THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice describes how we may use and disclose protected health information about you. Protected health information means any of health information that could be used to identify you. In this notice, we refer to all of that protected health information as "PHI."

This notice also describes your rights and our duties with respect to your PHI. In addition, it tells you how to complain to us if you believe we have violated your privacy rights.

We are committed to the protection of PHI in accordance with applicable laws and accreditation standards regarding patient privacy. Your PHI is personal. A record of the care and services you receive at our facility is needed to provide you with quality care and to comply with legal requirements. The law requires us to make sure that your PHI is kept private. The law also requires us to provide a copy of this notice which explains our legal duties and privacy practices with respect to your PHI, and to follow the terms of this notice currently in effect.

HOW WE MAY USE AND DISCLOSE YOUR PHI

We use and disclose your PHI for a number of different purposes. Each of those purposes is listed below.

1. TREATMENT

We may use your PHI to provide, coordinate or manage your in-patient, out-patient, or post-hospital care. We may disclose your PHI to doctors, nurses, hospitals and other healthcare facilities who become involved in your care. In the course of your treatment here, your PHI may be disclosed to indirect healthcare providers such as our independent contractor radiologists and pathologists. Similarly, we may refer you to another healthcare provider and as part of the referral process share your PHI with that provider. An example of this would be if you were being treated for a broken leg, and the physician needed to know if you had diabetes, because diabetes may slow the healing process. So the physician treating your leg may refer you to another physician who specializes in treating diabetic patients and in doing so, will share your PHI with that physician. Additionally, if you have diabetes, the physician will share your PHI with a dietitian so we can arrange for appropriate meals for you.

2. PAYMENT

We may use and disclose your PHI so we can be paid for the services we provide. This can include billing you, your insurance company, or a third party payor. For example, we may need to give your insurance company information about the healthcare services provided to you such as your dates of admission and discharge so that your insurance company will pay us for those services or reimburse you for money that you have paid. We may also provide your name, address and insurance information to other healthcare providers who care for you while you are being treated here so that they may submit bills for their care. Additionally, we may need to provide your insurance company or a government program such as Medicare or Medicaid with information prior to your admission about your medical condition and the treatment you need to determine if you are covered in the event of planned care, under that insurance program.

3. HEALTHCARE OPERATIONS

We may use and disclose your PHI for our own healthcare operations. These uses and disclosures are necessary to run our organization and to make sure that all of our patients receive quality care and cost-effective services. For example, we may use PHI to review the quality of our treatment and services, to develop new programs, to determine whether new treatments are effective, and to evaluate the performance of our staff in caring for you. We may use PHI to contact you after your discharge from our care to discuss satisfaction with your stay with us and your current health status.

Additionally, we may share your PHI with accrediting and licensing bodies in order to continue to be a licensed and accredited healthcare facility. We may also combine your PHI with PHI from other healthcare organizations to improve our services. When we do so, we may remove information that identifies you as an individual from the shared PHI.

We may also share your PHI with other healthcare organizations who have or have had a relationship with you if that information is related to and needed for the healthcare operations of the other healthcare organization.

4. HOSPITAL DIRECTORY

We may include your name, date of admission, and location in our facility in our directory while you are a patient in our facility. This information may be released to people who ask for you by name. Additionally, during the registration process, you will be asked your religious affiliation, if any. Your religious affiliation may be given to members of the clergy, such as a minister, priest, or rabbi, who ask for you by name, or who ask for a list of patients who are members of their church, synagogue, or parish. If a telephone call or delivery arrives for you, we may acknowledge that you are a patient in our facility, and either transfer the call to you or accept the delivery on your behalf. If a delivery arrives for you after your discharge from the hospital, we will direct the party making the delivery (for example, a florist or the United States Postal Service) to forward the item being delivered to your home address. If you do not want items forwarded to your home address after your discharge, please notify the registration and admitting staff of an alternative forwarding address.

Should your stay with us attract media attention (for example if you are involved in an accident or are a celebrity) we will follow the Hospital policy for release of information to the media. If you want us to withhold information from the media, please advise the registration and admitting staff of your request. If you do not want to be included in our directory or you want to restrict the information we include in the directory, please notify the registration and admitting staff and they will assist you with your request.

5. APPOINTMENT REMINDERS We may use and disclose PHI to contact you to remind you of an appointment you have with us. We may contact you by telephone or by mail at either your home or your office. We may, at your request, leave messages for you on the answering machine or voicemail. If you want to request that we communicate to you in a certain way or at a certain location, please contact Loretto Hospital's Privacy Officer.

6. HEALTH RELATED BENEFITS, SERVICES, AND ALTERNATIVES We may use and disclose your PHI to contact you about health-related benefits, services and treatment alternatives that may be of interest to you.

7. FUNDRAISING AND MARKETING We may use your PHI to contact you in an effort to raise money for the Hospital and its operations. We may also disclose health information to the Loretto Hospital Foundation so that the Foundation may contact you to raise money for the Hospital. We would only release contact information, such as your name, address, phone number, and the dates you received treatment or services at the Hospital. If you do not want the Hospital to contact you for fundraising efforts, you must notify the Hospital's Privacy Officer in writing. In addition, the Hospital may use your health information for marketing, but will require your authorization to do so for marketing communication other than those that describe our services, or those that relate to your treatment or care coordination. For example the Hospital may send you an announcement about a new service as part of a general mailing to all our patients.

. INDIVIDUALS INVOLVED IN YOUR CARE

We may disclose to a family member, other relative, friend, or any other person identified by you, PHI that is relevant to that person's involvement in either your care or payment related to your care. An example of this is a family member who accompanies you to the hospital for a procedure and with whom the surgeon speaks regarding your surgery.

We may also use or disclose your PHI to notify, or assist in notifying, those persons of your location, general condition, or death. If there is a family member, other relative, friend or other person to whom you do not wish us to disclose the above information, please notify the registration or admitting staff, and the person who is providing care to you of your request.

9. DISASTER RELIEF

We may use or disclose your PHI to a public or private entity authorized by law or by its charter to assist in disaster relief efforts. This will be done to coordinate with those entities in notifying a family member, other relative, friend, or other person identified by you of your location, general condition or death.

10. PUBLIC HEALTH AND GOVERNMENT FUNCTIONS

We may disclose your PHI to a health oversight agency for activities authorized by law, including audits, investigations, inspections, licensure or disciplinary actions. We may disclose your PHI to the government or a health oversight agency for the following purposes:

• To control or prevent a communicable disease, injury, or disability.
• To report electro-convulsive therapy treatment.
• To refer patients admitted with a psychiatric diagnosis to Behavioral Health.
• To report births and deaths.
• To report adverse reactions that may occur after administering a vaccine, drug or treatment to a patient.
• To report instances of food poisoning or product defects.
• To track products and enable product recalls.
• To conduct post procedure follow-ups as required by law.

If necessary, we may disclose your PHI to another healthcare provider who has or who will be providing care to you for purposes of controlling or preventing a communicable disease.

11. REQUIRED BY LAW

We are required by law to release your PHI as it relates to:

• a federal, state, county or law enforcement agency regarding reporting, investigating or prosecuting threatened or suspected child or elder abuse, domestic violence, or relinquishment of an infant 72 hours old or less.
• an agency or law enforcement agency investigating abuse, neglect. physical injury, violent crimes, death, animal bites, injuries due to the discharge of a firearm, and the inappropriate transfer of a patient by another facilities' emergency department.
• your court-appointed guardian.
• an agent you appoint under a healthcare power of attorney.
• the appropriate law enforcement official or correctional institution if you are in custody or incarcerated.

12. JUDICIAL AND ADMINISTRATIVE PROCEEDINGS

We may disclose your PHI in the course of any judicial or administrative proceeding in response to an order of the court or administrative tribunal. We may also disclose your PHI in response to a subpoena, discovery request, or other legal process but only if efforts have been made to tell you about the request, it appears from the request that you know of its existence, or an order is obtained protecting the information to be disclosed.

13. LAW ENFORCEMENT PURPOSES

We may disclose your PHI to a law enforcement official for the following law enforcement purposes:

• as required by law, in response to a court, grand jury, or administrative order or subpoena,
• to identify a suspect, fugitive, material witness, or missing person, about an actual or suspected victim of a crime,
• regarding a death if we suspect the death may have resulted from criminal conduct,
• about crimes that occur at our facility, and
• to report a crime in emergency circumstances.

14. CORONERS, MEDICAL EXAMINERS AND FUNERAL DIRECTORS

We may disclose your PHI to a coroner or medical examiner for purposes such as identifying a deceased person or determining cause of death. We may disclose your PHI to a funeral director in the event of your death.

15. ORGAN EYE OR TISSUE DONATION

We may disclose your PHI to organ procurement organizations or other entities engaged in the procurement, banking or transplantation of organs, eyes or tissues.

16. RESEARCH

Under certain circumstances, we may disclose your PHI for research. For example, a research project might compare the health and recovery of all patients who received one medication to those who received another medication for the same condition. For this type of project, we remove information that identifies you from your PHI. In all other circumstances, you will be asked to give your consent to participate in a research project. You may choose not to participate in a research project and your care and treatment will not be affected by your decision. All research projects are approved through a process that evaluates the needs of the research project with your need for protection of PHI.

17. SERIOUS THREAT TO HEALTH OR SAFETY

We may use or disclose your PHI if we believe the use or disclosure is necessary to prevent or lessen a serious or imminent threat to the health or safety of a person or the public. We may also release information about you if we believe the disclosure is necessary for law enforcement authorities to identify or apprehend an individual who admitted participation in a violent crime or who is an escapee from a correctional institution or from lawful custody.

18. MILITARY

If you are a member of the Armed Forces, we may use and disclose your PHI for activities deemed necessary by the appropriate military command authorities to assure the proper execution of the military mission. We may also release information about foreign military personnel to the appropriate foreign military authority for the same purposes.

19. NATIONAL SECURITY

We may disclose your PHI to authorized federal officials for the conduct of intelligence, counter-intelligence, and other national security activities authorized by law. Additionally, we may also disclose your PHI to authorized federal officials so they can provide protection to the President of the United States, certain other federal officials, or foreign heads of state. We may use your PHI to make medical suitability determinations and may disclose the results to officials in the United States Department of State for purposes of a required security clearance or service abroad.

20. INMATES AND PERSONS IN CUSTODY

We may disclose your PHI to a correctional institution or law enforcement official having custody of you. The disclosure will be made if it is necessary to provide healthcare to you, for your health and safety, the health and safety of others, or the safety, security and good order of the correctional institution.

21. WORKERS COMPENSATION

We may disclose your PHI to the extent necessary to comply with workers compensation and similar laws that provide benefits for work related injuries or illness.

22. OTHER USES AND DISCLOSURES

Other uses and disclosures will be made only with your written authorization. You may revoke such authorization at any time by notifying the Privacy Officer, Paula Crossen, Loretto Hospital, 645 S. Central, Chicago, Il 60644 (877-854-5599) of your desire to revoke it. If you revoke such an authorization, however, it will not have any affect on actions taken in reliance upon it.

In all instances where we use or disclose your PHI, we follow a "Minimum Necessary" standard. Each person accessing your PHI makes every reasonable effort to limit the use and disclosure of your PHI to that information necessary to accomplish the intended purpose or job.

1. RIGHT TO REQUEST RESTRICTIONS

You have the right to request that we restrict the uses or disclosures of your PHI to carry out treatment, payment or healthcare operations. You also have the right to request that we restrict the uses or disclosures we make to someone who is involved in your care or the payment for your care. We are not required to agree to your request if it inhibits the provision of patient care, treatment, payment or healthcare operations.

If we do agree to the restriction, we will comply with your request unless the information is needed to provide you emergency treatment. If we agree to a restriction and later disclose your PHI for emergency treatment purposes to another provider, we will ask that provider not to use or disclose the information other than for treatment purposes. A request for a restriction should be made in writing to the Medical Records Department. Your request should specify what information you want to limit, whether you want to limit use or disclosure or both, and to whom you want the limits to apply.

If we agree to a restriction, you can request orally or in writing that we end that agreement and lift the restriction. If you make an oral request, we will document that you requested that the restriction be lifted in your medical record. We may also decide to end the agreement and lift the restriction and if we decide to do so we will advise you of our decision.

2. RIGHT TO INSPECT AND COPY

You have the right to inspect and obtain a copy of your health records with limited exceptions as allowed by law. While you are an inpatient, your request to inspect your records may be made to your nurse or physician. After discharge your request should be made to the Medical Records Department. To obtain a copy of your health records, you must complete an authorization form and submit it to the Medical Records Department. To obtain a copy of your billing information, you must contact the Patient Financial Services Department. We will respond to your request within 30 calendar days of receipt of the completed authorization form.

We may deny your request to inspect and copy your health records if the information involved is psychotherapy notes. We may also deny a request by you or your legal representative to inspect and copy your PHI if doing so may endanger the life or physical safety of you or another person.

If we deny your request, in its entirety or in part, we will inform you in writing of the basis of the denial, how and under what circumstances you may have your denial reviewed, and how you may complain. If you request a review of our denial, it will be conducted by a licensed healthcare professional designated by us who was not directly involved in the denial. We will comply with the outcome of that review.

3. RIGHT TO AMEND

You have the right to ask us to amend your PHI as long as the PHI is maintained by us. You may request an amendment by notifying the Medical Records Department of your desire to amend the record and completing the "Amendment Form" utilized for that purpose. The Medical Records Department will provide a written response to your request within 30 calendar days of receipt of the completed "Amendment Form."

We may deny your request if we determine that your PHI: a) was not created by us, b) is not part of the record set, c) is protected from access by law, or d) we believe your PHI is accurate and complete.

4. RIGHT TO A LIST OF DISCLOSURES

You have the right to receive a list of disclosures made of your PHI. Certain types of disclosures are not included in that list such as disclosures to you or your legal representative, disclosures to carry out treatment, payment and healthcare operations, disclosures made as discussed in paragraphs 7, 8, 9 or 10 of this notice, or those disclosures made in response to a signed authorization. To request a list of disclosures, you should submit your request in writing to the Medical Records Department. Your request must indicate a time period for the disclosures.

The first list you request from us within a 12 month period will be provided at no charge. For additional lists, we may charge you for the costs associated with providing the list. We will notify you of the cost involved, and you may choose to withdraw or modify your request at the time before any costs are incurred.

The list of disclosures will include the following information about the disclosures: a) the date the disclosure was made, b) the name and address of the person or entity to whom it was made, c) a brief description of what was disclosed, and d) a brief statement of the purpose of the disclosure.

We will attempt to provide the list to you within 60 days after receipt of your request. If we are unable to do so within that time frame, we will let you know.

5. RIGHT TO REQUEST CONFIDENTIAL COMMUNICATIONS

You have the right to request that we communicate with you about your PHI in a certain way or at a certain location. For example, you may ask that we only contact you by mail or at work. Our standard means of communication is in person, by telephone, or in writing. If you wish to make a request for an alternative means of communication, you must do so in writing to the Medical Records Department. Your request must state how or where you can be contacted, but does not need to explain the reason for your request. We will accommodate all reasonable requests.

6. RIGHT TO REVOKE AUTHORIZATION

Uses and disclosures of PHI not covered by this Notice of Privacy Practices or applicable laws will be made only with your written authorization. If you authorize us to use or disclose your PHI, you may revoke that authorization, in writing, at anytime. We are unable to take back any disclosures we have already made with your permission. To revoke an authorization, you must contact the Medical Records Department.

7. RIGHT TO COMPLAIN

If you believe your privacy rights have been violated, you may complain to the Hospital or to the United States Department of Health and Human Services. To complain to the Hospital, please contact Paula Crossen, Privacy Officer at (877) 854-5599 and indicate that you have a complaint regarding a breach of privacy. To complain to the United States Department of Health and Human Services, contact the Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, D.C., 20201. There will be no retaliation against you for making your complaint.

Loretto Hospital reserves the right to change this Notice of Privacy Practices. We reserve the right to make the new notice's provisions effective for all PHI that we maintain, including that created or received by us prior to the effective date of the new notice. A copy of our current Notice of Privacy Practices will be posted in all patient registration areas. In addition, each time you register at a site covered by this notice, a copy of the current notice will be made available to you. If you have any questions after reading this notice, please contact the Loretto Hospital Privacy Officer.

Effective April 14, 2003
Revised May 7, 2004