This notice describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.
This Notice of Privacy Practices (NOPP) applies to Shriners Hospitals for Children (SHC) and its facilities, programs and departments. This includes all employed physicians and other members of the medical staff and health professionals.
Shriners Hospitals for Children® has long been committed to protecting patient privacy. As part of this commitment, we follow federal and state law requiring us to maintain the privacy of your health information and to provide you with this notice of our privacy practices. When we use or disclose your health information, we are required to follow the privacy practices described in this NOPP. We must follow either federal or state law, whichever is more protective of your privacy rights. We reserve the right to change the privacy practices described in this NOPP at any time, and the changes will apply to all information we have about you. The NOPP will be available upon request, in our facility, and on our website. You may request a copy of our current NOPP at any time, even if you have agreed to receive the NOPP electronically. Please ask any Shriners Hospitals for Children associate and we will provide you with a copy.
What is “Protected Health Information” (PHI)?
PHI is information about a person’s health that can be related to that person concerning:
- The individual’s past, present or future physical or mental health or condition.
- The provision of healthcare to the individual.
- The past, present, or future payment for the provision of healthcare to the individual.
Common individual identifiers of health information include names, social security numbers, addresses and birth dates.
It is our responsibility to:
- Maintain the privacy and security of your PHI.
- Follow the duties and privacy practices described in this NOPP.
- Give you a copy of this NOPP and be available to you if you have any questions or concerns.
- Use or share your information only as described here unless you tell us we can use or share it differently. If you tell us we can use or share it differently, you may change your mind at any time. Let us know in writing if you change your mind.
- Notify you promptly if your information is compromised.
Your Health Information Rights
Access to Records
You can ask to receive an electronic or paper copy of your medical record and other health information. We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable, cost-based fee. In rare circumstances, we may deny your request. If we deny your request, we will tell you why, in writing.
Amend Your Medical Records
You can ask us to correct health information about you that you think is incorrect or incomplete. Ask us how to do this. We may say “no” to your request, but if we do, we will tell you why in writing within 60 days.
Request Restrictions
You can ask Shriners Hospitals for Children not to share your health information for treatment, payment, or health care operations. You can also request a restriction of release to people involved in your care. For instance, you can request that we not share information about a procedure or treatment.
We are not always required to agree to your request, and we may say “no” if it would affect your care. If you pay for a service or health care item out of pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information.
Requests of Confidential Communications
We may communicate with you through email, text messages, phone calls, or our patient portal. Emails, text messages, or electronic communications outside of our portal may not be encrypted or secure and could be intercepted by another person or organization. We will assume you understand these risks if you provide us with a mobile phone number or email address to communicate with you. You can always ask us to contact you about health matters in the way that makes you comfortable. For example, you can ask that we only contact you at work or by mail. We will say “yes” to all reasonable requests.
Accounting of Disclosures
You can ask for a list (accounting) of the times we shared your health information for six years prior to the date you ask, whom we shared it with, and why. We will include all the disclosures, except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We will provide one accounting a year for free but may charge a reasonable, cost-based fee if you ask for another one within 12 months.
Personal Representatives
If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.
Using and Sharing Your PHI
We will not share your PHI for the following purposes without your written authorization:
Psychotherapy Notes
Psychotherapy Notes: A signed authorization or court order is required for any use or disclosure of psychotherapy notes except to carry out certain treatment, payment or healthcare operations, or for use by SHC for treatment, for training programs or for defense in a legal action.
Marketing
Marketing: A signed authorization is required for the use or disclosure of your PHI for a purpose that encourages you to purchase or use a product or service, except for a face-to-face communication made by SHC to you or a promotional gift of nominal value provided by SHC. We may also provide refill reminders or communicate with you about a drug or biologic that is currently prescribed to you so long as any payment we receive for making the communication is reasonably related to our cost of making the communication. If SHC were ever to receive any payment from a third party for our marketing, we must tell you when we request your authorization.
Sale of PHI
Sale of PHI: SHC may not sell or disclose your PHI in exchange for payment without your signed authorization. If SHC were ever to receive payment for the sale of your PHI, we must tell you when we request your authorization.
Publicity
Publicity: We may ask you to let us use your patient story to tell others about Shriners Hospitals for Children. If we do ask you to share your patient story, we will ask you to sign a written authorization.
We are allowed to use your PHI and share it with others without your authorization for several reasons. Those reasons are:
Treatment and Payment
Treatment: In order to provide the most appropriate medical care, we will use your PHI at SHC to treat you. Each person involved in your treatment such as doctors, nurses, physical therapists and others will write in your medical record to explain what care is being provided. This way, each person taking care of you will know what the others are doing during your course of treatment. We may also share your PHI with other doctors or specialists outside of SHC who care for you, so proper medical treatment is rendered. You must advise us if you do not wish to have your PHI released to any medical professionals who care for you outside of SHC.
Payment: SHC bills outside third parties, such as insurance or Medicaid, for services provided at select locations. We may also utilize information about your care in order to bill your insurance or Medicare or Medicaid if available, for your treatment at SHC. In addition, patients sometimes need services at another hospital or outside facility. If we send you for those services, we may give that other facility information about your treatment at SHC and your insurance information to help them with their billing process.
Operations and Business Associates
Operations: We may use your PHI for healthcare operations. Healthcare operations means all of the things the SHC location does to improve the quality of care for all patients. For example, in making sure our employees do their jobs correctly, managers may need to look at PHI to make sure that your treatment was provided correctly.
Business Associates: Business associates are people or companies who provide some of the services needed for your care. For instance, some SHC locations hire a group of people called a transcription service to type up the notes dictated by the doctors. When they perform the services we request, the business associates need to see some of your PHI. However, both federal law and SHC require business associates to protect the privacy of your PHI.
Directory and Notification
Directory: Unless you tell us not to, we will use your name, room number and general condition in the hospital directory. We can then give this information to people who ask for you by name. We may also give this information, along with your religion, to ministers, priests and other religious leaders.
Notification: We may tell a family member or guardian your location and general condition.
Communication with Family and Subpoena
Communication with Family: We will tell your parents or guardian information that would help them to take part in your care. If you want, we may also share this information with other friends or family members.
Subpoena: We may have to share your PHI with a court or attorney if we receive a subpoena or court order. We will try to let you or your attorney know about the subpoena before we send the information.
Research and Organ Donation Groups
Research: We may share your PHI with researchers when an Institutional Review Board (IRB) has approved their research project and your condition or treatment is one they want to study. The IRB must first review the plans for the research study and set forth guidelines to make sure the PHI used in the study remains private. The IRB will also decide if a special consent form for the study is required. In the future, researchers may also look at your medical record to see if your condition or treatment is one that they plan to study. If so, they may ask for your permission to include your information in their study.
Organ Donation Groups: Sometimes we may share PHI with organ donation groups or other similar groups, such as skin banks.
Training and Medical Care
Training: Many colleges and other schools send students to SHC locations as part of their training. These students and their teachers may be able to see your PHI as they learn how to take care of patients.
Medical Care: We may use some of your PHI, including your name and address, to remind you about appointments.
Treatment Alternatives and Fundraising Activities
Treatment Alternatives: We may send you information about other treatments and services that might help you. If, however, we want to send you information about other treatments and services from a third party and SHC will receive payment for sharing this information with you, we will request your authorization.
Fundraising Activities: We may use or disclose a limited amount of demographic information to SHC staff in order to contact you about our fundraising efforts. We may also disclose this information to certain business associates who, at our request, will invite you to participate in raising money for SHC. All donations are used to expand, improve and support SHC’s health care services, operations, educational programs and research activities. You have the right to opt out of these communications. Information on how to opt out of receiving fundraising materials or requests are provided on all fundraising communications sent from SHC or our business associates.
Food and Drug Administration (FDA) and Work and Safety Laws
Food and Drug Administration (FDA): The FDA is an agency of the government that keeps track of drugs and medical devices. If anything goes wrong with a drug or medical device we used in your care, we have to send a notice to the FDA and the maker of the drug or device. We will also send in the warranty cards that come with devices. We will use only the least information needed to fill out these forms.
Work and Safety Laws: We may need to give PHI to state and federal health and safety agencies such as workers compensation commissions.
Public Health and Record-keeping Agencies
Public Health: We may have to share PHI with public agencies that work to prevent or control disease, injury, or disability. For example: If a child develops measles or mumps while in our care, we may be required to report that information to the state or local health department.
Record-keeping Agencies: We send information about patients’ injuries and treatment to private or public agencies that keep track of statistics. For instance, we send information about burn cases to the National Burn Registry and information about spinal cord injuries to the National Trauma Registry. We also may have to share information with agencies that license hospitals or providers.
Medical Examiners or Funeral Directors, Law Enforcement and Whistleblowers
Medical Examiners or Funeral Directors: We can share health information with a coroner, medical examiner, or funeral director when an individual dies.
Law Enforcement: We may disclose health information for law enforcement purposes as required by law or in response to a valid subpoena. We may also be required, by law, to make PHI available to offices that:
- Investigate abuse or neglect, or
- Involve threats to health or safety
Whistleblowers: If a person who works for us thinks we are breaking the privacy laws, they might tell an attorney or a government agency about their concern. We would need to cooperate in any follow-up inquiry, which may require disclosure of PHI.
What about other uses of my health information?
Uses and disclosures of your health information not covered by this NOPP or federal or state laws will be made only with your written authorization.
Can I revoke my authorization to disclose information?
If you authorize us to use or disclose your health information, but then change your mind, you can revoke your authorization at any time by submitting your request to the SHC Privacy Office using the contact information below. We will stop sharing your information upon processing your request. However, we will be unable to recall or redact any information we have already shared.
How do I contact the Shriners Children’s Privacy Office?
If you have questions, you may contact the SHC Privacy Office at 813-281-0300, and ask for the SHC Corporate Privacy Officer. You can visit shrinerschildrens.org or call the SHC Compliance Hotline at 866-290-7637. You may also ask to speak to the Hospital Administrator, Clinic Director, or Privacy Officer at any SHC location.
If you believe we violated your privacy rights, you can file a complaint with the SHC Corporate Privacy Officer at 813-281-0300.
You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting hhs.gov/ocr/privacy/hipaa/complaints/.
What if my information is lost or stolen from Shriners Hospitals for Children?
SHC will contact you, informing you what information was lost and how best to protect yourself.
We will post a summary of the current notice in the facility; the notice will contain the effective date on the first page.
We Understand the Unique Medical Needs of Children
Keep In Touch
Join our mailing list to stay up to date on everything that's happening at Shriners Children's.