HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL/HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice is provided on behalf of Connecticut Children’s Medical Center (“Connecticut Children’s”), Connecticut Children’s Specialty Group, Inc. (“Children’s Specialty Group”) and New York Children’s Medical Provider Services, P.C. (“New York Children’s”) (referred to collectively as the “Entities”).

INTRODUCTION

This Notice describes the privacy practices of Connecticut Children’s, Children’s Specialty Group, and New York Children’s healthcare professionals authorized to enter information into your medical records; all departments and units of Connecticut Children’s, Children’s Specialty Group, and New York Children’s; and all employees, staff, volunteers and other personnel of Connecticut Children’s, Children’s Specialty Group, and New York Children’s.

We respect the privacy of your health information and are committed to maintaining our patients’ confidentiality. We are required to maintain the privacy of your health information, provide you with this Notice regarding our legal duties and privacy practices with respect to information we collect and maintain about you, and abide by the terms of this Notice. This Notice describes your rights and our obligations regarding your health information, and informs you about the possible uses and disclosures of your health information. This Notice applies to all information and records related to your care that we have received or created.

The Entities will share your protected health information with each other, as necessary to carry out treatment, payment and health care operations.

UNDERSTANDING YOUR HEALTH RECORD INFORMATION

Each time you receive care at Connecticut Children’s or from a Children’s Specialty Group healthcare professional, a record of your visit is made. Typically, this record contains your symptoms, examination and test results, diagnoses, treatment, and a plan for future care or treatment. This information, often referred to as your health or medical record, serves as a:

Basis for planning your care and treatment;
Means of communication among the many healthcare professionals who contribute to your care;
Legal document describing the care you received;
Means by which you or your insurer can verify that services billed were actually provided;
A tool in educating healthcare professionals;
A source of data for medical research;
A source of information for public health officials charged with improving the health of the nation; and
A tool with which we can assess and continually work to improve the care we render and the outcomes we achieve.

Understanding what is in your health record and how your health information is used helps you to:

Ensure its accuracy;
Better understand who, what, when, where, and why others may access your health information; and
Make more informed decisions when authorizing the use or disclosure of your health information to others.

YOUR HEALTH INFORMATION RIGHTS

Although your health record is the physical property of the healthcare professional or facility that compiled it, the information belongs to you. You have the right to:

Request a restriction. You have the right to request a restriction on our use or disclosure of your health information for treatment, payment or healthcare operations. You have the right to request restrictions on the health information we disclose about you to a family member, friend or other person who is involved in your care or the payment of your care.

We are not required to agree to your requested restriction, unless (i) you request that information not be provided to a health plan for purposes of carrying out payment or health care operations, (ii) such restriction is allowed by law, and (iii) the information pertains solely to a health care item or service for which the Entities have been paid out of pocket in full. If we do agree to accept your requested restriction, we will comply with your request, except as needed to provide you emergency treatment. If restricted protected health information is disclosed to a healthcare professional for emergency treatment, we will request that such healthcare professional not further use or disclose the information. In addition, you and the Entities may terminate the restriction if the other party is notified in writing of the termination. Unless you agree, the termination of the restriction is only effective with respect to protected health information created or received after we have informed you of the termination.

Obtain a paper copy of this Notice. You have the right to obtain a copy of this Notice upon request at any time. In addition, you may obtain a copy of this Notice at our website: www.connecticutchildren’s.org.

Access, inspect and copy your health record. You have the right to access, inspect and obtain a copy of your protected health information that is used to make decisions about your care for as long as the protected health information is maintained by the Entities. To access, inspect and copy your protected health information that may be used to make decisions about you, you must submit your request in writing to either Connecticut Children’s or Children’s Specialty Group. If you request a copy of the information, we may charge a fee for the costs of preparing, copying, mailing or other supplies associated with your request. We may deny, in whole or in part, your request to access, inspect and copy your protected health information under certain limited circumstances. If we deny your request, we will provide you with a written explanation of the reason for the denial. You may have the right to have this denial reviewed by an independent healthcare professional designated by us to act as a reviewing official. This individual will not have participated in the original decision to deny your request.

Submit a request to amend your health record. You have the right to submit a request to amend your health record maintained by the Entities for as long as the information is kept by or for the Entities. Your request must be made in writing on a specific form and must state the reason for the requested amendment.

We may deny your request for amendment if the information (a) was not created by the Entities, unless the originator of the information is no longer available to act on your request; (b) is not part of the health information maintained by or for the Entities; (c) is not part of the information to which you have a right of access; or (d) is already accurate and complete, as determined by the Entities. If we deny your request for amendment, we will give you a written denial, including the reasons for the denial, and the right to submit a written statement disagreeing with the denial.

Obtain an accounting of certain disclosures. You have the right to obtain an accounting of certain disclosures of your health information. This is a listing of disclosures made by the Entities, or others, on our behalf, but does not include disclosures for treatment, payment and healthcare operations or certain other exceptions.

To request an accounting of disclosures, you must submit a request in writing, stating a time period beginning after April 14, 2003 that is within six years from the date of your request. An accounting will include, if requested: the disclosure date; the name of the person or entity that received the information and address, if known; a brief description of the information disclosed; and a brief statement of the purpose of the disclosure or a copy of the authorization or request or certain summary information concerning multiple disclosures. The first accounting provided within a 12-month period will be free; for further requests, a cost will be charged.

Receive confidential communications. You have the right to request a reasonable accommodation regarding how you receive communications of health information. You have the right to request an alternative means of communication or an alternative location where you would like to receive communications. For example, you can request that we contact you only at a certain telephone number. We will accommodate your reasonable requests.

Revoke your authorization to use or disclose. You have the right to revoke your authorization to use or disclose health information, except to the extent that action has already been taken by the Entities in reliance on the authorization.

Breach of unsecured protected health information. You have the right to be provided written notification, if your unsecured protected health information is subject to a breach (as defined by federal and/or state law) and the law requires us to provide you notification. In the event the Entities determine there is a breach, we will provide you with written notification of the breach no later than sixty (60) days following our discovery of such breach.

HOW WE MAY USE OR DISCLOSE YOUR PROTECTED HEALTH INFORMATION

The following categories describe some of the different ways that we may use or disclose your protected health information. Even if not specifically listed below, the Entities may use and disclose your protected health information as permitted or required by law or as authorized by you. We will make reasonable efforts to limit access to your protected health information to those persons or classes of persons, as appropriate, in our workforce who need access to carry out their duties and other persons or organizations involved in your care. In addition, if required, we will make reasonable efforts to limit the protected health information to the minimum amount necessary to accomplish the intended purpose of any use or disclosure and to the extent such use or disclosure is limited by law. Except as described in this Notice, we will not use or disclose your health information without your authorization.

Treatment. We will use and disclose your health information in providing you with treatment, services and coordinating your care. Doctors, nurses, as well as lab technicians, dieticians, physical therapists or other personnel involved in your care, may use your health information. For example: Information obtained by a nurse, physician or other member of your healthcare team will be recorded in your health record. Your physician will document, in your health record, his or her expectations of the members of your healthcare team. Members of your healthcare team will then record their actions and observations in the record so that the physician will know how you are responding to treatment.

We will also provide your physicians, or subsequent healthcare professionals, with access to your information in our medical record or copies of various reports that should assist him or her in treating you.

Payment. We may use and disclose your health information so that we can bill and receive payment for the treatment and services you receive. For billing and payment purposes, we may disclose your health information to your representative, insurance or managed care company, Medicare, Medicaid or another third party payer.

For example: A bill may be sent to you or your insurance company. The information on or accompanying the bill may include information that identifies you, as well as your diagnosis, procedures, and supplies used.

Healthcare Operations. We may use and disclose your health information, as necessary, for practice operations, such as for management purposes and to monitor our quality of care. For example: Members of the medical staff, the risk or quality improvement departments, or members of committees may use information in your health record to assess the care and outcomes in your case and others similar to it. This information will then be used in an effort to continually improve the quality and effectiveness of the healthcare and service we provide.

Electronic Health Information Exchange. We participate in the electronic sharing of health information with other health care providers, health plans, other health care-related entities, and others, through a health information exchange (“HIE”), which may include, but is not limited to, Care Everywhere, EpicCare Link, and CTHealthLink. Your electronic health records, including certain sensitive health information, e.g., mental health information, HIV/AIDS, genetic information, some alcohol and drug abuse treatment information, communicable diseases, and developmental and intellectual disability treatment, may be accessible through the HIE to properly authorized users for purposes of treatment, payment, and health care operations, as well as other purposes permitted or required by law unless you submit an opt-out request outlined in the RESTRICTIONS section below. Even if you opt-out of having your health information used and
disclosed through the HIE, some of your information may still be available through the HIE to properly authorized individuals as necessary in an emergency, Prescription Drug Monitoring Program or to report specific information to a government agency as required by law (for example, reporting of certain communicable diseases or suspected incidents of abuse).

Business Associates. There are some services provided in our organization through contracts with business associates. When these services are contracted, we may disclose your health information to our business associate so that they can perform the job we have asked them to do and bill you or your insurer. To protect your health information, however, we require the business associate to appropriately safeguard your information.

Connecticut Children’s Directory. Unless you object, we will include certain limited information about you in the Connecticut Children’s directory while you are a patient at Connecticut Children’s. This information may include your name, your location in Connecticut Children’s, your general condition and your religious affiliation. The Connecticut Children’s directory does not include specific medical information about you. We may disclose directory information, except for your religious affiliation, to people who ask for you by name. We may provide the directory information, including your religious affiliation, to any member of the clergy. You have the right to restrict or prohibit some or all of the foregoing uses or disclosures.

Notification. We may use or disclose information to notify, or assist in notifying, a family member, personal representative, or another person responsible for your care or payment of your care. Unless you object, we may disclose health information about you to persons including clergy, who are involved in your care. These disclosures are limited to information relevant to the person’s involvement in your care or in the arrangement for payment for your care.

Communication with Family. Healthcare professionals, using their best judgment, may disclose to a family member, other relative, close personal friend, or any other person you identify, health information relevant to that person’s involvement in your care or payment related to your care.

Reporting Victims of Abuse, Neglect or Domestic Violence. If we believe that you have been a victim of abuse, neglect or domestic violence, we may use and disclose your health information to notify a government authority, if authorized by law or if you agree to the report.

Research. We may disclose information to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your health information, if the researcher is collecting information in preparing a research proposal, if the research occurs after your death, or if you authorize the use or disclosure.

Funeral Directors, Coroners, Medical Examiners, Organ Procurement Organizations. We may disclose health information to funeral directors, coroners, medical examiners and organ procurement organizations consistent with applicable law to carry out their duties.

Appointment Reminders and Treatment Alternatives. We may contact you to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you.

Food and Drug Administration (FDA). We may disclose to the FDA health information relative to adverse events with respect to food, supplements, product and product defects, or post marketing surveillance information to enable product recalls, repairs, or replacement.

Workers’ Compensation. We may disclose health information, to the extent authorized by and to the extent necessary, to comply with laws relating to workers’ compensation or other similar programs established by law.

Public Health. As required by law, we may disclose your health information to public health or legal authorities charged with preventing or controlling disease, injury, or disability. For example, these activities may include the reporting of child abuse or neglect cases, births and deaths, or communicable disease.

Emergencies/Disaster Relief. We may use or disclose health information, as necessary, in emergency treatment situations. We will attempt to obtain an authorization as soon as possible. We may disclose health information about you to an organization assisting in a disaster relief effort.

Correctional Institution/Law Enforcement. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose your health information to the institution or official for certain purposes, including the health and safety of you and others, suspicious deaths, or in response to a valid subpoena, court order or warrant.

Judicial and Administrative Proceedings. We may disclose your health information in response to a court or administrative order.

Fundraising Activities. In order to contact you in an effort to raise money for Connecticut Children’s, we may disclose certain health information to a foundation related to Connecticut Children’s. Such information includes certain contact information such as your name, address, phone number, and email address; the dates you received treatment or services; guarantor information; information regarding the departments in which you received care; treating provider information; and outcome information. A description of how to opt out of receiving any further fundraising communications will be included with any fundraising materials you receive from Connecticut Children’s. If you request that your information not be used or disclosed for fundraising purposes, we will ensure that you do not receive future fundraising communications.

Health Oversight Agency. We may disclose your health information to a health oversight agency for activities authorized by law. These may include audits, investigations, inspections, licensure or other legal proceedings. These activities may include government oversight of the health care system, government payment or regulatory programs, and compliance with civil right laws.

Serious Threat to Health or Safety. To prevent a serious threat to your health or safety or the health or safety of the public or another person, we may use or disclose health information, limiting disclosures to someone able to help lessen or prevent the threatened harm.

Military and Veterans. If you are a member of the armed forces, we may use and disclose your health information, as required by military command authorities. We may also use and disclose health information about foreign military personnel, as required by the appropriate foreign military authority.

National Security and Intelligence Activities. We may disclose health information to authorized federal officials conducting national security and intelligence activities or as needed to provide protection to the President of the United States, certain other persons or foreign heads of states or to conduct certain special investigations. As Required by Law. We may disclose your health information when required by law to do so.

YOUR AUTHORIZATION IS REQUIRED FOR OTHER USES

Except as described in this Notice, we will use and disclose your health information only with your written authorization. While your written acknowledgement of receipt of our privacy practices allows us to use and disclose your health information for treatment, payment and health care operations, an authorization must specify other particular uses or disclosures that you may allow. You may revoke an authorization to use or disclose your health information for the purposes covered by that authorization, except where we have already relied on the authorization.

DISCLOSURES OF BEHAVIORAL HEALTH, SUBSTANCE ABUSE AND HIV-RELATED HEALTH INFORMATION

Special restrictions may apply to the disclosure of behavioral health conditions, substance abuse and HIV-related testing and treatment. Your authorization or a court order is required for release of this information in response to a subpoena.

Behavioral Health. If necessary for your diagnosis or treatment in a behavioral health program, behavioral health information may be used and disclosed as permitted or required by law. Very limited information may be disclosed for payment purposes. Otherwise, behavioral health information, including psychotherapy notes, may not be used or disclosed without your authorization except as specifically permitted under federal or state law.

HIV-related Information. HIV-related information may be used or disclosed for purposes of treatment or payment, but your authorization will be necessary for other disclosures except as permitted under state law.

Substance Abuse Treatment. If you are treated in a specialized substance abuse program, your authorization will be needed for most uses and disclosures, not including emergencies, certain reporting requirements and other disclosures specifically allowed under Federal law.

Minors. We will comply with Connecticut law when using or disclosing protected health information of minors. For example, if you are an unemancipated minor consenting to a health care service related to HIV/AIDS, venereal disease, abortion, outpatient mental health treatment or alcohol/drug dependence, and you have not requested that another person be treated as a personal representative you may have the authority to consent to the use and disclosure of your health information.

Marketing. A signed authorization is required for the use or disclosure of your protected health information for a purpose that encourages you to purchase or use a product or service except for certain limited circumstances such as when the marketing communication is face-to-face or when marketing includes the distribution of a promotional gift of nominal value provided by the Entities.

Sale of protected health information. A signed authorization is required for the use or disclosure of your protected health information in the event that the Entities receive remuneration for such use or disclosure, except under certain circumstances as allowed by federal or Connecticut law.

CHANGES TO THIS NOTICE

We will promptly revise and distribute this Notice whenever there is a material change to the uses or disclosures of health information, your individual rights, our legal duties, or other privacy practices stated in this Notice. We reserve the right to change this Notice and to make the revised or new Notice effective for all health information already received and maintained by the Entities, as well as for all health information we receive in the future. We will post a copy of the current Notice in all of our offices. In addition, we will post a copy of the revised Notice on our website: www.connecticutchildrens.org and provide a copy to all patients at their next encounter with the Entities.

NOTICE EFFECTIVE DATE

This notice went into effect on August 15, 2021.

RESTRICTIONS

If you would like to request a restriction on the use or disclosure of your health information, please contact our Health Information Management department at 860-837-5780 or send the request by mail to:

Connecticut Children’s Medical Center
Connecticut Children’s Specialty Group
Health Information Management Department
282 Washington Street
Hartford, CT 06106

COMPLAINTS

If you believe that your privacy rights have been violated, you may file a complaint in writing with us (through the Compliance/HIPAA Officer and/or committee) or with the government.

To file a complaint with the government, you may contact: Office of Civil Rights, U.S. Department of Health and Human Services 200 Independence Avenue, S.W., Room 509F Washington, D.C. 20201
To file a complaint with us, you should contact the Connecticut Children’s Hotline Service by dialing 877-363-3073 or 800-297-8592 (Spanish).
You will not be retaliated against for filing a complaint.

FOR FURTHER INFORMATION

If you have any questions about this Notice or would like further information concerning your privacy rights, please contact the Connecticut Children’s Hotline Service by dialing 800-723-5985 or by visiting https://reportanissue.com/connecticutchildrens.