HIPAA Privacy Notice

Notice of Privacy Practices

Northeastern Vermont Regional Hospital (NVRH)

We are committed to protecting the privacy of your protected health information. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

This Notice of Our Privacy Practices (this “Notice”) Explains:

How we may use and disclose your health information in the course of providing treatment and services to you.
What rights you have with respect to your health information. These include the right:
To inspect and obtain a copy of your health information.
To request that we amend health information in our records.
To receive an accounting of certain disclosures we have made of your health information.

To request that we restrict the use and disclosure of your health information.To request confidential communication about health information.
To receive a paper copy of this Notice.
How to file a complaint if you believe your privacy rights have been violated.
If you have questions about this document, our privacy policies or any other questions regarding the privacy of your health information, please call 1-802-748-7419.
NOTE:
For your convenience, an English PDF version of this Notice is available for download.

Revised Effective Date: June 1, 2019

Northeastern Vermont Regional Hospital Covers the Following Entities:

This Notice describes the practices of the Northeastern Vermont Regional Hospital (NVRH) Organized Health Care Arrangement, which is composed of the following entities (referred to as “NVRH Entities” in this Notice):

NVRH
Corner Medical
Obstetrics
Kingdom Internal Medicine
Women’s Wellness
St. Johnsbury Pediatrics
Neurology
Dan Wyand Physical Therapy
Northern Physical Therapy
Urology
Cardiology
General Surgery
Orthopedics
Pain Clinic
Our Pledge Regarding Health Information:

We are committed to protecting the privacy of “protected health information” about you, as that term is defined in the privacy regulations issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). With certain limited exceptions, protected health information is generally defined as information that identifies an individual or that reasonably can be used to identify an individual, and that relates to the individual’s past, present, or future health or condition, healthcare provided to the individual, or the past, present, or future payment for healthcare provided to the individual. For simplicity, we will refer to protected health information simply as “health information” in this Notice. NVRH Entities may share health information with other NVRH Entities about treatment, payment and health care operations of the NVRH. Our privacy practices concerning your health information are as follows:

We will safeguard the privacy of health information that we have created or received as required by law.
We will explain how, when and why we use and/or disclose your health information.
We will comply with the provisions of this Notice and only use and/or disclose your health information as described in this Notice.
We will provide notice of an NVRH breach of unsecured health information.
Who Will Follow This Notice?

This Notice applies to the facilities, providers and workforce members of the NVRH Entities, including:

Any health care professional authorized to enter health information into your NVRH medical record.
All departments and units of NVRH.
All employees, staff, volunteers and other NVRH personnel.
All hospitals, ambulatory surgery centers, clinics, ancillary provider locations, and other healthcare facilities and administrative offices of the NVRH.
How We May Use and Disclose Your Health Information

The following categories describe different ways that we may use and disclose health information. For each category of uses or disclosures, we will explain what we mean and try to give some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose health information will fall within at least one of the categories.

For Treatment. We may use your health information to provide, coordinate or manage your healthcare treatment and related services. This may include communication with other health care providers regarding your treatment and coordinating and managing your healthcare with others. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. The doctor may need to tell the dietitian if you have diabetes so that we can arrange for appropriate meals. Different NVRH departments may also access your health information in order to coordinate services or items that you may need, such as prescriptions, lab work and x-rays. We may also disclose your health information to people, such as home health providers, who may be involved in your medical care after you leave our care.

For Payment. We may use and disclose your health information in order to bill and collect payment for treatment and services provided to you by the NVRH. We may also disclose your health information to other providers so they may bill and collect payment for treatment and services they provided to you. Before you receive scheduled services, we may share health information about these services with your health plan(s) to obtain prior approval or to determine whether your insurance will cover the treatment. We may also share your health information with billing and collection departments or agencies, insurance companies and health plans to collect payment for services, departments that review the appropriateness of the care provided and the costs associated with that care and to consumer reporting agencies (e.g., credit bureaus). For example, if you have a broken leg, we may need to give your health plan(s) health information about your condition, supplies used (medications or crutches) and services you received (x-rays or surgery). This health information is given to our billing agency and your health plan so we can be paid or you can be reimbursed.

For Health Care Operations. We may use and disclose your health information to conduct activities that are called healthcare operations that allow us to improve the quality of care we provide and reduce healthcare costs. Examples of uses and disclosures for healthcare operations include the following:

Reviewing and improving the quality, efficiency and cost of care that we provide to you and other patients.
Evaluating the skills, qualifications, and performance of healthcare providers taking care of you.
Providing training programs for students, trainees, healthcare providers or non-healthcare professionals (for example, billing clerks) to help them practice or improve their skills.
Cooperating with outside organizations that assess the quality of care we provide. These organizations might include government agencies or accrediting bodies like the Joint Commission and the Accreditation Association of Ambulatory Healthcare, Inc.
Cooperating with outside organizations that evaluate, certify or license healthcare providers, staff or facilities in a particular field or specialty. For example, we may use or disclose health information so that one of our nurses may become certified in a specific field of nursing.
Sharing health information with the Caledonia County Sheriff to maintain safety at our facilities.
Assisting various people who review our activities. Health information may be seen by doctors reviewing services provided to you, and by accountants, lawyers and others who assist us in complying with applicable laws.
Conducting business management and general administrative activities related to our organizations and services we provide.
Resolving grievances within our organizations.
Complying with this Notice and with applicable laws.
Contacting You. We may use and disclose health information to contact you about appointments, clinical instructions, surveys, or general communications. We may contact you by mail, telephone, email, or text message when you provide your address, telephone number, email address, or mobile phone number.

De-identified Health Information. We may use your health information to create “de-identified” information that is not identifiable to any individual in accordance with HIPAA. We may also disclose your health information to a business associate for the purpose of creating de-identified information, regardless of whether we will use the de-identified information.

Limited Data Set. We may use your health information to create a “limited data set” (health information that has certain identifying information removed). We may also disclose your health information to a business associate for the purpose of creating a limited data set, regardless of whether we will use the limited data set. We may use and disclose a limited data set only for research, public health, or health care operations purposes, and any person receiving the limited data set must sign an agreement to protect the health information.

Treatment Alternatives. We may use and disclose your health information to manage and coordinate your healthcare and inform you of treatment alternatives and other health related benefits that may be of interest to you. This may include telling you about treatments, services, products and/or other healthcare providers. For example, if you are diagnosed with diabetes, we may tell you about nutritional and other counseling services that may be of interest to you.

Electronic Health Information Exchange (HIE). We may participate in certain HIEs that permit health care providers or other health care entities, such as your health plan or health insurer, to share your health information for treatment, payment and other purposes permitted by law, including those described in this Notice. We currently participate in the HIEs listed:

VITL

You may ask that your health information no longer be contributed to an HIE by sending your request to the Privacy Office address below. Please include your name, date of birth and address. We will use reasonable efforts to limit the sharing of health information in HIEs if you opt out. Opting out will not recall your health information that has already been shared, nor will it prevent access to health information about you by other means, e.g., request by your individual providers.

Business Associates. There are some services provided in our organization through our business associates. For example, we may use a copy service to make copies of your medical record. When we hire companies to perform these services, we may disclose your health information to these companies so that they can perform the job we have asked them to perform. To protect your health information, however, we require the business associate to appropriately safeguard your health information.

Fundraising Activities. We may contact you to provide information on fundraising programs in support of NVRH and the services it provides in the community. For these purposes, we may use your contact and demographic information (such as your name, address, telephone number or e-mail information, age, date of birth, gender), the dates on which and the department from which you received treatment or services, your treating provider’s name, your treatment outcome, and your health insurance status. The money raised will be used to expand and improve the services and programs NVRH provides. You may opt out of being contacted for this purpose by following the instructions included in the fundraising communication you receive.

Hospital Directory. We may include certain limited information about you in the hospital directory while you are a patient at NVRH. This information may include your name, location in the hospital, your general condition (e.g., fair, stable, etc.) and your religious affiliation. The directory information, except for your religious affiliation, may be released to people who ask for you by name. Your religious affiliation and other directory information may be given to a member of the clergy, such as a priest or rabbi, even if they do not ask for you by name. If you do not want information about you listed in the hospital directory, please notify Registration when you arrive or call NVRH’s Admitting Office.

Individuals Involved in Your Care or Payment for Your Care. We may share with a family member, relative, friend, or other person identified by you, health information that is directly relevant to that person’s involvement in your care or payment for your care. We may use or disclose health information in order to notify a family member, personal representative, or other person responsible for your care of your location, general condition or death. In addition, we may disclose health information about you to an entity assisting in a disaster relief effort so that your family, personal representative or others responsible for your care can be notified about your location, general condition or death. If you do not want health information about you used or disclosed in the above circumstances, please call 802-748-7419. We will comply with additional state law confidentiality protections if you are a minor and receive treatment for pregnancy, drug and/or alcohol abuse, communicable disease, or mental health.

Special Situations

We may use and/or disclose health information about you for a number of circumstances in which you do not have to consent, give authorization or otherwise have an opportunity to agree or object. Those circumstances include:

As Required by Law. We will disclose your health information when required to do so by federal, state, or local law or other judicial or administrative proceedings. For example, we may disclose your health information in response to an order of a court or administrative tribunal.

To Avert a Serious Threat to Health or Safety. We may use and disclose your health information when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent or reduce the threat.

Public Health Risks. We may disclose your health information to appropriate government authorities for public health activities. These activities generally include the following:

To prevent or control disease, injury or disability.
To report births and deaths.
To report child abuse or neglect.
To report reactions to medications or problems with products.
To notify people of recalls of products they may be using.
To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease.
To notify the appropriate government authority if we believe an adult patient has been the victim of abuse, neglect or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.
To support public health surveillance and combat bioterrorism.
Health Oversight Activities. We may disclose your health information to a federal or state health oversight agency for oversight activities authorized by law.

Law Enforcement. We may release health information to a law enforcement official for certain law enforcement purposes. For example, we may disclose your health information to report a gunshot wound.

Lawsuits and Disputes. In the course of any judicial or administrative proceeding, we may be compelled to disclose your health information in response to a court or administrative order, subpoena, discovery request, or other lawful process. Generally speaking, subpoenas in Vermont, standing alone, are not adequate for the disclosure of protected health information. There must be an authorization, court order or express provision of law allowing for the disclosure in response to the subpoena.

Coroners, Medical Examiners and Funeral Directors. We may release health information to a coroner or medical examiner. This may be necessary to identify a deceased person or determine the cause of death. We may also release health information to funeral directors as necessary for them to carry out their duties.

Organ and Tissue Donation. We may release health information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

Research. Under certain circumstances, we may use and disclose health information about you for research purposes. For example, we may use health information in preparing to conduct a research project or to see if you are eligible to participate in certain research activities. Before we use or disclose health information for research, however, the research project will have been approved through a specialized approval process. We may also contact you to see if you are interested in participating in research.

Specialized Government Functions. We may disclose health information about you if it relates to military and veterans’ activities, national security and intelligence activities, protective services for the President, and medical suitability determinations of the Department of State.

Workers’ Compensation. We may release your health information for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness. In Vermont, you will be required to sign a consent form for the disclosure of your records in a Workers’ Compensation matter.

Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release your health information to the correctional institution or law enforcement official. This release is required: (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; and (3) for the safety and security of the correctional institution.

Other Uses and Disclosures of Health Information

Other uses and disclosures of health information not covered by this Notice or the laws that apply to us will be made only with your written permission. We will ask your written permission before we use or disclose health information, for example, for the following purposes:

Psychotherapy notes made by your individual mental health provider during a counseling session, except for certain limited purposes related to treatment, payment and health care operations, or other limited exceptions, including government oversight and safety.
Certain marketing activities, including if we are paid by a third party for marketing statements as described in your executed authorization.
Sale of your health information except certain purposes permitted under the regulations.
If you provide us permission to use or disclose your health information, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose your health information for the reasons covered by your written authorization. We are unable to take back any disclosures we have already made with your permission. We are required to retain records of the care that we provided to you.

Vermont Law. In the event that Vermont Law requires us to give more protection to your health information than stated in this Notice or required by federal law, we will give that additional protection to your health information. We will comply with additional state law confidentiality protections relating to treatment for mental health and drug or alcohol abuse. Unless you object in writing, we may release health information related to your mental health to other health care providers for treatment, quality assessment and improvement activities, and other permitted purposes, including case management and care coordination, disease management, outcomes evaluation, development of clinical guidelines and protocols, population-based activities and the provision, coordination, or management of mental health, developmental disabilities, and substance abuse services and other health or related services.

In accordance with federal law, generally we will obtain your written consent before we may disclose health information that would identify you as a patient for substance abuse services. There are exceptions to this general requirement. For instance, we may disclose health information to our workforce as needed to coordinate your care, to agencies or individuals who help us carry out our responsibilities in serving you, and to health care providers in an emergency.

Your Rights Regarding Your Protected Health Information

You have the following rights regarding the health information we maintain about you:

Right to Inspect and Copy. You have the right to inspect and obtain an electronic or paper copy of your health information. To inspect and copy your health information, please visit www.NVRH.org or call 1-802-748-7412 for instructions on how to submit your written request. If you request a copy of the health information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request. We will respond to you, usually within 30 days of receiving your written request. Under certain situations, we may deny your request in writing, describing the reason for denial and your rights to request a review of our denial. In some cases, we may provide a summary of your health information.

Right to Amend. You have the right to request that we make amendments to clinical, billing and other records used to make decisions about you. Your request must be in writing and must explain your reason(s) for the amendment. We may deny your request if:

The health information was not created by NVRH unless you provide a reasonable basis for us to believe that the originator of the health information is no longer available to make the amendment.
The health information is not part of the health information used to make decisions about you.
We believe the health information is correct and complete.
You would not have the right to inspect and copy the record as described above.
We will tell you in writing the reasons for the denial and describe your rights to give us a written statement disagreeing with the denial. If we accept your request to amend the health information, we will make reasonable efforts to inform others of the amendment, including persons you name that have received your health information. Please call 1-802-748-7412 to obtain the appropriate form to request an amendment to your record.

Right to an Accounting of Disclosures. You have the right to receive a written list of certain disclosures we made of your health information. You may ask for disclosures made, up to six (6) years before your request. We are required to provide a listing of all disclosures, except the following:

For treatment, payment, or health care operations purposes.
Occurring as a byproduct of permitted uses and disclosures.
Made to or requested by you or that you authorized.
Made to individuals involved in your care, for directory or notification purposes, or for disaster relief purposes.
Made for national security or intelligence purposes.
Made to correctional institutions and other law enforcement officials.
Made as part of a limited data set which does not contain certain health information which would identify you.
The list will include the date of the disclosure, the name (and address, if available) of the person or organization receiving the health information, a brief description of the health information disclosed, and the purpose of the disclosure. To request this list or accounting of disclosures, you must submit your request on the appropriate NVRH form, which can be obtained by calling 1-802-748-7412.

Right to Request Restrictions. You have the right to request that we restrict the use and disclosure of your health information. We are not required to agree to your requested restrictions, except we will honor your request to not disclose to your health plan if the disclosure is for payment or healthcare operations purposes (and is not otherwise required by law) and the health information pertains solely to items or services for which you have paid out of pocket in full. If we agree to your request, there are certain situations when we may not be able to comply with your request. These situations include emergency treatment, disclosures to the Secretary of the Department of Health and Human Services, and uses and disclosures that do not require your authorization. You may request a restriction by submitting the appropriate NVRH form, which can be obtained by calling 1-802-748-7412.

Right to Request Confidential Communication (Alternative Ways). You have the right to request confidential communications, i.e., how and where we contact you, about your health information. For example, you may request that we contact you at your work address or phone number. Your request must be in writing. We will accommodate reasonable requests, but when appropriate, may condition that accommodation on you providing us with information regarding how payment, if any, will be handled and your specification of an alternative address or other method of contact. You may request alternative means of communications by submitting the appropriate NVRH form, which can be obtained by calling 1-802-748-7412. If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information.

Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice upon request. We will make available a copy of this Notice to you no later than the date you first receive service from us except for emergency services, in which case we will provide the Notice to you as soon as practicable. You may also obtain a copy of this Notice at any time from our website, www.NVRH.org, or from any of the NVRH treatment facilities listed in this Notice.

Contact for Questions and Complaints

If you have any questions regarding this Notice, our privacy policies or if you believe your privacy rights have been violated or you wish to file a complaint about our privacy practices, you may contact:

Privacy Officer
Northeastern Vermont Regional Hospital
PO Box 905 1315 Hospital Drive
St. Johnsbury, VT 058119
1-802-748-7419

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.

Changes to This Notice

We reserve the right to change the terms of this Notice and to make new notice provisions effective for all health information that we maintain by:

Posting the revised Notice at our facilities.
Making copies of the revised Notice available upon request at NVRH facilities.
Posting the revised Notice on our website, www.NVRH.org.

KEY PHONE NUMBERS

Office of the CEO 802-748-7400
Billing & Financial Services 802-748-7518
Care Management 802-748-7367
Chaplain 802-748-7473