Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. PLEASE REVIEW IT CAREFULLY.

For part 2 Substance Use Disorder (SUD) records, this notice describes:

• How part 2 health information about you may be used and disclosed
• Your rights with respect to your health information
• How to file a complaint concerning a violation of the privacy or security of your health information, or of your rights concerning your information

You have a right to a copy of this notice (in paper or electronic form) and to discuss it with our privacy officer at 833-718-1043 or privacyofficer@trinity-health.org if you have any questions.

We understand that your health information is highly personal, and we are committed to safeguarding your privacy. Please read this Notice of Privacy Practices thoroughly. It describes how we will use and disclose your Protected Health Information (PHI).

The Health Insurance Portability and Accountability Act of 1996, and the Health Information Technology for Economic and Clinical Health Act (found in Title XIII of the American Recovery and Reinvestment Act of 2009) (collectively referred to as “HIPAA”), as amended from time to time, requires us to maintain the privacy of individually identifiable patient health information (this information is “protected health information” and is referred to herein as “PHI”).

We are also required to provide patients with a Notice of Privacy Practices regarding PHI. We will only use or disclose your PHI as permitted or required by applicable state and federal law. This Notice applies to your PHI under our control including the medical records generated by us.

This Notice applies to the delivery of health care by our hospital and its medical staff in the main hospital, all outpatient departments, Part 2 Substance Use Disorder treatment programs and clinics. This Notice also applies to the utilization review and quality assessment activities of Trinity Health and our hospital as a member of Trinity Health, a Catholic health care system with facilities located in multiple states throughout the United States.

1. Permitted Use or Disclosure
   
   1. Treatment: We will use and disclose your PHI to provide, coordinate, or manage your health care and related services to carry out treatment functions. The following are examples of how we will use and/or disclose your PHI:
      
      1. To your attending physician, consulting physician(s), and other health care providers who have a legitimate need for such information in your care and treatment.
      2. To coordinate your treatment (e.g., appointment scheduling) with us and other health care providers such as name, address, employment, insurance carrier, etc.
      3. To contact you as a reminder that you have an appointment for treatment or medical care at our facilities.
      4. To provide you with information about treatment alternatives or other health-related benefits or services.
      5. If you are an inmate of a correctional institution or under the custody of a law enforcement officer, we will disclose your PHI to the correctional institution or law enforcement official as required by law.
   2. Substance Use Disorder (SUD) Treatment: We provide substance use disorder treatment programs that are covered by 42 CFR Part 2 (a “Part 2” Program). If you receive this type of care, you may be asked to sign a general consent for treatment form for the Part 2 Program. Written authorization for treatment, payment and operations purposes may be obtained once and can support future uses of your PHI for treatment, payment and operations purposes without further authorization under HIPAA.
      
      1. If we receive or maintain any information about you from a substance use disorder treatment program that is covered by 42 CFR Part 2 (a “Part 2 Program”) through a single written consent you provide to the Part 2 Program to use and disclose the Part 2 Program record for purposes of treatment, payment or health care operations, we may also use and disclose your Part 2 Program record for treatment, payment and health care operations purposes as described in this Notice.
      2. If we receive or maintain your Part 2 Program record through specific consent you provide to us or another third party, we will use and disclose your Part 2 Program record only as expressly permitted by you in your consent as provided to us.
      3. In no event will we use or disclose your Part 2 Program record, or testimony that describes the information contained in your Part 2 Program record, in any civil, criminal, administrative, or legislative proceedings by any Federal, State, or local authority, against you, unless authorized by your consent or the order of a court after it provides you notice of the court order.
      4. Fundraising. You have the right to request to opt out of specific fundraising activities related to Substance Use Disorder treatment.
      5. Your Rights Regarding Part 2 Records. The additional patient rights outlined in this Notice apply to all medical information, including Part 2 records.
   3. Payment: We will use and disclose PHI about you for payment purposes. The following are examples of how we will use and/or disclose your PHI:
      
      1. To an insurance company, third party payer, third party administrator, health plan or other health care provider (or their duly authorized representatives) for payment purposes such as determining coverage, eligibility, pre-approval / authorization for treatment, billing, claims management, reimbursement audits, etc.
      2. To collection agencies and other third parties engaged in obtaining payment for care.
   4. Health Care Operations: We will use and disclose your PHI for health care operations purposes. The following are examples of how we will use and/or disclose your PHI:
      
      1. For case management, quality assurance, utilization, accounting, auditing, discharge planning, population health activities relating to improving health or reducing health care costs, education, accreditation, licensing, and credentialing activities.
      2. To consultants, accountants, auditors, attorneys, transcription companies, information technology and cloud storage providers, etc.
   5. Other Uses and Disclosures: As part of treatment, payment, and health care operations. We may also use your PHI for the following purposes:
      
      1. Fundraising and Marketing Activities: We will use and may also disclose some of your PHI, including a related foundation, for certain fundraising and marketing activities. For example, we may use or disclose your demographic information, your treatment dates of service, treating physician information, department of service and outcomes information and may ask you for a monetary donation. Any fundraising and marketing communication sent to you will let you know how you can exercise your right to opt-out of receiving similar communications in the future.
      2. Medical Research: We will use and disclose your PHI in a permitted manner to medical researchers who request it for approved medical research projects. Researchers are required to safeguard all PHI they receive.
      3. Health Promotion Activities: We will use and disclose some of your PHI for certain health promotion activities. For example, your name and address will be used to send you general newsletter or specific information based on your own health concerns.
      4. Artificial Intelligence: We use technology to support care and treatment that may use Artificial Intelligence (AI). Artificial intelligence technology uses information to train and improve AI functionality. Our technology partners, including those with AI technology, must keep information confidential under applicable law.
      5. De‑identified Information: We may use and disclose information that has been de-identified, meaning it does not include your name, address, or other individual details that could directly identify you, in accordance with federal law. Once your information has been de-identified, it is no longer considered protected health information under HIPAA and is not subject to the same privacy protections.
   6. More Stringent Laws: The State laws where you live may be more stringent than HIPAA in several areas. We will continue to abide by these more stringent state laws.
      
      1. More Stringent Laws: State law is more stringent when the individual is entitled to greater access to records than under HIPAA. State law also is more stringent when the records are provider greater protection from disclosure by state law than under HIPAA. In cases where we provide treatment to a patient who resides in a neighboring state, we will abide by the more stringent applicable state law.
   7. Health Information Exchange: We share your health records electronically or otherwise with Health Information Exchanges ("HIEs") that exchange health records with other HIEs. We also use data exchange technology (such as direct messaging services, health information services provider (“HISP”), and provider portals) with its Electronic Health Record ("EHR") to share your health records for permitted purposes including continuity of care and treatment. HIEs and data exchange technology enable the sharing of your health records to improve the quality of health care services provided. The shared health records will include, if applicable, sensitive diagnoses such as HIV/AIDS, sexually transmitted diseases, genetic information, mental health, and alcohol/substance use disorder. HIEs and data exchange technology providers function as our business associate and, in acting on our behalf, they will transmit, maintain and store your PHI for treatment, payment and health care operations and other permitted purposes. HIEs and data exchange technologies are required to implement administrative, physical, and technical safeguards that protect the confidentiality and integrity of your medical information. Applicable law may provide you with the right to restrict, opt-in, or opt-out of HIE(s). For more information, please contact our Privacy Officer at 833-718-1043, or you can email us at privacyofficer@trinity-health.org.
2. Permitted Use or Disclosure with an Opportunity to Agree or Object
   
   1. Family/Friends: We will disclose PHI about you to a friend or family member who is involved in or paying for your medical care. You have a right to request that your PHI not be shared. In addition, we will disclose PHI about you to an agency assisting in disaster relief efforts so that your family can be notified about your condition, status, and location.
   2. Hospital Directory: We may include certain information about you in a directory when you are a hospital patient. This information will include your name, location, your general condition (e.g., fair, stable, critical, etc.) and your religious affiliation. The directory information, except your religious affiliation, will be disclosed to people who ask for you by name. You have the right to request that your name not be included in our directory. If you request to opt-out of the directory, we cannot inform visitors of your presence, location, or general condition.
   3. Spiritual Care: Directory information, including your religious affiliation, will be given to a member of the clergy, even if they do not ask for you by name. Spiritual care providers are members of the health care team and may be consulted regarding your care. You have the right to request that your name not be given to members of the clergy.
   4. Media Reports: We will release facility directory information to the media (excluding religious affiliation) if the media requests information about you using your name. Note that you may decline to be included in the directory.
3. Use or Disclosure Requiring Your Authorization
   
   1. Marketing: Subject to certain limited exceptions, your written authorization is required in cases where we receive any direct or indirect financial remuneration in exchange for making the communication to you which encourages you to purchase a product or service or for a disclosure to a third party who wants to market their products or services to you.
   2. Research: We will obtain your written authorization to use or disclose your PHI and/or tissue samples for research purposes when required by HIPAA or clinical research laws and regulations.
   3. Psychotherapy Notes: Most uses and disclosures of psychotherapy notes require your written authorization.
   4. Part 2 SUD Counseling Notes: We must obtain your separate written consent prior to disclosing any SUD Counseling Notes which may be contained within your Part 2 record unless otherwise permitted by Part 2. An authorization for disclosure of SUD Counseling Notes may not and will not be combined with any other authorization.
   5. Sale of PHI: Subject to certain limited exceptions, disclosures that constitute a sale of PHI require your written authorization.
   6. Other Uses and Disclosures: Any other uses or disclosures of PHI that are not described in this Notice of Privacy Practices may require your written authorization (if not permitted by HIPAA). Written authorizations will let you know why we are using your PHI. You have the right to revoke an authorization at any time.
4. Use or Disclosure Permitted or Required by Public Policy or Law without your Authorization
   
   1. Law Enforcement Purposes: We may disclose your PHI for law enforcement purposes as permitted by law, such as identifying a criminal suspect or a missing person or providing information about a crime victim or criminal conduct affecting you.
   2. Required by Law: We will disclose PHI about you when required by federal, state, or local law. Examples include disclosures in response to a court order / subpoena, mandatory state reporting (e.g., gunshot wounds, victims of child abuse or neglect), government investigations, or information necessary to comply with other laws such as workers’ compensation or similar laws. We will report drug diversion and information related to fraudulent prescription activity to law enforcement and regulatory agencies.
   3. Public Health Oversight or Safety: We will use and disclose PHI to avert a serious threat to the health and safety of a person or the public. Examples include disclosures of PHI to state investigators regarding quality of care or to public health agencies regarding immunizations, communicable diseases, etc. We will use and disclose PHI for activities related to the quality, safety or effectiveness of Food and Drug Agency regulated products or activities, including collecting and reporting adverse events, tracking, and facilitating in product recalls, etc.
   4. Coroners, Medical Examiners, Funeral Directors: We will disclose your PHI to a coroner or medical examiner. For example, this will be necessary to identify a deceased person or to determine a cause of death. We may also disclose your medical information to funeral directors as necessary to carry out their duties.
   5. Organ Procurement: We will disclose PHI to an organ procurement organization or entity for organ, eye, or tissue donation purposes.
   6. Specialized Government Functions: We will disclose your PHI regarding government functions such as military, national security and intelligence activities. We will use or disclose PHI to the Department of Veterans Affairs to determine whether you are eligible for certain benefits.
   7. Immunizations: We will disclose proof of immunization to a school where the state or other similar law requires it prior to admitting a student.
5. Your Health Information Rights:
   
   You have the following individual rights concerning your PHI including Part 2 records:
   
   1. Right to Inspect and Copy: Subject to certain limited exceptions, you have the right to access your PHI and to inspect and copy your PHI as long as we maintain the data.
      
      If we deny your request for access to your PHI, we will notify you in writing with the reason for the denial. For example, you do not have the right to psychotherapy notes or to inspect the information which is subject to law prohibiting access. You may have the right to have this decision reviewed.
      
      You also have the right to request your PHI in electronic format in cases where We utilize electronic health records.
      
      You will be charged a reasonable copying fee in accordance with applicable federal or state law.
      
      For your convenience, some of your PHI will be accessible in a patient portal. Access to additional PHI is obtained through an access request.

   2. Right to Amend: You have the right to amend your PHI for as long as we maintain the data. You must make your request for amendment of your PHI in writing to privacyofficer@trinity-health.org or, to our system privacy officer at 20555 Victor Parkway, Livonia, MI 48152 including your reason to support the requested amendment.
      
      However, we will deny your request for amendment if:

      1. We did not create the information
      2. The information is not part of the designated record set
      3. The information would not be available for your inspection (due to its condition or nature)
      4. The information is accurate and complete

      If your request for changes in your PHI is denied, the Privacy Officer will notify you in writing with the reason for the denial. The Privacy Officer will also inform you of your right to submit a written statement, disagreeing with the denial. You may ask that we include your request for amendment and the denial any time that we subsequently disclose the information that you wanted changed. We may prepare a rebuttal to your statement of disagreement and will provide you with a copy of that rebuttal.

   3. Right to an Accounting: You have a right to receive an accounting of the disclosures of your PHI that we have made, except for the following disclosures:

      1. To carry out treatment, payment, or health care operations;
      2. To you;
      3. To people involved in your care;
      4. For national security or intelligence purposes; or
      5. To correctional institutions or law enforcement officials.

      You must make your request for an accounting of disclosures of your PHI in writing to our privacy officer at: privacyofficer@trinity-health.org at: 20555 Victor Parkway, Livonia, MI 48152.
      
      You must include the time period of the accounting, which may not be longer than 6 years. Once during any 12-month period, we will provide you with an accounting of the disclosures of your PHI at no charge. Any additional requests for an accounting within that time period will be subject to a reasonable fee for preparing the accounting.

   4. Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures of your PHI to carry out treatment, payment or health care operations functions or to prohibit such disclosure. However, we will consider your request, but it is not required to agree to the requested restrictions.
   5. Right to Request Restrictions to a Health Plan: You have the right to request a restriction on disclosure of your PHI to a health plan (for purposes of payment or health care operations) in cases where you paid out of pocket, in full, for the items received or services rendered. Such requests will be honored.
   6. Right to Confidential Communications: You have the right to receive confidential communications of your PHI by alternative means or at alternative locations. For example, you may request that we only contact you at work or by mail. If you have provided your email, we may contact you via that email unless you request an alternate means of contact.
   7. Right to Receive a Copy of this Notice: You have the right to receive a paper copy of this Notice of Privacy Practices, upon request.
6. Breach of Unsecured PHI
   
   If a breach of unsecured PHI that affects you occurs, we are required to notify you of the breach. Such notice may be provided by our business associate on our behalf.
7. Sharing and Joint Use of Your Health Information
   
   Members of Trinity Health and medical staff use your PHI for treatment, payment and/or for health care operations permitted by HIPAA with respect to our mutual patients. While providing care to you and in furtherance of our mission to improve the health of the community, we will share your PHI with other organizations and providers who have agreed to abide by the terms described below:
   
   1. Medical Staff: The medical staff and the members of Trinity Health participate together in an organized health care arrangement to deliver health care to you. We have agreed to abide by the terms of this Notice with respect to PHI created or received as part of delivery of health care to you. We will access and use PHI to fulfill our charitable mission, including assessing and improving the quality of care.
   2. Membership in Trinity Health: We and other members of Trinity Health participate together in an organized health care arrangement for utilization review, quality assessment, and related activities. As a part of Trinity Health, a national Catholic health care system, that includes other hospitals, nursing homes, and health care providers share your PHI for utilization review, quality assessment, and related activities of Trinity Health, the parent company, and its members. All members of Trinity Health have agreed to abide by the terms of this Notice with respect to PHI created or received as part of utilization review and quality assessment activities.
      
      Please go to Trinity Health’s websites for a listing of member organizations at https://www.trinity-health.org. Or, alternatively, you can call our Privacy Officer to request the same at 833-718-1043, or you can email us at privacyofficer@trinity-health.org.
   3. Business Associates: We will share your PHI with business associates and their subcontractors contracted to perform business functions on our behalf, including Trinity Health, which performs certain business functions for our members.
   4. Your Health Care Providers and Care Coordinators: You receive care delivered in an integrated care setting, where patients are seen by different providers and in different care settings as part of continuity of care and coordinated care delivery. We share your PHI with other health care providers and care coordinators who work together to provide treatment, obtain payment, and conduct health care operations. Your PHI is shared electronically in multiple ways with providers involved in the delivery of care and care coordination. Your PHI may be shared via a direct connection to the electronic health record system of other providers. Your PHI may be shared in a health information exchange or via technology that enables downstream providers and care coordinators to obtain your information. Your PHI may be shared via secure transmission to other providers' inboxes.
8. Changes to this Notice
   
   We will abide by the terms of the Notice currently in effect. We reserve the right to make material changes to the terms of its Notice and to make the new Notice provisions effective for all PHI that we maintain. We will distribute / provide you with a revised Notice on your first visit following the revision of the Notice- in cases where we have made a material change in the Notice. You can also ask for a current copy of the Notice at any time. Current copies are posted on the Trinity Health member internet sites.
   
   Complaints: If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the Secretary of the Department of Health and Human Services. Also complaints can be submitted to us at privacyofficer@trinity-health.org, or by calling 833-718-1043, or to our system privacy officer at: 20555 Victor Parkway, Livonia, MI 48152.
9. You will not be retaliated against for filing any complaint.
   
   Privacy Official – Questions / Concerns / Additional Information. If you have any questions, concerns, or want further information regarding the issues covered by this Notice of Privacy Practice, please contact our privacy officer at 833-718-1043, or you can email privacyofficer@trinity-health.org.