THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
We are required by law to protect the privacy of your health information. We are also required to provide you notice, which explains how we may use information about you and when we can disclose that information to others. You also have rights regarding your health information that are described in this notice. We are required by law to abide by the terms of this notice.
The terms “information” or “health information” in this notice include any information we maintain that reasonably can be used to identify you and that relates to your physical or mental health condition, the provision of health care to you, or the payment for such health care.
We have the right to change our privacy practices and the terms of this notice. If we make a material change to our privacy practices, we will post the revised notice in a prominent public location and also have copies available upon request.
THM collects and maintains oral, written and electronic information to administer our business and to provide products, services and information of importance to our patients. We maintain physical, electronic and procedural security safeguards in the handling and maintenance of our patients’ information, in accordance with applicable state and federal standards, to protect against risks such as loss, destruction or misuse.
The following categories describe the ways that we use and disclose medical information about you. Not every use or disclosure in a category will be listed. However, all of the ways we use and disclose medical information about you will fall into one of these categories.
1. For Treatment: We may use or disclose medical information about you to provide you with medical treatment and/or pharmacy services. We may disclose medical information about you to doctors, nurses, pharmacists, therapists or other personnel who are involved in taking care of you in order to coordinate your care. This would include, for example, information regarding medications being taken, lab work and x-rays. For example, a doctor treating you for a broken leg might review x-rays or other information gathered by a radiologist in order to treat you properly. We may also share information about the medications you are prescribed with your doctor who needs to know what other medications you are taking to protect against harmful drug interactions, or we may provide medical information to a consultant pharmacist who reviews your treatment.
2. For Payment: We may use or disclose medical information about you so that the services you receive may be billed to you, an insurance company, or a third party. For example, if you have health insurance we will disclose information to your health plan about services provided or medications dispensed to you. We may also tell your health plan about a treatment or medication you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment or medication.
3. For Health Care Operations: We may use or disclose medical information about you for our health care operations. For example, members of the medical staff, nursing staff, pharmacy staff, or the quality improvement team may use medical information about you to assess the health care or pharmacy services provided to you and the outcomes from that health care or pharmacy service in an effort to continually improve the quality and effectiveness of the health care and pharmacy services we provide. We may use medical information about our patients to decide what additional services we should offer.
4. Other Uses and Disclosures of Medical Information About You
Affiliated Covered Entity: An affiliated covered entity is comprised of a group of entities all under common ownership or control who designate themselves as a single affiliated covered entity for purposes of complying with HIPAA. The entities participating in this affiliated covered entity, as listed in this Notice, will use and disclose your medical information as permitted by this Notice and as required to conduct, assess and facilitate your health care and pharmacy needs.
Organized Health Care Arrangement: An organized health care arrangement is a clinically-integrated care setting in which individuals typically receive health care services from more than one health care provider. As an organized health care arrangement, we will share medical information among the participants in the organized health care arrangement, as necessary, to carry out treatment, payment, or health care operations relating to the organized health care arrangement.
Business Associates: There are some services provided through contracts with business associates. Examples could include attorneys, consultants, or a copy service used when making copies of your health record. When these services are contracted, we will disclose information to these business associates so that they can perform their jobs, and so they can bill for the services rendered. To protect the medical information about you, however, we require the business associate to appropriately safeguard the information.
Directory: We may use your name, your location in a facility, your general condition (e.g., fair, stable, etc.) and your religious affiliation for directory purposes. This is so your family, friends, and clergy can visit you in the facility and generally know how you are doing. This information, except for your religious affiliation, may be disclosed to people who ask for you by name. Your religious affiliation may be disclosed to a member of the clergy even if they don’t ask for you by name. You have the right to restrict or prohibit some or all of the uses and disclosures described here.
Individuals Involved in Your Heath Care or Pharmacy Services or Payment for Your Health Care or Pharmacy Services: We may disclose medical information about you to a family member, a close personal friend, or any other person identified by you. We will disclose only the information that is directly relevant to that individual’s involvement with your health care or pharmacy services or with the payment for your health care or pharmacy services. We may also use or disclose information about you to notify, or to assist in the notification of, family members, personal representatives, or others responsible for your health care of your location and general condition. In addition, we may disclose medical information about you to an entity assisting in a disaster relief effort so that your family can be notified about your location and condition. You have the right to object to these disclosures to the extent that your objection does not interfere with the ability to respond to emergency circumstances.
Required by Law: We may use or disclose medical information about you as required by state or federal law, but only to authorized persons, and only to the extent necessary to meet the requirements of those laws.
Public Health Activities: We may disclose medical information about you to a public health authority that is authorized to receive such information for public health purposes, including:
• Prevention or control of disease, injury or disability
• Reporting births and deaths;
• Reporting child abuse or neglect;
• Reporting reactions to medications or problems with products;
• Notifying people of recalls of products;
• Notifying a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease.
Abuse, Neglect, or Domestic Violence: We may disclose information about you to the appropriate authorities if we believe that you have been the victim of abuse, neglect, or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.
Health Oversight Activities: We may disclose medical information about you to a health oversight agency for activities authorized by law. These oversight activities may include audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
Judicial or Administrative Proceedings: We may disclose medical information about you in response to a court or administrative order. We may also disclose medical information about you in response to a HIPAA-compliant subpoena or court order, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.
Law Enforcement: We may disclose medical information about you when requested by law enforcement official:
• In response to a court order, subpoena, warrant, summons or similar process;
• To identify or locate a suspect, fugitive, material witness, or missing person;
• About you, if you are the victim of a crime and, under certain limited circumstances, we are unable to obtain your agreement;
• About a death we believe may be the result of criminal conduct;
• About criminal conduct regarding the Facility; or
• In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.
Coroners, Medical Examiners and Funeral Directors: We may disclose medical information about you to a coroner or medical examiner. This may be necessary to identify a deceased person or determine the cause of death. We may also disclose medical information to funeral directors as necessary to carry out their duties.
Organ and Tissue Donation: If you are an organ or tissue donor, we may disclose medical information about you to organizations that handle organ procurement to facilitate donation and transplantation.
Research: We may disclose medical information about you to researchers when we have documentation that the research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of the health information.
To Avert a Serious Threat to Health or Safety: We may disclose medical information about you to prevent a serious threat to your health and safety or the health and safety of the public or another person.
Specialized Government Functions: We may disclose medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law. If you are a member of the armed forces, we may disclose medical information about you as required by military authorities. We may also disclose medical information about foreign military personnel to the appropriate foreign military authority. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose medical information about you to the correctional institution or law enforcement official. This disclosure would be necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
Workers’ Compensation: We may disclose medical information about you for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.
Benefits and Services: We may use or disclose medical information about you to tell you about possible treatment options or alternatives that may be of interest to you, or to tell you about health-related benefits or services that may be of interest to you. For example, we may use information about you to provide appointment or prescription refill reminders to you.
Data Breach Notification Purposes: We may use your contact information to provide legally-required notices of unauthorized acquisition, access, or disclosure of your health information. We may send notice directly to you and/or the Department of Health.
Additional Restrictions on Use and Disclosure: Certain federal and state laws may require special privacy protections that restrict the use and disclosure of certain health information, including highly confidential information about you. “Highly confidential information” may include confidential information under Federal laws governing alcohol and drug abuse information and genetic information as well as state laws that often protect the following types of information:
• HIV/AIDS;
• Mental health;
• Genetic tests;
• Alcohol and drug abuse;
• Sexually transmitted diseases and reproductive health information; and
• Child or adult abuse or neglect, including sexual assault.
Electronic Storage and Transmission: We may record and transmit your health information electronically. This includes but is not limited to information about the medicines you take and your prescriptions. Health information may also be shared electronically through local, regional, state and national health information networks.
Marketing: We must receive your authorization for any use or disclosure of medical information for marketing, except if the communication is in the form of a face-to-face communication made to you personally; or a promotional gift of nominal value provided by us. It is not considered marketing to send you information related to your individual treatment, case management and care coordination or to direct or recommend alternative treatment, therapies, health care providers or settings of care. These may be sent without written permission. If the marketing is to result in direct or indirect payment to us by a third party, we will state this on the authorization.
Sale of PHI: We must receive your authorization for any disclosure of your PHI which is a sale of PHI. Such authorization will state that the disclosure will result in remuneration to THM or one of its’ managed providers.
Confidentiality of Psychotherapy Notes: We must receive your authorization for any use or disclosure of psychotherapy notes, except: for use by the originator of the psychotherapy notes for treatment or health oversight activities; for use or disclosure by THM for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; for use or disclosure by THM to defend itself in a legal action or other proceeding brought by you; to the extent required to investigate or determine THM’s compliance with the HIPAA regulations; to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law; for health oversight activities with respect to the oversight of the originator of the psychotherapy notes; for disclosure to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law; or if disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and is made to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.
If a use or disclosure of health information described above in this notice is prohibited or materially limited by other laws that apply to us, it is our intent to meet the requirements of the more stringent law.
Except for uses and disclosures described and limited as set forth in this notice, we will use and disclose your health information only with a written authorization from you. Once you give us authorization to release your health information, we cannot guarantee that the person to whom the information is provided will not disclose the information. You may take back or “revoke” your written authorization at any time in writing, except if we have already acted based on your authorization. To find out where to mail your written authorization and how to revoke an authorization, contact the phone number listed on the back of your ID card.
Although your health record is our property, the information belongs to you. You have the following rights regarding your medical information:
1. Right to Request Restrictions: You have the right to request a restriction or limitation on the medical information we use or disclose about you. For example, you may request that we not disclose information about a surgery you had to a certain family member or that we not allow a certain family member to know what medications you are prescribed. You have the right to require restrictions on disclosure of your medical information to a health plan where you paid out of pocket, in full, for items or services, and we are required to honor this request. Otherwise, we are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment.
You must submit your request in writing. In your request, you must tell us (1) what information you want to limit; and (2) to whom you want the limits to apply, for example, disclosures to your spouse.
2. Right to Request Alternate Communications: You have the right to request that we communicate with you in a confidential manner or at a specific location. For example, you may ask that we only contact you via mail at a post office box. You must submit your request in writing. Your request must specify how or where you wish to be contacted. We will not ask you the reason for your request. We will accommodate all reasonable requests.
3. Right to view and obtain a copy: You have the right to view and/or obtain a copy of your health information. You must make a written request. We may charge a reasonable fee for any copies. If we maintain an electronic health record containing your health information, you will have the right to request that we send a copy of your health information in an electronic format to you or to a third party that you identify. We may charge a reasonable fee for sending the electronic copy of your health information.
4. Right to Amend: If you feel that medical information in your record is incorrect or incomplete, you may ask us to amend the information. You have this right for as long as the information is kept by or for us. You must submit your request in writing to our business office, Administrator, or Executive Director as applicable. In addition, you must provide a reason for your request. We may deny your request for an amendment if it is not in writing or it does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:
• Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
• Is not part of the medical information kept by or for us; or
• Is accurate and complete.
If your request for an amendment is denied, and you disagree with the reason for the denial, you may file a statement of disagreement in your record.
5. Right to an Accounting of Disclosures: You have the right to request an “accounting of disclosures.” This is a list of certain disclosures we made of your medical information, other than those made for purposes such as treatment, payment, or health care operations.You must submit your request in writing to our business office, Executive Director or Compliance Department. Your request must state a time period which may not be longer than six (6) years from the date the request is submitted and may not include dates before April 14, 2003. Your request should indicate in what form you want the list (for example, on paper or electronically). The first list you request within a 12 month period will be free. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
6. Right to a Paper Copy of This Notice: You have the right to a paper copy of this notice even if you have agreed to receive the notice electronically. You may ask us to give you a copy of this notice at any time by contacting us at the location described below under “Contacting Us.” You may also obtain a copy of this notice on our website at https://thmgt.com/privacy-policy/.
Other uses and disclosures of medical information not covered by this notice or the laws that apply to us will be made only with your written authorization. If you provide us authorization to use or disclose medical information about you, you may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose medical information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your authorization, and that we are required to retain our records of the care that we provided to you.
We are required to abide by the terms of this notice, as it may be updated from time to time. We reserve the right to change this notice and to make the changed notice effective for information we already have about you as well as any information we receive in the future. If we change this notice, the new notice will specify the effective date for the changed notice, and we will distribute the new notice to all patients/clients on service at the time of the change. Copies of the current notice can be obtained by contacting us at the location described below under “Contacting Us” or by visiting our website at https://www.thmgt.com.
If you believe your privacy rights have been violated, you may file a complaint with us at the location described below under “Contacting Us” or with the Secretary of the United States Department of Health and Human Services. All complaints should be submitted in writing. You will not be retaliated against for filing a complaint.
In the event of any breach of unsecured PHI, we shall fully comply with the HIPAA/HITECH breach notification requirements, which will include notification to you of any impact that breach may have had on you and/or your family member(s) and actions we undertook to minimize any impact the breach may or could have on you.
To request additional copies of this notice or to receive more information about our privacy practices or your rights, please contact THM’s Chief Compliance Officer at:
512 Autumn Springs Court, Suite A
Franklin, TN 37013
(615) 905-5403
H. EFFECTIVE DATE
THE EFFECTIVE DATE OF THIS NOTICE IS AUGUST 1, 2013.