Notice of Privacy Rights and Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

We create records of the health care and services you receive from us and we are committed to protecting that medical information. We are required by law to protect the privacy of any medical information that identifies you; provide you with this notice describing our legal duties and privacy practices with respect to your medical information; and to follow the terms of the most current Steward privacy notice.

1. Who Will Follow This Notice

   This notice describes the privacy practices of the Steward Health Care System Organized Health Care Arrangement (“Steward”) and applies to all Steward Health Care System hospitals, other Steward Health Care System health care providers, as well as health care providers who are participants in Steward Health Care Network and Steward Integrated Care Network, including their employees, medical staff, students and volunteers. Collectively these entities and individuals are referred to as “we” or “us” in this notice. We will share medical information among ourselves to carry out your treatment, payment, and healthcare operations activities. A full list of the Steward participants to which this notice applies is available at www.steward.org/OHCA. A paper copy is available upon request.

2. How We Use and Disclose Your Medical Information Without Your Written Permission

   We use and disclose your medical information to conduct many activities that are common in hospitals and other types of health care providers. In certain situations, which are described below in Section 3, we are required to obtain your written permission to use or disclose your medical information. The following are different situations in which we may use or disclose your medical information without your written permission.

   • Treatment: We use and disclose your medical information to provide, coordinate or manage your medical treatment and related services. For example, a physician will use your test results to diagnose and treat your injury or illness. We may share medical information with providers outside Steward such as a referring physician who is treating you.
   • Payment: We use and disclose your medical information so that we can obtain payment for health care services that we provide to you. For example, we may provide information about your treatment to your insurer or other company or program that arranges or pays for your health care, in order to obtain their prior approval and authorization for the treatment.
   • Health Care Operations: We use and disclose your medical information to support our efforts to improve the quality or cost of care and for our own management and planning. For example, we may use your medical information to measure the performance of our staff in how they care for you. We may also share your medical information with our business associates with whom we have contracted to provide services, such as a billing company or medical transcription service.
   • Other Health Care Providers: We may also share medical information with your doctor and other health care providers who are not part of Steward when they need it to provide Treatment to you, to obtain Payment for the care they give to you, to perform certain Health Care Operations, such as reviewing the quality and skill of health care professionals, or to review their actions in following the law.
   • Use or Disclosure for Directory Purposes for Patients in Steward Hospitals: We may include your name, location in the hospital, general health condition and religious affiliation in a patient directory without receiving your permission unless you tell us you do not want your information in the directory. Information in the directory may be shared with anyone who asks for you by name or with members of the clergy; however, religious affiliation will only be shared with members of the clergy.
   • Disclosure to Family, Friends and Other Caregivers: We may share your medical information with a family member, a close personal friend, or another person who you identify if we (1) first provide you with the chance to object to the disclosure and you do not object; (2) infer that you do not object to the disclosure; or (3) obtain your agreement to share your medical information with these individuals. The medical information we share will be limited to the information necessary for that person’s involvement with your care or payment for your health care. We may also use or share your medical information with an organization, such as the American Red Cross, assisting in a disaster relief effort, to notify (or assist in notifying) your family about your location and general condition. In the event you are deceased, and unless we know that you would object, we may share your medical information with a family member or a close personal friend that was involved with your care or payment for your health care. The medical information we share will be limited to the information necessary for that person’s involvement with your care or payment for your health care.
   • Public Health Activities: We are required or are permitted by law to report medical information to certain government agencies and others. For example, we may disclose your medical information for the following:
     • To report health information to public health authorities for the purpose of preventing or controlling disease, injury, or disability;
     • To report abuse and neglect to government authorities or social agencies that are legally permitted to receive the reports;
     • To report information about products and services to the U.S. Food and Drug Administration;
     • To alert a person who may have been exposed to a communicable disease or may otherwise be at risk of developing or spreading a disease or condition;
     • To report information to your employer as required under laws addressing work-related illnesses and injuries or workplace medical surveillance; and
     • To prevent or lessen a serious and imminent threat to a person for the public's health or safety, or to certain government agencies with special functions such as the State Department.
   • Health Oversight Activities: We may disclose your medical information to local, state or federal authorities that are responsible for the oversight of health care related matters, such as agencies administering Medicare and Medicaid.
   • Judicial and Administrative Proceedings: We may disclose your medical information in the course of a judicial or administrative proceeding in response to a legal order or other lawful process, to the extent the disclosure is authorized by a court, tribunal, or, in certain circumstances, to a subpoena, discovery request or other lawful process.
   • Law Enforcement Purposes: We may disclose your medical information to the police or other law enforcement officials as required or permitted by law as part of law enforcement activities and investigations.
   • Decedents: We may disclose your medical information to a coroner or medical examiner as authorized by law, and we may disclose medical information to funeral directors so they may carry out their obligations.
   • Organ and Tissue Procurement: We may disclose your medical information with organizations that facilitate organ, eye, or tissue procurement, banking, or transplantation.
   • Military and Veterans: If you are in the U.S. or foreign armed services, or a veteran, we may disclose your medical information as required by the proper military authority so that they may carry out their lawful duties.
   • National Security: We may disclose your medical information to the appropriate federal officials for the protection of the President, to other authorized persons, to conduct special investigations or for intelligence, counter-intelligence and other national security purposes.
   • Inmates: If you are an inmate in a correctional facility or in the custody of a law enforcement official, we may disclose your medical information to the correctional facility or law enforcement officer so that they may carry out their lawful duties.
   • Research: We may use or share your medical information if the group that oversees our research, the Institutional Review Board/ Privacy Board, approves a waiver of permission (authorization) for disclosure or for a researcher to begin the research process.
   • Workers' Compensation: We may disclose your medical information as permitted by or required by state law relating to workers' compensation or other similar programs.
   • As Required by Law: We may use and disclose your medical information when required to do so by federal, state or local law.
3. Uses and Disclosures Requiring Your Written Permission (Authorization)

   We are required to obtain your written permission to use or disclose your medical information for the following reasons. You may revoke an authorization at any time, in writing, except to the extent that we have acted in reliance on it.

   • Use or Disclosure with Your Permission (Authorization): For any purpose other than the ones described in Section 2, we may only use or share your medical information when you grant us your written permission (Authorization).
   • Marketing and Sale of Your Medical Information: We must also obtain your Authorization prior to using or disclosing your medical information to send you any marketing materials. However, we may communicate with you about products or services related to your Treatment, case management or care coordination, or alternative treatments, therapies, health care providers, or care settings without your permission. In addition, we are prohibited from selling your medical information without your written authorization to do so.
   • Uses and Disclosures of Your Highly Confidential Information: Federal and state law requires special privacy protections for certain highly confidential information including any portion of your medical information that is: (1) psychotherapy notes; or is about (2) mental health and developmental disabilities services; (3) alcohol and drug Treatment; (4) HIV/AIDS testing; (5) sexually transmitted disease(s); (6) genetic testing; (7) child abuse and neglect; (8) abuse of an adult with a disability; (9) sexual assault; or (10) Invitro Fertilization (IVF). Before sharing your Highly Confidential Information for a purpose other than as permitted by law, we must obtain your written permission.
4. How Long We Keep Your Medical Information

   As required by state law, Steward Health Care System hospitals maintain medical records for at least 20 years after your discharge or final treatment. A copy of the hospital medical record retention policy is available upon request.

5. Your Rights Regarding Your Medical Information

   With respect to the medical information maintained by Steward, you have the right:

   • To see and get a copy of your medical information that is used to make decisions about your care and treatment, including your medical and billing records. Under certain circumstances, we may deny your request. If we do so, we will send you a written notice describing the basis of our denial. Requests must be made in writing. We may charge a reasonable fee for copying, mailing or other expenses associated with processing a request. If your medical information is maintained electronically, you may request a copy of the information in an electronic format.
   • To request a change or amendment to your medical information if you think it is incorrect or incomplete. Requests for an amendment must be made in writing. We may deny your request under certain circumstances. If we deny your request, we will send you a written notice of denial. This notice will describe the reason for our denial and your right to submit a written statement disagreeing with the denial.
   • To receive an accounting of disclosures of your medical information. Requests for an accounting must be made in writing. An accounting will only include disclosures made during the time period indicated on the request, but may not exceed a period of six years.
   • To request that we restrict or limit our use or disclosure of your medical information. We are generally not required to agree to your request, however we will consider them. We must, however, agree to your request to restrict the disclosure of your medical information to a health plan if the medical information pertains solely to a health care item or service for which you or a person other than a health plan has paid for in full at time of service. Please note that in certain cases, other law may not permit us to agree to a requested restriction.
   • To receive confidential communications at a phone number or address other than your home. We will accommodate your request if your request is reasonable and you specify an alternative means or location.
   • To receive notice if we discover a breach of your unsecured medical information and notification is required by law.
   • To receive a paper copy of this notice, upon request, even if you have agreed to receive it electronically.
   • To revoke an authorization at any time, in writing, except to the extent that we have acted in reliance on the authorization.
6. Effective Date and Changes to this Notice

   This notice takes effect September 23, 2013. We reserve the right to change this notice and our privacy practices, policies and procedures and to make the new notice, practices, policies and procedures effective for all medical information we already have as well as any we create or receive in the future. If we make any changes to the notice, we will publish the revised notice on the Steward Health Care System website at www.steward.org and post it in common areas in our hospitals, physician practices and other patient care facilities.

7. Questions and Complaints

   Please contact the Office of Corporate Compliance & Privacy to request a copy of this notice, to obtain help understanding this notice or to obtain more information. You may also contact a Privacy Officer if you are concerned that your privacy rights have been violated or if you disagree with a decision that was made about access to your medical information. A Privacy Officer can be reached by phone at 1-617-419-4732, or in writing at Privacy Officer, Steward Health Care System, 111 Huntington Ave., Suite 1800, Boston, MA 02199.

   Written complaints may also be filed with the Office of Civil Rights, U.S. Department of Health and Human Services. Filing a complaint will not affect the treatment or services you receive from us.

This notice applies to the following Steward Health Care System Organized Health Care Arrangement (OHCA) participants, as of March 1, 2015.

A paper copy is available upon request.