Legal and Compliance Information HIPAA Notice of Privacy Practices

When it comes to your health information, you have certain rights. This section explains your rights and our responsibilities to help you. You have the right to:

Access and understand this Notice of Privacy Practices

• You may ask for a paper copy of this Notice at any time. If you need help understanding this Notice we will provide language and content support.

Get an electronic or paper copy of your medical record

• You may ask to see or receive an electronic or paper copy of your medical record and other health information.
• Contact Health Information Management to request a summary of your record (contact information is at the end of this document). You will need to provide proper identification and a description of the information you are seeking.
• We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable fee that is based on Massachusetts state-regulated rates.
• We may deny requests that are not legal, not permitted, or are a safety threat or concern.

Ask us to correct your medical record

• You may ask us to correct or amend health information about you that is incorrect or incomplete.
• Contact Health Information Management to request a correction to your record.
• We may say “no” to your request, but we will tell you why in writing within 60 days.

Request confidential communications

• You may ask us to contact you in a specific way (for example, home or office phone) or to send mail, or encrypted email, to a different address.
• To request confidential communications, submit your written request to the Boston Children’s program where you register or sign-in.
• We will say “yes” to all reasonable requests that we have the ability to fulfill.

Ask us to limit what we use or share

• You may ask us not to use or share certain health information for treatment, payment, or healthcare operations (for example, for use in a patient directory, or to your family members and others involved in your care).
• We are not required to agree to requested restrictions except in the case of a disclosure to a health insurer, and we may say “no” if it would affect your care.
• If you pay for a service or health care item out-of-pocket in full, you may ask us not to share information with your health insurer. We will say “yes” unless a law requires us to share that information.

Get a list of those with whom we have shared information

• You may ask for a list of the times we have shared your health information for six years before the date of your request, who we shared it with, and why. To request an accounting of disclosures, contact Health Information Management.
• We will include all the disclosures, except for those about treatment, payment, and health care operations, which we are allowed to make without your authorization.
• We will provide one accounting a year for free, but will charge a reasonable, cost-based fee if you ask for another one within 12 months.

Choose someone to act for you

• If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.
• To let us know that another person may make medical choices for you, inform your health care provider.
• We will make sure the person has been authorized to make medical decisions for you before we take any action.

• Patients younger than the age of 18 are usually considered minors. Most of the time, the parents or legal guardians of minor patients make decisions about their children’s medical care and have the privacy rights described in this Notice.
• However, there are times a minor may exercise these rights and may even legally keep information confidential from their parents or guardians. For example, a minor has the consenting rights of an adult with respect to diagnosis and care of some conditions (defined by law) such as sexually transmitted diseases, drug dependency, and pregnancy. In addition, minor patients who are married, have given birth to a child, or meet other legal criteria are considered “mature minors” and possess the right to say who receives that information.
• When minor patients are legally permitted to make decisions about their own medical care, they can usually control the release of their medical information even to their parents or legal guardians.

You may complain if you feel we have violated your rights. We will not retaliate against you for filing a complaint.

• To file a complaint with Boston Children’s, contact Patient Relations or our Privacy Officer (contact information is at the end of this document).
  To file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights, send a letter to 200 Independence Ave. SW, Washington, DC 20201, call 877-696-6775, or visit www.hhs.gov/ocr/privacy/hipaa/complaints/.

For certain health information, you may tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions. In these cases, you have both the right and choice to tell us to:

• Share information with your family, close friends, or others involved in your care
• Share information in a disaster relief situation
• Include your information in a hospital directory such as your name, location within the facility, condition described in general terms, and religious affiliation. We may use the hospital directory for purposes to share information with religious leaders or to other persons who ask for you by name
• Locate a family member, personal representative, or others involved in your care • Share information with family members or others involved in your care or the payment of health care
• If you are not able to tell us your preference, for example, if you are unconscious, we may share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

In these cases we do not share your information unless you give us valid written permission:

• Marketing campaigns that identify you in images, recordings, and social media.
• Sale of your PHI
• Most psychotherapy notes written and kept by your therapist, except for purposes related to treatment, payment, or our operations, to avoid a serious threat to health or safety, or as required by law
• Substance abuse treatment records
• HIV/AIDS testing, diagnosis, or treatment information
• Information about reproductive health issues, such as sexually transmitted diseases or pregnancy.

In the case of fundraising:

• We may contact you for charitable fundraising efforts, to assist us in raising funds; however, you may opt out of receiving such communications and tell us not to contact you again.

You may revoke prior authorizations you have given us, provided the request is in writing; however, previously released information or an authorization granted as a condition of obtaining insurance coverage is not covered by this request.

Treatment

Without your authorization, we may use your health information and share it with other professionals who treat you. To care for you we may use or disclose your health information to:

• Provide, coordinate, or manage health care and related services. We may share information with other health care providers. For example, we may use and disclose your health information when you need a prescription, lab work, an x-ray, or other services
• Refer you to another health care provider, such as a specialist, home health agency, ambulance or transport company, and/or rehabilitation hospital
• Communicate with clinicians who previously treated or referred you to Boston Children’s, including your primary care physician, and to clinicians who will treat you after you leave Boston Children’s
• In some cases, providers at other health care organizations may be able to electronically access your health information created or maintained by Boston Children’s, either through a secure connection to our systems or through a secure network for the transmission of health information, such as the Massachusetts Health Information Highway. All of these providers are required to take steps to protect the confidentiality of your information.

Bill for your services

We may use and share your health information to bill and get payment from health plans or other entities. An example is that we give information about your treatment to your health insurance plan so it will pay for your services.

Run our operations

We may use and share your health information to improve your care, run our operations, and contact you when necessary for the purposes of health care fraud and abuse detection or compliance. We share your health information with:

• Suppliers and vendors known as Business Associates
• Joint programs and other affiliated institutions and health care practices
• Boston Children’s information systems, such as in our patient directory, our patient portal, or by secure email

You may ask us not to use or share certain health information for treatment, payment, or healthcare operations, and you may revoke prior authorizations you have given us to share your health information. Please submit your request in writing. We will do our best to accommodate your request but may not be able to do so if we have already taken action relying on your authorization, or if the authorization was obtained as a condition of obtaining insurance coverage. For example, we may use your dietary health information to influence our food service options.

Help with public health and safety issues

We may share health information about you for certain situations such as:

• Preventing disease
• Helping with product recalls
• Reporting adverse reactions to medications or products
• Reporting suspected abuse, neglect, or domestic violence
• Preventing or reducing a serious threat to anyone’s health or safety

Conduct research

We may use or share your information for health research when the research has been reviewed through an Institutional Review Board process that includes review of the research proposal and established protocols to ensure the privacy of your health information. Many research projects require your written permission before using or sharing your information. Sometimes, however, our researchers may use your information without your written permission. For example, our researchers may study your health information without using your name or other personal information. We may also use or share your information to plan a research project or tell you about research opportunities that might interest you. We may use your contact information to let you know about research projects that we think you may be interested in knowing about. We may contact you by mail, phone, or email if you have provided it to us. Information created or collected about you during a research project may be used and shared as described in this Notice.

Organ donation requests and medical examiners

• We may share health information about you with organ procurement organizations.
• We may share health information with a coroner, medical examiner, or funeral director when an individual dies.

Workers’ compensation, law enforcement, and other government requests

We will share information about you if required by law. We will share information with the Department of Health and Human Services, if required to prove that we are complying with federal privacy law. In certain cases, we will share your information but only with your written permission. We may use or share health information about you:

• For workers’ compensation claims
• Workplace compliance and school compliance requirements
• For law enforcement purposes and activities (such as locating a suspect and including certain distinguishing characteristics) or with a law enforcement official and to avert a serious or imminent threat of harm
• With health oversight agencies for activities authorized by law
• For special government functions such as military, prisons, national security, and presidential protective services
• We may share health information about you in response to a court or administrative order, or in response to a subpoena.

We are allowed and sometimes required to share your information in other ways — usually in ways that contribute to the public good, such as public health and research. We must meet many conditions in the law before we may share your information for these purposes.

• We are required by law to maintain the privacy and security of your PHI and abide by the terms of this Notice. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your PHI.
• We will follow the legal duties and privacy practices, with respect to your PHI, described in this Notice and give you a copy of it.
• We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you do change your mind.
• We maintain medical records for at least twenty years after the patient’s discharge or after the final treatment, as required by law. Our internal policies govern the safe retention and destruction of any of your information. A copy of our record retention policy is available upon request.

For more information see www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.

This Notice applies to Boston Children’s, its physicians, nurses, and other personnel. It applies to PHI at Boston Children’s, at satellite clinical sites owned and operated by Boston Children’s, and at Boston Children’s affiliated physician foundations.

Boston Children’s has joint programs with other institutions and health care providers. We may share resources and services with these programs for diagnosis, treatment, education, and research related to specific diseases, therapies, or conditions. Participating providers may share medical, quality assurance, administrative, fundraising, or research information. Some of the following entities covered by the Boston Children’s Notice of Privacy Practices include, but are not limited to:

• Boston Children’s at 333 Longwood Avenue
• Boston Children’s at Lexington
• Boston Children’s at North Dartmouth
• Boston Children’s at Peabody
• Boston Children’s at Waltham
• Martha Elliot Health Center

We reserve the right to change the terms of this Notice and to make the new Notice provisions effective for all PHI that we maintain. The Notice of Privacy Practices is available upon request at all Boston Children’s patient sites, and on our website. Our staff will respond if you have questions or concerns regarding your privacy rights.

Medical Record Information
Director of Health Information Management
Boston Children’s Hospital
300 Longwood Avenue, BCH3040
Boston, MA 02115
P: (617) 355-7546
F: (617) 730-0329

• Privacy Officer: 617-919-4309
• Patient Relations: 617-355-7673
• International Patients: 617-355-5209
• Patient Financial Services: 617-355-3397