Notice of Privacy Practices

Introduction

Lurie Children's believes in protecting the privacy of your health information. This Notice of Privacy Practices (“Notice”) tells you about a federal law, the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, designed to help protect that privacy. The HIPAA Privacy Rule requires Lurie Children's to make this Notice available. This Notice explains our use of your health information.

This Notice describes how medical information about you may be used and disclosed and how you can access this information. Please review it carefully.

We hope the Notice helps you understand how we use and protect your health information. If you have any questions about this Notice, please contact our Privacy Officer at Ann & Robert H. Lurie Children's Hospital of Chicago, 225 East Chicago Avenue, Box 160, Chicago, Illinois 60611-2605, or by phone at 1.312.227.4679.

NOTICE OF PRIVACY PRACTICES

This Notice describes how we may use and disclose patient information for treatment, payment, health care operations, and other purposes permitted or required by law. It also describes a patient's, parent's, legal guardian's, or other authorized personal representative's rights to access and control patient information. "Patient information" is information that may identify the patient and that relates to the patient's past, present, or future physical or mental health or condition and related healthcare services or payment for such services.

Generally, when this Notice uses the words "you" or "your," it refers to the patient who is the subject of patient information. However, when this Notice discusses rights regarding patient information, including rights to access or authorize the disclosure of patient information, "you" and "your" may refer to a minor-patient's parent, legal guardian, or other personal representative, or, as applicable, an adult patient's personal representative.

If you have any questions about this Notice, please contact our Privacy Officer at Ann & Robert H. Lurie Children's Hospital of Chicago, 225 East Chicago Avenue, Box 160, Chicago, Illinois 60611-2605, or by phone at 1.312.227.4679.

WHO WILL FOLLOW THIS NOTICE

This Notice describes the privacy practices of Children’s Hospital of Chicago Medical Center, Ann & Robert H. Lurie Children’s Hospital of Chicago, Stanley Manne Children’s Research Institute, Pediatric Faculty Foundation, Inc., Lurie Children’s Surgical Foundation, Inc., Lurie Children’s Pediatric Anesthesia Associates, Lurie Children’s Medical Group, LLC, Lurie Children’s Primary Care, LLC (also known as Town & Country Pediatrics), Almost Home Kids, Lurie Children’s Health Partners Care Coordination, LLC, and their physicians, nurses, other personnel and business associates (collectively, “we” or “us”).

OUR PLEDGE REGARDING PATIENT INFORMATION

This Notice applies to patient information and the records of your care and payment for your care.

This Notice tells you how we may use and disclose your patient information.  It also describes your rights and our obligations regarding using and disclosing patient information.

We are required by law to:

• Assure that patient information that identifies you is kept confidential in accordance with law;
• Give you this Notice of our legal duties and privacy practices with respect to protected health information, with the exception of inmates;
• Follow the terms of this Notice or, if this Notice is later revised, a future notice then in effect; and
• Notify you in the event of a breach of your patient information.

CHANGES TO THIS NOTICE

We reserve the right to change this Notice. We reserve the right to make the revised or changed Notice effective for patient information we already have about you and any information we receive in the future. We will post a copy of our current Notice of Privacy Practices in Lurie Children's inpatient admission and outpatient registration departments (including Outpatient Centers) and on our Web site at www.luriechildrens.org. The revised Notice is available upon request.

COMPLAINTS

If you have questions, would like additional information, or believe your privacy rights have been violated, you may file a complaint with us or the Director of the Office for Civil Rights of the U.S. Department of Health and Human Services. Upon request, Patient Relations will provide you with the correct address of the Director. To file a compliance report with us, please contact the Privacy Officer, Lurie Children’s, 225 E. Chicago Ave., Box 106, Chicago, Illinois 60611, by phone at 312.227.4679 or by email at masiegel@luriechildrens.org. We will not retaliate against you if you file a complaint with us or the Director of the Office for Civil Rights. 

HOW WE MAY USE AND DISCLOSE YOUR PATIENT INFORMATION

The following categories describe different purposes for which we may use and disclose your patient information without specific written authorization from you (or your parent or other personal representative). We explain each category of use or disclosure below and include examples, but we do not list every use or disclosure.

However, for certain other activities and purposes, we must obtain your written authorization to use or disclose your patient information. For instance, we will obtain written authorization before disclosing any of your patient information when required by law, including laws providing extra protection for information or records about HIV/AIDS testing, mental health or developmental disability services, alcohol or drug abuse treatment services, genetic testing, child abuse, or sexual assault. We will also obtain your written authorization to use the telephone number(s) and email address(es) you provide for marketing, fundraising, payment, and collection purposes.

Treatment: We may use patient information about you to provide treatment services, such as diagnosing or treating your injury or illness.

Payment: We may use and disclose patient information about you so that the treatment and services you receive may be billed to, and payment may be collected from you, a health insurance company, another health plan, or other third party responsible for paying for your treatment. For example, we may need to give your health plan information about the treatment you received so your health plan will pay us or reimburse you for your treatment. We may also contact your health plan about a treatment you will receive to obtain prior approval or to determine whether your plan will pay for the treatment.

Health Care Operations: We may use and disclose your patient information for our health care operations, including internal administration and planning and various activities that improve the quality and cost-effectiveness of the care that we deliver to you.

Appointment Reminders and Treatment Follow-up Alternatives: We may contact you to remind you of any appointments, healthcare treatment options, or other health services that may be of interest to you.

Research: We may use or disclose your patient information without your authorization for certain research activities. We may also share a subset of your patient information for research without your consent as part of a Limited Data Set, as defined under HIPAA. A Limited Data Set does not include your name, contact information, or social security number.

Patient Directory: Unless you notify us that you object, we will use your name, location in the facility, general condition, and religious affiliation for directory purposes. We will disclose all this information, except for religious affiliation, to people who ask for you by name. Members of the clergy may be told of your religious affiliation.

Communication with Family, Close Friends, and Other Caregivers: Health professionals, using their best judgment, may disclose to a family member, other relative, close personal friend, or any other person you identify health information relevant to that person’s involvement in your care or payment related to your care. You have a right to request a limit on the patient information we disclose about you to a family member or someone else who is involved in your care or the payment for your care.

Notification: We may disclose your patient information to notify or assist in notifying your caregivers of your location, general condition, or death. For instance, in the event of a disaster, we may disclose your location, general condition, or death to a disaster relief organization so that it may notify your caregivers of such information. However, we will obtain your written authorization to use or disclose your patient information for certain other activities and purposes that do not fall under treatment, payment, or healthcare operations or as required by law. For instance, we will obtain written authorization before disclosing sensitive information, including records about HIV/AIDS testing, mental health or developmental disability services, psychotherapy notes, alcohol or drug abuse treatment services, genetic testing, child abuse, or sexual assault.

Fundraising Communications: In the continuing effort to enhance Lurie Children's capacity to conduct its mission of service to children and families, periodic communications and invitations to consider fundraising support may be sent to patient families and friends of the hospital. In connection with any such communication or request, we may use demographic information, information about the department of service and treating physician, health insurance status, and dates on which we provide health care to you or your child or disclose that information to Ann & Robert H. Lurie Children's Hospital of Chicago Foundation or its related fundraising organizations. You have the right to opt out of receiving such communications.

Marketing: We will obtain your written authorization before using patient information about you for marketing purposes.

Sale of Patient Information: We will never sell your information unless you give us written permission.

As required by law: We will disclose patient information when required to do so by federal, state, or local law.

To Avert a Serious Threat to Health or Safety: We may use and disclose patient information about you when necessary to prevent a serious threat to your health and safety, the health and safety of the public, or the health and safety of another person.

Workers' Compensation: We may release patient information about you to comply with state laws regulating workers' compensation or similar programs providing benefits for work-related injuries or illness.

Public Health Activities: We may disclose patient information about you for public health activities authorized or required by laws. These activities include disclosures:

• To public health authorities to prevent or control disease, injury, or disability;
• To report child abuse or neglect to the Department of Children and Family Services;
• To report reactions to medication or problems with products to the United States Food and Drug Administration; or
• To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.

Health Oversight Activities: We may disclose patient information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure.

Lawsuits and Disputes: If you are involved in a lawsuit or a dispute, we may disclose patient information about you in response to a proper court order, subpoena, or other lawful process.

Law Enforcement: We may release patient information about you to the police or other law enforcement officials if the release is required or allowed by applicable law or to comply with a proper court order, grand jury or administrative subpoena, or similar legal process.

Specialized Government Functions: Under limited circumstances authorized by law and for national security and intelligence purposes, we may release patient information about you to authorized federal government officials for intelligence, counterintelligence, and other national security purposes.

Medical Examiners: We may also release patient information about a decedent to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death.

Organ and Tissue Procurement: We may disclose your patient information to organizations that facilitate organ, eye, or tissue procurement, banking, or transplantation.

Community Connect Health Information Exchange: Along with certain other health care providers and practice groups in the area, we participate in a health information exchange operated by Lurie Children's (the "Exchange"). The Exchange facilitates the electronic sharing and exchange of medical and other individually identifiable health information regarding patients among healthcare providers that participate in the Exchange. Through the Exchange, we may electronically disclose demographic, medical, billing, and other health-related information about you to other healthcare providers that participate in the Exchange and request such information for purposes including but not limited to facilitating or providing treatment, arranging for payment for health care services, or otherwise conducting or administering their health care operations.

CareEverywhere®: We have a software product called CareEverywhere® that allows us to exchange health information with other providers with the CareEverywhere® product. The CareEverywhere® exchange facilitates the electronic sharing and exchange of medical and other individually identifiable health information regarding patients among healthcare providers who also have the CareEverywhere® software. Through the software CareEverywhere®, we may electronically disclose demographic, medical, billing, and other health-related information about you to other healthcare providers that participate in the Exchange and request such information for purposes including but not limited to facilitating or providing treatment, arranging for payment for health care services, or otherwise conducting or administering their health care operations. Due to our participation in the Exchange, your electronic health information from our practice may be made available to other providers through Lurie Children's shared electronic medical record.

Illinois Health Information Exchange EHR Connect: Your electronic medical records may be shared with the Illinois Health Information Exchange (ILHIE). The ILHIE facilitates the electronic exchange of electronic health information among health care providers that participate in the ILHIE and with the ILHIE Authority for purposes including but not limited to facilitating or providing treatment, arranging for payment for health care services, or otherwise conducting or administering health care operations. Participation is voluntary unless required by law. The ILHIE is helpful if you require treatment at other participating healthcare facilities in Illinois because it enables other facilities to obtain your medical history and coordinate care.

Business Associates: Some services are provided in our organization through contracts with third parties or business associates.  Examples include certain physician services, certain lab tests, and other certain services. We require business associates to safeguard your information.

Illinois Immunization Registry: We may disclose information concerning your immunization records to the Illinois Department of Public Health ("IDPH") for inclusion in a centralized database of children's immunization records. Such information may be used by IDPH, public vaccine providers, community health centers, the Centers for Disease Control and Prevention, or any other person or entity providing immunization services or approved by IDPH as needing to know your health or immunization status. These recipients may use such information to provide immunization services to you, monitor your immunization status, promote adherence to recommended immunization schedules, assist in the preparation of vaccination documentation required by your school, prepare statistical reports on the immunization status of groups of patients in which neither you nor any other patient may be individually identified, and otherwise monitor and promote your health and the health of children in Illinois generally. You have the right to opt out of participating in this registry.

YOUR RIGHTS REGARDING YOUR PATIENT INFORMATION

Right to Inspect and Copy: You have the right to inspect and obtain a copy of patient information within your medical and billing records and other records used to make treatment or payment decisions about you, with certain exceptions.

You have a right to obtain a copy of your medical records in electronic or paper format and, if you choose, to direct Lurie Children's to transmit a copy of your medical records directly to an entity or person designated by you. We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable, cost-based fee.

Right to Amend: If you feel that any of the patient information we maintain in your medical and billing records and other records used to make decisions about you is incorrect or incomplete, you may request that we amend the information. We will comply with an amendment request unless we believe that the information that would be amended is accurate and complete or that other special circumstances apply.

Right to an Accounting of Disclosure: You have the right to request an accounting of disclosures, which is a list of certain disclosures we have made of your patient information.  However, we are not required to account for all disclosures, such as disclosures for your treatment, to obtain payment for treatment, or our health care operations. Your request must state a time period, which may not be longer than six years. The first accounting you request within a twelve-month period is free of charge. For additional accountings, we may charge you for the costs of providing the list.

Right to Request Confidential Communications: You have the right to request that we communicate with you by certain means or at a certain location. For example, you may ask that we only contact you at work or by mail. We will not ask you the reason for your request. We will accommodate only reasonable requests. Your request must specify how or where you wish to be contacted.

Right to a Paper Copy of this Notice: You have the right to a paper copy of this Notice even if you agree to receive the Notice electronically. You may request a copy of this Notice at any time. This does not apply to inmates.

Right to Request Restrictions: You have the right to request a restriction on the patient information we use or disclose about you for treatment, payment, or health care operations. While we will comply with your request to the extent required by law and consider all requests for additional restrictions carefully, we are not required to agree to requested restrictions, except in the case of disclosure to a health plan for purposes of carrying out payment or healthcare operations, where the patient information pertains solely to a healthcare item or service for which we have been paid out-of-pocket in full. If we agree, we will comply with your request unless the information is needed to provide you emergency treatment.

Right to Revoke Your Authorization: You may revoke, in writing, any written authorization you have given us to use or disclose your patient information, except to the extent that we have acted in reliance upon it.