Richmond University Medical Center Notice of Privacy Practices



This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Richmond University Medical Center’s Responsibility

We, at Richmond University Medical Center (RUMC), are committed to protecting the privacy of information we gather about you while providing health-related services. We are required by law to protect the privacy of health information that may reveal your identity, and to provide you with a copy of this notice, which describes the health information privacy practices of RUMC, its medical staff, and affiliated health care providers that jointly provide health care services with RUMC. A copy of our current notice will be posted in our reception area. You can also obtain your own copy by accessing our website at www.rumcsi.org, calling our Privacy Office at 718-818-2402 or asking for one at the time of your next visit.

Changes to This Notice. RUMC will abide by the terms of the Notice currently in effect. However, RUMC reserves the right to change the terms of the Notice and to make new Notice provision(s) effective for all health information that it maintains. RUMC will promptly post the revised Notice on the RUMC web site: www.rumcsi.org.

Security Breach Notification. RUMC is required by law to notify affected individuals following a breach of unsecured protected health information. “Unsecured” means the protected health information has not been rendered unusable, unreadable or indecipherable to unauthorized individuals though the use of technology or methodology specified by the Secretary or Department of Health & Human Services. Will Follow This Notice?

RUMC provides health care to patients jointly with physicians and other health care professionals and organizations. The privacy practices described in this notice will be followed by:

• Any health care professional who treats you at any of our locations;
• All employees, medical staff, trainees, students or volunteers at any of our locations;
• All employees, medical staff, trainees, students or volunteers at entities that are part of an organized health care arrangement with RUMC;
• Any business associates of RUMC (which are described further below).

Reliance on This Notice by Other Healthcare Entities. RUMC may sometimes participate in an organized healthcare arrangement with providers and entities that may not be employed by RUMC, but participate in your healthcare. Any providers or entities participating in this arrangement may rely on their Notice as providing you with notice of their privacy practice.

How We May Use and Disclose Your Health Information

Exceptions to Patient Authorization. The following describes the way in which RUMC will use and disclose your medical information without your authorization. Other uses and disclosures not covered by this notice will be made only with your written authorization. For each category we will provide an example to help explain what we mean. The examples given are not exhaustive.

• Treatment. We may share your health information with doctors or nurses at RUMC who are involved in taking care of you, and they may in turn use that information to diagnose or treat you. A doctor at RUMC may share your health information with another doctor inside RUMC, or with a doctor at another RUMC facility, to determine how to diagnose or treat you. Your doctor may also share your health information with another doctor to whom you have been referred for further health care.
• Payment. We may use your health information or share it with others so that we may obtain payment for your health care services. For example, we may share information about you with your health insurance company in order to obtain payment after we have treated you, or to determine whether it will cover your treatment. We might also need to inform your health insurance company about your health condition in order to obtain pre-approval for your treatment, such as admitting you to RUMC for a particular type of surgery. Finally, we may share your information with other health care providers and payors for their payment activities.
• Health Care Business Operations. We may use your health information or share it with others in order to conduct our business operations. We may share your health information with other health care providers and payors for their business operations, including quality assurance, utilization review, medical review, internal auditing, accreditation, social services certification, licensing or credentialing activities of RUMC, certain medical research, and educational purposes.
• Appointment Reminders, Treatment Alternatives, Benefits and Services. In the course of providing treatment to you, we may use your health information to contact you with a reminder that you have an appointment for treatment or services at our facility. We may also use your health information in order to recommend possible treatment alternatives or health-related benefits and services that may be of interest to you.

Other Exceptions to Patient Authorization:

• Fundraising. To support our business operations, we may use demographic information about you, including information about your age and gender, where you live or work, and the dates that you received treatment, in order to contact you to raise money to help us operate. If you do not wish to be contacted for fundraising efforts, please contact the Privacy Office at HIPAA@rumcsi.org or by calling 718-818-2402. As Required by Law. We may use or disclose your health information if we are required by law to do so. We also will notify you of these uses and disclosures if notice is required by law.
• Research. In most cases, we will ask for your written authorization before using your health information or sharing it with others in order to conduct research. However, under some circumstances, we may use and disclose your health information without your written authorization if we obtain approval through a special process to ensure that research without your written authorization poses minimal risk to your privacy. Under no circumstances, however, would we allow researchers to use your name or identity publicly.
• Business Associates. We may disclose your health information to contractors, agents and other business associates who need the information in order to assist us with obtaining payment or carrying out our business operations. If we do disclose your health information to a business associate, we will have a written agreement to make sure that your health information is protected. For example, we may share your health information with a billing company that helps us to obtain payment from your insurance company.
• Facility Directory. Unless you object, we may include certain limited information about you in the facility directory while you are a patient at our facilities. This information may include your name, location at RUMC, your general condition, (e.g., fair, critical, etc.) and your religious affiliation. This is so your family and friends can visit you in the RUMC facility and generally know how you are doing. The directory information, except for your religious affiliation, may only be given to people who ask for you by name. Your religious affiliation may be given to a member of the clergy, such as a priest or rabbi, even if they do not ask for you by name. If you do not want to be included in the facility directory, inform the admitting staff.
• Family and Friends Involved in Your Care. If you do not object, we may share your health information with a family member, relative, or close personal friend who is involved in your care or payment for that care. In some cases, we may need to share your information with a disaster relief organization that will help us notify these persons.
• Public Health Activities. We may disclose your health information to authorized public health officials (or a foreign government agency collaborating with such officials) so they may carry out their public health activities. For example, we may share your health information with government officials that are responsible for controlling disease, injury or disability.
• Victims of Abuse, Neglect or Domestic Violence. We may release your health information to a public health authority that is authorized to receive reports of abuse, neglect or domestic violence.
• Health Oversight Activities. We may release your health information to government agencies authorized to conduct audits, investigations, and inspections of our facility.
• Product Monitoring, Repair and Recall. We may disclose your health information to a person or company that is regulated by the Food and Drug Administration for the purpose of tracking medical devices or recalling defective or dangerous products.
• Lawsuits and Disputes. We may disclose your health information if we are ordered to do so by a court or administrative tribunal that is handling a lawsuit or other dispute.
• Law Enforcement. We may use and disclose your health information for law enforcement purposes to a law enforcement official if required by law, or where permitted by law, or in response to a valid subpoena. Also, we may disclose health information if it is necessary for law enforcement authorities to identify or locate an individual.
• To Avert a Serious and Imminent Threat to Health or Safety. We may use your health information or share it with others when necessary to prevent a serious and imminent threat to your health or safety, or the health or safety of another person or the public. National Security and Intelligence Activities or Protective Services. We may disclose your health information to authorized federal officials who are conducting national security and intelligence activities or providing protective services to the President or other important officials.
• Military and Veterans. If you are in the Armed Forces, we may disclose health information about you to appropriate military command authorities for activities they deem necessary to carry out their military mission.

• Inmates and Correctional Institutions. If you are an inmate or a law enforcement officer detains you, we may disclose your health information to the prison officers or law enforcement officers if necessary to provide you with health care, or to maintain safety, security and good order at the place, where you are confined.
• Workers’ Compensation. We may disclose your health information for workers’ compensation or similar programs that provide benefits for work-related injuries.
• Coroners, Medical Examiners, and Funeral Directors. In the unfortunate event of your death, we may disclose your health information to a coroner or medical examiner. We may also release this information to funeral directors as necessary to carry out their duties.
• Organ Procurement Organizations. We may use and disclose your health information to organ procurement organizations and other entities engaged in the procurement, banking, or transplantation of organs for the purpose of tissue donation and transplant.

Requirement for Written Authorization. Your written authorization is required for the following types of confidential information. We will obtain your specific authorization before using or disclosing these types of information as we are required to do so by such applicable State and Federal laws. Still, we may be permitted to use and disclose such information under special circumstances, as permitted under the law. For each category we will provide an example to help explain what we mean. The examples given are not exhaustive.

• Most Sharing of Psychotherapy Notes. Notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record are highly confidential.
• Marketing. Marketing means to make a communication (other than a face-to-face communication) about a product or service that encourages recipients of the communication to purchase or use the product or service. We need authorization in order to inform patients about a third party, which is not part of the hospital, that can provide a service for a fee, when the communication is not for the purpose of providing treatment advice.
• Sale of Protected Health Information. We may not sell lists of our patients or enrollees to third parties without obtaining authorization from each person on the list.

Special Protections. Special privacy protectionsapply to disclosures of HIV-related information, alcohol and substance abuse treatment information, mental health information, and genetic information. If your treatment involves this information, you will be provided with separate notices explaining how the information will be protected. To request copies of these other notices, please contact the Privacy Office, at 718-818-2402.

Your Rights to Access and Control Your Health Information

Right to Inspect and Copy Records. You have the right to inspect and obtain a copy of your health information (copying fees may be imposed). However, such requests may be denied as permitted under law. You have a right to appeal such denials. To exercise your right, please write to the Health Information Management (HIM) Office.

Right to Amend Records. You have the right to amend your health information. However, RUMC may deny your request to amend your health information under certain circumstances. All requests for amendments must be in writing and provide a reason for supporting your request for an amendment. To exercise your right, please write to the HIM Office.

Right to an Accounting of Disclosures. You have the right request that we provide you with an accounting of disclosures we have made of your health information. An accounting is a list of disclosures. This list will not include disclosures of your health information made for treatment, payment, or operations made to you or made pursuant to an authorization signed by you. To exercise your right, please contact the HIM Office.

Right to Request Additional Privacy Restrictions. You have a right to request restrictions on certain uses and disclosures of your health information. However, RUMC is not required to agree to such request. You must communicate your request in writing by using the proper form. To exercise your right, please contact the Privacy Office.

Right to Request Confidential Communications. You have the right to request that we communicate with you about your medical matters in a more confidential way by requesting that we communicate with you by alternative means or at alternative locations. For example, you may ask that we contact you at home instead of at work. To exercise your right, please contact the Privacy Office.

Right to Revoke Your Prior Authorization. You have a right to revoke your authorization (your permission) to use or disclose your health information except to the extent that action has already been taken in reliance on your prior authorization. To exercise your right, please contact the Privacy Office.

Right to Receive a Copy of This Notice. You have the right to a paper copy of this notice, upon request. You may also obtain a copy of this notice from our website at www.rumcsi.org.

All requests to exercise your above rights must be made to either the:

How to File a Complaint

If you believe your privacy rights have been violated, you may file a privacy complaint with RUMC or with the Secretary of the Department of Health and Human Services. To file a privacy complaint with RUMC, please contact the Privacy Office at 355 Bard Avenue, Staten Island, NY 10310 or at HIPAA@rumcsi.org or call 718-818-2402. No one will retaliate or take action against you for filing a privacy complaint.