NOTICE OF PRIVACY PRACTICES

Effective Date: April 14, 2003
Revised: January 2004
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.

North Shore University Hospital (“NSUH” or “Tthe Hospital”) and Syosset Hospital (“NSUHS” or “the Hospital”) are required by law to protect the privacy of health information that may reveal your identity (“Protected Health Information: or “PHI”), and to provide you with a copy of this Notice which describes the health information privacy practices of the Hospital (including its medical staff providing services at the Hospital, employees, trainees, students, volunteers, and business associates) and other facilities of the North Shore-Long Island Jewish Health System, Inc. (“NSLIJHS”) including the North Shore Long Island Jewish Health Systems Laboratories, NSLIJHS and North Shore Long Island Jewish Health Care, Inc. (“NSLIJHC”) that jointly perform treatment, payment activities and/or health care operations with the Hospital.  You may obtain additional copies of this Notice by accessing our the NSLIJHS website at Northshorelij.com, calling NSUH Administration at 516-562-4050 or NSUHS Administration at 516-496-6520 or asking the registrar/receptionist for one at the time of your next visit. When the Hospital uses or discloses PHI it is required to abide by this Notice (or amended Notice in effect at the time of the use or disclosure of PHI).

If you have any questions about this notice or would like further information or would like to discuss any privacy concerns you may have contact the NSUH Privacy Officer at 516-562-4050  or the NSUHS Privacy Officer at 516-496-2602.
WHO WILL FOLLOW THIS NOTICE?
The Hospital provides health care to patients jointly with physicians and other health care professionals and organizations.  The privacy practices described in this notice will be followed by:

• Any health care professional who treats you as an inpatient or outpatient in any of the Hospital’s facilities;
• All employees, medical staff, trainees, students or volunteers at any of the Hospital’s locations;
• All employees, medical staff, trainees, students or volunteers in the practice offices of physicians and other health care practitioners employed by the Hospital (“Faculty Practice Offices”), or other facilities that are part of an organized health care arrangement performing treatment, payment or health care operations jointly with the Hospital;
• Any business associates of the Hospital (as defined in this Notice).

PROTECTED HEALTH INFORMATION OR PHI

The Hospital is committed to protecting the privacy of information gathered about you while providing health-related services.  This includes any information that may identify you in connection with your health care.  Some examples of Protected Health Information are:

• information about your health condition (such as medical conditions and test results you may have);
• information about health care services you have received or may receive in the future (such as a surgical procedure);
• information about your health care benefits under an insurance plan (such as whether a prescription is covered);
• geographic information (such as where you live or work);
• demographic information (such as your race, gender, ethnicity, or marital status);
• unique numbers that may identify you (such as your social security number, your phone number, or your driver’s license number);
• biometric identifiers, such as fingerprints;
• full face photographs.

USE AND DISCLOSURE OF YOUR HEALTH INFORMATION

1.  Treatment, Payment And Health Care Operations
The Hospital and its medical staff, other health care professionals and professional trainees may use your PHI or share it with others to the extent that such information is necessary in order to treat your medical  condition, obtain payment for that treatment, and carry out the Hospital’s normal health care operations.  Your PHI may also be shared with affiliated hospitals and health care providers so that they may jointly perform certain treatment, payment activities and health care operations along with our the Hhospital.  It is the Hospital’s practice to request your written consent for disclosures to insurance companies that are responsible for your hospital bill and post-discharge health care providers.  Below are further examples of how your information may be used without your specific authorization.

Treatment.  The Hospital may share your PHI with caregivers at the Hhospital who are involved in your care, and they may in turn use that information or share it with others outside the Hospital in order to diagnose or treat you.  In addition, with your consent the Hospital may share your PHI with health care practitioners or facilities that need to know with respect to your treatment outside of the Hospital.  The Hospital also may contact you to provide you with appointment reminders or information about treatment alternatives or other health care related benefits or services, which may be of interest to you.  While the Hospital will take reasonable steps to safeguard the privacy of your PHI, certain disclosures of your PHI may occur during or as an unavoidable result of our otherwise permissible uses or disclosures of your PHI.  For example, during the course of a treatment session other patients in the treatment area may see or overhear discussion of your PHI.  These “incidental disclosures” are permissible.

Communication Barriers.  The Hospital may use and disclose your health information if it is unable to obtain your consent because of substantial communication barriers, and believes you would want the Hospital to treat you if it could communicate with you.

Payment.  The Hospital may use your PHI or share it with others so that it can obtain payment for health care services the Hospital provides for to you.  For example, the Hospital may share information about you with your health insurance company in order to obtain reimbursement after you have been treated.  In some cases, the Hospital may share information about you with your health insurance company to determine whether it will cover your treatment.  The Hospital might also need to inform your health insurance company about your health condition in order to obtain pre-approval for your treatment, such as admission to the Hospital for a particular type of surgery.  In addition, the Hospital may share your PHI with other health care providers so that they can obtain payment for services they provide to you.

Health Care Operations.  The Hospital may use or disclose your PHI in order to conduct its health care operations, which include internal administration and planning and various activities that improve the quality and cost effectiveness of the care that the Hospital delivers to you.  For example, the Hospital may use your PHI to evaluate the quality and competence of its physicians, nurses and other health care workers.  The Hospital may also use your PHI to educate students and trainees in health related professions.  Other examples of health care operations include legal, accounting and transcription services which may be performed through contracts with outside organizations designated as Business Associates.  All such contracts will include assurances that the Business Associate also protects the privacy of your PHI.  In addition, the Hospital may share your health information with other health care providers who have provided services to you in order for them to conduct certain business activities such as activities designed to improve the quality of care or reduce health care costs, to conduct clinical training programs, and to evaluate the experience and performance of its medical staff.

Fundraising.  The Hospital may use demographic information, for example, your name, where you live or work, and the dates that you received treatment, in order to contact you to raise money to support the operations of the Hospital.  The Hospital also may share this information with a charitable foundation that may contact you to raise money on the Hospital’s behalf.  If you do not want to be contacted for these fundraising efforts, please write to the Director of Development, North Shore-Long Island Jewish Health System Foundation at[Address]. 125 Community Drive, Great Neck, New York 11021.

2.  Hospital Directory
Unless you object, the Hospital will include your name, your location in ourthe facility, your general condition (e.g., fair, stable, critical, etc.) and your religious affiliation in the our Hospital Directory while you are a patient in the hospital.  The Hospital does not include information about patients admitted to Psychiatric or substance abuse treatment units in its Directory.  This directory information, except for your religious affiliation, may be released to people who contact the Hospital and ask for you by name.  .  Your religious affiliation may be given to a member of the clergy, such as a priest or rabbi, even if he or she doesn’t the clergy member does not ask for you by name.Members of the clergy may be given your Directory information on the basis of your religious affiliation without asking for you by name.  Upon admission you will be given an opportunity to limit or withhold information about you in the Directory (if you require emergency treatment, the opportunity to be excluded from the Directory will be provided after the emergency is over)not be listed in this directory except in the case of a medical emergency (in which case the Hospital will discuss your preferences with you as soon as the emergency is over).

3.  Family and Friends Involved In Your Care
The Hospital may disclose your PHI to a family member, personal friend or any other person identified by you provided that you are present for, or otherwise available prior to the disclosure, you have the capacity to make your own health care decisions, you have been given an opportunity to object to the disclosure and have not done so.  If you are not present, you are incapacitated, or in an emergency circumstance, we may exercise our professional judgment to determine whether a disclosure is in your best interests, provided that we only disclose information that is directly relevant to the person’s involvement with your health care or payment related to your health care.  We may also disclose PHI to disaster relief organization in order to notify (or assist in notifying) such family members or friends of your location, general condition or death.  Information may also be shared with a legally authorized Personal Representative, such as the parent or guardian of a minor, a health care agent, DNR surrogate, or court appointed guardian with health care decision making authority.  However, portions of the medical record relating to sexual activity, sexual conduct, tests for sexually transmitted diseases, contraception, family planning, abortion or mental health services may not be accessible to the parent or guardian of a minor unless specific written authorization from the minor patient is received, except as otherwise provided in this Notice.  Moreover, the Hospital will not share PHI with third parties, including parents or legally appointed guardians of children or adults if the attending physician determines that access to the information requested would pose a serious risk to the mental or physical well-being of the patient or third party, or be detrimental to the relationship between the parents or guardians and the patient.

4.  As Permitted or Required By Law
The Hospital may use your PHI and share it with others, as required by law.  For example, the Hospital will disclose information if required to do so pursuant to a court order.  In addition the Hospital may use or share PHI concerning mental health services patients as noted below:

Pursuant to a Court Order.  The Hospital may disclose your PHI pursuant to an order of a court of record requiring disclosure upon a finding by the court that the interest of justice significantly outweigh the need for confidentiality.

Mental Hygiene Legal Service.  The Hospital may disclose your PHI to the mental hygiene legal service if they are acting as your personal representative.

Involuntary Hospitalization Proceedings.  The Hospital may disclose your PHI to the attorney(s) who may represent you in any involuntary hospitalization proceeding if the attorney has made a good faith attempt to provide you with a written notice that explains the proceeding and gives you the opportunity to object to the proceeding.

 Medical Review Board of the State Commission of Correction.  The Hospital may disclose your PHI to the medical review board of the New York State Commission of Correction when the board has requested such information in the event of your death.

Endangered Individuals and Law Enforcement Agencies.  If your treating psychiatrist or psychologist has determined that you may present a serious and imminent danger to an individual the Hospital may disclose your PHI to that individual and a law enforcement agency.

As Authorized by the Department of Mental Health.  The Hospital may disclose your PHI to:

• persons and agencies needing information to locate missing persons or to a law enforcement agency in connection with criminal investigations, provided that such information will be limited to identifying data;

• appropriate persons and entities when necessary to prevent imminent serious harm to you or another person;

• a district attorney in connection with and necessary to conduct a criminal investigation of patient abuse.

Director of Community Services.  The Hospital may disclose your PHI to a director of community services or his or her designee in order to provide post-hospitalization oversight of your care.

5.  Public Health Activities

Public Health Activities.  The Hospital may disclose your PHI to authorized public health officials (or a foreign government agency collaborating with such officials) so they may carry out their public health activities.   For example, the Hospital may share your PHI with government officials that are responsible for controlling disease, injury or disability.  The Hospital may also disclose your PHI to a person who may have been exposed to a communicable disease or be at risk for contracting or spreading the disease if the law permits it to do so.

Reports to Employers Regarding Work Related Illnesses or Injuries.  Excluding mental health services patients, the Hospital may disclose relevant PHI to your employer if the Hospital provides health care services to you at the request of your employer related to medical surveillance of the workplace or to evaluate whether you have a work related illness or injury and the employer is required by law (such as Workers Compensation rules) to obtain such information.

Reports to School Districts.  The Hospital may disclose PHI for a psychiatric patient under the age of 21 years who has been discharged from an inpatient psychiatric unit to the patient’s school district in order for the school to continue to provide or arrange for appropriate services to the patient.

Victims Of Abuse, Neglect Or Domestic Violence.  The Hospital may release your PHI to a public health authority that is authorized to receive reports of abuse, neglect or domestic violence.  For example, the Hospital may report your information to government officials if the Hospital reasonably believes that you have been a victim of abuse, neglect or domestic violence.  The Hospital will make every effort to obtain your permission before releasing this information, but in some cases the Hospital may be required or authorized to act without your permission.

Health Oversight Activities.  The Hospital may release your PHI to government agencies authorized to conduct audits, investigations, and inspections of the facility.  These government agencies monitor the operation of the health care system, government benefit programs such as Medicare and Medicaid, and compliance with government regulatory programs and civil rights laws.

Product Monitoring, Repair And Recall.  The Hospital may disclose your PHI to a person or company that is required by the Food and Drug Administration to: (1) report or track product defects or problems; (2) repair, replace, or recall defective or dangerous products; or (3) monitor the performance of a product after it has been approved for use by the general public.

Judicial and Administrative Proceedings.  Excluding mental health services patient, the Hospital may disclose your PHI in the course of a judicial or administrative proceeding in response to a legal order or other lawful process.

Law Enforcement.  Excluding mental health services patients, the Hospital may disclose your PHI to law enforcement officials for the following reasons:

• To comply with a court order, grand jury subpoena or administrative subpoena that is legally enforceable;
• To report certain types of wounds or physical injuries if required to do so by law;
• To assist law enforcement officers with identifying or locating a suspect, fugitive, witness, or missing person, provided that only limited PHI will be disclosed;
• You are the victim of a crime and: (1) the Hospital has been unable to obtain your consent because of an emergency or your incapacity; (2) law enforcement officials represent that they need this information immediately to carry out their law enforcement duties; and (3) in the Hospital’s professional judgment disclosure to these officers is in your best interests;
• In the event of your death, if the Hospital suspects that your death resulted from criminal conduct;
• It is necessary to report a crime that occurred on our property; or
• It is necessary to report a crime discovered by the Hospital when providing offsite emergency medical care.

To Avert A Serious Threat To Health Or Safety.  The Hospital may use your PHI or share it with others as necessary to prevent a serious threat to your health or safety, or the health or safety of another person or the public.  The Hospital may also disclose your PHI to law enforcement officers if you tell the Hospital that you participated in a violent crime that may have caused serious physical harm to another person (unless you admitted that fact while in counseling), or if the Hospital determines that you escaped from lawful custody (such as a prison or mental health institution).

National Security And Intelligence Activities Or Protective Services.  Excluding mental health services patient, the Hospital may disclose your PHI to authorized federal officials who are conducting national security and intelligence activities or providing protective services to the President or other important officials.

Military and Veterans.  Excluding mental health services patients, if you are in the Armed Forces, the Hospital may disclose PHI to appropriate military command authorities for activities the military deems necessary to carry out its military mission.  The Hospital may also release PHI about foreign military personnel to the appropriate foreign military authority.

Inmates And Correctional Institutions.  If you are an inmate or a law enforcement officer detains you, the Hospital may disclose your PHI to the prison officers or law enforcement officials if necessary to provide you with health care, or to maintain safety, security and good order at the place where you are confined.  This includes sharing information that is necessary to protect the health and safety of other inmates or persons involved in supervising or transporting inmates.

Workers’ Compensation.  The Hospital may disclose your PHI to the extent legally required for workers’ compensation or similar programs that provide benefits for work-related injuries.

Coroners, Medical Examiners and Funeral Directors.  In the event of your death, the Hospital may disclose your PHI to a coroner or medical examiner.  This may be necessary, for example, to determine the cause of death.  The Hospital also may release this information to funeral directors as necessary to carry out their duties.

Organ and Tissue Donation.  In the event of your death, the Hospital may disclose your PHI to organizations that procure or store organs, eyes or other tissues so that these organizations may investigate whether you are a candidate for organ or tissue donation under applicable laws.

Research.  In most cases, The Hospital will ask for your written authorization before using your PHI or sharing it with others in order to conduct research.  However, under some circumstances, the Hospital may use and disclose your PHI without your authorization if the Hospital obtains approval through a special process to ensure, among other things, that research without your authorization poses minimal risk to your privacy and could not reasonably be performed without waiving your consent.  Under no circumstances, however, would the Hospital allow researchers to use your PHI publicly.  The Hospital also may release your PHI without your authorization to people who are preparing a future research project, so long as any information identifying you does not leave the facility.  In the event of your death, the Hospital may share your PHI with people who are conducting research using the information of deceased persons, as long as they agree not to remove from the facility any information that identifies you.

6.  Completely De-Identified or Partially De-Identified Information

The Hospital may use and disclose your PHI if the Hospital has removed any information that has the potential to identify you so that the health information is “completely de-identified.”  The Hospital also may use and disclose “partially de-identified” PHI about you if the person who will receive the information signs an agreement to protect the privacy of the information as required by federal and state law.  Partially de-identified PHI will not contain any information that would directly identify you (such as your name, street address, social security number, phone number, fax number, electronic mail address, website address or license number).

USE AND DISCLOSURES REQUIRING YOUR WRITTEN AUTHORIZATION

1.  Use or Disclosure with Your Authorization.  For any purposes other than the ones described in this Notice the Hospital may only use or disclose PHI when you give the Hospital your authorization on the Hospital’s authorization form.  For instance, you will need to execute an authorization form before the Hospital can send your PHI to your life insurance company or to the attorney representing the other party in litigation in which you are involved.

2.  Special Authorization.  Confidential HIV-related information (for example, information regarding whether you have ever been the subject of an HIV test, have HIV infection, HIV-related illness or AIDS, or any information which could indicate that you have ever been potentially exposed to HIV) will not be used or disclosed to any person without your specific written authorization, except to certain other persons who need to know such information in connection with your medical care, and, in certain limited circumstances, to public health or other government officials (as required by law), to persons specified in a court order, to insurers as necessary for payment for your care or treatment, or to public authorities in order to contact persons with whom you have had sexual contact or have shared needles or syringes (in accordance with a specified process set forth in New York State law).  Federal regulation requires special authorization with respect to the disclosure of substance abuse treatment records.

3.  Marketing Communications.  The Hospital must obtain your written authorization prior to using your PHI to engage in marketing activities.  The Hospital can, however, provide you with marketing materials in a face-to-face encounter, without obtaining your authorization.  The Hospital may also give you a promotional gift of nominal value.  In addition, the Hospital may communicate with you about products or services relating to your treatment, case management or care coordination, or alternative treatments, therapies, providers or care settings.  Further, the Hospital may use or disclose PHI to identify health-related services and products that may be beneficial to your health and then contact you about the services and products, or the Hospital may describe to you the products, services or staff of the Hospital.

YOUR RIGHTS TO ACCESS AND CONTROL YOUR PHI

1.  Right To Inspect And Receive Copies of Records

You, or your legally authorized representative, have the right to inspect and obtain a copy of any hospital records that are used to make decisions about your care and treatment, and any billing records, for as long as the Hospital maintains this information.  To inspect or obtain a copy of any of these records, you must submit a request in writing to the Health Information Management Correspondence Unit.  If you request a copy of the information, the Hospital may charge a fee for the costs of copying, mailing or other supplies the Hospital uses to fulfill your request.  The fee, at the time of the publication of this Notice, is $0.75 per page and must generally be paid before or at the time the Hospital gives the copies to you.  A waiver of the fee may be given in certain circumstances, upon the approval of the Director of Health Information Management.

The Hospital will respond to your request for inspection of records within 10 days.  The Hospital ordinarily will respond to requests for copies within 30 days if the information is located in the facility, and within 60 days if it is located off-site.  If the Hospital needs additional time to respond to a request for copies, the Hospital will notify you in writing within the time frame above to explain the reason for and expected duration of the delay.

Under certain very limited circumstances, the Hospital may deny your request to inspect or obtain a copy of your record.  If so, the Hospital may provide you with a summary of the information instead; or if the Hospital has reason to deny only part of your request the Hospital will provide to you access or copies of the other parts of the record.  The Hospital will provide a written notice that explains its reasons for providing only a summary or limited portions of the records requested, and a description of your rights to have that decision reviewed and how you can exercise those rights.  The notice will also include information on how to file a complaint about these issues with the Hospital or with the Secretary of the Department of Health and Human Services.

Note.  A parent or legal guardian of a minor may be denied access to certain portions of the minor’s medical record (for example, records relating to mental health services, venereal disease, abortion, or care and treatment to which the minor is permitted to consent himself, such as HIV testing, sexually transmitted disease diagnosis and treatment, chemical dependence treatment, prenatal care, contraception and/or family planning services).

2.  Right To Amend Records

If you believe that the health information the Hospital has about you is incorrect or incomplete, you may ask the Hospital to amend the information.  You have the right to request an amendment for as long as the information is kept in Hospital records.  To request an amendment, please write to the Director of Health Information Management.  Your request should include the reasons why you think the Hospital should make the amendment.  Ordinarily the Hospital will respond to your request within 60 days.  If the Hospital needs additional time to respond, the Hospital will notify you in writing within 60 days to explain the reason for the delay and when you can expect to have a final answer to your request.

If the Hospital denies part of or your entire request, the Hospital will provide a written notice that explains the reasons for doing so.  You will have the right to have certain information related to your requested amendment included in your records.  For example, if you disagree with the Hospital’s decision, you will have an opportunity to submit a statement explaining your disagreement, which the Hospital will include in your records.  The written denial notice also will include information on how to file a complaint with the Hospital or with the Secretary of the Department of Health and Human Services.

3.  Right To An Accounting Of Disclosures

You have a right to request an “accounting of disclosures” made within the last 6 years but not prior to April 14, 2003, which is a list with information about certain disclosures of your PHI that the Hospital has made to others.  An  accounting of disclosures will not include:

• Disclosures the Hospital made to you or to your personal representative;
• Disclosures made pursuant to your written authorization;
• Disclosures the Hospital  made in order to provide you with treatment, obtain payment for that treatment, or conduct our its normal business operationsmade for treatment, payment or health care operations;
• Disclosures made from the facilityPatient Directory;
• Disclosures made to your friends and family involved in your care or payment for your care;
• Disclosures that were incidental to permissible uses and disclosures of your PHI;
• Disclosures that do not directly identify you;
• Disclosures made to federal officials for national security and intelligence activities;
• Disclosures about inmates to correctional institutions or law enforcement officers; or
• Disclosures made before April 14, 2003.

The accounting of disclosures may be obtained by writing to the Director of Health Information Management.  Your request must state a time period for the disclosures you want included.  The Hospital may charge you for the cost of providing more than one accounting of disclosures in any 12-month period.  The Hospital will notify you of any such charge prior to fulfilling your request.

Ordinarily the Hospital will respond to your request for an accounting within 60 days.  If the Hospital needs additional time to prepare the accounting you have requested, the Hospital will notify you in writing about the reason for and expected duration of the delay.  If required to do so by a government agency the Hospital will withhold certain disclosures from the accounting.

4.  Right To Request Additional Privacy Protections

You have the right to request that the Hospital restrict its use and disclose of your PHI for purposes related to treatment, payment or health care operations.  You may also request that the Hospital limit how it discloses information about you to family or friends involved in your care or payment for your care.  For example, you may request that the Hospital withhold information about services you received.  Requests for restrictions must be in writing.  Your request should include (1) what information you want to limit; (2) whether you want to limit how the Hospital may use the information, how the Hospital shares it with others, or both; and (3) to whom you want the limits to apply.

The Hospital is not required to agree to your request for a restriction, and in some cases the restriction you request may not be permitted under law.  However, if the Hospital does agree, the Hospital will be bound by its agreement unless the information is needed to provide you with emergency treatment or comply with the law.  Once the Hospital has agreed to a restriction, you have the right to revoke the restriction at any time.  Under some circumstances, the Hospital will also have the right to revoke the restriction as long as the Hospital notifies you before doing so; in other cases, the Hospital will need your permission before the Hospital can revoke the restriction.

5.  Right To Request Confidential Communications

You have the right to request that you receive PHI by alternative means of communication or at alternative locations.  For example, you may ask that the Hospital contact you at work instead of at home.  Such requests must be in writing.  The Hospital will not ask you the reason for your request, and the Hospital will try to accommodate all reasonable requests.

6.  How to File a Privacy Complaint

You may register a privacy complaint with the Hospital.  Complaints to the Hospital must be in writing and submitted to:
 

Privacy Officer/Administration	OR	Privacy Officer/Administration
North Shore University Hospital		Syosset Hospital
300 Community Drive		221 Jericho Turnpike
Manhasset, NY 11030		Syosset, NY 11791

You will not be retaliated against or denied any health services if you file a complaint.

If you are not satisfied with the Hospital’s response to your privacy complaint or otherwise wish to file a privacy complaint with the Secretary of Health and Human Services (“HHS”), the HIPAA privacy regulations require your complaint to:

• Be in writing, either on paper or electronically;
• Name the person or organization that is the subject of the complaint, and describe the acts or omissions that you believe violate the HIPAA privacy regulations; and
• Be filed with 180 days of when you knew or should have known that the act or omission you are complaining of occurred (unless you show good cause why the Secretary of HHS should waive the time limit and the Secretary does waive it).

Send your complaint to either the Office for Civil Rights (“OCR”) regional office listed below that has jurisdiction over Nassau County, or to the OCR headquarters. 

The addresses are:

OCR Headquarters
Robinsue Frohboese, Acting Director
Office for Civil Rights
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F, HHH Building
Washington, D.C. 20201

Region II: New York
Michael Carter, Regional Manager
Jacob Javits Federal Building
26 Federal Plaza, Suite 3312
New York, NY 10278
Telephone: 212-264-3313
Fax:   212-264-3039
TDD: 213-264-2355

TOP