PURPOSE

This policy describes the general principles of Perham Memorial Hospital and Home's protections for privacy of health care information, and it implements the privacy provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). It is Perham Memorial Hospital and Home's policy to protect privacy of medical records and other personal health information of its patients without jeopardizing patients' access to health care or the quality of their health care.

This policy applies to Perham Memorial Hospital and Home. It applies to all individually identifiable health care information, whether oral, written or electronic. It applies to all activities involving the use or disclosure of protected health information (PHI), even if Perham Memorial Hospital and Home has contracted with other businesses or individuals to perform some of those functions.

Click below to print Perham Memorial Hospital and Home's Privacy Policy and/or the Authorization Form for release of protected health information. You will need Adobe® Acrobat® or Adobe® Acrobat® Reader™ to print the policy and form. If you do not have this software, you can download it for free by clicking on the following link.

POLICY

In order to protect patient privacy, Perham Memorial Hospital and Home will use and disclose PHI in accordance with the requirements of this policy.

PERMITTED USE AND DISCLOSURE OF INFORMATION

Perham Memorial Hospital and Home is permitted to use PHI for its own treatment, payment, and health care operations. It is also permitted to use and disclose PHI for treatment and payment activities of other non-Perham Memorial Hospital and Home providers, and for certain health care operations of other non-Perham Memorial Hospital and Home providers, as described below. These uses do not require authorization from the patient.

For uses or disclosures of protected health information other than for treatment, payment and health care operations, or as otherwise permitted by this policy, Perham Memorial Hospital and Home will obtain patient authorization. Authorization is explained further in this policy.

Treatment

Perham Memorial Hospital and Home may use PHI for its own treatment of patients. Treatment means providing, coordinating, or managing health care and related services by health care providers. Treatment includes services by those with direct and indirect relationships to the patient. Indirect treatment includes those who deliver health care based on the orders of another treatment provider, or those who deliver services, products, or reports on diagnosis or results of studies to another health care provider who is directly treating the patient. Treatment includes coordination and management of health care among providers or with a third party, consultations between health care providers, and referrals from one health care provider to another.

Perham Memorial Hospital and Home may also disclose PHI to non-Perham Memorial Hospital and Home providers for the treatment activities of those providers. For example, a Perham Memorial Hospital and Home primary care physician may send PHI of an individual to a non-Perham Memorial Hospital and Home specialist who needs the information to treat that individual.

Payment

Perham Memorial Hospital and Home may use and disclose PHI for payment for its own services, and for payment of other non-Perham Memorial Hospital and Home health care providers. Payment includes such things as billing, claims management, collection, determining eligibility for coverage, risk adjustment and utilization review.

Health care operations

Perham Memorial Hospital and Home may use and disclose PHI as necessary for its own health care operations. Health care operations include but are not limited to quality assessment, development of clinical guidelines or protocols, population-based activities to improve health or reduce costs, contacting patients with information about treatment alternatives, evaluating and reviewing practitioner qualifications and performance, conducting training, performing certification and accreditation activities, underwriting and premium rating, medical review, legal services, auditing, fraud and abuse detection and compliance, business planning and development, administrative activities, and due diligence for sale or transfer of assets.

To a limited extent, Perham Memorial Hospital and Home may disclose PHI to other non-Perham health care providers for the health care operations of those providers.

Amount of information used or disclosed

Perham Memorial Hospital and Home will take reasonable safeguards to prevent the improper use or disclosure, whether intentional or inadvertent, of PHI of its patients. For routine or recurring uses and disclosures of PHI, employees will follow Perham Memorial Hospital and Home's standard policies and procedures for disclosure. A case-by-case review of the information to be used or disclosed is not required. Non-routine disclosures of information will limit the PHI used or disclosed to the amount reasonably necessary to accomplish the purpose of the disclosure, and these non-routine disclosures will be reviewed on an individual basis by Perham Memorial Hospital and Home's, Health Information System Release of Information staff.

Perham Memorial Hospital and Home will identify which uses and disclosures are routine or recurring and covered by standard policies and procedures. Examples of routine uses and disclosures include access by Perham Memorial Hospital and Home physicians and nurses for treatment purposes, exchange of information between health care providers for treatment purposes, and access to treatment information for reimbursement and payment.

Physicians, nurses, and others involved in treatment may have access to a patient's entire record, as needed. Others who are involved indirectly in treatment or involved in payment or health care operations will have access to and use of PHI based upon their role(s) in the organization.

Employees who are not involved in treatment of patients but who require PHI for other activities will make reasonable efforts to limit use, disclosure, or requests of PHI to the minimum necessary for the intended purpose.

Oral communications

Oral communications must occur freely and quickly for effective and high quality care. Perham Memorial Hospital and Home's providers will communicate orally whenever necessary for appropriate treatment, but will take reasonable steps to minimize disclosure of information to others who may be nearby who are not involved in treatment. These steps include not using patient's names in public hallways and elevators, speaking quietly when discussing a patient's condition with family members in a waiting room or public area, asking patients to stand back at registration desks or pharmacy counters until their turn, and using available curtains or cubicles in areas where multiple patients are seen.

Psychotherapy Notes

Psychotherapy notes are treated differently for privacy purposes than other parts of a medical record. Psychotherapy notes are notes of conversation during private counseling or group, joint or family counseling and which are kept separate from the rest of the patient's medical record. They do not include medication prescription and monitoring, start and stop times of counseling sessions, type and frequency of treatment, results of clinical tests, or summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date.

Psychotherapy notes by a mental health professional may be used as part of treatment or health care operations only for three purposes: 1) by the creator of the notes for treatment purposes, 2) in training programs for mental health trainees under supervision, or 3) to defend a legal proceeding brought by the patient. For purposes other than treatment or health care operations, psychotherapy notes may be disclosed in certain limited circumstances required or allowed by law, as listed below. Otherwise, psychotherapy notes may not be used or disclosed to anyone else, even within Perham Memorial Hospital and Home, without a patient authorization.

Perham Memorial Hospital and Home may use or disclose psychotherapy notes without authorization:

• When required by the Secretary of DHHS (Dept. of Health and Human Services) to investigate compliance with privacy regulations
• When required by law
• When requested by a health oversight agency in order to oversee the author of the notes
• To coroners regarding a deceased individual
• To prevent a serious and imminent threat

Perham Memorial Hospital and Home psychotherapy providers will keep psychotherapy notes in a separate section of patients' medical records.

Minors

Access to PHI and disclosure of PHI for minors (patients under age 18) will be handled according to state law (Minnesota law at Minnesota sites; North Dakota law at North Dakota sites). Refer to Perham Memorial Hospital and Home's Informed Consent policy for guidance. When the patient is a minor, the patient's parent, guardian or authorized representative is the person authorized to give consent and authorization for use of the minor's PHI. However, the minor patient himself or herself is the person authorized to give authorization if:

• The minor is emancipated (married, has borne a child, or is living away from home and managing own financial affairs)
• The minor lawfully may obtain the healthcare services without consent of a parent or guardian, and the minor, a court, or other authorized person has consented to the services (for example, in North Dakota a minor age 14 or older and in Minnesota a minor of any age may obtain treatment for chemical dependency or sexually transmitted diseases without parental consent)
• The minor's parent, guardian or authorized representative has assented to an agreement of confidentiality between the minor and the healthcare provider
• Perham Memorial Hospital and Home reasonably believes that the parent, guardian or authorized representative has abused or neglected the minor, or that dealing with the adult as legal representative could endanger the minor or would not be in the minor's best interests.

Authorized representatives

If a person has the legal authority to act on behalf of a patient (such as a guardian, substituted decision maker or a person with durable power of attorney for health care), that person is the representative permitted to authorize use and disclosure of the patient's PHI. Perham Memorial Hospital and Home will seek authorization from that representative, unless Perham Memorial Hospital and Home reasonably believes that the representative has abused or neglected the patient, or that dealing with the representative could endanger the patient or would not be in the patient's best interests.

Deceased patients

A person who is legally authorized to act on behalf of a deceased patient or the patient's estate is the person authorized to give consent and authorization for use of the patient's PHI.

NOTICE OF PRIVACY

Perham will provide individuals with notice of the uses and disclosures that may be made of the individual's PHI, of the individual's rights, and of Perham Memorial Hospital and Home's responsibilities regarding privacy of PHI.

This notice will be provided in writing in a Notice of Privacy Practices. The notice of privacy practices will be in plain language, and will be posted in a clear and prominent location at Perham Memorial Hospital and Home sites. A copy of the Notice of Privacy Practices is attached to this policy.

Perham Memorial Hospital and Home will obtain a written acknowledgment that the individual has received this notice. Direct treatment providers at Perham Memorial Hospital and Home will make good faith efforts to obtain this acknowledgment at the time of first delivery of health care services to an individual. If the first delivery of service is not in person, but provided electronically, Perham will obtain electronic acknowledgment of receipt of the notice. Perham Memorial Hospital and Home need not provide notice and obtain acknowledgment in emergency treatment situations. If an emergency exists, Perham Memorial Hospital and Home will provide notice when reasonably practical after the emergency.

If an individual refuses to sign or provide an acknowledgment of receipt of the privacy notice, Perham Memorial Hospital and Home may still proceed with treatment and permitted uses and disclosures of information. In such cases, Perham Memorial Hospital and Home will document the good faith efforts to obtain an acknowledgment and the reason it could not be obtained (such as "patient refused to sign after being requested to do so.")

AUTHORIZATION

In general, authorizations are required for any use and disclosure of health care information for purposes other than treatment, payment, or health care operations. Perham Memorial Hospital and Home will not use or disclose PHI without a valid authorization from the patient, except as provided in this policy. An authorization specifies the uses and disclosures permitted by the patient and the PHI that may be used or disclosed.

Authorization is required for use or disclosure of psychotherapy notes, with some exceptions. See Psychotherapy Notes section in this policy.

A valid authorization will be in plain language and will include these basic requirements:

• A specific description of the information to be used or disclosed
• Name or other specific identification of the entity authorized to use or disclose PHI
• Name or other specific identification of the entity to whom Perham Memorial Hospital and Home may disclose or make use of PHI
• Description of each purpose of the requested use or disclosure. (If authorization is at patient's request, patient need not state a purpose; authorization may simply state "at the request of the individual.")
• Expiration date or event
• Statement of the patient's right to revoke the authorization in writing
• Description of how to revoke and exceptions to the right to revoke, or reference to that information in the notice of privacy
• Statement that treatment, payment, enrollment or eligibility may not be conditioned on signing the authorization in most circumstances or a description of consequences of refusal to sign, when conditioning of treatment, enrollment or eligibility is permitted
• Statement that information disclosed may be subject to redisclosure by the recipient and no longer protected by Perham Memorial Hospital and Home's privacy policy
• Signature of the patient or patient's authorized representative. If a representative, it will include a description of that person's authority
• Date of signature

Patient's refusal to give authorization

• Perham Memorial Hospital and Home may not refuse treatment, payment, enrollment, or eligibility of a patient if a patient refuses to give an authorization, except that:
• Research related treatment may be conditioned on an authorization
• Health plan enrollment or eligibility may be conditioned on authorization, if authorization is requested before enrollment, and is sought for eligibility, enrollment, underwriting, or risk rating, and is not for psychotherapy notes
• Payment may be conditioned on authorization if disclosure is necessary to determine payment and authorization is not for psychotherapy notes
• Healthcare solely for the purpose of creating PHI for disclosure to a third party may be conditioned on authorization

Revocation of authorization

A patient may revoke an authorization at any time, except to the extent Perham Memorial Hospital and Home has already acted in reliance on it. The revocation must be in writing.

Amount of information used or disclosed

When a patient authorizes disclosure of PHI, Perham Memorial Hospital and Home will disclose the information requested, and will not make an independent determination of how much information is needed for that purpose.

Authorization requested by Perham Memorial Hospital and Home

If Perham Memorial Hospital and Home requests an authorization from an individual for PHI, it will provide a copy of the signed authorization to the individual.

USE AND DISCLOSURE WITHOUT AUTHORIZATION

Perham Memorial Hospital and Home is permitted by law to use and disclose PHI for certain public health and public protection purposes. Perham may disclose PHI without patient authorization, and without opportunity for the patient to agree or object, in the following circumstances:

• When required by law, as long as the use and disclosure is limited to the requirements of the law
• To public health authorities who are authorized to receive such information
• To the FDA or those subject to FDA jurisdiction to report adverse events, track products, allow product recalls, repairs or replacements, or conduct surveillance
• To a person exposed to a communicable disease if permitted by law
• To an employer for medical surveillance under limited conditions
• To an authorized government authority concerning victims of abuse, neglect or domestic violence if permitted by law
• For health oversight activities authorized by law
• In judicial and administrative proceedings in response to a court order or order of an administrative court, as long as the information produced is limited to the scope of the order
• In judicial and administrative proceedings in response to a subpoena or discovery request if certain conditions are met
• For law enforcement purposes:

  if required by law

  in compliance with certain warrants, subpoenas, or administrative requests

  to help locate a fugitive, missing person or material witness as long as only limited information is provided

  regarding suspected crime victims

  to notify of a death suspected to be due to criminal conduct

  to report crime in an emergency

• To coroners, medical examiners, and funeral directors
• For organ donation or procurement
• For research under limited conditions
• To avoid a serious threat to health or safety

Perham Memorial Hospital and Home may disclose PHI without patient consent or authorization in the following circumstances, but must allow the patient an opportunity to agree or object, or restrict the disclosure:

• In Perham Memorial Hospital and Home's directory, limited to the patient's name, location (except for exclusively psychiatric, chemical dependency, or communicable disease treatment areas), condition in general terms only, and religious affiliation. This information, except for religious affiliation, may be given to those who ask for the patient by name. Religious affiliation may be given to members of the clergy
• To family members, friends, or others identified by the patient if the information is directly related to that person's involvement in care or payment, or to notify that person of the patient's location, general condition, or death
• For disaster relief purposes

REQUIRED DISCLOSURES

Perham Memorial Hospital and Home must disclose PHI to a patient who requests his/her own information (except for psychotherapy notes, information compiled in anticipation of legal proceedings, and when otherwise prohibited by law) and to DHHS for enforcement of federal privacy standards. A patient may request a copy of his/her PHI, or to inspect the PHI, or an accounting of disclosures made of the PHI.

COMBINING AUTHORIZATIONS

Authorizations for psychotherapy notes may be combined only with other authorizations regarding other psychotherapy notes.

OBTAINING AUTHORIZATIONS

Disclosures based upon authorizations will be handled by Perham Memorial Hospital and Home Health Information Services, Release of Information staff. A separate policy titled Perham Memorial Hospital and Home, Health Information Services Privacy Policy will be used, in addition to this policy, by Health Information Services, Release of Information staff for processing of disclosures of PHI.

PATIENT RESTRICTIONS ON USE OF PROTECTED HEALTH INFORMATION

A patient may request Perham Memorial Hospital and Home to restrict use or disclosure of protected health information for treatment, payment and operations, or disclosures to relatives or close friends involved with care or payment. Perham Memorial Hospital and Home is not required to accept those restrictions. If it does accept restrictions, however, it must follow them except in certain emergencies. A restriction, once agreed to by Perham Memorial Hospital and Home, may be terminated only with the patient's agreement (in writing, or orally, and documented in writing) or by informing the patient that Perham Memorial Hospital and Home will no longer agree to the restriction. Perham Memorial Hospital and Home may only terminate a patient's restriction as to PHI created or received after it notifies the patient the restriction is terminated.

A patient may not restrict, even by special request, these uses of PHI:

• Disclosures required by law (such as abuse or neglect reporting, judicial and administrative proceedings, and law enforcement purposes)
• Disclosures to authorized public health authorities
• Disclosures to an authorized health oversight agency
• Disclosures about deceased individuals to authorized persons such as coroners and funeral directors
• Disclosures related to organ or tissue donation
• Disclosures for research purposes when permitted by law
• Disclosures to avert serious threats to health or safety
• Disclosures for special government functions such as military operations
• Disclosures to comply with workers' compensation laws

A patient may request Perham Memorial Hospital and Home to communicate with him/her by alternate means, or at an alternate location for confidentiality purposes, for example, only at work or only by mail. Perham Memorial Hospital and Home must accommodate these requests if they are reasonable.

Any patient requests for restrictions will be in writing, and will be directed to Perham Memorial Hospital and Home's Privacy Officer. Perham Memorial Hospital and Home may ask the patient to specify the alternate arrangements and how payment will be handled under the alternate arrangement.

PATIENT ACCESS TO INFORMATION AND RIGHT TO AN ACCOUNTING

Patients have the right to see and copy their own health information. This applies to information in a "designated record set", that is, PHI maintained by Perham Memorial Hospital and Home and composed of:

• for providers, medical and billing records
• for the health plan, enrollment, payment, claims, and case or medical management information, or
• information Perham Memorial Hospital and Home used to make decisions about that patient

Perham Memorial Hospital and Home will act on patient requests for PHI within 30 days of the request for PHI accessible on site, and within 60 days for PHI not accessible on site. Perham Memorial Hospital and Home may delay action on a request for an additional 30 days by sending the patient a written statement of the reasons for the delay and the date by which it will act on the request.

Perham Memorial Hospital and Home may deny requests for the following information:

• Psychotherapy notes
• Information compiled in anticipation of legal proceedings
• Information governed by CLIA (Clinical Laboratory Improvement Amendments)
• Research information, when the patient agreed to a limitation of access for the duration of the research project
• Information obtained from someone other than a healthcare provider under promise of confidentiality, if revealing it would likely reveal the source of the information
• Information protected under the federal Privacy Act, 5 U.S.C. section 552a

Perham Memorial Hospital and Home may deny requests for the following information, but must allow the patient to have the decision to deny reviewed by a licensed health care professional not involved in the original decision:

• Information Perham Memorial Hospital and Home believes is likely to endanger the life or physical safety of the patient or another person, or cause substantial harm to another person
• Requests by a personal representative of the patient, if access is likely to cause substantial harm to the patient or another individual

Patients also have a right to receive an accounting of all disclosures of PHI made by Perham Memorial Hospital and Home for the six years before their request. However, no accounting is required for disclosures for treatment, payment or health care operations, for Perham Memorial Hospital and Home's directory, for disclosures to the patient or patient's representative, disclosures to persons involved in the patient's care or for notification purposes, for national security and intelligence purposes, and for certain disclosures to correctional facilities and law enforcement. No accounting is required for disclosures based upon authorizations. No accounting is required for disclosures made before April 14, 2003.

Perham Memorial Hospital and Home's accounting to the patient will be provided in writing, and will include the date, recipient, brief description of information disclosed, and purpose of each disclosure. It will cover the six years before the request, or a shorter period as requested by the patient. Perham Memorial Hospital and Home will provide an accounting within 60 days of receipt of the request. Perham Memorial Hospital and Home may delay action on a request for an additional 30 days by sending the patient a written statement of the reasons for the delay and the date by which it will act on the request.

Additional information about patient requests for information and for accounting are found in the Perham Memorial Hospital and Home Privacy Health Information System Policy.

PATIENT RIGHT TO AMENDED RECORDS

Patients have the right to request that their PHI be amended so that it is accurate and complete, as long as Perham Memorial Hospital and Home maintains their PHI in a designated record set. Perham Memorial Hospital and Home may accept or deny the request. If a request is accepted, Perham Memorial Hospital and Home will leave the disputed entry in place, but either append the correction to that record, or refer the reader to a signed, dated, and corrected entry. All affected records will be corrected, and Perham Memorial Hospital and Home will make reasonable efforts to notify business associates and others who have received the information of the correction. Perham Memorial Hospital and Home will also notify the patient of the actions taken.

Perham Memorial Hospital and Home may deny a request for amendment if the record is already accurate and complete, or the information came from another source, or the information is not part of the designated record set. If the patient provides a reasonable basis to show that the originator of the record, although not Perham Memorial Hospital and Home, is no longer available to act on the request, Perham Memorial Hospital and Home will not deny the request on grounds that the record came from another source. If Perham Memorial Hospital and Home denies a request, it will:

• Make the denial in writing in plain language
• Explain the basis for the denial
• Notify the patient of the right to submit a written statement disagreeing with the denial
• Notify the patient of the right to ask that the request and denial be included with future disclosures of PHI
• Describe the process for requesting review of the denial, including contact information
• Describe the process for filing a complaint with the Secretary of HHS

Patient requests for amendment will be in writing and must specify the date and entry for which amendment is requested, and the correction requested.

If Perham Memorial Hospital and Home receives notice of amendment from another entity, it will make the correction in its copy of the other entity's records.

BUSINESS ASSOCIATES

Business associates are persons who are not employees of Perham Memorial Hospital and Home, but who perform activities involving use or disclosure of individually identifiable health information on behalf of Perham Memorial Hospital and Home, such as claims processing, billing, data analysis, accreditation, legal, accounting, actuarial, financial, or consulting services.

Perham Memorial Hospital and Home will disclose PHI to business associates and allow business associates to create or receive PHI on Perham Memorial Hospital and Home's behalf only after Perham Memorial Hospital and Home has obtained satisfactory assurance that the business associate will properly safeguard the information. This assurance will be documented in writing, as part of the contract or some other written agreement with the business associate.

The written contract or other written agreement with a business associate will:

• Establish what uses and disclosures of PHI are permitted and required by the business associate
• Provide that the business associate may not use or further disclose PHI in a way that would violate this policy if done by Perham Memorial Hospital and Home
• Permit the business associate to use and disclose PHI for proper management and administration of its own business or to carry out its legal responsibilities
• Permit the business associate to provide data aggregation services regarding healthcare operations of Perham Memorial Hospital and Home
• Provide that the business associate will:

• Not use or further disclose the PHI except as permitted by the contract or required by law
• Use appropriate safeguards to prevent use or disclosure of PHI other than as provided by its contract
• Report to Perham Memorial Hospital and Home any use or disclosure of PHI not provided for under its contract of which it becomes aware
• Ensure that its agents and subcontractors to whom it provides Perham Memorial Hospital and Home PHI agree to the same restrictions and conditions that apply to the business associate
• Make PHI available to individuals, or for amendment, or for an accounting of disclosures, all as required by this policy
• Make its internal practices, books and records available to the Secretary of Human Services for determining Perham Memorial Hospital and Home's compliance with privacy requirements
• Return or destroy all PHI received from or created on behalf of Perham Memorial Hospital and Home and not retain copies when its contract with Perham Memorial Hospital and Home is terminated, or if not feasible, to extend the protections of the contract to the information that cannot be feasibly returned or destroyed
• Authorize termination of its contract with Perham Memorial Hospital and Home if Perham Memorial Hospital and Home determines that the business associate has violated a material term of the contract.

DE-IDENTIFIED INFORMATION

De-identified information is health care information that does not identify an individual and which Perham reasonably believes can't be used to identify an individual. Properly de-identified information may be used without restriction. HIPAA privacy standards only apply to individually identifiable health information.

De-identification of information requires removal of 18 identifiers of the patient, or of patient's relatives, employers, or household members, from the patient's health information. These identifiers are:

• Names
• Geographic subdivisions smaller than a state, including street address, city, county, precinct, zip code and other geocodes. (If the population of the area with the first three numbers of the zip code is over 20,000, the first three numbers may be kept; if under 20,000 the numbers must be changed to 000.)
• All dates, except year, related to an individual including birth date, admission dates, discharge dates, and date of death; and all ages over 89 and all elements of dates (including year) that indicate ages over 89. Ages and elements of dates for ages over 89 may be aggregated into a single category of age 90 or over.
• Telephone numbers
• Fax numbers
• Electronic mail addresses
• Social security numbers
• Medical record numbers
• Health plan beneficiary numbers
• Account numbers
• Certificate/license numbers
• Vehicle license plate numbers, identifiers and serial numbers
• Device identifiers and serial numbers
• URLs (Web Universal Resource Locators)
• Internet Protocol (IP) address numbers
• Biometric identifiers, including finger and voice prints
• Full face photographs, photographic images and comparable images
• Any other unique identifying number, characteristic or code

If, even after removal of the 18 identifiers, Perham Memorial Hospital and Home has actual knowledge that the information could be used, either alone or in combination with other information, to identify an individual, it is not considered de-identified.

Perham Memorial Hospital and Home may assign a code or other means to allow de-identified information to be re-identified, as long as the code is not derived from information about the individual and cannot be translated to identify the individual, and Perham Memorial Hospital and Home does not use or disclose the code for re-identification, or use it for any other purpose.

Employees are permitted to use PHI to create de-identified information even if Perham Memorial Hospital and Home will not directly be using the de-identified information. Employees may also disclose PHI to a business associate to create de-identified information.

RETENTION OF DOCUMENTATION

Perham Memorial Hospital and Home will maintain its privacy policies and procedures in writing or electronically for six years from the date they were created or were last in effect, whichever is later.

Whenever documentation of certain matters is required by this policy, Perham Memorial Hospital and Home will maintain that documentation in writing or electronically for six years from the date it was created or last in effect, whichever is later.

TRAINING

Perham Memorial Hospital and Home will train all members of its workforce, as necessary and appropriate for their functions, about the requirements of this privacy policy. If the policy and procedures change in a substantial way, employees affected by the change will be trained about the changes within a reasonable time after the changes become effective.

COMPLAINTS

Persons who have complaints about Perham Memorial Hospital and Home's privacy policy and procedures, or its compliance with the policy and procedures, should make those complaints in writing to the Privacy Officer. All complaints and their disposition will be documented. This documentation will be maintained for six years.

MARKETING AND FUNDRAISING

Perham Memorial Hospital and Home's policy for privacy in marketing and fundraising activities is contained in a separate policy titled Perham Memorial Hospital and Home Privacy Marketing/Fundraising Policy.

PRIVACY OFFICER

Perham Memorial Hospital and Home's privacy officer is the person responsible for the adoption, implementation, and updating of privacy policies and procedures.

ENFORCEMENT

Perham Memorial Hospital and Home will impose sanctions against employees who violate this privacy policy. Those sanctions may include, among others steps, remedial training, reprimand, warning, or termination of employment. Enforcement and sanctions are more fully described in Perham Memorial Hospital and Home's Human Resources Policy.

DEFINITIONS

De-identified information: Health information that does not identify an individual, and for which there is no reasonable basis to believe it can be used to identify an individual.

Designated record set: a group of records maintained by Perham Memorial Hospital and Home including medical records, billing records, [enrollment, payment, claims adjudication, and case or medical management record system maintained by or for a health plan], and records used to make decisions about individuals.

Healthcare operations: include such activities as quality improvement, case management, care coordination, contacting patients and providers about care alternatives, accreditation, certification, licensing, credentialing, performance reviews, training, underwriting, medical reviews, legal services, auditing, compliance, business management, administration, and resolving internal grievances.

Individually identifiable health information (IIHI): Health information, including demographic information, which

• is created by a health care provider, plan or employer, and
• relates to the past, present or future physical or mental health or condition of an individual, or to provision of healthcare to an individual, or to past, present, or future payment for health care for an individual, and
• identifies the individual (or there is a reasonable basis to believe it could be used to identify the individual).

Payment: includes billing, claims management, coordination of benefits, obtaining premiums, determining eligibility or coverage, collection, medical necessity or coverage review, utilization review, adjudication or subrogation of health benefit claims, risk adjusting, and certain disclosures to consumer reporting agencies regarding premium collections or reimbursement.

Protected health information (PHI): Individually identifiable health information that is maintained or transmitted electronically or in any other form. It includes written and oral communications.

Psychotherapy notes: Notes of the contents of conversation during a private counseling session, or a group, joint, or family counseling session that are recorded in any medium by a mental health professional and that are separated from the rest of the individual's medical record. Psychotherapy notes do not include medication prescription and monitoring, session start and end times, modalities and frequency of treatment, results of clinical tests, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date.

Treatment: provision, coordination or management of health care and related services by one or more health care providers. This includes coordination of health care by a provider with a third party, consultation between providers relating to a patient, and referral of a patient for health care from one provider to another.