WE ARE COMMITTED TO YOUR PRIVACY
Penn Medicine Princeton Health (“Princeton Health”) understands that information about you and your health is very personal. Therefore, we strive to protect your privacy as required by law. We will only use and disclose your protected health information (“PHI”) as allowed by law. We train our staff and workforce to be sensitive about privacy and to respect the confidentiality of your PHI.
We are required by law to maintain the privacy of our patients’ PHI and to provide you with notice of our legal duties and privacy practices with respect to your PHI. We are required to abide by the terms of this Notice so long as it remains in effect. We reserve the right to change the terms of this Notice as necessary and to make the new notice effective for all PHI maintained by us. A copy of any revised notice will be available upon request and posted on the Princeton Health website.
Pursuant to Princeton Health being identified as an Organized Health Care Arrangement (“OHCA”) for purposes of federal privacy requirements, the entities participating in the Princeton Health OHCA will share PHI with each other, as necessary, to carry out treatment, payment, or health care operations relating to the OHCA.
You will be asked to acknowledge that you have received this Notice. If you have questions regarding the information in this Notice, or if you would like to obtain a copy of this Notice, please contact the Princeton Health Privacy Officer as described below.
WHO FOLLOWS THIS NOTICE
The terms of this Notice apply to Princeton Health, and its affiliated entities, divisions, programs, departments, and units, including, but not limited to:
- Penn Medicine Princeton Medical Center
- Penn Medicine Princeton HomeCare
- Penn Medicine Princeton House Behavioral Health
- Penn Medicine Princeton Medicine Physicians
Princeton Health employees, physicians, licensed professionals, trainees, volunteers, and agents must follow these privacy practices.
USES AND DISCLOSURES OF YOUR PHI
The following categories describe the ways we may use or disclose your PHI without your consent or authorization.
For Treatment. We may use your PHI as necessary for your treatment. For instance, doctors, nurses, and other professionals involved in your care- within and outside of Princeton Health- may use your information in your medical record that may include procedures, medications, tests, etc. to plan a course of treatment for you.
For Payment. We may use and disclose your PHI as necessary for payment purposes. For instance, we may forward information regarding your medical procedures and treatment to your insurance company to arrange payment for the services provided to you. Also, we may use your information to prepare a bill to send to you or to the person responsible for your payment.
For Healthcare Operations. We may use and disclose your PHI for health care operations. This is necessary to operate Princeton Health, including by ensuring that our patients receive high quality care and that our health care professionals receive superior training. For example, we may use your PHI to conduct an evaluation of the treatment and services we provide, or to review the performance of our staff. Your health information may also be disclosed to physicians, nurses, staff, medical students, residents, and others for education and training purposes.
For Health Information Exchange. The sharing of your PHI for treatment, payment, and health care operations may happen electronically. Electronic communications enable fast, secure access to your information for those participating in and coordinating your care to improve the overall quality of your health and prevent delays in treatment. We participate in initiatives to facilitate this electronic sharing, including but not limited to Health Information Exchanges (HIEs) which involve coordinated information sharing among HIE members for purposes of treatment, payment, and health care operations. Patients may opt-out of some of these electronic sharing initiatives, such as HIEs. Penn Medicine will use reasonable efforts to limit the sharing of PHI in such electronic sharing initiatives for patients who have opted-out. If you wish to opt-out, please contact the Princeton Health Privacy Officer.
Facility Directory. We use information to maintain an inpatient directory listing your name, room number, general condition, and, if you wish, your religious affiliation. Unless you choose to have your information excluded from this directory, the information, excluding your religious affiliation, may be disclosed to anyone who requests it by asking for you by name. This information, including your religious affiliation, may also be provided to members of the clergy, even if they don’t ask for you by name. If you wish to have your information excluded from this directory, please contact the Princeton Health Privacy Officer or a patient access associate.
Persons Involved In Your Care. Unless you object, we may, in our professional judgment, disclose your PHI to a member of your family, a close friend, or any person you identify to facilitate that person’s involvement in caring for you or in payment for your care. We may use or disclose your PHI to assist in notifying a family member, personal representative, or any person responsible for your care of your location and general condition. We may also disclose limited PHI to a public or private entity that is authorized to assist in disaster relief efforts to locate a family member or other persons who may be involved in some aspect of caring for you.
Fundraising. We may contact you, at times in coordination with your physician, to donate to a fundraising effort on our behalf. If we contact you for fundraising purposes, you have the right to opt-out of receiving any future solicitations. If you wish to opt-out, please contact the Princeton Health Privacy Officer.
Appointments and Services. We may use your PHI to remind you about appointments or to follow up on your visit.
Health Products and Services. We may, from time to time, use your PHI to communicate with you about treatment alternatives and other health-related benefits and services that may be of interest to you.
Research. We may use and disclose your PHI, including PHI generated for use in a research study, as permitted by law for research, subject to your explicit authorization and/or oversight by the institutional review board (IRB), committees charged with protecting the privacy rights and safety of human subject research, or a similar committee. In all cases where your specific authorization has not been obtained, your privacy will be protected by confidentiality requirements evaluated by such a committee.
Business Associates. We may contract with certain outside persons or organizations to perform certain services on our behalf, such as auditing, accreditation, legal services, etc. At times it may be necessary for us to provide your information to one or more of these outside persons or organizations. In such cases, we require these business associates, and any of their subcontractors, to appropriately safeguard the privacy of your information.
Other Uses and Disclosures. We are permitted or required by law to make certain other uses and disclosures of your PHI without your consent or authorization. Subject to conditions specified by law, we may release your PHI:
- for any purpose required by law;
- for public health activities, such as required reporting of disease, injury, birth and death, and for required public health investigations;
- to certain governmental agencies if we suspect child abuse or neglect, or if we believe you to be a victim of abuse, neglect or domestic violence;
- to entities regulated by the Food and Drug Administration, if necessary, to report adverse events, product defects, or to participate in product recalls;
- to your employer when we have provided health care to you at the request of your employer for purposes related to occupational health and safety. In most cases you will receive notice that your PHI is being disclosed to your employer;
- if required by law to a government oversight agency conducting audits, investigations, inspections, and related oversight functions;
- in emergency circumstances, such as to prevent a serious and imminent threat to a person or the public;
- if required to do so by a court or administrative order, subpoena, or discovery request;
- to law enforcement officials, including for purposes of identifying or locating suspects, fugitives, witnesses, or victims of crime, or for other allowable law enforcement purposes;
- to coroners, medical examiners, and/or funeral directors;
- if necessary, to arrange for an organ or tissue donation from you or a transplant for you;
- if you are a member of the military for activities set out by certain military command authorities as required by armed forces services. We may also release your PHI, if necessary, for national security, intelligence, or protective services activities; and
- if necessary, for purposes related to your worker’s compensation benefits.
Except as outlined above, we will not use or disclosure your PHI for any other purpose unless you have signed a form authorizing the use or disclosure. The form will describe what information will be disclosed, to whom, for what purpose, and when. You have the right to revoke your authorization in writing, expect to the extent we have already relied upon it. These situations can include:
- uses and disclosures of psychotherapy notes;
- uses and disclosures of PHI for marketing purposes, including marketing communications paid for by third parties;
- uses and disclosures of PHI specially protected by state and/or Federal law and regulations;
- uses and disclosures for certain research protocols;
- disclosures that constitute a sale of PHI.
The confidentiality of substance use disorder treatment records, HIV-related information, genetic information, and mental health records maintained by us is specifically protected by state and/or Federal law and regulations. Any disclosure of these types of records will be subject to these special protections.
Mental Health Records. Information directly or indirectly identifying you, currently or formerly, as receiving mental health services may be disclosed as permitted by state and/or federal law and as otherwise described below:
- with your written authorization, or, if applicable, your legal guardian or authorized representative’s written authorization;
- in response to a court order;
- to workforce members involved in your care;
- to workforce members of another entity, so long as such disclosure is relevant to your current treatment and in compliance with the Health Insurance Portability and Accountability Act (HIPAA);
- to carry out the provisions of N.J.S.A. 2A:82-41 relating to rights of a person against whom a claim is asserted;
- to clinical records audit teams, monitoring, and site review staff designated by the New Jersey Department of Health and Senior Services, Department of Human Services, the Office of Legislative Services, the Center for Medicaid and Medicare Services;
- to a person participating in a Professional Standards Review Organization;
- to officials within the offices of the State Medical Examiner or a County Medical Examiner making investigations and conducting autopsies;
- to the NJ Department of Children and Families in connection with investigations and reports of child abuse or neglect;
- your current medical condition may be disclosed to a relative or friend upon proper inquiry and after you have had the opportunity to object and do not express an objection;
- to any licensed mental health provider or medical health care provider who has a contract with the Division of Mental Health Services or the Department of Human Services, or to your primary care physician or other treating physician if its appears the information is to be used for your benefit;
- to the estate administrator or executor of a deceased person who has received services or for whom services were sought, or, if no such person exists, to next of kin with proper written authorization.
Substance Use Disorder Records. The confidentiality of substance use disorder patient records maintained by Princeton Health is protected by federal regulations. Generally, we may not acknowledge the presence of an identified patient in a Princeton Health facility or component of a Princeton Health facility which is publicly identified as a place where only substance use disorder diagnosis, treatment, or referral for treatment is provided unless the patient consents to the disclosure in writing, or the disclosure is authorized by a court order.
Any answer to a request for disclosure of patient substance use disorder treatment records which is not permissible under the federal regulations must be made in a way that will not affirmatively reveal that an identified individual has been, or is being, diagnosed or treated for a substance use disorder.
There are limited situations in which the federal regulation permits the disclosure of patient substance use disorder treatment information without your authorization. These include:
- to medical personnel to the extent necessary to meet a bona fide medical emergency in which the patient’s prior informed consent cannot be obtained;
- for the purpose of conducting scientific research, with certain confidentiality protections as specified by regulations;
- in the course of a review of records on the substance use disorder program premises for an audit or evaluation, with certain confidentiality protections as specified by regulations.
Violation of the federal regulations governing confidentiality of substance use disorder information is a crime. Suspected violations may be reported to the United States Attorney for the judicial district in which the violation occurs and, if applicable, to the Substance Abuse and Mental Health Services Administration (SAMHSA) office responsible for opioid treatment program oversight.
United States Attorney’s Office
970 Broad Street, 7th Floor
Newark, NJ 07102
SAMHSA Center for Substance Abuse Treatment
5600 Fishers Lane
Rockville, MD 20857
Information related to a patient’s commission of a crime on the premises of a substance use disorder treatment program or against personnel of such a program is not protected. Reports of suspected child abuse and neglect made under state law to appropriate state or local authorities are not protected. The federal regulations do not prohibit Princeton Health from giving a patient access to their own records, including the opportunity to inspect and copy any records that a substance use disorder program maintains about the patient. The federal regulations governing substance use disorder treatment information are set forth at 42 C.F.R. § 2.1 et seq.
RIGHTS THAT YOU HAVE
Access to Your PHI. Generally, you have the right to access, inspect, and/or receive paper and/or electronic copies of certain PHI that we maintain about you. Requests for access must be made in writing and signed by you or, when applicable, your personal representative. We will charge you for a copy of your medical records in accordance with a schedule of fees under federal and state law. You may obtain the appropriate form from the doctor’s office or entity where you received services. You may also access much of your health information using Princeton Health’s patient portal.
Amendments to Your PHI. You have the right to request that PHI that we maintain about you be amended or corrected. Requests for amendment must be made in writing and signed by you or, when applicable, your personal representative and must state the reasons for the amendment/correction request. We are not obligated to make all requested amendments but will give each request careful consideration. If we grant your amendment request, we may also reach out to other prior recipients of your information to inform them of the change. You may obtain the appropriate form by contacting the Princeton Health Privacy Officer.
Accounting of Disclosures of Your PHI. You have the right to receive an accounting of certain disclosures made by us of your PHI, except for disclosures made for purposes of treatment, payment, and healthcare operations or for certain other limited exceptions. This accounting will include only those disclosures made in the six years prior to the date on which the accounting is requested. Requests must be made in writing and signed by you or, when applicable, your personal representative. The first accounting in any 12-month period is free; you will be charged a reasonable, cost-based fee for each subsequent accounting you request within a 12-month period. You may obtain the appropriate form by contacting the Princeton Health Privacy Officer.
Restrictions on Use and Disclosure of Your PHI. You have the right to request a restriction on certain uses and disclosures of your PHI for treatment, payment, or health care operations. We are not required to agree to your restriction request, unless otherwise described in this Notice, but will attempt to accommodate reasonable requests when appropriate. We retain the right to terminate an agreed-to restriction if we believe such termination is appropriate. In the event we have terminated an agreed upon restriction, we will notify you of such termination. You may obtain the appropriate form by contacting the Princeton Health Privacy Officer.
Restrictions on Disclosures to Health Plans. You have the right to request a restriction on certain disclosures of your PHI to your health plan. We are required to honor such requests only when you or someone on your behalf, other than your health plan, pays for the health care items(s) or services(s) in full. Such requests must be made in writing and signed by you and, when applicable, your personal representative. You may obtain the appropriate form by contacting the Princeton Health Privacy Officer.
Confidential Communications. You have the right to request communications regarding your PHI from us by alternative means or at alternative locations and we will accommodate reasonable requests by you. You, or when applicable, your personal representative may request such confidential communication in writing to each department to which you would like the request to apply. You may obtain the appropriate form by contacting the Princeton Health Privacy Officer.
Breach Notification. We are required to notify you in writing of any breach of your unsecured PHI without unreasonable delay, but in any event, no later than 60 days after we discover the breach.
Paper Copy of Notice. You have the right to obtain a paper copy of this Notice. You can also access this Notice on the Princeton Health website.
Complaints. If you believe your privacy rights have been violated, you may file a complaint by contacting the Princeton Health Privacy Officer. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services. All complaints must be made in writing and in no way will affect the quality of care you received from us.
For Further Information. If you have questions or need further assistance regarding this Notice, including with exercising your rights described in this Notice, you may contact the Princeton Health Privacy Officer by telephone at (609)-853-7140 or by email at: PMPH-PrivacyOfficer@PennMedicine.Upenn.edu.
A solicitud, esta información se encuentra disponible en español.
This Notice is effective as of January 31, 2019.