THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Click HERE to download a PDF version of the Notice of Privacy Practices
This Notice of Privacy Practices (“Notice”) describes how Hawaii Health Systems Corporation (HHSC) may use and disclose your protected health information (PHI) to carry out treatment, payment, and/or health care operations and for other purposes that are permitted or required by law.
Who Will Follow this Notice: This notice describes the privacy practices of our facilities that make up the Hawaii Health Systems Corporation (HHSC) and includes:
- Maui Memorial Medical Center
- Kula Hospital
- West Kauai Medical Center
- Kauai Veterans Memorial Hospital
- West Kauai Clinics
- Kona Community Hospital
- Hilo Medical Center
- Ka’u Hospital
- Kohala Hospital
- Lanai Community Hospital
- Leahi Hospital
- Maluhia Hospital
- Hale Ho`ola Hamakua
- Samuel Mahelona Medical Center
What This Notice Provides: The law gives you certain rights in relation to your PHI. PHI is information about you, including information that may identify who you are or where you live, that relates to your past, present, or future physical or mental health or condition, related health care services, and/or payment for such services.
HHSC is implementing an electronic medical record system throughout our facilities that will eventually integrate your medical record across our facilities. This means information created in the course of caring for you will be kept in this integrated record and may be available to others involved in your care at any of our facilities.
"Uses and Disclosures of Health Information" section below describes in more detail how we use and share your health information. We will get your written authorization before we use or share your health information for any other purpose(s), unless such authorization is not required by law.
"Your Rights" section below describes what those rights are. The law also tells us what our obligations are. Those legal obligations are described under "Our Legal Duties." That section also explains that we may revise this Notice at any time.
You may question or complain about our privacy practices; we will not retaliate against you for doing so. How you may file a complaint is described under the "Complaints" section below. The address and telephone number of our Privacy Officer are provided in the "Contact" section. Our Privacy Officer will provide you with any further information and answer any questions that you may have about what is covered under this Notice.
Uses and Disclosures of Health Information
Uses and disclosures which may be made by us without your written authorization:
Treatment. We will use and disclose health information about you to provide, coordinate, and manage your health care and any related services. We will, for example, share your health information with a physician who is treating you, or a nurse who is assisting your doctor, such as prescriptions, lab work, and X-rays. We may also permit disclosure of your medical record via electronic transfer to other medical facilities for treatment. This might include continuing care such as hospice or home care, as well as unrelated care you may seek on your own at other locations.
We also participate in one or more Health Information Exchanges (HIE). Your health information and basic identifying information regarding your visits to our facilities may be shared with the HIEs for the purposes of diagnosis and treatment. Other participating providers in these HIEs may access this information as part of your treatment.
Payment. We will use and disclose health information about you for payment purposes. For example, we will provide your health information as necessary to your health insurance company in order to obtain payment for our services to you. We also may disclose your PHI to third parties for collection of payment.
Health Care Operations. We will use and disclose health information about you for purposes of health care operations. These include quality assessments, training of students (medical, nursing, and other), and fund raising, among other activities. For example, we will use it to evaluate the quality of care that you receive at our facility, and to learn how to improve our facility and services. We may use information from other health care providers to compare our services and outcomes. We may remove information that identifies you from this set of medical information so others may use it to study health care and health care delivery without learning who specific patients are.
We may disclose your PHI for certain healthcare operations, including payment, to certain business operations of another healthcare facility, provider, or third party as long as they have a relationship with you and the information is used for operations such as quality assessment and improvement, case management, and care coordination.
Appointment reminders. We may use your PHI to contact you by phone, email, or letter, to provide appointment reminders.
Treatment Alternatives. We may also contact you to give you information about treatment alternatives, or about other health-related benefits and services that may be of interest to you.
Fund raiser. We may also contact you to ask for donations to raise funds for our benefit. We would disclose only contact information and the dates you received service in one of our facilities. You have a right to opt out of fundraising communications. If you do not want to be contacted, please contact the Privacy Officer.
Uses and disclosures for which you will have the opportunity to agree or object to:
Facility Directory. For facility directory purposes, unless you object when we ask for your permission, we may give out your room number or location in the facility, and your condition described in very general terms that does not give away any medical information about you (for example, "stable"), to people who ask us about you by your name. Unless you object when we ask for your permission, we may also give out that same information plus your name and your religious affiliation to members of the clergy. If you don’t want this information listed in the directory, you must notify the admissions department.
Involvement in your care. We may use and give out information about you to a person who is involved in your care or who is involved in paying for your health care. But before we give out any information to that person, if you are there and able to answer, we will ask you for your permission, unless we reasonably believe that you will not object. If you are not there, or are unable to agree or object, we may give out information about you to a person involved in your care if we believe it would be in your best interest for us to do so. For example, we may allow the person on your behalf to pick up filled prescriptions, X-rays, or medical supplies, to that person.
For purposes of notification. We may use information in your records to find a member of your family or a person responsible for your care. We may get in touch with and tell that person that you are at our facility, about your general condition, or of your death. But before we use or give out any such information, if you are there and able to answer, we will ask you for your permission, unless we believe from the circumstances and our professional judgment that you will not object. If you are not present, or are unable to agree or object, we may disclose information to a person involved in your care only if we believe that it would be in your best interest for us to do so. We may also use or give out information about you to disaster relief organizations (such as the Red Cross), in order to coordinate and help them in their notification efforts.
Uses and disclosures we may make without your authorization:
As Required by law. We may use or give out information about you if we are required to do so by law. For example, we may use or give out information about you as required by law:
- To a government agency for it to oversee our activities as a health care provider. Examples of those agencies include the state health professional licensure boards, Offices of Inspectors General of federal agencies, the Department of Justice, Health and Human Services Office for Civil Rights, Federal Drug Administration, OSHA, the EPA, the state Medicaid fraud control unit, Social Security Administration, and the Department of Education.
- In judicial and administrative proceedings, in response to an order of a court or an administrative tribunal, or in response to a subpoena, discovery request, or other lawful process; and
- To report information about victims of abuse, neglect, or domestic violence to a government authority, such as a social service or protective services agency.
Public Health or Health Oversight Purposes. We may give out information about you to a public health authority authorized by law, such as the Department of Health, to help the public health authority perform various public health activities, such as preventing and controlling disease, injury, disability, and child abuse. Other examples might include notifying people of recalls of medical products they may be using, notifying a person who has been exposed to a disease, reporting reactions to certain medications.
Law Enforcement Purposes. We may give out information about you for law enforcement purposes to the police or other law enforcement officials, as required by law. For example, we report:
- Certain types of wounds, such as a knife wound, bullet wound, gunshot wound, and powder burn;
- Drug and alcohol testing results under certain circumstances;
- Serious injuries and fatalities caused by fireworks.
We may also give out information about you to law enforcement officials:
- pursuant to a court order, warrant, subpoena, or summons, or a grand jury subpoena or other similar legal process. for purposes of identifying or locating a suspect, fugitive, material witness, or a missing person.
- for the purpose of alerting law enforcement of your death which is suspected to have resulted from criminal conduct.
- if we believe in good faith that information constitutes evidence of a criminal conduct that occurred on our property.
- in providing emergency health care outside our hospital, if disclosure appears necessary to alert law enforcement to the commission and nature of a crime, the location of the crime or of the victim of it, and the identity, description and location of the perpetrator of the crime.
To coroners, medical examiners, and funeral directors. Where applicable, we may give PHI about you to a coroner or medical examiner, for the coroner or medical examiner to identify you upon your death and to determine a cause of death, and to perform their other duties. We may also give out information about you to a funeral director to carry out his or her duties. If necessary for the funeral directors to carry out their duties, we may do so prior to and in reasonable anticipation of death.
Organ donation. We may use or give out information about you to organ procurement organizations, for purposes of organ, eye, or tissue donation and transplantation.
Research. We may disclose your protected health information to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to protect the privacy of your health information. We may allow other researchers to review your PHI to prepare a plan for a specific research project, but none of your identifiable information will leave our facilities. We may use your PHI to contact you about participating in a research study that you might be interested in. If you choose to participate, you will be asked to sign an authorization.
Serious threat to health or safety. We may use or give out certain information about you in order to prevent or lessen a serious threat to health or safety of a person or the public. If necessary, we may give out such information to law enforcement authorities.
Armed Forces and foreign military personnel. If you are a member of our Armed Forces, we may use or give out information about you to military authorities if the military authorities determine that it is necessary for proper execution of the military mission. If you are a member of the armed forces of a foreign country, we may similarly use and give out information about you to your military authorities.
National security and intelligence activities. We may give information about you to authorized federal government officials for them to conduct lawful intelligence, counter-intelligence, and other national security activities.
Protective services for the President and others. We may give out information about you to authorized federal government officials for them to provide protective services to the President, to foreign government leaders, and to others whom they are authorized to provide such services, and for them to conduct authorized investigations.
Workers compensation. We may give out information about you in order to comply with workers' compensation laws and other similar programs established by law that provide benefits when you are injured or when you get ill at work.
Proof of Immunizations: We may give out proof of immunizations about an individual, who is a student or prospective student, where the school is required by law to have such proof, and we obtain documentation regarding the agreement to the disclosure from the personal representative or the individual, if the individual is an adult or emancipated minor.
Other Uses and disclosures that require your written authorization:
Any other uses or disclosures of PHI about you, other than those listed above, will be made by us only with your written authorization. You may at any time revoke, in writing, any authorization you give, except to the extent that we have taken an action in reliance on your authorization. If you revoke your permission, we will stop any use or disclosure of PHI previously permitted by your written authorization; however, we cannot recoup any disclosures already made with your permission. Certain information, such as HIV/AIDS and substance abuse information, is subject to additional protections. Most uses and disclosures of psychotherapy notes (where appropriate), uses and disclosures of PHI for marketing purposes, and disclosures that constitute a sale of PHI, require an authorization.
This section on "Uses and Disclosures of Health Information" does not describe all the details regarding the uses and disclosures of information about you. For further information and details, and for any questions that you may have, please contact our Privacy Officer. The contact information is provided below in the "Contact" section of this Notice.
Your Rights Regarding your PHI In addition to those rights explained above, you have the following rights: Request for Restrictions. You may ask us not to use or disclose any part, or all, of the information we have about you:
- for purpose of carrying out treatment, payment, or health care operations;
- to anyone who is involved in your care or is paying for your care; or
- for notification purposes, as described above under "Uses and Disclosures of Health Information."
If you are going to ask us for any such restrictions on how we are to use or give out information about you, please make the restriction request in writing to the Privacy Officer. You must clearly tell us what restriction(s) you are asking for. You must tell us what information you do not want us to use or disclose. You must also tell us to whom you do not want us to give the information about you.
Please understand that you may ask us for such restrictions, but we are not required by law to agree to any such restrictions except as described in the next paragraph. If we do agree to your request, we will honor it until such time as when the request for restriction is withdrawn or terminated by you in writing.
Request for Restriction on Disclosures to Your Health Plan. You have a right to request a restriction on information disclosed to your health plan if:
- The disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and
- The PHI pertains solely to a health care item or service for which you, or a person on your behalf (other than your health plan), have paid us in full at the time services are delivered.
Termination of a restriction. We may terminate any previously agreed upon restriction of the sharing of PHI if:
- You agree to, or request, the termination in writing;
- You orally agree to the termination and the oral agreement is documented, or;
- You are informed that we are terminating our agreement to a restriction, except that such termination is not effective for PHI for requests for restrictions to your health plan as identified in the previous section.
Request for Confidential Communication. You may ask us, in writing, to contact you in a certain way or at a certain place. For example, you may ask us not to call you by telephone or to call you at a certain telephone number; or you may ask us to mail things to you at a certain address. As long as the request is reasonable, we will honor your request, and not ask for an explanation as to the request.
Inspection and copying. In most cases, you have the right to look at or get a paper or electronic copy of the information we have about you in our medical and business records. If you request a copy of the information, or agree to a summary or explanation of the information, we will charge you a reasonable fee for the copying, postage, and/or preparing the explanation or summary, as applicable. If the PHI that is the subject of your request for access is maintained electronically, and if you request an electronic copy, HHSC will provide the individual with access to the PHI in electronic format. If your request for access directs the HHSC facility to transmit the copy of PHI directly to a third-party designated by you, we must provide the copy to the person you designate.
The law may not allow you to look at certain types of information about you. If we decide that you may not look at or copy certain information about you, under some circumstances, you may question that decision and have it reviewed. Please contact the facility Health Information Management Department if you have questions about access to your health information.
Request for amendment. If you believe that PHI about you in our medical or business record is incorrect or if important information is missing, you may ask us, in writing, to amend the information. Under certain circumstances, we may deny your request, in whole or in part. If we deny your request, we will notify you of the denial. You may then submit to us a written statement of disagreement. We may then prepare a rebuttal and provide a copy of it to you.
Accounting of disclosures. You have the right to receive a list of disclosures about you that we have made during a period of up to three years before the date of your request. Your request may state a shorter time period. The list will not include any disclosures made for purposes of carrying out treatment, payment, or health care operations. It will not include disclosures made to you, those made with your authorization, or those made for facility directory or notification purposes. There are other exceptions, restrictions, and limitations to this right.
Paper copy of the Notice. You have the right to request and obtain a paper copy of this Notice of Privacy Practices, even if you have agreed to receive the notice electronically.
You have the right to file a complaint. If you believe your privacy rights regarding your PHI may have been violated, you may file a complaint with the facility, the HHSC Corporate Office, or the Secretary of the Department of Health and Human Services. You will not be penalized for filing a complaint in good faith.
This section on "Your Rights" does not describe all the details of your rights. Nor does it describe in detail all the exceptions, restrictions, and limitations that may apply to those rights. For further information and details, and for any questions that you may have, please contact our Privacy Officer. The contact information is provided below in the "Contact" section of this Notice.
Our Legal Duties We are required by law to:
- Keep records of the care that we provided you
- Protect the privacy of your PHI;
- Provide this notice about our legal duties and privacy practices with respect to your PHI ; and
- To abide by what this Notice of Privacy Practices says.
To notify you of breaches of your unsecured PHI as an individual has the right to, or will receive notifications of, breaches of his or her unsecured PHI.
Revising this Notice of Privacy Practices. We reserve the right to change this Notice of Privacy Practices, and to make the new (changed) Notice apply to all health information and records that we have at that time, including information about you that we obtained or created before the change. The new Notice will be posted in the registration and business area(s) of our facilities, and on our web site at [www.hhsc.org]. You may also call the Privacy Officer and request that a copy of the revised Notice be sent to you by mail.
Complaints If you believe that we have violated any of your privacy rights, you may complain to us by calling or writing our Privacy Officer, whose name, telephone number, and address appear below. You may also complain to the Secretary of the U.S. Department of Health and Human Services. We will not retaliate against you for questioning or complaining to us, or for filing a complaint against us.
Please contact our Privacy Officer for any further information about the complaint process.
Please contact the Regional Compliance and Privacy Officer and/or the Corporate Compliance and Privacy Officer for any questions you may have, and for further information about anything in this Notice:
East Hawaii (Hilo, Ka`u, Hale Ho`ola Hamakua)
Regional Compliance and Privacy Officer Hilo Medical Center
1190 Waianuenue Ave. Hilo, HI 96720
Tel: (808) 932-3181
Kauai (West Kauai Medical Center/Kauai Veterans Memorial Hospital, Samuel Mahelona Medical Center, West Kauai Clinics)
Regional Compliance and Privacy Officer
P.O. Box 337
Waimea, HI 96796
Tel: (808) 240-2754
Maui (Maui Memorial Medical Center, Kula Hospital, Lanai Community Hospital)
Regional Compliance and Privacy Officer
Maui Memorial Medical Center
221 Mahalani Street
Wailuku, Maui, HI 96793
Tel: (808) 442-5232
Oahu Region (Leahi Hospital, Maluhia Hospital)
Regional Compliance and Privacy Officer
3675 Kilauea Avenue
Honolulu, HI 96816
Tel: (808) 733-7913
West Hawaii Region (Kona Community Hospital, Kohala Hospital)
Regional Compliance and Privacy Officer
Kona Community Hospital
79-1019 Haukapila Street
Kealakekua, HI 96750
Tel: (808) 322-6976
Chief Compliance and Privacy Officer
Hawaii Health Systems Corporation
3675 Kilauea Avenue
Honolulu, HI 96816
Tel: (808) 240-1342
Effective Date Legal Review: May 15, 2013 Updated: May 24, 2013