HIPAA - Privacy Notice

Effective Date: April 14, 2003
NOTICE OF PERRY COUNTY HEALTH SYSTEMS
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND
DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice is intended to inform you about our practices related to the protection of the privacy
of your medical records. Generally, we are required by law to ensure that medical information
that identifies you is kept private. Further, we must give you this information related to our
legal duties and privacy practices with respect to any medical information we create or receive
about you. We are required by law to follow the terms of the notice that currently is in effect.

This notice will explain how we may use and disclose your medical information, our obligations related to the use and disclosure of your medical information and your rights related to any medical information that we have about you. This notice applies to the medical
records that are generated in or by this hospital.

With a few exceptions, we are required to obtain your authorization for the use or disclosure of
information for reasons other than for treatment, payment, or health care operations. We have
listed some of the reasons why we might use or disclose your medical information and some
examples of the types of uses or disclosures below. Not every use or disclosure is covered,
but all of the ways that we are allowed to use and disclose information will fall into one of the
categories.

If you have any questions about the content of this Notice of Privacy Practices, or if you
need to contact someone at the Hospital about any of the information contained in
this Notice of Privacy Practices, the contact person is:
Ron Heuring, Privacy Officer
Perry County Memorial Hospital
434 North West Street
Perryville, MO 63775
573-768-3255

In addition to hospital departments, employees, staff and other hospital personnel, the
following persons also will follow the practices described in this Notice of Privacy Practices:

Any health care professional who is authorized to enter information in your medical record;

Any member of a volunteer group that we allow to help you while you are in the hospital; and

Perryville Family Care Clinic, Perry County Women’s Care, Dr. M. Moaddabi Medical Practice, Frohna Clinic, Garden of Hope Oncology Clinic, and Prescriptions Plus Pharmacy. These other entities follow the terms of this Notice of Privacy Practices. In addition, these entities may share medical information for treatment, payment, or health care operations as they are described in this Notice of Privacy Practices. These other entities are hereinafter referred to collectively with the hospital as “Hospital”.

Use and Disclosure of Medical Information for Treatment, Payment, or Health Care Operations:

We can use or disclose medical information about you regarding your treatment, payment for services or for certain hospital operations.

For Treatment: To provide you with medical treatment or services, we may need to use or
disclose information about you to doctors, nurses, technicians, medical students or other
hospital personnel who are involved in your treatment. For example, a doctor may need to
know what drugs you are allergic to before prescribing medications. Departments within the
hospital may share medical information about you to coordinate your care. For instance, the
laboratory may request information to complete lab work. We also may disclose medical
information about you to people who may be involved in your medical care after you leave the
hospital, such as home health agencies, your family and clergy members. We also may
disclose information to other covered entities that are not affiliated with the hospital for your
treatment (e.g., pharmacists, emergency medical providers, and unafilliated physicians).

For Payment: We may use and disclose your medical information for the hospital to bill and receive payment for the treatment that you received here. For example, we may use or disclose your medical information to your insurance company about a service you received at the hospital so that your insurance company can pay us or reimburse you for the service. We also ask your insurance company for prior authorization for a service to determine whether the
insurance company will cover it. We also may disclose your information so that other covered
entities may obtain payment for treatment that they have provided(e.g., ambulance service
providers).

For Health Care Operations: We can use and disclose medical information about you for
hospital operations. These include uses and disclosures that are necessary to run the
hospital and make sure that our patients receive quality care. For example, we may use or
disclose medical information about you to evaluate our staff’s performance in caring for you.
Medical information about you and other hospital patients also may be combined to allow us
to evaluate whether the hospital should offer additional services or discontinue other services
and whether certain treatments are effective. We also may compare this information with
other hospitals to evaluate whether we can make improvements in the care and services
that we offer. Uses and Disclosures of Medical Information That Do Not Require Your
Authorization:

Uses and Disclosures of Medical Information That Do Not Require Your Authorization:

We can use or disclose health information about you without your authorization when there is
an emergency or when we are required by law to treat you, when we are required by law to
use or disclose certain information or when there are substantial communication barriers to
obtaining consent from you.

Further, we may use or disclose your health information without your consent or authorization
in any of the following circumstances:

When it is required by law;

When it involves use and disclosure for public health information activities, such as mandated disease reporting, etc.;

When reporting information about victims of abuse, neglect or domestic violence;

When disclosing information for the purpose of health oversight activities, such as audits, investigations, licensure or disciplinary actions or legal proceedings or actions;

When disclosing information for judicial and administrative proceedings in accordance with state and/or federal law, for instance, in response to a court order, such as a
court-ordered subpoena;

When disclosing information for law enforcement purposes, for instance, to locate or identify a suspect, fugitive, witness or missing person or regarding a victim of a crime who can not give consent or authorization because of incapacity;

When disclosing information about deceased persons to medical examiners, coroners, and funeral directors;

When disclosing or using information for organ and tissue donation purposes;

When disclosing information related to a research project when a waiver of authorization has been approved by the Institutional Review Board (or Privacy Committee);

When we believe in good faith that the disclosure is necessary to avert a serious health or safety threat to you or to the public’s safety;

When disclosure is necessary for specialized government functions, such as military service, for the protection of the president or for national security and intelligence
activities;

When required by military command authorities, if you are a member of the armed forces (or if foreign military personnel, to appropriate foreign military authorities);

In the case of a prison inmate, information can be released to the correctional facility in which he or she resides for the following purposes: (1) for the institution to provide the inmate with health care; (2) to protect the health and safety of the inmate or the health and safety of others; or (3) for the safety and security of the correctional facility; and

When disclosure is necessary to comply with worker’s compensation laws or purposes.

Planned Uses or Disclosures to Which You May Object

We will use or disclose your health information for any of the purposes described in this
section unless you affirmatively and object to or otherwise restrict a particular release.
You must direct your written objections or restrictions to: Ron Heuring, Privacy Officer
Perry County Memorial Hospital
434 North West Street
Perryville, MO 63775
573-768-3255

We may use or disclose your health information to contact you and remind you that you have an appointment for treatment or medical care.

We may use and disclose your health information to provide you with information about or recommendations of possible treatment options or alternatives that may interest you.

We may use and disclose your health information to inform you about health benefits or services that may interest you.

We may use or disclose your health information in order to include you in the Hospital’s patient directory. Directory information includes your name, location in the Hospital and your general condition. We may disclose this information to people that ask for you by name. In addition, a member of clergy may obtain your religious affiliation, even
if they do not ask for you by name.

We may use health information about you to contact you in an effort to raise money for the hospital. A Foundation related to the hospital may receive contact information, which includes your name, address and phone number and the dates that you received services from the hospital.

We may release health information about you to a friend and/or family member who is involved in your care. We can tell your family and/or friends of your condition and that you are in the hospital for treatment or services. We also can give this information to someone who will help or is helping to pay for your care.

We can disclose health information about you to a public or private entity that is authorized by law or it’s charger to assist in disaster relief efforts, i.e., the American Red Cross, for the purpose of notification of family and/or friends of your whereabouts and condition.

Other Uses or Disclosures

Uses or disclosures not covered in this Notice of Privacy Practices will not be made
without your written authorization. If you provide us written authorization to use or disclose
information, you can change your mind and revoke your authorization at any time as
long as it is in writing. If you revoke your authorization, we will no longer use or disclose the
information. However, we will not be able to take back any disclosures that we have
made pursuant to your previous authorization.

Your Rights With Respect To Health Information

Right to Request Restrictions: You have the right to request that we restrict any use or disclosure of your health information. We are not required to agree to any restriction that you request. If we do agree to adhere to your restrictions, we will comply with your request unless the information is needed to provide you treatment. Any request to restrict uses or disclosures must be made in writing to the Privacy Officer. Your request must indicate
(1) what information you want limited;
(2) whether you want to limit our use, disclosure or both; and
(3) to whom you want the limits to apply.

Right to Receive Information in Certain Form and Location: You have the right to receive information about your health in a certain form and location. For instance, you can request that we not contact you at work. To request confidential communications, you must make your request in writing to the Privacy Officer. The request must tell us how and/or where you want to receive information. We will accomodate reasonable requests.

Right to Inspect and Copy PHI: You have the right to inspect and copy your health information that may be used to make decisions about your care, with the exception of psychotherapy notes. If you want to see or copy your medical information, you must submit your request in writing to the Privacy Officer. If you request copies of information, we may charge a fee for any costs associated with your request, including the cost of copies, mailing or other supplies.

In limited circumstances we can deny access to your health information. If access is denied, you can request that the denial be reviewed. Another licensed health care professional chosen by the hospital will review your request and the denial. We will adhere to the decision of the reviewer.

Right to Request Amendment to PHI: You have a right to request that our health information be changed if you believe that it is incorrect or incomplete. You have a right to request changes for as long as the information is kept by the hospital. To request a change in your information, you must submit it in writing to the Privacy Officer. In
addition, you must give the reason that you want the information changed, including why you think the information is incorrect or incomplete.

We can deny your request if it is not in writing and if it does not include a reason why the
information should be changed. We also can deny your request for the following reasons:
(1) the information was not created by the Hospital, unless the person or entity that did create the information is no longer available;
(2) the information is not part of the medical record kept by or for the Hospital;
(3) the information is not part of the information that you would be permitted to inspect and copy; or
(4) we believe the information is accurate and complete.

Right to an Accounting of Disclosures: You have the right to receive an accounting of disclosures of medical information that we have made, with some exceptions. You must submit your request in writing to the Privacy Officer. Your request must state the time period that may not be longer than six (6) years and may not include dates before April 14, 2003. You should include how you want the information reported to you, i.e., by paper, electronically, etc. You have the right to receive a free accounting every twelve (12) months. If you request more than one (1) accounting in a twelve (12) month period, we may charge you a reasonable fee for the costs of providing that list. We will notify you of the charge for such a request and you can then choose to withdraw or
change your request before any costs are incurred.

You have the right to a paper copy of this Notice of Privacy Practices. Even if you have agreed to receive this notice in another form, you can still have a paper copy of this notice. To obtain a paper copy of this notice, contact the Privacy Officer.

Complaints

If you believe that we have violated any of your privacy rights or have not adhered to the
information contained in this Notice of Privacy Practices, you can file a complaint by putting it in writing and sending it to:
Ron Heuring, Privacy Officer
Perry County Memorial Hospital
434 North West Street
Perryville, MO 63775
573-768-3255

You also may file a complaint with the Secretary of the United States Department of Health and Human Services. You will not be retaliated against for filing a complaint with either the hospital or the United States Department of Health and Human Services.

Changes to This Notice of Privacy Practices

We reserve the right to change or modify the information contained in this Notice of Privacy Practices. Any changes that we make can be effective for any health information that we have about you and any information that we might obtain. Each time you receive services from the hospital, we will provide the most current copy of our Notice of Privacy Practices. The most recent version of Privacy Practices will be posted in our building. Also, you can call or write our contact person, whose information is included on the first page of this Notice of Privacy Practices, to obtain the most recent version of this Manual.