This Notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

This information pertains to facilities and services managed by Heritage.

Understanding Your Health Record/Information

Each time you are admitted to a nursing facility, a record of your stay is made. Typically, this record contains your symptoms, examination and test results, diagnoses, treatment, and a plan for future care or treatment. This information, often referred to as your health or electronic or paper medical record, serves as a:

• Basis for planning your care and treatment
• Means of communication among the many health professionals who contribute to your care
• Legal document describing the care you received
• Means by which you or a third-party payer can verify that services billed were actually provided
• A tool in educating health professionals
• A source of data for medical research
• A source of information for public health officials who oversee the delivery of health care in the United States
• A source of data for facility planning and marketing
• A tool with which we can assess and continually work to improve the care we render and the outcome we achieve

Understanding what is in your record and how your protected health information (PHI) is used helps you to: ensure its accuracy, better understand who, what, when, where, and why others may access your health information, and make more informed decisions when authorizing disclosure to others.

Our Responsibilities

Our nursing facility is required to:

• maintain the privacy and security of your protected health information (PHI)
• provide you with a notice as to our legal duties, privacy and security practices with respect to information we collected and maintain about you
• abide by the terms of this notice.
• notify you if we are unable to agree to a requested restriction
• accommodate reasonable requests you may have to communicate health information by alternative means or at alternative locations.
• notify you promptly if a breach occurs that may have compromised the privacy or security of your health information.

We reserve the right to change our practices and to make the new provisions effective for all protected health information we maintain. Should our information practices change, we will post a copy of the current Notice, which will identify its effective date, in our facilities and on our website at www.heritageofcare.com.

We will not use or disclose your health information without your authorization, except as described in this notice.

How We Will Use or Disclose Your Health Information

• Treatment. We will use your health information for treatment. For example, information obtained by a nurse, physician, or other member of your healthcare team will be recorded in your record and used to determine the course of treatment that should work best for you. Your physician will document in your record his or her expectations of the members of your healthcare team. Members of your healthcare team will then record the actions they took and their observations. In that way, the physician will know how you are responding to treatment. We will also provide your physician or a subsequent healthcare provider with copies of various reports that should assist him or her in treating you during your course of treatment and once you’re discharged from our nursing facility. Copies of original documents may be made for internal use.
• Payment. We will use your health information for payment. For example, a bill may be sent to you or a third-party payer, including Medicare or Medicaid. The information on or accompanying the bill may include information that identifies you, as well as your diagnosis, procedures, and supplies used.
• Health care operations. We will use your health information for regular health care operations. For example, members of the medical staff, the risk or quality improvement manager, or members of the quality improvement team may use information in your health record to assess the care and outcomes in your case and others like it. This information will then be used in an effort to continually improve the quality and effectiveness of the health care and service we provide.
• Business associates. There are some services provided in our organization through contacts with business associates. Examples include our accountants, consultants and attorneys. When these services are contracted, we may disclose your health information to our business associates so that they can perform the job we’ve asked them to do. To protect your health information, however, we require the business associates to appropriately safeguard your information.
• Directory. Unless you notify us that you object, we may use your name, location in the facility, general condition, and religious affiliation for directory purposes. The directory is often posted near the front door of our facilities. This information may also be provided to members of the clergy and, except for religious affiliation, to other people who ask for you by name. We may also use your name on a nameplate next to or on your door in order to identify your room, unless you notify us that you object.
• Notification. We may use or disclose information to notify or to assist in notifying a family member, personal representative, or another person responsible for your care, of your location, and general condition. If we are unable to reach your family member or personal representative, then we may leave a message for them at the phone number that they have provided us, e.g., on an answering machine.
• Communication with family. Health professionals, using their best judgment, may disclose to a family member, other relative, close personal friend or any other person you identify, health information relevant to that person’s involvement in your care or payment related to your care, unless you notify us that you object to any person or person(s) by name.
• Research. We may disclose information to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your health information.
• Funeral directors. We may disclose health information to funeral directors and coroners to carry out their duties consistent with applicable law.
• Organ procurement organizations. Consistent with applicable law, we may disclose health information to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs for the purpose of tissue donation and transplant.
• Marketing. We may contact you to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you, unless you object to participate in marketing activity.
• Food and Drug Administration (FDA). We may disclose to the FDA health information relative to adverse events with respect to food, supplements, product and product defects, or post marketing surveillance information to enable product recalls, repairs, or replacement.
• Workers compensation. We may disclose health information to the extent authorized by and to the extent necessary to comply with laws relating to workers compensation or other similar programs established by law.
• Public health. As required by law, we may disclose your health information to public health or legal authorities charged with preventing or controlling disease, injury, or disability.
• Law enforcement. We may disclose health information for law enforcement purposes as required by law or in response to a valid subpoena. Similarly, should you be an inmate of a correctional institution, we may disclose to the institution or agents thereof health information necessary for your health and the health and safety of other individuals.
• Reports. Federal law makes provision for your health information to be released to an appropriate health oversight agency, public health authority or attorney, provided that a work force member or business associate believes in good faith that we have engaged in unlawful conduct or have otherwise violated professional or clinical standards and are potentially endangering one or more patients, workers or the public.
• Incidental disclosures. Unless you notify us that you object, your name and likeness may be used in our building, newsletters, and other publications, which report on birthdays, celebrations, community activities and other events and occasions involving our facility.
• Health Information Exchange(s). We may disclose to participating providers of Health Information Exchanges(s), health information relative to provide accurate patient care. It is the responsibility of the individual to notify the provider of any restriction.
• Accountable Care Organizations (ACOs). We may disclose your health information to healthcare organizations, practitioners and their contractors for care coordination and quality improvement purposes.

Your Health Information Rights and Choices

Although your health record is the physical property of the nursing facility, the information in your health record belongs to you. You have the following rights:

• You may request that we not use or disclose your health information for a particular reason related to treatment, payment, the Facility’s general health care operations, and/or to a particular family member other relative or close personal friend. We ask that such requests be made in writing on a form provided by our facility. Although we will consider your request, please be aware that we are under no obligation to accept it or to abide by it. For more information about this right, see 45 Code of Federal Regulations (C.F.R.) § 164.522(a).
• If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information. For more information about this right, see 45 C.F.R. § 164.522.
• If you are dissatisfied with the manner in which or the location where you are receiving communications from us that are related to your health information, you may request that we provide you with such information by alternative means or at alternative locations. Such a request must be made in writing, and submitted to the facility Administrator. We will attempt to accommodate all reasonable requests. For more information about this right, see 45 C.F.R. § 164.522(b).
• You may request to inspect and/or obtain copies of health information about you, which will be provided to you in the time frames established by law. If you request copies, we will charge you a reasonable fee. For more information about this right, see 45 C.F.R. § 164.524(b).
• If you believe that any health information in your record is incorrect or if you believe that important information is missing, you may request that we correct the existing information or add the missing information. Such requests must be made in writing, and must provide a reason to support the amendment. We ask that you use the form provided by our facility to make such requests. For a request form, please contact the Administrator, Director of Nursing, or Social Services Director at your facility. For more information about this right, see 45 C.F.R. § 164.526.
• You may request that we provide you with a written accounting of all disclosures made by us during the time period for which you request (not to exceed 6 years, and commencing April 14, 2003). We ask that such requests be made in writing on a form provided by our facility. Please note that an accounting will not apply to any of the following types of disclosures: disclosures made for reasons of treatment, payment or health care operations; disclosures made to you or your legal representative, or any other individual involved with your care; disclosures to correctional institutions or law enforcement officials; and disclosures for national security purposes. You will not be charged for your first accounting request in any 12 month period. However, for any requests that you make thereafter, you will be charged a reasonable, cost-based fee. For more information about this right, see 45 C.F.R. § 164.528.
• You have the right to obtain a paper copy of our Notice of Privacy Practices upon request.
• You may choose someone to act for you. If you have given someone medical Power of Attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action. For more information about this right, see 45 C.F.R. § 164.514(h); 45 C.F.R. § 164.530(c).
• You may revoke an authorization to use or disclose health information, except to the extent that action has already been taken. Such a request must be made in writing.

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions. If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious or imminent threat to health or safety.

• You have the right and the choice to share information with your family, close friends, or others involved in your care.
• You have the right and the choice to share information in a disaster relief situation.
• You have the right and the choice to include information in a directory.

Certain uses and disclosures will be made only with the individual written authorization and you may revoke such authorization as provided by 45 C.F.R. § 164.508(b)(5). In these cases we never share your information unless you give us written permission for:

• Marketing purposes
• Sale of your information
• Most sharing of psychotherapy notes

In the case of fundraising we may contact you for fundraising efforts; you can tell us if you prefer to opt out of fundraising communication.

Breach Notification

A “breach” means the acquisition, access, use or disclosure of protected health information (PHI) in a manner not permitted under subpart E of this part which compromises the privacy or security of the PHI. The breach poses a significant risk of financial, reputational, or other harm to individual. For more information about breach notification, see 45 C.F.R. § 164.402.

Unsecured protected health information means protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in the guidance issued under HITECH section 13402(h)(2) of Public Law 111-5.

Notification to individuals will comply with 45 C.F.R. § 164.404; 45 C.F.R. § 164.406 and 45 C.F.R. § 164.408 as applicable.

For More Information or to Report a Problem

If you have questions and would like additional information, you may contact Heritage Operations Group Privacy Officer at (309) 828-4361.

If you believe that your privacy rights have been violated, you may file a complaint with us. These complaints must be filed in writing on a form provided by our facility. The complaint form may be obtained from the Administrator, Director of Nursing, or Social Services Director, and when completed should be returned to your facility Administrator. There will be no retaliation for filing a complaint.

You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services Office for Civil Rights by:

Sending a letter to:
U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Ave., S.W.
Washington, D.C. 20201

Calling: 1-877-696-6775

Or visiting: www.hhs.gov/ocr/privacy/hipaa/complaints/

Effective Date: September 23, 2013
Revised Date: July 16, 2019