HIPAA Notice of Privacy Practices

 
This notice describes how National Jewish Health may use and share your medical information.  It also describes your rights to access and control your medical information.  We will notify you if there is a breach of your unsecured protected health information.  Your health care team, support staff, our researchers and all our other employees, affiliates and volunteers are required to follow the Health Insurance Portability and Accountability Act (HIPAA) requirements.

What medical information is protected?
Each time you visit National Jewish Health a record of your visit is made.  The information we create or receive about your past, present or future physical or mental health is called protected health information (PHI.) PHI may include documentation of your symptoms, examinations, test results, diagnoses and treatment.  It also includes documents related to billing and payment for care provided.

How will National Jewish Health use and disclose my PHI?
The following categories describe ways in which we are allowed to use you PHI within National Jewish Health and release your health information without first seeking your written permission (which is called an “authorization” under HIPAA.)  We have not listed every single use or release but all permitted uses and releases fall within one of the following categories:
 
Treatment- We may use or disclose your PHI to provide you with medical treatment and health care services.  We may share your PHI with or request it from doctors, nurses, technicians, medical students, interns, hospitals or others who are involved in taking care of you during your visit with us or elsewhere for continuity of care. 
 
Payment - We may use or disclose your PHI so the treatment and services you receive may be billed to and payment collected from you, an insurance company or other payer.  This may also include the release of PHI to obtain prior authorization for treatment and procedures from your insurance plan.
 
Health Care Operations – These uses or disclosures are necessary to operate our health care facility and make sure all of our patients receive quality care.  We may use only the minimum necessary patient identifiers for these purposes.  Some of these uses may include quality assurance activities; granting medical staff credentials to physicians; administrative activities, including the hospital financial and business planning; customer service activities, including investigation of complaints; auditing and compliance program activities; and educational and training activities.
 
Business Associates – Some of our services are provided through contracts with third parties who are Business Associates of National Jewish Health.  We may share your health information with them so that they can perform the job we’ve asked them to do.  We require our Business Associates to sign a contract that states they will appropriately protect your PHI.  Examples of Business Associates include information storage services, management consultants, quality assurance reviewers and auditors.
 
Appointment Reminders – We may use PHI to contact you as a reminder that you have an appointment for treatment or medical care at National Jewish Health. If you receive a text message from us, it will include information on how to “opt-out” of text reminders.
 
Fundraising - We may use certain PHI for fundraising including your name, address, dates of service, date of birth, age, gender, department of service, treating physician, outcome information, and insurance information.  The money raised through these activities is used to expand and support the research, health care services and educational programs we provide.  If you receive a fundraising communication from us, it will include information about how to opt out of any further fundraising communications if you wish to do so.  Future treatment or payment is not affected by your decision to participate in or “opt out” of fundraising communications.
 
Individuals Involved in your Care or Payment for your Care – We may share your health information with a friend, family member or personal representative who is involved in your medical care when we believe that information is directly relevant to the person’s involvement.  You may object to such sharing if you are present and may tell us in advance not to do so.
 
Public Health and Other Required Governmental Reports – We may share your PHI for public health activities.  For example, we report information about various diseases to government officials in charge of collecting that information.
 
Health Oversight Activities – We may disclose your health information with a health oversight agency for activities authorized by law.  These include audits, investigations, inspections and licensure.  These activities are necessary for the government to monitor the health care system, government programs and HIPAA compliance.
 
Workers’ Compensation.  We may disclose your medical information to the extent necessary to comply with laws relating to workers’ compensation or similar programs providing benefits for work-related injuries or illness.
 
Reports Required by Law.  We will disclose your medical information when required to do so by federal, state or local law.  For example, we make disclosures when a law requires that we report information to government agencies and/or law enforcement personnel about victims of abuse, neglect or domestic violence; to report reactions to medications or problems with products; or to notify people of product recalls.
 
Lawsuits and Disputes.  If you are involved in a lawsuit or other legal dispute, we may disclose medical information if we are ordered to do so by a court, for an administrative hearing, or if we receive a subpoena.  In most situations, you will receive advance notice about this disclosure so that you will have a chance to object to sharing your medical information.
 
Disaster Relief Efforts.  As part of a disaster relief effort, we may disclose your PHI to an authorized entity assisting in the relief efforts.  One use of the information may be notifying your family about your condition, status and location.
 
Military, Veterans, National Security and other Government Purposes.  If you are a member of the armed forces, we may release your health information to military command authorities or to the Department of Veterans Affairs if they require us to do so.  We may also disclose medical information for certain national security purposes and to the Secret Service for the provision of protective services.
 
Correctional Institutions, In Custody: If you are or become an inmate of a correctional institution or are under the custody of a law enforcement official, we may disclose your health information to the correctional institution or the law enforcement official when it is necessary to (i) provide you with health care; (ii) to protect your health and safety or the health and safety of others; or (iii) for the safety and security of the correctional institution.
 
Coroners, Medical Examiners and Funeral Home Directors.  We may share your health information consistent with applicable law with a coroner, medical examiner or funeral home director when needed to carry out their legal duties.
 
Can National Jewish Health use and disclose my PHI for research?
National Jewish Health may use and disclose your PHI for health research. Before using your PHI in a research project, National Jewish Health will either obtain your written permission or obtain permission from an Institutional Review Board (IRB) that approves such use or disclosure. An IRB is a committee that is responsible, under federal law, for reviewing and approving human subjects research to protect the safety of the participants and the confidentiality of your personal information.  The IRB will only give its permission if the proposed use of your PHI has met HIPAA’s requirements for release for research purposes. We may also use or share your information to plan a research project or tell you about research opportunities that might interest you. We may contact you about these research opportunities by mail, phone, or email if you have provided it to us.
 
Are there situations that require my written permission before NJH uses or shares of my PHI?
Use or sharing of your PHI in situations that are not covered by this Notice or the laws that apply will be made only with your written permission. If you do give us permission to use or disclose medical information about you, you may revoke that permission, in writing, at any time.  If you revoke your permission, we will no longer use or share PHI about you for the reasons covered in your written authorization but we cannot take back any disclosures we have already made. Some typical situations that require your authorization are as follows:
 
Marketing. We may ask you to sign an authorization to use or disclose PHI as a part of a marketing effort.   Marketing is generally defined as a communication about a product or service that encourages the recipient to purchase or use the items described. Marketing does not include (i) communications about your treatment or recommendations about alternative treatments or providers unless NJH is being paid to make the communication, (ii) mere descriptions of products or services that NJH offers, (iii) communications made face-to-face or (iv) a promotional gift of nominal value provided by NJH. If NJH will be paid for sending the marketing communication, the authorization will state that payment is involved.
 
Alcohol and Drug Abuse Treatment Records.  Use and disclosure of any medical information about you relative to alcohol or drug abuse treatment programs receives additional protection under federal law (42 CFR Part 2.)  Generally, we will not disclose any information identifying you as a recipient of alcohol or drug abuse treatment unless you have consented in a writing that qualifies under the law or we receive a court order requiring the disclosure.
 
Disclosures of Mental Health Treatment Information. We may share your information for treatment purposes to qualified professionals, for payment purposes or if we receive a court order.  In most other cases, Colorado law requires your written authorization or the written authorization of your representative.
 
Psychotherapy Notes.  Psychotherapy notes are the personal notes of psychotherapists.  Under most circumstances, we must obtain your permission to use or disclose psychotherapy notes.
 
HIV/AIDS Information.  Use and disclosure of any medical information about you relative to HIV testing, HIV status or AIDS, is protected by federal and state law.  Generally, we will need your permission to disclose this information; however, state laws require certain reporting and disclosure when public safety, emergency medical services or detention center staff might have been exposed.
 
Minors.  As a general rule, we disclose PHI about minors to their parents or legal guardians.  However, in instances where state law allows minors to consent to their own treatment without parental consent (such as HIV testing, minors who are emancipated), we will not disclose that information to the minor’s parents without the minor’s permission unless otherwise specifically allowed under state law.
 
Participation in Health Information Networks. We participate in the Colorado Regional Health Information Organization (CORHIO) which is a secure computer network which provides safe and efficient ways to share medical information with other health care providers. For example, if you require emergency medical care while you are traveling, providers at other at other healthcare facilities in Colorado could have access to your medical information to assist then in caring for you. By participating in this network and other electronic information exchanges, we intend to provide timely information to health care providers involved in your care. If you do not want your information to be shared through CORHIO, you may “opt-out” at www.corhio.org/for-patients.
 
Can I review and have a copy of my medical information?
Yes, in most circumstances, you may inspect and get a paper or electronic copy of medical information that may be used to make decisions about your care.  To request to inspect or to get a copy of your information, please contact the Health Information Management Department  (Medical Records) at (303) 398-1580.   We may charge a reasonable, cost‑based fee for making copies.  In certain limited situations, we may deny your request to inspect and copy your PHI.  If we deny your request, you may request a review of our decision. 
 
Can I restrict how National Jewish Health uses my PHI for treatment, payment or operations?
You may ask us not to use or disclose any part of your PHI for a particular reason related to treatment, payment or health care operations.  We will consider your request, but we are not legally obligated to agree to most such requests.  If you have paid for services out-of-pocket in full, you may request that we not disclose information related solely to those services to your health plan and we are required to agree to your request unless another law requires us to make the disclosure.   You also may request that we not disclose your PHI to family members, friends or others who may be involved in your care.  Your request must be submitted in writing to the Health Information Management Department.

Can I amend my protected health information (PHI)?
If you believe the medical information we have about you is incorrect or incomplete, you have the right to request that we correct the existing information or add missing information.  Requests to amend PHI must be made in writing and include a reason for your request.  You may obtain an amendment form by contacting the Health Information Management Department at (303) 398-1580. We may deny your request.  If we deny your request, you have the right to file a statement of disagreement.  We may respond to this statement.  Both your statement of disagreement and our response will be attached to the medical record.  If we grant your request, we will make the changes and distribute it to the people whom we believe need it and to those whom you state should receive a copy. 
 
Can I ask you to communicate with me using different means or at a different place?
Yes.  We agree to such requests when they are reasonable and we have a process available to accommodate your request.  You may obtain a form for this purpose by contacting the Health Information Management Department at (303) 398-1580.
 
Can I receive an accounting of the disclosures made by National Jewish Health?
You can obtain an accounting of any disclosures made by National Jewish Health that occurred within the last six (6) years.  We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make).  It will contain the date information was disclosed, the name of the party receiving the information and a brief description of what was disclosed and why.  The first accounting in a 12‑month period is free.  After that, with advance notice to you, we may charge a reasonable, cost‑based fee. To request a disclosure, please submit your request in writing to the Health Information Management Department.
 
What if I think National Jewish Health has violated my right to privacy?
If you wish to make a complaint to us or have questions about this Notice, please contact our Privacy Office at (800) 414-5939. Or, you may obtain a complaint form from the Privacy Office or the Health Information Management Department by calling (303) 398-1580. You may also complain to the Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue S.W., Room 515F, HHH Building, Washington D.C. 20201 within 180 days of an alleged violation of your rights. You will not be penalized for filing a complaint about our privacy practices. You will not be asked to waive this right as a condition of treatment.
 
This Notice may change.
The Health Insurance Portability and Accountability Act (HIPAA) requires that we provide this Notice to you. We may change the terms of this Notice at any time. You can obtain a copy of our current Notice of Privacy Practices on our website (www.njhealth.org) or by asking for one at your next appointment.
 
This notice was revised and became effective on November 4, 2022.