Carle Foundation Hospital & Affiliate Privacy Notice
This notice describes how your medical information may be used and disclosed, and how you can access this information. Please review it carefully.
The HIPAA Privacy Rule (HIPAA) gives you the right to be informed of the privacy practices of The Carle Foundation and some of its affiliates and subsidiaries (Carle). Carle uses health information for the treatment of patients, to obtain payment for treatment, and for operational purposes.
This notice explains our legal duties to protect your protected health information (PHI) and describes how Carle may use and disclose your medical information. If you have any questions, contact Carle Corporate Compliance at (217) 902-5391.
I. WHAT IS PROTECTED HEALTH INFORMATION?
Protected Health Information (PHI) is information that can identify you as a patient of Carle. The information can be paper, electronic, or another format. Examples of PHI include:
- Medical records such as doctors’ notes, doctors’ orders, x-ray films, and lab reports
- Demographic information such as your name, address and date of birth, if combined with your medical information, and
- Billing and payment information.
II. WHO WILL FOLLOW THIS NOTICE?
This notice describes the privacy practices of The Carle Foundation and its affiliates and subsidiaries including but not limited to, Carle Foundation Hospital, Carle Health Care Incorporated (d/b/a Carle Physician Group), Arrow Ambulance, LLC, Carle SurgiCenter, LLC, and its medical staff, and Hoopeston Community Memorial Hospital (d/b/a Carle Hoopeston Regional Heath Center). Our Affiliated Covered Entities (legally separate covered entities under common ownership or control), our medical staff, employees, volunteers, and students may share PHI for the joint management and operation of these entities for your treatment, payment of your claims, and for health care operational purposes. This sharing does not mean that one organization is responsible for the activities of another, but means we are all committed to protecting our patients’ privacy rights.
III. OUR PLEDGE REGARDING MEDICAL INFORMATION
We are required by law to create and maintain medical records, charts, and files of the care and services you receive at Carle. We also use this information to provide quality care to our patients. We understand that your health and medical care are personal. We are committed to protecting your information.
We are required by law to:
- make sure your PHI is private and secure
- notify you after a breach of your unsecured PHI, if required by law
- provide this notice of our legal duties and describe ways we may use and share your PHI
- follow the terms in this notice, and
- follow Illinois laws that may provide greater protection of your information.
IV. HOW WE MAY USE AND SHARE YOUR MEDICAL INFORMATION
The following categories summarize ways we may use and share your medical information without your permission:
- to provide you with care
- obtain payment for that care, and
- operate our business.
We also describe other permissible ways we may use your medical information without authorization.
For Treatment: We may use and share your medical information to provide treatment or services to you. We may disclose your health information to doctors, therapists, clinical students, office staff or other personnel involved in your care, whether at Carle or at another facility.
For example, a provider treating you for high blood pressure may need to know if you have other medical conditions or if you are taking medications that impact your care.
Individuals Assisting with Your Care: We may share your medical information to people involved in your care, such as family members, close friends, clergy, parents, legal guardians or another person you identify as an emergency contact or being involved in your care.
For Payment: We may use and share your information to obtain payment from you, your insurance company, or another person/entity you identify for services received.
For example, we may disclose PHI regarding a service you received from us so your health plan will pay us or reimburse you for the service. We may also tell your health plan about a service you are going to receive to obtain prior approval, or to determine whether your plan will cover the treatment.
For Health Care Operations: We may use and share information about you for business tasks necessary for our operations. Examples of how we may use and disclose our patients’ information for our internal operations include:
- reviewing our treatment and services, and to evaluate the performance of our staff in caring for you
- deciding what additional services Carle might offer, what services are not needed, and whether certain treatments are effective
- providing you with general information about Carle and our services in newsletters and other communications
- teaching purposes and to provide training to doctors, nurses, technicians, medical students, and others involved in authorized training programs, and
- comparing our services with the services of other health care providers to see where we can make improvements in the care we provide.
Health Information Exchanges: Carle participates in Health Information Exchange (HIE) networks that enable the sharing of electronic health records with other participating providers for the purpose of our patients’ treatment. Carle may share your health information with other providers when they request it or Carle may request medical information about you to provide your care. Information typically available from the HIE includes demographics, medical information including diagnoses, allergies, medications, laboratory results and radiology reports. Information available through the HIE may be limited to electronic health records and may not include older health records collected on paper. Health records will be available to the HIE unless an individual chooses to opt-out. Any patient registration representative can assist you or you can contact Carle’s Health Information Management department (contact information located at the end of this document) to opt-out. An individual’s decision to opt-out of HIE participation will not adversely affect his or her ability to receive care. However, it may affect the ability of the provider to obtain medical information to provide care. It does not affect the sharing of health information for treatment through more traditional methods, such as having records faxed or mailed. After choosing to opt-out of HIE participation, an individual may later decide to opt back in by contacting the Health Information Management department.
Business Associates: We may disclose PHI to our business associates to enable them to perform services for us, or on our behalf, relating to our operations. Some examples of business associates are auditors, accrediting agencies, consultants, and billing and collections companies. Our business associates are required to maintain the same standards of safeguarding your privacy that we require of our own employees and affiliates.
Facility Directory: If you are admitted to Carle, we may list information about you in our facility directory, including your name, location in the facility, and general condition. We will only disclose this information to those who ask for you by full name. If you provide your religious affiliation, we will only share your religious affiliation with members of clergy. If you ask, we will refrain from sharing your name on the facility directory with the public. You may request to remain anonymous while at our facility. Please notify hospital registration upon admission to be noted as anonymous.
Fundraising: We may use and disclose your information to contact you to raise funds for Carle, which are used to support our mission of providing health care services to the communities we serve. If you do not wish to be contacted regarding fundraising, you will have the opportunity to opt-out.
Research: Carle may use or share your information for research studies when the research meets regulatory requirements regarding protection of your privacy. You may also be contacted to participate in a research study.
Other Uses and Disclosures: As part of our treatment, payment and business operations, we may use and share your information to remind you of an appointment, to communicate changes to an appointment, to inform you of potential treatment alternatives or options, and to inform you of health-related benefits or services that may be of interest to you.
Uses and Disclosures Requiring Authorization:
- Most uses and disclosures of “psychotherapy notes” (your mental health provider’s private notes separate from your medical record)
- Use of your information for some marketing purposes, and
- Uses and disclosures of your information that constitute the sale of your information.
V. SPECIAL SITUATIONS
Carle may use or share your information in the following special situations:
Required By Law: We will disclose your information to authorities as required by federal, state or local law. Examples include:
- to respond to a court order, subpoena, warrant, summons or similar process
- to identify or locate a suspect, fugitive, material witness, or missing person
- to provide information about a crime victim if, under certain limited circumstances, we are unable to obtain the person’s agreement
- in mandatory reporting situations, including reason to suspect domestic, child or elder abuse or neglect
- to report a death we believe may be the result of criminal conduct
- to inform the Illinois Department of Human Services FOID reporting system when an individual receiving mental health treatment is developmentally or intellectually disabled or is a clear and present danger to themselves or others
- to report criminal conduct at a Carle facility
- to assist the Federal Food and Drug Administration with tracking medical devices and products, and
- to enable a government agency to conduct audits, investigations, or inspections.
For Public Health, Safety and Oversight Activities: We may use and share your information when required for public health, safety, and oversight activities, or as necessary to prevent a serious threat to the health and safety of you, the public or another person. We may share your information to report, prevent, or control disease, injury, or disability.
Coroners, Medical Examiners and Funeral Directors: We may share your information with a coroner or medical examiner in order for them to carry out their duties.
Disaster Relief Efforts: We may use or share your information with disaster relief organizations to notify your family or other persons involved in your health care about your location, general condition, or death. We will not make such disclosures if you object, unless we believe restricting the disclosure would interfere with the ability to respond to the emergency.
Organ and Tissue Donation: If you are or may be an organ donor, we may share your information to organizations that handle organ, eye, or tissue procurement, to facilitate organ or tissue donation and transplantation.
Military, Veterans and Government Functions: If you are or were a member of the armed forces, we may disclose your information as required by military command authorities. We also disclose information about foreign military personnel to the appropriate foreign military authority. We may also disclose information to the government for national security and protection activities.
Inmates: We may share information about an inmate in a correctional institution or in the custody of a law enforcement official to the correctional institution or law enforcement official as needed for the institution to provide health care, to protect the health and safety of the inmate or others, or for the safety and security of the correctional institution.
VI. POTENTIAL IMPACT OF OTHER APPLICABLE LAWS
HIPAA generally does not override other laws that give people greater privacy protections. As a result, if any applicable state or federal privacy law requires us to provide you with more privacy protections, then we must follow that law.
Certain types of information may have special protections or restrictions under federal or state law. Examples may include mental health records, certain genetic test results, HIV/AIDS test results, and federally assisted alcohol and substance abuse treatment program records.
VII. YOUR PRIVACY RIGHTS
You have the following rights regarding your Protected Health Information that we maintain:
Right to Inspect and Copy: You have the right to inspect and obtain a copy of most of your medical information we maintain. You may be required to submit your request to inspect and/or obtain a copy of your information in writing to the Health Information Management department. There may be costs associated with requests for copying or mailing. We may deny your request to inspect or copy your information in limited circumstances. If we deny you access to certain information we maintain, you may request the denial be reviewed. A licensed health care professional chosen by Carle will review your request and denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.
Right to Amend Certain Records: You have the right to request an amendment (correction or additional information) to your medical information we maintain. If you feel the medical information we have is inaccurate or incomplete, you may request an amendment by submitting a written request to the Health Information Management department. The request must include the reason for the amendment. You may also request an amendment by using our form Request for an Amendment of Health Information which can be obtained from our Health Information Management department.
We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. We may also deny your request if you ask us to amend information:
- not created by us
- not part of the medical information we maintain in our files
- restricted by law, or
- deemed accurate and complete.
Right to an Accounting of Disclosures: You have the right to request an Accounting of Disclosures. This is a list of disclosures we have made of your medical information outside of Carle, other than those:
- specifically authorized by you
- related to your treatment
- to obtain payment for products or services we provided to you
- used for our healthcare operations, and
- certain disclosures authorized by the government.
To request an Accounting of Disclosures, you must submit a written request to the Health Information Management Department. You must specify the period of time for which the Accounting will span, which may not be longer than six (6) years. The first request within a 12-month period will be free. We may charge you a nominal fee for additional lists, but will notify you of the cost so you may choose to stop or change your request before costs are incurred.
Right to Request Restrictions: You have the right to request a restriction or limitation on the use or disclosure of your medical information for treatment, payment, or health care operations. You also have the right to request a limit on the information we disclose about you to those involved in your care or with the payment for your care, like a family member or friend.
We are not required to agree to your restriction request. If we agree to a restriction, we will comply unless the information is needed to provide emergency treatment or services. To restrict medical information, submit your written request to the Health Information Management department. Your request must include:
- the information you want to restrict
- whether you want to limit our use, disclosure or both, and
- to whom you want the limits to apply (for example, disclosures to your spouse).
If you restrict our use or sharing of your medical information for payment purposes, you will be financially responsible for all products and services you receive from us.
Right to Request Confidential Communications: You may ask us to send documents that contain your medical information to a different location than the address you gave us or using other means. You may ask us to contact you in a specific way, such as home or office phone. You will need to ask us in writing. We will try to grant any reasonable requests for confidential or alternate communications.>
Right to Additional Copies of This Notice: Additional copies of this Notice can be obtained at carle.org, by visiting any Carle entity, or by calling Carle Compliance at (217) 902-5391.
VIII. CHANGES TO THIS NOTICE
We have the right to change our privacy practices and the terms of this notice. If we make a material change to our privacy practices, we will provide you with a revised notice at your next visit after the revision or electronically as permitted by applicable law. In all cases, we will post the revised notice on our website. We reserve the right to make any revised notice effective for information we already have or may receive in the future.
If you believe your privacy rights have been violated, you may file a complaint with Carle Compliance by calling (888) 309-1566. You can also contact Patient Relations by calling (855) 665-8252. You can also file a complaint with the Office for Civil Rights. You will not be retaliated against for filing a complaint.
X. OTHER USES OF PROTECTED HEALTH INFORMATION
Other uses and disclosures of your medical information not covered by this Notice or the laws that apply to us will be made only with your written authorization. If you provide written authorization you may revoke that permission, in writing, at any time. If you revoke your authorization, we will no longer use or disclose your medical information for the purposes covered by your written authorization; however we are unable to take back any disclosures we have already made.
XI. CONTACT INFORMATION.
To access your medical information, or to request an amendment, restriction or an accounting of disclosures, submit your written request to:
611 W. Park St.
Urbana, Illinois 61801
ATTN: Health Information Management Department
The Effective Date of this Notice April 14, 2003. AS AMENDED AND REVISED August 1, 2013; July 1, 2016; January 8, 2019