Privacy Notice of BUENA VISTA REGIONAL MEDICAL CENTER
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
We are required by law to maintain the privacy of your health information and to give you our Notice of Privacy Practices (this “Notice”) that describes our privacy practices, legal duties and your rights concerning your health information.
We follow the confidentiality protections of 42 C.F.R. Part 2 for substance use disorder-related records and the Affiliates who operate Part 2 programs also follow the privacy practices described in Appendix A.
WHO WILL FOLLOW THIS NOTICE
THE UNITYPOINT HEALTH ACE. This Notice describes the privacy practices of the UnityPoint Health Affiliated Covered Entity (the “UnityPoint Health ACE”), the participants of which are listed in Appendix B (the “Affiliates”).
THE UNITYPOINT HEALTH OHCAS. This Notice may be followed by participants of one or more of the Organized Health Care Arrangements (“OHCAs”) listed in Appendix C, if designated as following a joint notice. The participants of the OHCAs must be able to share your health information freely for treatment, payment and health care operations relating to the purposes of the OHCAs as described in this Notice.
HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION
The following are general descriptions of the types of uses and disclosures we may make of your health information without your permission. Where state or federal law restricts one of the described uses or disclosures, we follow the requirements of such law.
TREATMENT. We will use and disclose your health information for treatment. For example, nurses, physicians, students and others who are involved in your care at a UnityPoint Health Affiliate can view your health information in our electronic medical record system. We will also disclose your health information to your physician and other practitioners, providers and health care facilities that provide care for you at their sites, for their use in treating you. For example, if you are transferred from one of our hospitals to a nursing facility, we will send health information about you to the nursing facility.
PAYMENT. We will use and disclose your health information for payment purposes. For example, we will use your health information to prepare your bill and we will send health information to your insurance company with your bill. We may also disclose health information about you to other health care providers, health plans and health care clearinghouses for their payment purposes. For example, if you are brought in by ambulance, the information collected will be given to the ambulance provider for its billing purposes. If state law requires, we will obtain your permission prior to disclosing to other providers or health insurance companies for payment purposes.
HEALTH CARE OPERATIONS. We may use or disclose your health information for our health care operations. For example, medical staff members or members of our workforce may review your health information to evaluate the treatment and services provided, and the performance of our staff in caring for you. In some cases, we will furnish other qualified parties with your health information for their health care operations. The ambulance company, for example, may also want information on your condition to help them know whether they have done an effective job of providing care. If state law requires, we will obtain your permission prior to disclosing your health information to other providers or health insurance companies for their health care operations.
CONTACTING YOU. We may contact you for a variety of reasons, such as to remind you of an appointment for treatment or to provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you. If you provide us with your mobile telephone number, we may contact you by call or text message at that number for treatment-related purposes such as appointment reminders, wellness checks, registration instructions, etc. We will identify UnityPoint Health as the sender of the communication and provide you with a way to “opt out” and not receive further communication in this manner. With your consent, we may contact you on your mobile phone for certain other purposes.
FUNDRAISING. We may use and disclose your health information for the purpose of raising money for one or more of our organizations listed in Appendix B. For example, we may disclose certain information about you to a foundation supporting an Affiliate so that the foundation may contact you to raise money on behalf of the Affiliate. You will have the right to opt out of receiving such communications with each solicitation. Please note that we will promptly process your request to be removed from our fundraising list, and we will honor your request unless we have already sent a communication prior to receiving notice of your election to opt out.
FACILITY DIRECTORY. We may disclose certain information about you while you are an inpatient at any UnityPoint Health hospital unless prohibited by state or federal law. You have the right to request that your name not be included in the directory.
FAMILY, FRIENDS OR OTHERS. We may disclose certain information about you to a family member, your personal representative or another person identified by you if you do not object or we think it’s in your best interest to do so. If any of these individuals are involved in your care or payment for care, we may also disclose such health information as is directly relevant to their involvement. We may also disclose your information to an entity assisting in disaster relief efforts so that your family or individual responsible for your care may be notified of your location and condition.
REQUIRED BY LAW. We will use and disclose your information as required by federal, state or local law, including disclosures to the Secretary of the Department of Health and Human Services to evaluate our compliance with privacy laws.
PUBLIC HEALTH ACTIVITIES. We may disclose health information about you for public health activities, including:
• to a public health authority authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury or disability;
• to appropriate authorities authorized to receive reports of child abuse and neglect;
• to FDA-regulated entities for purposes of monitoring or reporting the quality, safety or effectiveness of FDA-regulated products;
• to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; and
• with parent or guardian permission, to send proof of required immunization(s) to a school.
ABUSE, NEGLECT OR DOMESTIC VIOLENCE. To the extent required or permitted by law, we may notify the appropriate government authority if we believe an individual has been the victim of abuse, neglect or domestic violence.
HEALTH OVERSIGHT ACTIVITIES. We may disclose health information to a health oversight agency for activities authorized by law.
LEGAL PROCEEDINGS. If you are involved in a lawsuit or a dispute, we may disclose health information about you in response to a court or administrative order or in response to a subpoena, discovery request or other lawful process by someone else involved in the dispute, but only if reasonable efforts have been made to notify you of the request or to obtain an order from the court protecting the information requested.
LAW ENFORCEMENT. We may disclose certain health information to law enforcement authorities for law enforcement purposes,
such as:
• as required by law, including reporting certain wounds and physical injuries;
• in response to a court order, subpoena, warrant, summons or similar process;
• to identify or locate a suspect, fugitive, material witness or missing person;
• about the victim of a crime if we obtain the individual’s agreement or, under certain limited circumstances, if we are unable to obtain the individual’s agreement;
• to alert authorities of a death we believe may be the result of criminal conduct;
• information we believe is evidence of criminal conduct occurring on our premises; and
• in emergency circumstances to report a crime; the location of the crime or victims or the identity, description or location of the person who committed the crime.
DECEASED INDIVIDUALS. Following your death, we may disclose health information to a coroner or to a medical examiner and to funeral directors as authorized by law. We are required to apply safeguards to protect your health information for 50 years following your death.
ORGAN, EYE OR TISSUE DONATION. We may disclose health information to organ, eye or tissue procurement, transplantation or banking organizations or entities.
RESEARCH. Under certain circumstances, we may use or disclose your health information for research, subject to certain safeguards. We may disclose health information about you to people preparing to conduct a research project, but the information will stay on site.
THREATS TO HEALTH OR SAFETY. Under certain circumstances, we may use or disclose your health information to prevent a serious and imminent threat to health and safety.
SPECIALIZED GOVERNMENT FUNCTIONS. We may use and disclose your health information for national security and intelligence activities authorized by law or for protective services of the President. If you are a military member, we may disclose to military authorities under certain circumstances. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose to the institution, its agents or the law enforcement official your health information.
WORKERS’ COMPENSATION. We may disclose health information about you as authorized by law for workers’ compensation or similar programs that provide benefits for work-related injuries or illness.
INCIDENTAL USES AND DISCLOSURES. There are certain incidental uses or disclosures of your information that occur while we are providing service to you or conducting our business. For example, after surgery the nurse or doctor may need to use your name to identify family members that may be waiting for you in a waiting area. Other individuals waiting in the same area may hear your name called. We will make reasonable efforts to limit these incidental uses and disclosures.
HEALTH INFORMATION EXCHANGES. We participate in one or more electronic health information exchanges, which permit us to exchange health information about you with others who are permitted to access your health information. Please note that the records of all of our patients will be accessible through the HIEs with which we participate, regardless of the state affiliation and our patients’ locations of care. If you do not want your health information shared with providers through an HIE, you may contact the Privacy Officer at the contact information below to obtain information on how to opt out. If required by law to inform you of our participation in a specific HIE, we have listed the HIE on Appendix D.
BUSINESS ASSOCIATES. We will disclose your health information to our business associates and allow them to create, use and disclose your health information to perform their services for us. For example, we may disclose your health information to an outside billing company who assists us in billing insurance companies.
USES AND DISCLOSURES REQUIRING YOUR AUTHORIZATION
There are many uses and disclosures we will make only with your written authorization. These include:
• Uses and Disclosures Not Described Above. We will obtain your authorization for uses and disclosures of your health information that are not described in the Notice above.
• Psychotherapy Note. Many uses or disclosures of psychotherapy notes require your authorization.
• Marketing. We will not use or disclose your protected health information for certain marketing purposes without your authorization.
• Sale. Unless otherwise permitted by law, we will not sell your protected health information to third parties without your authorization.
If you provide authorization for the disclosure of your health information, you may revoke it at any time by giving us notice in accordance with our authorization policy and the instructions in our authorization form. Your revocation will not be effective for uses and disclosures made in reliance on your prior authorization.
YOUR RIGHTS
ACCESS TO HEALTH INFORMATION. You have the right to request paper or electronic access to inspect and obtain a copy of the health information we maintain about you, with some exceptions. We will provide the information to you in the form and format you requested, assuming it is readily producible. If not, we will produce it another readable electronic form we agree to. We may charge a cost-based fee for producing and sending copies or, if you request one, a summary. If you direct us to transmit your health information to another person, we will do so, provided your signed, written direction clearly designates the recipient and location for delivery.
REQUEST FOR RESTRICTIONS. You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment or health care operations or to persons involved in your care or payment for your care. We are not always required to agree to your request, except if you request that we not disclose certain health information to your health plan for payment or health care operations purposes if (1) you pay out-of-pocket in full for all expenses related to that service either at the time of service or within time frames specified by our written policies and (2) the disclosure is not otherwise required by law.
Certain independent providers provide services at the Affiliates. You must make a separate request to each of these covered entities from whom you will receive services that are involved in your request for any type of restriction. Contact the UnityPoint Health ACE or Affiliate Privacy Officer at the contact information listed below if you have questions regarding which covered entity/providers will be involved in your care.
AMENDMENT. You may request that we amend certain health information that we keep in your records if you believe that it is incorrect or incomplete. We are not required to make all requested amendments. If we deny your request, we will provide you with a written explanation of the reasons and your rights.
ACCOUNTING. You have the right to receive a list of certain disclosures of your health information made by us or on our behalf. The first list in any 12-month period will be provided to you for free; you may be charged a fee for each subsequent list you request within the same 12-month period.
CONFIDENTIAL COMMUNICATIONS. You have the right to request that we communicate with you about your health information in a different way or at a different place. We will agree to your request if it is reasonable and specifies the alternate means or location to contact you.
NOTICE IN THE CASE OF BREACH. You have the right to receive notice of an access, acquisition, use or disclosure of your health information that is not permitted by HIPAA, if such access, acquisition, use or disclosure compromises the security or privacy of your PHI (we refer to this as a breach).
HOW TO EXERCISE THESE RIGHTS. All requests to exercise these rights must be in writing. We will follow written policies to handle requests, respond to you within the stated timeframes and as required by law, and notify you of our decision or actions and your rights. For more information or to obtain request forms, contact the Privacy Officer using the contact information at the end of this Notice.
COMPLAINTS. If you have concerns about any of our privacy practices or believe that your privacy rights have been violated, you may file a complaint with the UnityPoint Health ACE using the contact information at the end of this Notice. You may also submit a written complaint to the U.S. Department of Health and Human Services. You will not be penalized or retaliated against for filing a complaint.
ABOUT THIS NOTICE.
We are required to follow the terms of the Notice currently in effect. We reserve the right to change our practices and the terms of this Notice and to make the new practices and notice provisions effective for all health information that we maintain. Before we make such changes effective, we will make available the revised Notice by posting it in physical locations where we deliver care, where copies will also be available. The revised Notice will also be posted on our website at www.unitypoint.org. You are entitled to receive this Notice in writing at any time. For a written copy, please contact the Privacy Officer using the contact information at the end of this Section.
This Notice does not form a contract with you.
EFFECTIVE DATE OF NOTICE: October 1, 2023
CONTACT INFORMATION
If you have questions about this Notice, please contact:
Attention: Privacy Officer
Buena Vista Regional Medical Center
1525 W. 5th St.
Storm Lake, IA 50588
Phone: 712.213.8687
Fax: 712.732.4190
You may also contact the Privacy Officer for UnityPoint Health by sending written communications to: Privacy Officer, UnityPoint
Health, 1776 West Lakes Parkway, Suite 400, West Des Moines, IA 50266, emailing UPH_PrivacyOfficer@unitypoint.org or calling (515)
241.4652.
APPENDIX A:
In addition to the privacy protections afforded to all medical records under HIPAA, the confidentiality of substance use disorder records are protected by another federal law referred to as Part 2. Certain UnityPoint Health Affiliates operate Part 2 covered programs, and this Appendix is intended to provide patients of those programs with a summary of the laws and regulations governing substance use disorder treatment records, which can be found at 42 U.S.C. §290dd-2 and 42 C.F.R. Part 2 (“Part 2”).
DISCLOSURES OF INFORMATION SUBJECT TO FEDERAL SUBSTANCE USE DISORDER RULES
The following is a summary of the limited circumstances under which we may acknowledge your presence or disclose information about you to individuals outside UnityPoint Health without your permission.
Medical Emergencies. We may disclose your information to medical personnel to the extent necessary to meet a bona fide medical emergency during which you are unable to provide prior informed consent of the disclosure. We may also disclose your identifying information to medical personnel of the Food and Drug Administration (“FDA”) who assert a reason to believe that your health may be threatened by an error in the manufacture, labeling, or sale of a product under FDA jurisdiction, and that the information will be used for the exclusive purpose of notifying patients or their physicians of potential dangers.
Research: Under certain circumstances, we may disclose your information for scientific research, subject to certain safeguards..
Audit and Evaluations. We may disclose information to others for specific audits or evaluations, including those who provide financial assistance to UnityPoint Health or those who conduct audits and evaluations necessary under federally-funded health care programs and federal agencies with oversight of those programs.
Reporting Certain Criminal Conduct. The following information is not protected by Part 2:
• Information related to your commission of a crime on the premises of a UnityPoint Health facility;
• Information related to your commission of a crime against UnityPoint Health personnel; and
• Reports of suspected child abuse and neglect made under state law to the appropriate state or local authorities.
Individuals Involved in Your Care. Depending on your age and mental capacity and the location of your services, we may be permitted to make certain disclosures of your information to your guardian, for payment purposes, and your guardian may be permitted to consent to disclosures of your information.
Deceased Patients. We may disclose your information relating to cause of death under laws requiring the collection of death or other vital statistics or permitting inquiry into the cause of death.
Judicial Proceedings. We may disclose information about you in response to a court order and subpoena that comply with the requirements of the regulations.
Qualified Service Organizations. We will disclose your information to our qualified service organizations to the extent necessary for these entities to provide services to UnityPoint Health.
VIOLATIONS OF LAWS AND REGULATIONS. A violation of the federal law and regulations governing the confidentiality of substance use disorder records is a crime. Suspected violations may be reported to the Substance Abuse and Mental Health Services Administration Center for Substance Abuse Treatment at 5600 Fishers Lane Rockville, MD 20857 or (240) 276.1660 or to the US Attorney for the district in which the violation occurred.
Central District of Illinois
One Technology Plaza
211 Fulton Street, Suite 400
Peoria, IL 61602
(309) 671.7050
Northern District of Iowa
111 7th Ave, SE, Box #1
Cedar Rapids, IA 52401
(319) 363.6333
Southern District of Iowa
U.S. Courthouse Annex
110 East Court Avenue, # 286
Des Moines, Iowa 50309-2053
(515) 473.9300
Western District of Wisconsin
222 West Washington Ave,
Suite 700
Madison, WI 53703
(608) 264.5158
APPENDIX B:
LIST OF PROVIDERS COVERED UNDER THIS NOTICE OF PRIVACY PRACTICES
IOWA
Allen Health Systems, Inc. dba
– UnityPoint Health – Waterloo
Allen Memorial Hospital Corporation dba
– Allen Hospital
Anamosa Area Ambulance Service
Black Hawk-Grundy Mental Health Center, Inc.
Buena Vista Regional Medical Center
Center for Alcohol and Drug Services, Inc.
Central Iowa Health System
Central Iowa Hospital Corporation dba
– Ankeny Medical Park
– Blank Children’s Hospital
– Iowa Lutheran Hospital
– Iowa Methodist Medical Center
– John Stoddard Cancer Center
– Methodist West Hospital
– UnityPoint Health – Des Moines
Clarke County Hospital
Finley Tri-States Health Group, Inc.
Greater Regional Medical Center dba
-Greater Regional Health
Greene County Medical Center
Grinnell Regional Medical Center
Grundy County Memorial Hospital
Humboldt County Memorial Hospital
Iowa Physicians Clinic Medical Foundation dba
– UnityPoint Clinic
Loring Hospital
Lucas County Health Center
Marengo Memorial Hospital dba
– Compass Memorial Healthcare
North Central Iowa Mental Health Center, Inc. dba
– Berryhill Center
Northwest Iowa Hospital Corporation dba
– St. Luke’s Regional Medical Center of Sioux City
Pocahontas Community Hospital
Siouxland Pace, Inc.
Sioux Valley Memorial Hospital Association dba
– Cherokee Regional Medical Center
St. Luke’s Healthcare
St. Luke’s Health Resources dba
– Occupational Medicine
St. Luke’s Methodist Hospital
St. Luke’s/Jones Regional Medical Center dba
– Jones Regional Medical Center
Stewart Memorial Community Hospital
Story County Medical Center
Sumner Community Club dba
– Community Memorial Hospital
The Dubuque Visiting Nurse Association
The Finley Hospital dba
– UnityPoint at Home – Dubuque
The Robert Young Center for Community Mental Health dba
– Robert Young Center
– The Robert Young Mental Health Center
Trinity Health Enterprises, Inc.
Trinity Medical Center
Trinity Regional Medical Center
Unity HealthCare dba
– Trinity Muscatine
UnityPoint At Home dba
– Paula J. Baber Hospice Home (IPU)
– Taylor House (IPU)
– UnityPoint Hospice
UnityPoint Health – Marshalltown
Younker Rehabilitation Therapy Services, LLC
ILLINOIS:
Center for Alcohol and Drug Services, Inc.
Iowa Physicians Clinic Medical Foundation dba
– UnityPoint Clinic
The Robert Young Center for Community Mental Health dba
– Robert Young Center
– The Robert Young Mental Health Center
Trinity Health Enterprises, Inc.
Trinity Medical Center
UnityPoint at Home
WISCONSIN:
Meriter Enterprises, Inc.
– Meriter Laboratory
Meriter Health Services, Inc.
Meriter Hospital, Inc.
APPENDIX C:
UnityPoint Health participates in one or more Organized Health Care Arrangements (“OHCAs”). OHCAs can take one of two forms. First, an OHCA can be a clinically integrated care setting in which patients receive health care services from more than one independent health care provider. Next, an OHCA can be an organized system of health care in which multiple independent covered entities participate in joint health care-related activities including utilization review, quality assessment and improvement activities, or certain payment activities.
This Appendix lists the OHCAs in which UnityPoint Health participates and describes whether and to what extent the OHCA participants follow this Notice.
MEDICAL STAFF
The UnityPoint Health ACE Affiliate Hospitals and the members of their respective medical staffs participate in an OHCA. Our medical staff is made up of physicians, nurse practitioners and other eligible health care professionals who provide health care services in our hospitals, clinics and other sites. The medical staff will follow this Notice when using or disclosing health information related to inpatient or outpatient hospital services rendered through our facilities.
UNITYPOINT HEALTH’S ACOS
The The UnityPoint Health ACE and providers of UnityPoint Health’s Accountable Care Organization (“ACO”) also participate in an OHCA. We share information with providers in the ACO to carry out the health care operations of the ACO, which may include, for example, information regarding a physician’s compliance with ACO protocols in the physician’s treatment of you.
UnityPoint Health-Meriter, Iowa Physicians Clinic Medical Foundation (UPC), UnityPoint at Home participate in an OHCA with University of
Wisconsin Hospitals and Clinics Authority (UWHC) and University of Wisconsin Medical Foundation (UWMF). UWHC and UWMF are collectively referred to as UW Health. These members participate in a joint operating agreement to clinically align their operations within a geographic area to provide timely access and coordinated medical care within the Madison region and surrounding communities. The members share information to carry out their joint health care operations under the joint operating agreement, including, for example, business planning activities and coordinating
managed care contracting.
Robert Young Center participates with other behavioral health services agencies in the Independent Practice Association Network established by Illinois Health Practice Alliance, LLC. The participants share in joint quality activities and/or share financial risk for the delivery of health care with other participants.
All independent practitioners are solely responsible for their judgment and conduct in treating or providing professional services to patients and for their compliance with state and federal laws. Nothing in this Notice is meant to imply or create an employment relationship between any independent physician or other practitioner and us. This Notice does not change or limit any consents for treatment or procedures the patient may sign during the time the patient receives care from any of us.
When applicable, we use a joint Notice of Privacy Practices and a joint Acknowledgement Form with independent physicians and other practitioners to reduce paperwork and make it easier to share information to improve your care. The OHCA does not cover the information practices of practitioners in their private offices or at other practice locations.
APPENDIX D:
LIST OF HEALTH INFORMATION EXCHANGES REQUIRED TO BE DISCLOSED
Iowa Health Information Network (IHIN)
To opt out or for more information visit: https://cynchealth.force.com/s/iowa-opt-in-out