliation with members of clergy. If you ask, we will refrain from sharing your name on the facility directory with the public. You may request to remain anonymous while at our facility. Upon admission, please alert our hospital registration staff you wish to be made anonymous.
Fundraising: We may use and disclose your information to contact you to raise funds for Carle, which are used to support our mission of providing health care services to the communities we serve. If you do not wish to be contacted regarding fundraising, you will have the opportunity to opt-out.
Research: Carle may use or share your information for research studies when the research meets regulatory requirements regarding protection of your privacy. You may also be contacted to participate in a research study. Community Connect Partners may also have permissible access to your records for research purposes.
Other Uses and Disclosures: As part of our treatment, payment and business operations, we may use and share your information to remind you of an appointment, to communicate changes to an appointment, to inform you of potential treatment alternatives or options, and to inform you of health-related benefits or services that may be of interest to you.
Uses and Disclosures Requiring Authorization:
V. Special Situations
Carle may use or share your information in the following special situations:
Required By Law: We will disclose your information to authorities as required by federal, state or local law. Examples include:
For Public Health, Safety and Oversight Activities: We may use and share your information when required for public health, safety, and oversight activities, or as necessary to prevent a serious threat to the health and safety of you, the public or another person. We may share your information to report, prevent, or control disease, injury, or disability.
Coroners, Medical Examiners and Funeral Directors: We may share your information with coroners, medical examiners, or funeral home personnel in order for them to carry out their duties.
Disaster Relief Efforts: We may use or share your information with disaster relief organizations to notify your family or other persons involved in your health care about your location, general condition, or death. We will not make such disclosures if you object, unless we believe restricting the disclosure would interfere with the ability to respond to the emergency.
Organ and Tissue Donation: If you are or may be an organ donor, we may share your information to organizations that handle organ, eye, or tissue procurement, to facilitate organ or tissue donation and transplantation.
Military, Veterans and Government Functions: If you are or were a member of the armed forces, we may disclose your information as required by military command authorities. We also disclose information about foreign military personnel to the appropriate foreign military authority. We may also disclose information to the government for national security and protection activities.
Inmates: We may share information about an inmate in a correctional institution or in the custody of a law enforcement official to the correctional institution or law enforcement official as needed for the institution to provide health care, to protect the health and safety of the inmate or others, or for the safety and security of the correctional institution.
VI. Potential Impact of Other Applicable Laws
HIPAA generally does not override other laws that give people greater privacy protections. As a result, if any applicable state or federal privacy law requires us to provide you with more privacy protections, then we must follow that law.
Certain types of information may have special protections or restrictions under federal or state law. Examples may include mental health records, certain genetic test results, HIV/AIDS test results, and federally assisted alcohol and substance abuse treatment program records.
VII. Your Privacy Rights
You have the following rights regarding your Protected Health Information that we maintain:
Right to Inspect and Copy: You have the right to inspect and obtain a copy of most of your medical information we maintain. You may be required to submit your request to inspect and/or obtain a copy of your information in writing to the Health Information Management department. There may be costs associated with requests for copying or mailing. We may deny your request to inspect or copy your information in limited circumstances. If we deny you access to certain information we maintain, you may request the denial be reviewed. A licensed health care professional chosen by Carle will review your request and denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.
Right to Amend Certain Records: You have the right to request an amendment (correction or additional information) to your medical information we maintain. If you feel the medical information we have is inaccurate or incomplete, you may request an amendment by submitting a written request to the Health Information Management department. The request must include the reason for the amendment. You may also request an amendment by using our form Request for an Amendment of Health Information which can be obtained from our Health Information Management department.
We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. We may also deny your request if you ask us to amend information:
Right to an Accounting of Disclosures: You have the right to request an Accounting of Disclosures. This is a list of disclosures we have made of your medical information outside of Carle, other than those:
To request an Accounting of Disclosures, you must submit a written request to the Health Information Management Department. You must specify the period of time for which the Accounting will span, which may not be longer than six (6) years. The first request within a 12-month period will be free. We may charge you a nominal fee for additional lists, but will notify you of the cost so you may choose to stop or change your request before costs are incurred.
Right to Request Restrictions: You have the right to request a restriction or limitation on the use or disclosure of your medical information for treatment, payment, or health care operations. You also have the right to request a limit on the information we disclose about you to those involved in your care or with the payment for your care, like a family member or friend.
We are not required to agree to your restriction request. If we agree to a restriction, we will comply unless the information is needed to provide emergency treatment or services. To restrict medical information, submit your written request to the Health Information Management department. Your request must include:
If you restrict our use or sharing of your medical information for payment purposes, you will be financially responsible for all products and services you receive from us.
Right to Request Confidential Communications: You may ask us to send documents that contain your medical information to a different location than the address you gave us or using other means. You may ask us to contact you in a specific way, such as home or office phone. You will need to ask us in writing. We will try to grant any reasonable requests for confidential or alternate communications.
Right to Additional Copies of This Notice: Additional copies of this Notice can be obtained at carle.org, by visiting any Carle entity, or by calling Carle Compliance at (217) 902-5391.
VIII. Changes To This Notice
We have the right to change our privacy practices and the terms of this notice. If we make a material change to our privacy practices, we will provide you with a revised notice at your next visit after the revision or electronically as permitted by applicable law. In all cases, we will post the revised notice on our website. We reserve the right to make any revised notice effective for information we already have or may receive in the future.
IX. Complaints
If you believe your privacy rights have been violated, you may file a complaint with Carle Compliance by calling (888) 309-1566. You can also contact Patient Relations by calling (855) 665-8252. You can also file a complaint with the Office for Civil Rights. You will not be retaliated against for filing a complaint.
X. Other Uses of Protected Health Information
Other uses and disclosures of your medical information not covered by this Notice or the laws that apply to us will be made only with your written authorization. If you provide written authorization you may revoke that permission, in writing, at any time. If you revoke your authorization, we will no longer use or disclose your medical information for the purposes covered by your written authorization; however we are unable to take back any disclosures we have already made.
XI. Contact Information
Direct access to medical information is available via your MyCarle account. Additionally, to get a copy of your medical information or to request an amendment, record restriction, or an accounting of dislosures, submit your written request to:
Carle Health
611 W. Park St.
Urbana, Illinois 61801
ATTN: Health Information Management
The Effective Date of this Notice April 14, 2003. AS AMENDED AND REVISED August 1, 2013; July 1, 2016; January 8, 2019; September 13, 2019; July 1, 2020