Privacy Statement

Effective Date: April 14, 2003

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Pledge Regarding Medical Information

We understand that medical information about you and your health is personal. We are committed to protecting medical information about you. We create a record of the care and services you receive at the hospital. We need this record to provide you with quality care and to comply with certain legal requirements. This Notice of Privacy Practices applies to the following protected health information about you: (1) all of the records of your health care and services generated within the hospital, whether made by members of the hospital medical staff, or hospital employees. Members of the hospital medical staff, including your personal doctor, may have different policies or notices regarding the doctor's use and disclosure of information that is created in the doctor's office or clinic.

This Notice will tell you about the ways in which we may use and disclose medical information about you. We also describe your rights and certain obligations we have regarding the use and disclosure of medical information.

This Notice is intended to meet the requirements of the HIPAA Privacy Regulations, which has required the hospital to:

Make sure that medical information that identifies you is kept private;
Give you this notice of our legal duties and privacy practices with respect to medical information about you;
Describe your rights to your medical information and certain obligations we have regarding the use and disclosure of your medical information; and
Abide by the terms of this Notice as currently in effect (as amended from time to time).

For More Information, or to Report a Problem

If you have any questions about this notice, please contact our Privacy Officers at:

Privacy Officer

Grande Ronde Hospital

P.O. Box 3290

La Grande, OR 97850

541.963.1555

Who Will Follow This Notice

The following individuals and organizations share the hospital’s commitment to protect your privacy and will comply with this Notice:

a) Any health care professional authorized to enter information into your hospital medical records;

b) Members of our medical staff, employees, volunteers, trainees, students, and other hospital personnel providing services in the hospital or hospital affiliated patient care settings listed in c) and d) below;

c) All departments and units of the hospital; and

d) The following patient care settings affiliated with the hospital, and all medical staff, employees, volunteers, trainees, students or other personnel providing services in these patient care settings. These patient care settings include in-patient hospital facility, hospital medical staff, all hospital owned physician clinics, and home care departments of the hospital.

Note: This hospital may provide services to you in an integrated way with our medical staff and the affiliated patient care settings referenced above; however, Grande Ronde Hospital accepts no legal responsibility for activities solely attributable to these other providers or care settings.

This hospital and other medical providers are required by law to maintain the privacy of your medical information. We also are required to notify you of our legal duties and privacy practices regarding your medical information, and abide by the practices described in this Notice.

How We May Use and Disclose Your Medical Information

Members of our medical staff, appropriate hospital employees and other participants in our patient care system may share your medical information as necessary for your treatment, payment for services provided, and health care operations, without your express permission. Other uses require your specific authorization. The following describes how we may use and disclose your information without express permission. Other parts of this notice describe uses and disclosures that require your authorization, and the rights you have to restrict our use and disclosure of your medical information.

Uses and Disclosures the Hospital May Make Without Your Express Permission

This section discusses the requirements of federal privacy laws. Oregon law provides additional protections in some circumstances.

Treatment. We are permitted to use and disclose your medical information within the hospital and within the designated patient care settings as necessary to provide you with medical treatment and services. We also are permitted to disclose your medical information to other health care providers outside the hospital as necessary for those providers to provide you with medical treatment and services. For example, physicians and other health professionals treating you in the hospital will document information about your treatment in your medical record. This record will be released to other health professionals assisting in your treatment to ensure they are fully informed about your medical condition and treatment needs.

Payment. We may use and disclose your medical information as necessary for the hospital’s payment operations. We are permitted to disclose your medical information so that the treatment and services you receive at the hospital may be billed and payment may be collected from you, from an insurance company or a third party. In addition, we may need to give your health plan information about surgery you received at the hospital so your health plan will pay us or reimburse you for the surgery. We may also tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment.

Health Care Operations. We may use and disclose your medical information in performing business activities which are called health care operations. Health care operations include doing things that allow us to improve the quality of care we provide and to reduce health care costs. We may use and disclose your medical information in the following health care operations:

Reviewing and improving the quality, efficiency and cost of care that we provide to our patients. We may use your medical information to develop ways to assist our physicians and staff in deciding how we can improve the medical treatment we provided to others.
Improving health care and lowering costs for groups of people who have similar health problems and helping to manage and coordinate the care for these groups of people. We may use your medical information to identify groups of people with similar health problems to give them information, for instance, about treatment alternatives and educational classes.
Reviewing and evaluating the skills, qualifications, and performance of health care providers taking care of you and our other patients.
Provide training programs for students, trainees, health care providers, or non-health care professionals to help them practice or improve their skills.
Cooperating with outside organizations that assess the quality of the care that we provide.
Cooperating with outside organizations that evaluate, certify, or license health care providers or staff in a particular field or specialty. We may use or disclose your medical information so that one of our nurses may become certified as having expertise in a specific field of nursing.
Cooperating with various people who review our activities. Your medical information may be seen by doctors reviewing the services provided to you, and by accountants, lawyers, and others who assist us in complying with the law and managing our business.
Assisting us in making plans for our practice's future operations.
Resolving grievances within our practice.
Reviewing our activities and using or disclosing your health information in the event that we sell our practice to someone else or combine with another practice.
Business planning and development, such as cost-management analyses.
Business management and general administrative activities of our practice, including managing our activities related to complying with the HIPAA Privacy Rule and other legal requirements.
Creating de-identified information that is not identifiable to any individual.

If another health care provider, company, or health plan that is required to comply with the HIPAA Privacy Rule has or once had a relationship with you, we may disclose your medical information for certain health care operations of that health care provider or company. Such health care operations may include: reviewing and improving the quality, efficiency and cost of care provided to you; reviewing and evaluating the skills, qualifications, and performance of health care providers, or non-health care professionals; cooperating with outside organizations that evaluate, certify, or license health care providers or staff in a particular field or specialty; and assisting with legal compliance activities of that health care provider or company. We may also disclose your medical information for the health care operations of an "organized health care arrangement" in which we participate. An "organized health care arrangement" is the joint care provided by a hospital and the doctors who see patients at the hospital.

Oregon Law. Oregon law provides additional confidentiality protections in some circumstances. For example, in Oregon a health care provider generally may not release the identity of a person tested for HIV or the results of an HIV-related test without your consent and you must be notified of this confidentiality right. Drug and alcohol treatment program records are specially protected and may require your specific consent for release under both federal and state law. Mental health records are specially protected in some circumstances, as is genetic information.

For more information on Oregon law related to these and other specially protected records, please contact the Hospital Privacy Officer, or refer to the Oregon Revised Statutes and the Oregon Administrative Rules. These documents are available on-line at www.oregon.gov.

Uses and Disclosures That We May Make Unless You Object

How you can object to a use or disclosure: If you do not want your information used in the following ways, you must notify the Grande Ronde hospital Privacy Officers in writing at the address provided above and specify the use or disclosure to which you object.

Soliciting funds for the hospital. We may use demographic information about you and dates of health care provided to you to contact you in an effort to raise money for the hospital. We may disclose this information to a foundation related to the hospital or to a business associate of the hospital so that the foundation or business associate may contact you in raising money for the hospital. We would only disclose contact information, such as your name, address and phone number and when you received treatment.

Providing information from our hospital directory. Hospital directory information is defined as your (1) name, (2) location in the hospital, (3) religious affiliation and (4) general condition described in terms that do not communicate specific medical information about you. We may disclose location and general condition information to individuals who ask for you by name. This may include your family and friends or even the media in some circumstances. We are allowed to disclose hospital directory information to the clergy even if they do not ask for you by name. You will be asked to indicate your preference at the time of admission.

Individuals involved in your care or payment for your care. We may release medical information about you to a friend or family member who is involved in your medical care. We may also give information to someone who helps pay for your care. We may also tell your family or friends your condition and that you are in the hospital. In addition, we may disclose medical information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.

Appointment Reminders. We may contact you as a reminder that you have an appointment for treatment or medical care at the hospital.

Treatment Alternatives. We may contact you to tell you about or recommend possible treatment options or alternatives that we offer that may be of interest to you.

Health-Related Benefits and Services. We may contact you to tell you about health-related benefits or services that may be of interest to you.

Uses and Disclosures that Do Not Require Your Authorization or An Opportunity to Object

We may use or disclose your medical information for the following purposes:

To organ procurement organizations, for purposes of organ, eye, or tissue donation. If you are an organ donor, we may disclose your medical information to organizations that handle organ procurement or organ, eye, or tissue transplantation or to an organ donation bank, as necessary to facilitate organ, eye, or tissue donation and transplantation.

To the military as required by military command authorities. If you are an armed forces personnel, we may disclose your medical information required by military command authorities. If you are a foreign military personnel, we may also disclose your medical information to the appropriate foreign military authority.

As authorized by law in connection with the Workers’ Compensation Program. We may disclose your medical information to the extent authorized by and to the extent necessary to comply with law relating to workers’ compensation or similar programs to the extent authorized by law. These programs provide benefits for work-related injuries or illness.

To support public health activities. We may disclose your medical information for certain public health activities and purposes. These activities typically include reports to such agencies as the Oregon Department of Human Services as required or authorized by state law. These reports may include, but not necessarily be limited to, the following reports:

To a public health authority or other appropriate government authority that is authorized by law to collect or receive information for the purpose of:

Preventing or controlling disease, injury or disability;
Reporting births and deaths;
Reporting child abuse or neglect.

To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.
To notify the appropriate government authority if we believe a patient has been the victim of abuse or neglect. We will only make this disclosure if the patient agrees or when required or authorized by law.
To the Food and Drug Administration relative to adverse events concerning food, supplements, product and product defects, or post marketing surveillance information to enable product recalls, repairs, or replacement.

Health oversight activities. We may disclose medical information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Lawsuits and disputes. If you are involved in a lawsuit or a dispute, we may disclose medical information about you in response to a court or administrative order. We may also disclose medical information about you in response to a civil subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell patients about the request or to obtain an order protecting the information requested.

Law Enforcement. We may release medical information if asked to do so by a law enforcement official:

In response to a court order, subpoena, warrant, summons or similar process;
To identify or locate a suspect, fugitive, material witness, or missing person;
About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person's agreement;
About a death we believe may be the result of criminal conduct;
About criminal conduct at the hospital; and
In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.

Coroners, Medical Examiners and Funeral Directors. We may disclose your medical information to a coroner or medical examiner as necessary, for example, to identify a deceased person, to determine the cause of death, or to carry out other duties as authorized by law. We may also disclose your medical information to funeral directors as necessary to carry out their duties.

National Security and Intelligence Activities. We may disclose your medical information to authorized federal officials for the conduct of lawful intelligence, counterintelligence, and other national security activities authorized by law.

When required to avert a serious threat to health or safety. We may use and disclose your medical information when necessary to prevent or lessen a serious threat to your health and safety or the health and safety of the public or another person.

Protective services for the President and others. We may disclose your medical information to authorized federal officials so they may provide protection to the President, other authorized persons, or foreign heads of state or for the conduct of special investigations.

Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose your medical information to the correctional institution or law enforcement official. This release would be necessary if the correctional institution or law enforcement official represents that the information is necessary in certain circumstances, such as (1) providing you with health care; (2) protecting your health and safety or the health and safety of other inmates; or (3) for the health and safety of the officers or employees or others at the correctional institution.

As required by federal, state or local law. We will use or disclose your medical information to the extent when required by federal, state or local law.

Incidental disclosures. Certain incidental disclosures of your medical information occur as a by-product of lawful and permitted use and disclosure of your medical information. For example, a visitor may inadvertently overhear a discussion about your care occurring at the nurses’ station. These incidental disclosures are permitted if the hospital applies reasonable safeguards to protect your medical information.

Limited data set information. We may disclose limited health information to third parties for purposes of research, public health and health care operation purposes. This health information excludes direct identification information about you and will include only the following identifiers:

Admission, discharge, and service dates;
Dates of birth and, if applicable, death;
Age (including age 90 or over); and
Five-digit zip code or any other geographic subdivision, such as state, county, city, precinct and their equivalent geocodes (except street address).

Before disclosing this information, we must enter into an agreement with the recipient of the information that fulfills several requirements, including: (1) limiting who may use or receive the data; (2) requiring the recipient to agree not to identify the data or contact you; and (3) containing assurances that the recipient of the information will use appropriate safeguards to prevent inappropriate use or disclosure of the information.

Uses and Disclosures Requiring Your Authorization.

Other uses and disclosures for purposes other than described above require your express authorization. For example, the hospital must obtain your authorization before disclosing your medical information to a life insurer or to an employer, except under special circumstances such as when disclosure to the employer is required by law. You have the right to revoke an authorization at any time, except to the extent we have already relied on the authorization in making an authorized use or disclosure. Your revocation of an authorization must be in writing, must specify the authorization you wish to revoke, and must be delivered to the Grande Ronde Hospital Privacy Officer at the address provided above.

The hospital hopes that if you choose to revoke an authorization, you will help us comply with your wishes by identifying the authorization you are choosing to revoke. Ways of telling us which authorization you are revoking might include indicating who you authorize to receive information or the approximate time frame in which you signed the authorization.

Disclosures to Business Associates

The hospital contracts with outside companies that perform business services for us, such as billing companies, management consultants, quality assurance reviewers, accountants or attorneys. In certain circumstances, we may need to share your medical information with a business associate so it can perform a service on our behalf. The hospital will limit the disclosure of your information to a business associate to the amount of information that is the minimum necessary for the company to perform services for the hospital. In addition, we will have a written contract in place with the business associate requiring it to protect the privacy of your medical information.

Your Rights

You have the right to:

Request to inspect and copy your medical information used to make decisions about your care. Usually, this includes medical and billing records, but does not include psychotherapy notes. To inspect and copy medical information that may be used to make decisions about patients, you must submit a request in writing. If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request. We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to medical information, you may request that the denial be reviewed.

Amend Your Medical Information. If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for the hospital. To request an amendment, your request must be made in writing and submitted to hospital’s Privacy Officer. In addition, you must provide a reason that supports your request. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
Is not part of the medical information kept by or for the hospital;
Is not part of the information which you would be permitted to inspect and copy; or
Is accurate and complete.

We will put any acceptance or denial of a request to amend in writing and explain our reasons for any denial. You have the right to respond in writing to our explanation of denial, and to require that your request, our denial, and your statement of disagreement, if any, be included in future disclosures of the disputed record. Such responses should be sent to Grande Ronde Hospital’s Privacy Officer.

Request that we send you confidential communications by alternative means or at alternative locations. For example, you may ask that we only contact you at work or by mail. A request for confidential communication must be made in writing. We will honor all reasonable requests.

Request restrictions. You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not use or disclose information about a surgery you had.

Request an accounting of disclosures. You may request an accounting of disclosures we made of your medical information in the six years prior to the date of your request. Your request must state a time period which may not be longer than six years and may not include dates before April 14, 2003. To request an accounting of disclosures, your request must be made in writing and submitted to the Grande Ronde Hospital Privacy Officer at the address provided above. You are not entitled to an accounting of disclosures of certain information, including disclosures made for purposes of treatment, payment or healthcare operations; disclosures you authorized; disclosures to you; incidental disclosures; disclosures to family or other persons involved in your care; disclosures to correctional institutions and law enforcement in some circumstances; disclosures of limited data set information; or disclosures for national security or law enforcement purposes.

Receive a paper copy of this Notice if you received the notice electronically. You may obtain a paper copy of this notice at any time by requesting a copy from any member of our staff.

Please direct requests discussed above to the Privacy Officer at 541-963-1555.

We reserve the right to change our health information practices and the terms of this Notice, and to make the new provisions effective for all protected health information we maintain, including health information created or received prior the effective date of any such revised notice. Should our health information practices change, we will post the revised notice at our service delivery sites and make the revised notice available to you at your request.

If you believe your privacy rights have been violated, you may file a complaint with the Grande Ronde Hospital Privacy Officer, or with the Secretary of the Department of Health and Human Services, 200 Independence Avenue S.W., Washington, DC 20201. The DHHS toll-free telephone number is 1-877-696-6775. There will be no retaliation for filing a complaint.

Back to the top