VCC Community Clinic Notice of Privacy Practices
Effective Date: September 23, 2013
This notice describes how health information about you may be used and disclosed and how you can access this information. Please review it carefully.
Contact ‐ If you have any questions about this notice, please contact Dorothy Lujan, our Chief Compliance Officer, at (760) 631‐5000, extension 1133 or e-mail firstname.lastname@example.org, and visit our web site for any updated information.
Our Pledge Regarding Your Health Information
We understand that information about you and your health is personal. We are committed to protecting the privacy of this information. Each time you visit a Vista Community Clinic facility we create a record of the care and services you receive. We need this record to provide you with quality care and to comply with certain legal requirements. This notice applies to all of the records of your care generated by any of the Vista Community Clinic facilities listed below, whether made by health care personnel or your physician.
This notice will tell you about the ways in which we may use and disclose health information about you. We also describe your rights and certain obligations we have regarding the use and disclosure of health information.
Our primary responsibility is to safeguard your personal health information. We must also give you this notice of our privacy practices, and we must follow the terms of the notice that is currently in effect.
Changes to this notice ‐ We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current notice in our facilities, and it will also be posted on our web site. A copy of the current notice in effect will be available at the registration area of each facility.
Complaints ‐ If you believe your privacy rights have been violated, you may file a complaint with any of our facilities. This complaint must be in writing to: Vista Community Clinic, HIPAA Privacy Officer, 1000 Vale Terrace, Vista, CA 92084. There will be no retaliation for filing a complaint. You also have the right to submit a complaint to the Secretary of the Department of Health and Human Services.
How We May Use and Disclose Health Information About You
The following categories describe different ways that we use your health information within Vista Community Clinic and disclose your health information to persons and entities outside of Vista Community Clinic. Each description is of a category of uses or disclosures. We have not listed every use or disclosure within the categories, but all permitted uses and disclosures will fall within one of the following categories.
With Your Written Consent
In compliance with the federal Health Insurance Portability and Accountability Act (HIPAA), we will obtain in writing, your information consent when you first visit a Vista Community Clinic facility or upon a mandatory change to the NPP. The information consent is necessary to allow us to use your health information within Vista Community Clinic and to disclose your health information outside Vista Community Clinic. The information consent needs to be obtained only once. It remains valid unless you revoke it in writing. This consent will be used for the following purposes:
Treatment ‐ We may use health information about you to provide you with medical treatment and services. We may disclose health information about you to doctors, nurses, technicians, medical students, interns, or other personnel who are involved in taking care of you during your visit with us.
Payment ‐ We may use and disclose health information about you so the treatment and services you receive at our health care facility may be billed to and payment collected from you, an insurance company or a third party. This may also include the disclosure of health information to obtain prior authorization for treatment and procedures from your insurance plan.
Health Care Operations ‐ We may use and disclose health information about you for health care operations, including quality assurance activities; granting medical staff credentials to physicians; administrative activities, including Vista Community Clinic financial and business planning and development; customer service activities, including investigation of complaints; and certain marketing and fundraising activities, etc. These uses and disclosures are necessary to operate our health care facility and make sure all of our patients receive quality care.
Business Associates ‐ There are some services provided in our organization through contracts with business associates. Examples of business associates include accreditation agencies, management consultants, quality assurance reviewers, etc. We may disclose your health information to our business associates so that they can perform the job we’ve asked them to do. To protect your health information, we require our business associates to sign a business associate agreement (BAA) that states they will appropriately safeguard your information.
Appointment Reminders ‐ We may use and disclose health information to contact you as a reminder that you have an appointment for treatment or medical care at our health care facility.
Marketing or Fundraising ‐ We may contact you as part of a marketing and/or fundraising effort. As part of our marketing, we may tell you about Vista Community Clinic health‐related products and services that may be of interest to you. If you receive a communication from us for either marketing or fundraising purposes, in most cases you will be told how you can opt out of any further marketing or fundraising communications. These types of communication may be sent in various formats such as but not limited to e-mail, phone call, text message, or mailing letter.
Research That Doesn’t Involve Your Treatment ‐ When a research study does not involve any treatment, we may disclose your health information to researchers when an Institutional Review Board (IRB) has reviewed the research proposal, has established appropriate protocols to ensure the privacy of your health information, and has approved the research.
With Your Verbal Agreement
Individuals Involved in your care or payment for your care ‐ We may disclose health information about you to a friend or family member who is involved in your medical care, unless you tell us in advance not to do so. In addition, we may disclose health information about you to an entity assisting in a disaster relief effort (such as the Red Cross) so that your family can be notified about your condition, status and location.
With Your Specific Written “Authorization”
Other uses and disclosures of health information not covered by this notice or the laws that apply to us will be made only with your written permission (called “authorization”). If you authorize us to use or disclose health information about you, you may revoke that authorization in writing at any time. If you revoke your authorization, we will no longer use or disclose health information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission,
and that we are required to retain our records of the care that we provided to you. Some typical disclosures that require your authorization are as follows:
Research Involving Your Treatment ‐ When a research study involves your treatment, we may disclose your health information to researchers only after you have signed a specific written authorization. In addition, for any such research study, an Institutional Review Board (IRB) will already have reviewed the research proposal, established appropriate protocols to ensure the privacy of your health information, and approved the research. You do not have to sign the authorization in order to get treatment from Vista Community Clinic, but if you do refuse to sign the authorization, you cannot be part of the research study.
Drug & Alcohol Abuse Treatment Disclosures ‐ We will disclose drug and alcohol treatment information about you only in accordance with the federal Privacy Act. In general, the Privacy Act requires your written authorization for such disclosures.
Disclosure of Mental Health Treatment Information ‐ We will disclose mental health treatment information about you, to include psychotherapy notes, only in accordance with state law. In most cases, state law requires your written authorization or the written authorization of your representative for such disclosures.
Disclosures Requested by Vista Community Clinic ‐ We may ask you to sign an authorization allowing us to use or to disclose your health information to others for specific purposes such as notifying you of future educational or social events that you might enjoy.
Special Situations that do not Require Your Information Consent or Authorization
The following disclosures of your health information are permitted by law without any oral or written permission from you:
Organ and Tissue Donation ‐ If you are an organ donor, we may release health information to organizations that handle organ procurement or organ, eye or tissue transplantation, or to an organ donation bank as necessary to facilitate organ or tissue donation and transplantation.
Military and Veterans ‐ If you are a member of the armed forces, we may release health information about you as required by military command authorities.
Worker’s Compensation ‐ We may release health information about you for worker’s compensation or similar programs if you have a work related injury. These programs provide benefits for work related injuries.
Averting a Serious Threat to Health or Safety ‐ We may use and disclose health information about you when necessary to prevent a serious threat to your health or safety or the health and safety of another person or the public. These disclosures would be made only to someone able to help prevent the threat.
Public Health Activities ‐ We may disclose health information about you for public health activities. These generally include the following:
- To prevent or control disease, injury or disability.
- To report births and deaths.
- To report child abuse or neglect.
- To report reactions to medications, problems with products or other adverse events.
- To notify people of recalls of products they may be using.
- To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.
- To notify the appropriate government authority if we believe a patient has been the victim of abuse (including child abuse), neglect or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.
Health Oversight Activities ‐ We may disclose health information to a health oversight agency for activities authorized by law. These oversight activities include audits, investigations, inspections and licensure. These activities are necessary for the government to monitor the health care system, government programs and compliance with civil rights laws.
Lawsuits and Disputes ‐ If you are involved in a lawsuit or a dispute, we may disclose health information about you in response to a court or administrative order. We may disclose health information about you in response to a subpoena, discovery request or other lawful process by someone else involved in the dispute. We would only disclose this information if efforts have been made to tell you about the request to allow you to obtain an order protecting the information requested.
Law Enforcement ‐ We may disclose health information if asked to do so by law enforcement officials for the following reasons:
- In response to a court order, subpoena, warrant, summons or similar process.
- To identify or locate a suspect, fugitive, material witness or missing person.
- About the victim of a crime if, under certain circumstances, we are unable to obtain the person’s agreement.
- About a death we believe may be the result of a criminal conduct.
- About criminal conduct at our facility.
- In emergency circumstances to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime.
Coroners, Medical Examiners and Funeral Home Directors ‐ We may disclose health information to a coroner or medical examiner. This may be necessary to identify a deceased person or determine the cause of death of a person. We may also release health information about patients at our facility to funeral home directors as necessary to carry out their duties.
National Security and Intelligence Activities ‐ We may disclose health information about you to authorized federal officials for intelligence, counterintelligence and other national security activities authorized by law.
Inmates ‐ If you are an inmate of a correctional institution or under custody of a law enforcement official, we may disclose health information about you to the correctional institution or the law enforcement official. This is necessary for the correctional institution to provide you with health care, to protect your health and safety and the health and safety of others, or for the safety and security of the correctional institution.
Legal Requirements ‐ We will disclose health information about you without your permission when required to do so by federal, state or local law.
Health Information Exchange – Vista Community Clinic is a participant in San Diego Health Connect, our county’s health information exchange (HIE). This HIE allows participating hospitals and health care providers throughout San Diego County to safely and securely share patient health information through a secured connected network, resulting in a more complete, up-to-date medical record that helps patients receive the best care possible.
The HIE is designed to further enhance your health care experience by reducing the likelihood of undergoing redundant tests and procedures, and lessening your burden of keeping track of and transferring your medical documents to each of your doctors. The HIE gives healthcare providers who participate in the HIE network immediate electronic access to your pertinent health information for treatment, payment and certain health care operations.
We will only send patient health information through San Diego Health Connect if and when you seek treatment from a doctor outside of Vista Community Clinic who participates in the HIE. Your information will not be shared unless there is a request from a doctor outside of Vista Community Clinic who is caring for you.
Opt-Out of Participating in San Diego Health Connect – Your health information will be automatically included in San Diego Health Connect’s HIE unless you choose to opt out. If you do not want to have your Vista Community Clinic health information made available through San Diego Health Connect’s HIE, please complete, sign and submit the opt-out form and return it to us. We will provide you with an opt-out form upon your request. Alternatively, the opt-out form can be obtained by visiting www.VCC.clinic.
By completing the opt-out form, you request that Vista Community Clinic not share your health information electronically through San Diego Health Connect’s HIE with any other regions or outside health care organizations. If you choose not to participate, none of your Vista Community Clinic health information will be shared electronically through San Diego Health Connect; however, in the event you see a caregiver for treatment outside of Vista Community Clinic, that provider may request and receive your health information from Vista Community Clinic through other traditional methods, such as fax or mail.
Any health information that is shared with San Diego Health Connect before you submit the completed opt-out form may remain securely with health care providers who accessed information before this opt-out went into effect. Your opt-out form will be effective approximately five business days after submitting the opt-out form.
However, certain information is required by California law to be shared with the county, state and/or federal public health agencies and this information may be transmitted through the HIE even if you opt out. In addition, some health information is subject to special privacy protection under California and federal law. Even if you do not opt out of HIE, we will continue to obtain authorization from you to disclose information that is subject to special protection.
If you decide to opt back in to San Diego Health Connect, you will need to submit the opt-in form to the medical records department at Vista Community Clinic. We also have a Spanish language version of the opt-out form available for you.
A separate request must be completed for each family member wishing to opt out.
Your Health Information Rights
Although your health record is the physical property of the Vista Community Clinic entity that created it, the information belongs to you.
You have the right to:
- Request a restriction on certain uses and disclosures of your information. We are not required by law to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you with emergency treatment.
- Restrict disclosures for items/services paid out‐of‐pocket
- Obtain a copy of this Notice of Privacy Practices upon request.
- Inspect and request a copy of your health record for a fee. We may deny your request under very limited circumstances. If you are denied access to health information, you may request that the denial be reviewed by another health care professional chosen by someone on our health care team. We will abide by the outcome of that review.
- Request an amendment to your health record if you feel the information is incorrect or incomplete. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. Also, we may deny your request if the information was not created by our health care team, is not part of the information kept by our facility, is not part of the information which you would be permitted to inspect and copy, and if the information is not accurate and complete. Please note that even if we accept your request, we are not required to delete any information from your health record.
- Obtain an accounting of disclosures of your health information. The accounting will only provide information about disclosures made for purposes other than treatment, payment or health care operations.
- Request communication of your health information by alternative means or locations.
- Revoke your authorization to use or disclose health information except to the extent that action has already been taken.
- Submit a complaint about any aspect of our health information practices to us or to the Department of Health and Human Services of the United States. You can complain to us and expect an investigation and explanation by writing: Vista Community Clinic Privacy Officer, 1000 Vale Terrace, Vista, CA 92084. You can make a complaint to the Dept. of Health and Human Services by addressing your written complaint to: Secretary, Dept. of Health and Human Services.
- Individuals have the right to receive notification in the event of a breach affecting privacy. It is the requirement of VCC to communicate the news of the breach to affected individuals, and in some cases media and the Department of Health and Human Services.
Changes to this Notice
Vista Community Clinic (VCC) reserves the right to change this Notice. VCC reserves the right to make the revised Notice effective for health information already collected about you/your child, as well as any information received in the future. VCC will post a copy of the current Notice in a clear and prominent location to which you have access. The Notice is also available to you upon request. The Notice will contain, on the first page in the top right‐hand corner, the effective date. In addition, if revised, and you are still with Vista Community Clinic (VCC) will offer you a copy of the current Notice in effect.