NOTICE OF PRIVACY PRACTICES (HIPAA COMPLIANCE)
TO OUR CLIENTS – Oregon laws require that all Pregnancy Resource Centers (PRC) protect health records in our possession. The Health Insurance Portability and Accountability Act of 1996 and 2003 (HIPAA) protects your personal health information, and requires that we provide you with this Notice of Privacy Practices. It lets you know how we may use and disclose your health information, and your rights regarding the health information we have in our possession.
Protected Health Information (PHI) that we maintain about you:
- Demographic information, including your name, address, date of birth, phone number(s), employer’s name, name of spouse/family, & emergency contacts
- Health information that you report to us during your visit(s) at PRC, including any pregnancy-related condition; your health history, dates of visits, diseases or diagnoses; medication and/or substance uses or abuses; allergies; HIV/AIDS status or STDs; social activities; and family &/or living situation
- Nurse and physician notes, medical record number, clinical findings, such as pregnancy test results, ultrasound exams, STI results
Your rights regarding your Protected Health Information:
- to request restrictions on certain uses and disclosures (which will be honored, unless in conflict with regulated external constraints);
- to receive communications of PHI by alternative means or at alternative locations;
- to inspect and obtain a copy of your PHI;
- to amend your PHI, if you believe it is incorrect or incomplete, by requesting to amend in writing;
- to obtain an accounting of PHI disclosures made, upon request;
- to receive a paper copy of this notice (NPP), upon request;
- to revoke this consent , in writing, to prevent any future uses or disclosures; and
- to file a complaint, if you believe your privacy rights have been violated*, which will not affect your treatment.
HOW WE USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION (PHI) – We only use or disclose your PHI as state and federal laws require or permit; some cases require your authorization and others do not. We will use secure modes, if transmitting your PHI for use or disclosure, including facsimile, telephone, email or USPS.
Uses and disclosures NOT requiring your authorization:
- Treatment – We may provide your PHI to other healthcare providers who request your medical records, as helpful in your continued medical treatment.
- Healthcare Operations – We may use or disclose your PHI to manage our program operations, such as reviewing the quality of services you receive.
- To Contact You – We may use the information in your medical records to contact you, if we have information about treatment or other health-related benefits/services that might be of help to you.
- Other Permitted Uses and Disclosures – HIPAA specifically permits us to use or disclose your PHI for other purposes without your consent or authorization. In our experience, such disclosures are very rare, and the limited PHI we maintain is generally not applicable. However, when authorized by law, and to the extent we may have the information, HIPAA permits us to disclose it:
- in order to comply with requirements of federal/state/local laws; court orders/ lawful processes; and administrative/court proceedings;
- to a public health authority, for the purpose of preventing or controlling disease, injury or disability;
- to the FDA for the quality, safety or effectiveness of FDA-regulated products or activities;
- in order to notify a person who may have been exposed to a communicable disease, or may be at risk of contracting/spreading a disease/condition;
- to a government authority, regarding abuse, neglect or domestic violence;
- to a health oversight agency, for activities such as audits, investigations, inspections, licensure of the healthcare system, government benefit programs and regulated entities;
- to a law enforcement official, for specified law enforcement purposes;
- to coroners or medical examiners, for identification or determining cause of death;
- to funeral directors, to carry out their duties with respect to the decedent;
- to organ procurement organizations, for facilitating donation and transplantation;
- to researchers, conducting studies approved by an Institutional Review Board;
- to prevent or lessen a serious and imminent threat to the health or safety of a person or the public;
- to authorized federal officials; for specialized government functions, such as military and veteran activities; national security and intelligence activities; medical suitability determinations; correctional institutions; and government entities providing public benefits; and
- to comply with workers’ compensation laws.
- for advertising and promotion, we may use your story and ultrasound images with all identifying information removed or de-identified to protect your privacy.
Uses and disclosures requiring your authorization: All other uses and disclosures of your PHI require your written authorization. You may revoke your authorization at any time, by doing so in writing.
*HOW YOU CAN REACH US – If you want additional information about our privacy practices, or if you believe PRC has violated your privacy rights, and you want to file a complaint, contact the PRC HIPAA Privacy Official: 1315 SE 20th Ave, Suite 2, Portland OR 97214. PRC does NOT retaliate against people who file a complaint. PRC reserves the right to change or modify its privacy practices, as necessary, keeping the most current notice on display. If you are not satisfied with PRC’s resolution of your complaint, you may file a complaint with the Office for Civil Rights-DHHS; 2201 6th Av, RX-11; Seattle WA 98121.Help available: [email protected]