Privacy of Your Health Care Information

Your privacy is important to us. The information you provide on this web site is protected by federal laws. To learn more about how your rights to privacy are being protected, please contact the Customer Service Department.

Below is Cambridge Health Alliance's Notice of Privacy Practices. You have received a copy of this notice if you have been seen at a Cambridge Health Alliance location after April, 2003.

NOTICE OF PRIVACY PRACTICES

Effective Date: April 14, 2003

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

SUMMARY

This summary of our Notice of Privacy Practices is included for your convenience. Please read the full Notice of Privacy Practices for complete details.

When you get care at any part of Cambridge Health Alliance, your caregivers create a chart (medical record). The chart has information about your medical history, tests you had, care you got, and how you responded. We also have billing records. The medical records and billing records contain your protected health information (or PHI). This notice tells how we use and share your PHI, and what your rights are.

Section A: Information we can share without your permission

1. We may use medical information about you to provide you with treatment.
People who care for you need to know about your health problems so that they can give you safe and complete care. Some examples of how we use and share information are
  • If you have diabetes, the dietician needs to know this to help you plan safe meals.

  • If you have been in the hospital, we may share information with your regular health care provider to help with your care after you leave the hospital.
2. We may share medical information about you so that we can get paid for your care.
For example, we may share your information with your insurance company so that we get paid for your health care. We may also share it to get an okay from your insurer before you come for treatment (prior approval). That way, we know they will pay for your care.

3. We may use and share medical information about you as part of improving care to all patients.
For example, to train doctors or other healthcare workers and students, or to look at how your care went and how we can improve care in the future.

4. We may share information for the Hospital Directory.
We may include your name, location, condition and religion in the hospital's patient list. We will share your location and condition with anyone who asks for you by name. We only let clergy see what your religion is. We will not include you in the list if you tell us not to. We do not tell anyone that you are in the hospital if you are on a psychiatric unit.

5. We may use or share information about you because you get care here.
  • to contact you about an appointment;

  • to ask you for a donation to Cambridge Health Alliance. If you do not want to get these requests, call our Fundraising Office (617) 306-8754;

  • to tell someone who helps pay for your care;

  • to tell your relatives, close friends or others involved in your care, but only if you say it is okay for us to share this information. If you are unable to say it is okay, we will do what we think is in your best interests; or

  • to let health oversight agencies make sure we are following the rules of programs like Medicare or Medicaid
6. We share information for public health activities.
For examples, please see Section III.E in the Notice of Privacy Practices.

7. We share information for legal reasons.
  • when we must respond to a legal order or other lawful process

  • when we are required by law to tell the police or other law enforcers, or when we are required by a grand jury or subpoena
8. We also use and share information
  • with donor programs, if you are donating or in need of an organ, eyes or tissues;

  • with medical examiners or coroners to help identify a body or find the cause of death; or

  • with funeral directors to help them carry out their duties.
9. We may use and share information for research.
We may use or share your PHI without your consent or authorization if our Institutional Review Board approves a waiver of authorization for disclosure.

10. We may also use and share information about you.
  • to prevent or lessen a serious threat to you or others;

  • if you are in the military, as required by military rules;

  • if you are an inmate, to the correctional institution or law enforcement officials;

  • to report findings from an examination ordered by the court; or

  • to follow the laws for national safety reasons.
11. We use and share information as required by other laws not mentioned above.


Section B: Information we may use or share only if you give us written permission

1. For any purpose not mentioned in Section A.
For example, before we can send information to your life insurance company.

2. To send you marketing materials.
But, we do not need your written permission if we give you marketing materials when we are face-to-face; or if we give you a gift that has very little value; or when we tell you about our products or services for your care or treatment.

3. To use or share any Highly Confidential Information.
We follow federal and state laws that require special privacy protections when we use or share this type of information. For examples, please see Section IV.C in the Notice of Privacy Practices.


Section C: You have rights about your medical information

1. If you believe that we have not kept your privacy according to the law, you have the right to complain.
You may contact our Patient Relations Office at (617) 665-1398. You may also complain to the Director, Office for Civil Rights of the U.S. Department of Health and Human Services. Making a complaint will not change how we treat you.

2. You can ask us, in writing, to limit who gets information about you.
We are not required to agree to your request. If we do agree, we will follow your request unless there is an emergency reason we need to share this information.

3. You can ask us, in writing, to contact you in private ways.
You do not need to tell us the reason for this.

4. If you signed an authorization, you can withdraw the authorization.
You must sign a form to do this. We cannot do anything about information we already may have shared, but we will not share any more after you give us the signed form.

5. You can see and get a copy of medical information that is being used to make decisions about your care.
This includes medical and billing records. You must sign a request form that you can get from the HIM/Medical Records Department. If you want copies, we will charge a reasonable fee for them. We will also charge you for our postage costs, if you want us to mail the copies to you. In some cases, we may not let you see or copy your record. If that happens, we will tell you why. If it is legally okay, you can ask to have someone else review your request. We will follow the decision of the person reviewing the request.

6. You can ask us to make changes to your record if you think what we have is wrong or not complete.
You must put your request in writing and give a reason why you want to make the changes. We will make the changes unless we believe that the information you want changed is complete and accurate.

7. You may ask for a list of anyone we shared information with and when we shared it.
You have to ask for this in writing. You can get a list that covers up to 6 years but cannot be dates before April 14, 2003.

8. You may get a paper copy of our Notice of Privacy Practices at any time.


Section D: Duration of the Notice of Privacy Practices

We may change the terms of the Notice. Your privacy rights may change if the laws change. When that happens, we will change the Notice and post it where you will be able to read it. The new Notice will be used for all the information we have about you. You can also get a copy of the new Notice by calling the Privacy Office at (617) 665-1227.


Section E: Privacy Office

Please see Section VII in the Notice of Privacy Practices for the address and phone number of the Privacy Office.


NOTICE OF PRIVACY PRACTICES

I. Who We Are

This Notice describes the privacy practices of Cambridge Health Alliance and members of its organized health care arrangement.
  • Cambridge Health Alliance is made up of the Cambridge Hospital, Somerville Hospital and Whidden Memorial Hospital, their outpatient clinics, neighborhood health centers, and other health care services and programs. Please refer to the last page of this Notice for a complete listing of Cambridge Health Alliance facilities.

  • Cambridge Public Health Department

  • In addition, the following entities participate with Cambridge Health Alliance in what is called an organized health care arrangement to provide health care services to Cambridge Health Alliance patients.

    1. Independent or private practice physicians and allied health care professionals who have been accepted as members of the Cambridge Health Alliance Medical Staff and who work as members of the Cambridge Health Alliance team in providing your health care and improving our health care operations.

    2. For our patients who are members of certain health plans (such as Tufts Health Plan and Harvard Pilgrim Health Plan) Cambridge Health Alliance works closely with the Mt. Auburn Cambridge Independent Practitioners Association (MACIPA) and Partners Community Health Care, Inc. (PCHI). These organizations work with Cambridge Health Alliance to improve your care through the following activities: quality improvement, utilization management, contract and financial management and case management.

Who Will Follow This Notice

  • All members of Cambridge Health Alliance's workforce including doctors, nurses, other health care providers, other employees, staff and volunteers

  • All members of Cambridge Health Alliance Medical Staff and other persons who participate in Cambridge Health Alliance's organized health care arrangement

II. Our Privacy Obligations Regarding Your Protected Health Information (PHI)

We are required by law to keep your health information private, and to provide you with this Notice of our legal duties and privacy practices with respect to your Protected Health Information (PHI). When we use or disclose your PHI, we are required to follow the terms of this Notice (or any revised notice in effect at the time of the use or disclosure).

III. Uses and Disclosures Which Do Not Require Your Written Authorization

Cambridge Health Alliance respects your right to keep personal and medical information about you private. We do, however, need to use this information at times in order to maintain our business and to provide you with quality medical care. In certain situations, which we will describe in Section IV below, we must obtain your written authorization before we use or disclose your PHI. Listed below are a number of uses and disclosures for which we do not need your prior written authorization.

  1. Uses and Disclosures For Treatment, Payment and Health Care Operations. We may use and disclose PHI, but not your "Highly Confidential Information" (defined in Section IV.C below), in order to treat you, obtain payment for services provided to you and conduct our "health care operations" as detailed below:
    • Treatment. We may use and disclose your PHI to provide treatment and other services to you, for example, to diagnose and treat an injury or illness. In addition, we may contact you to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you. We may also disclose PHI to other providers involved in your treatment.
    • Payment. We may use and disclose your PHI to obtain payment for services that we provide to you. For example we may make disclosures to claim and obtain payment from your health insurer, HMO, or other company that arranges or pays the cost of some or all of your health care ("Your Payor") to verify that Your Payor will pay for health care. We also may disclose your PHI to other providers to help them receive payment for the services they provided to you.
    • Health Care Operations. We may use and disclose your PHI for our health care operations, which include internal administration and planning and various activities that improve the quality and cost effectiveness of the care that we deliver to you. For example, we may use PHI to evaluate the quality and competence of our physicians, nurses and other health care workers. We may disclose PHI to our Patient Relations Manager in order to resolve any complaints you may have and ensure that you have a comfortable visit with us. We may also disclose your PHI to other providers who have treated you in order to assist them with various quality assessment and improvement activities.

  2. Use or Disclosure for Cambridge Health Alliance Hospitals Directory of Patients. Unless you object or are located in a specific unit which would reveal that you are receiving mental health services or treatment for substance abuse, we may include your name, location in the hospital, general health condition (e.g. good, fair) and religious affiliation in our inpatient directory. Information in this directory may be disclosed to anyone who asks for you by name or to members of the clergy. We will only disclose your religious affiliation to clergy members.
  3. Disclosure to Relatives, Close Friends and Other Caregivers. We may use or disclose your PHI to a family member, other relative, close personal friend or any other person identified by you when you are present for, or otherwise available prior to, the disclosure, if we (1) obtain your agreement; (2) provide you with the opportunity to object to the disclosure and you do not object; or (3) reasonably infer that you do not object to the disclosure.

    If you are not present or unable to agree or object due to an emergency situation or incapacity, we may exercise our professional judgment to determine whether a disclosure is in your best interests. If we disclose information to a family member, other relative or a close personal friend, we would disclose only the information that we believe is directly relevant to that person's involvement with your health care or payment related to your health care. We may also disclose your PHI in order to notify (or assist in notifying) a relative, friend or caregiver of your location, general condition or death.
  4. Fundraising Communications. Cambridge Health Alliance or its affiliated foundation, the Alliance Foundation for Community Health, Inc., may contact you to raise funds for Cambridge Health Alliance. In connection with any fundraising, we may disclose to our fundraising staff demographic information about you (e.g., your name, address and phone number) and dates on which we provided health care to you. No other information will be provided for fundraising purposes without your authorization. If you do not want to receive any fundraising requests in the future, you may contact our Fundraising Office at (781) 306-8754.
  5. Public Health Activities. We may disclose your PHI for certain public health purposes including, but not limited to: (1) to report health information to public health authorities for the purpose of preventing or controlling disease, injury or disability; (2) to report child abuse and neglect, elder abuse, and disabled persons abuse to public health authorities or other government authorities authorized by law to receive such reports; (3) to report information about products and services under the jurisdiction of the U.S. Food and Drug Administration; (4) if we know or have reason to believe that you are infected with a sexually transmitted disease, to alert your fiancee (if you are engaged) or your spouse (if you are married), or your parent or guardian (if you are a minor, unless as a minor you have sought treatment with us for such sexually transmitted disease); (5) to report information to your insurer and/or the Massachusetts Division of Industrial Accidents as required under laws addressing work-related illnesses and injuries or workplace medical surveillance; (6) to report information related to the birth and subsequent health of an infant to state government agencies as required by law; (7) to file a death certificate and report fetal deaths; and (8) to report abortions performed after 24 weeks of pregnancy to state government agencies as required by law.
  6. Victims of Abuse, Neglect or Domestic Violence. If permitted by law, we may disclose your PHI to an authorized governmental authority, including a social service or protective services agency if we reasonably believe you are a victim of abuse, neglect or domestic violence.
  7. Health Oversight Activities. We may disclose your PHI to a health oversight agency in connection with an audit, inspection, investigation or licensing review to ensure compliance with the rules of government health programs such as Medicare or Medicaid.
  8. Judicial and Administrative Proceedings. We may disclose your PHI in the course of a judicial or administrative proceeding in response to a legal order or other lawful process.
  9. Law Enforcement Officials. We may disclose your PHI to the police or other law enforcement officials as required or permitted by law or in compliance with a court order or a grand jury or administrative subpoena.
  10. In the Event of Your Death. We may disclose your PHI to (1) coroners or medical examiners for the purpose of identifying you or determining the cause of your death, or other duties as authorized by law; or (2) funeral directors to assist them in carrying out their duties.
  11. Organ, Eye and Tissue Donation. If you are a donor or a proposed organ, eye or tissue recipient, we may release information to organizations that handle organ, eye or tissue procurement, storage or transplants in order to facilitate donation, banking or transplants.
  12. Research. We may use or disclose your PHI without your authorization for the purpose of preparing a research project. In most cases, we must obtain your authorization to use or disclose your PHI to conduct a research project. In some cases, we may use or disclose your PHI to conduct a research project without your authorization, but only if our Institutional Review Board approves a waiver of authorization for disclosure or the use of a limited data set, which includes only a limited amount of identifying information.
  13. Health or Safety. We may use or disclose your PHI to prevent or lessen a serious and imminent threat to a person's or the public's health or safety.
  14. Specialized Government Functions. We may use and disclose your PHI to units of the government with special functions, such as the U.S. military, Secret Service, or the U.S. Department of State under certain circumstances.
  15. Workers' Compensation. We may disclose your PHI as authorized by and to the extent necessary to comply with state law relating to workers' compensation or other similar programs.
  16. Ordered Examinations. We may disclose your PHI when required to report findings from an examination ordered by a court or detention facility.
  17. As Required By Law. We may use and disclose your PHI when required to do so by any other law not already referred to in the preceding categories.

IV. Uses and Disclosures Requiring Your Written Authorization

  1. Use or Disclosure with Your Authorization. For any purpose other than the ones described above in Section III, we may only use or disclose your PHI when you grant us your written authorization on our authorization form ("Your Authorization"). For instance, you will need to execute an authorization form before we can send your PHI to your life insurance company or to the attorney representing the other party in litigation in which you are involved. You also understand that after we have disclosed your PHI with your authorization, we can no longer control how those individuals or entities receiving your PHI will treat that information and that the privacy laws may no longer protect the information from further disclosure.
  2. Marketing. We must also obtain your written authorization prior to using your PHI to send you any marketing materials ("Your Marketing Authorization"). We can, however, use (but not disclose to a third party) your PHI to provide you with marketing materials in a face-to-face encounter without obtaining Your Marketing Authorization. We are also permitted to use (but not disclose to a third party) your PHI to give you a promotional gift of nominal value, if we so choose, without obtaining Your Marketing Authorization. In addition, we may use (but not disclose to a third party) your PHI to communicate with you about products or services relating to your treatment, case management or care coordination, or alternative treatments, therapies, providers or care settings without Your Marketing Authorization, and we may use your PHI to identify health-related services and products that may be beneficial to your health and then contact you about the services and products.
  3. Uses and Disclosures of Your Highly Confidential Information. Federal and state law require special privacy protections for certain highly confidential information about you ("Highly Confidential Information"), including:
    1. your HIV/AIDS status;
    2. genetic testing information;
    3. confidential communications with a psychotherapist, psychologist, social worker, allied mental health professional, or human services professional;
    4. substance abuse (alcohol or drug) treatment or rehabilitation information;
    5. sexually transmitted disease information;
    6. abortion consent form(s);
    7. mammography records;
    8. family planning services;
    9. treatment or diagnosis of emancipated minors;
    10. mental health community program records; and
    11. research involving controlled substances.

    In order for us to disclose your Highly Confidential Information for a purpose unrelated to treatment, payment, or health care operations, we must obtain your separate, specific written consent unless we are otherwise permitted by law to make such disclosure.

    If you are an emancipated minor, certain information relating to your treatment or diagnosis may be considered "Highly Confidential Information" and as a result will not be disclosed to your parent or guardian without your consent. If a physician reasonably believes your condition to be so serious that your life or limb is endangered, we may notify your parents or guardian without your authorization. We will inform you of any such notification.

    Please note that if you are a parent or legal guardian of an emancipated minor, certain portions of the emancipated minor's medical record (or, in certain instances, the entire medical record) may not be accessible to you.

V. Your Rights Regarding Your Protected Health Information

  1. For Further Information. If you desire further information about your privacy rights you may contact our Privacy Office. (See Section VII for phone number and address.)
  2. Complaints. If you are concerned that we have violated your privacy rights or disagree with a decision that we made about access to your PHI, you may contact our Patient Relations Office at (617) 665-1398. You may also file written complaints with the Director, Office for Civil Rights of the U.S. Department of Health and Human Services. Upon request, we will provide you with the correct address for the Director. We will not retaliate against you if you file a complaint with us or the Director.
  3. Right to Request Additional Restrictions. You may request restrictions on our use and disclosure of your PHI

    1. for treatment, payment and health care operations,
    2. to individuals (such as a family member, other relative, close personal friend or any other person identified by you) involved with your care or with payment related to your care, or
    3. to notify or assist in the notification of such individuals regarding your location and general condition.

    While we will consider all requests for additional restrictions carefully, we are not required to agree to a requested restriction. If you wish to request additional restrictions, please obtain a request form from our HIM/Medical Records Department and submit the completed form to the HIM/Medical Records Department. We will send you a written response.
  4. Right to Receive Confidential Communications. You may request, and in certain situations we may be able to accommodate, any reasonable written request to contact you at a location other than the address we have on file or by alternative means of communication. Your request should be made in writing and must include exactly how we should contact you.
  5. Right to Revoke Your Authorization. You may revoke Your Authorization, Your Marketing Authorization or any written authorization obtained in connection with your Highly Confidential Information, except to the extent that we have taken action in reliance upon it, by delivering a written revocation statement to the Privacy Office identified below. A form of written revocation is available upon request from the HIM/Medical Records Department.
  6. Right to Inspect and Copy Your Health Information. You may request access to your medical record file and billing records maintained by us in order to inspect and request copies of the records. Under limited circumstances, we may deny you access to a portion of your records. If we deny you access to a portion of your records, we will tell you why and you will have an opportunity to have a third person review your request. If you would like access to your records, please obtain a record request form from the HIM/Medical Records Department and submit the completed form to the HIM/Medical Records Department. If you request copies, we will charge you a reasonable cost-based fee. We will also charge you for our postage costs, if you request that we mail the copies to you.

    You should take note that, if you are a parent or legal guardian of a minor, certain portions of the minor's medical record will not be accessible to you, for example, records relating to abortion, contraception and/or family planning services, and other health care issues which are protected by law.
  7. Right to Request Amendments to Your Records. You have the right to request that we correct, change or delete certain PHI maintained in our enrollment, payment, claims adjudication, and case or medical management records, or other records that may be used to make decisions about you and your health care if you believe that the information is incorrect or incomplete. If you would like us to amend your records, please obtain an amendment request form from the HIM/Medical Records Department and submit the completed form to the HIM/Medical Records Department. If we cannot or do not believe it is appropriate to amend your PHI, we will notify you of this decision in writing. You will then have the option of asking us to make your request for a change/correction of your PHI a part of your record or ask to have a third party review our decision. We cannot amend information that we did not create without receiving information or instructions to do so from the creator of the records.
  8. Right to Receive An Accounting of Disclosures. You have the right to obtain a list of when and with whom we have shared your PHI. Our response will not include uses or disclosures related to treatment, payment or health care operations or uses or disclosures for which you signed a written authorization. You may obtain an accounting of the remaining disclosures made by us during any period of time prior to the date of your request provided such period does not exceed six years and does not apply to disclosures that occurred prior to April 14, 2003. If you request an accounting more than once during a twelve (12) month period, we will charge you a reasonable, cost-based fee for each additional statement.
  9. Right to Receive Paper Copy of this Notice. Upon request, you may obtain a paper copy of this Notice, even if you previously agreed to receive the notice electronically.

VI. Duration of This Notice

Right to Change Terms of this Notice. We may change the terms of this Notice at any time. If we change this Notice, we may make the new Notice terms effective for all Protected Health Information that we maintain, including any information created or received prior to issuing the new Notice. If we change this Notice, we will post the new Notice in designated areas at Cambridge Health Alliance and on our Internet site at www.challiance.org. You also may obtain any new Notice by contacting the Privacy Office.

VII. Privacy Office

You may contact Cambridge Health Alliance's Privacy Officer by calling (617) 665-1227 or writing to:
Privacy Office
Cambridge Health Alliance
432 Columbia Street, Suite 15-16C
Cambridge, MA 02141

To obtain copies of authorization, amendment or other forms, please contact the HIM/Medical Records Department where you received your care.