CAPE FEAR VALLEY PHARMACY JOINT NOTICE OF PRIVACY PRACTICES THIS JOINT NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. OUR DUTY TO SAFEGAURD YOUR PROTECTED HEALTH INFORMATION Individually identifiable information about your past, present, or future health or condition, the provision of health care to you, or payment for your health care is considered ?Protected Health Information? (PHI). We are required by law to extend certain protections to your PHI, and legally required to give you this Joint Notice about our privacy practices that explains how, when and why we may use or disclose your PHI. Except in connection with your treatment and in other specified circumstances, we must use or disclose only the minimum necessary PHI to accomplish the intended purpose of the use or disclosure. We are required to follow the privacy practices described in this Joint Notice. The current Joint Notice is posted in the health system facilities at the points of registration. We reserve the right to change our privacy practices and the terms of this Joint Notice at any time. Prior to the effective date of any such revisions, the revised Joint Notice will be posted in the health system facilities at the points of registration, will be available upon request from any health system facility or the contact persons named in this Joint Notice, and will be posted on our website at http://www.capefearvalley.com. WHO WILL FOLLOW THIS JOINT NOTICE The terms of this Joint Notice of Privacy Practices apply to Cape Fear Valley Health System, which operates as clinically integrated health care system made up of: Cape Fear Valley Medical Center, Highsmith-Rainey Memorial Hospital, Behavioral Health Care, Southeastern Regional Rehabilitation Center, Outpatient Treatment Services, Outpatient Diagnostic Services, Cape Fear Valley Home Health and Hospice, Cumberland County Emergency Medical Services, Outreach Clinics, physicians and allied health providers credentialed by CFVHS while performing their duties within CFVHS (collectively ?CFVHS?). This Joint Notice describes the agreed upon procedures and policies governing how your PHI is gathered, utilized and maintained not only by CFVHS but also by the physicians and other licensed professional rendering your care. (Note: Your personal physician may have different notices and policies in effect for his or her private office or clinic which will govern use and disclosure of PHI at that location.) Specifically, our policies and practices regarding your PHI will be followed by: * All employees and staff of CFVHS; * Any member of a volunteer group that is allowed to assist you while you are in the hospital; * Any health care provider with access to your PHI; and * All others that have been requested by CFVHS to perform services on its behalf How We May Use and Disclose Your PHI We use and disclose PHI for a variety of reasons. We have a limited right to use and/or disclose your PHI without your specific authorization. Federal law does not require that we obtain your authorization for uses or disclosures related to treatment, payment, or health care operations. In certain other instances, federal or state law permits or requires us to make the use or disclosure without your authorization. Otherwise, we must have your written authorization to disclose your PHI. If we disclose your PHI to an outside entity in order for that entity to perform a function on our behalf, we must have in place an agreement from the outside entity that it extends the same degree or privacy protection to your information that we must apply to your PHI. The following offers more description and some examples of our potential uses/disclosures of your PHI. Uses and Disclosures Relating to Treatment, Payment, or Health Care Operations. For treatment: We may use and disclose PHI about you to provide, coordinate or manage your treatment and related services. This may include communicating with other health care personnel involved in treatment, coordination and management of your health care. For example, we may use and disclose PHI about you when you need a prescription, lab work, x-ray, specified diet, or other health care services. In addition, we may provide copies of your PHI to another health care provider involved with your health care following discharge, such as home health providers and nursing facilities. To obtain payment: We may use and disclose your PHI in order to bill and collect payment for your treatment and health care services. For example, we may need to provide PHI to your insurance company to receive payment for our services or so that your insurer will reimburse you for treatment. We may also tell your health plan about treatment you are going to receive to determine whether your plan covers the expense. For health care operations: We may use and disclose your PHI in the course of operating our hospital. These ?health care operations? activities allow us to use PHI to improve the quality of care we provide and reduce health care costs. For example, we may use your PHI for ?health care operations? to evaluate the quality of services provided or the need for new services. We may disclose your PHI to our accountant or attorney for audit purposes. Since we are an integrated system, we may disclose your PHI to designated staff in our other facilities, or program for similar purposes. Other examples of the way we may use or disclose PHI about you for health care operations include disclosures: * To business associates with whom we have contracted to perform the agreed upon service and billing for it; * To remind you that you have an appointment for medical care; * To assess your satisfaction with our services; * To tell you about possible treatment alternatives * To tell you about health related benefits or services * To cooperate with outside organizations that evaluate, certify, or license health care providers, staff or facilities in a particular field or specialty; * For population-based activities relating to improving health or reducing health care cost; and * For conducting training programs or reviewing competence of health care professionals Each of the entities included in the integrated health care system will share PHI with one another as necessary to carry out treatment, payment, and health care operations. We May Use and Disclose PHI Under Other Circumstances Without Your Authorization. When required by law: For example, we may disclose PHI when a law requires that we report information about suspected abuse, neglect, or domestic violence, or relating to suspected criminal activity, or in response to a court order. We must also disclose PHI to authorities that monitor compliance with these privacy requirements. Lawsuits/Judicial Proceedings: If you are involved in a lawsuit or other legal dispute, we may in accordance with North Carolina law disclose PHI in response to a court or administrative order. Law Enforcement: We may disclose your PHI is asked to do so by a law enforcement official for reasons, including but not limited to, the following: * In response to a court order, search warrant, or similar process; or * About a death we believe may be the result of a criminal conduct. These disclosures will be made in accordance with North Carolina law. For public health activities: For example, we may disclose PHI when we are required to collect information about disease or injury, or to report vital statistics to a public health authority. For health oversight activities: We may disclose PHI to a state or federal health oversight agency, which is authorized by law to oversee our operations. These activities include, for example, licensure and certification audits or inspections. Relating to decedents: For example, we may disclose PHI relating to a death to coroners, medical examiners or funeral directors. For cadaveric organ, eye or tissue donation: We may disclose PHI to organ procurement organizations relating to organ, eye, or tissue donations or transplants. For research purposes: For example, we may disclose information to researchers when an Institutional Review Board has reviewed the research proposal and established protocols to provide for the privacy of your health information, thereby waiving the requirement to obtain your consent. To avert a serious threat to health or safety: For example, in order to avoid a serious threat to health or safety, we may disclose PHI as necessary to law enforcement or other persons who can reasonably prevent or lessen the threat of harm. For specialized government functions: we may disclose PHI if it relates to the following: military personnel as required by military command authorities, national security and intelligence activities, and protective services for the President or foreign heads of state. We may also disclose PHI to a correctional institution having lawful custody of you or in other law enforcement custodial situations. Fundraising Activities: We may disclose your PHI to the Cape Fear Valley Health Foundation (Foundation) in order to contact you in an effort to raise money for CFVHA and the services it offers the community. In such cases, we would limit our use and disclosure of your PHI to demographic information, such as your name, address, phone number and the date you received treatment or services. We would not release information indicating the reasons you were receiving treatment. If you do not want CFVHS or its Foundation to contact you for fundraising efforts, you must notify the Executive Director Cape Fear Valley Foundation in writing at P.O. 2000 Fayetteville, NC 28302. Marketing Activities: We may use your PHI to identify a service which may be of benefit to you, or new services offered by CFVHS. If you do not want CFVHS to mail you marketing information, you must notify the Director of Marketing in writing at Cape Fear Valley Medical Center P.O. 2000 Fayetteville, NC 28302. Opportunity to Object to Uses and Disclosures In the following situations, we may disclose a limited amount of your PHI if we inform you about the disclosure is not otherwise prohibited by law. Notify registration staff of your desire to object to either of the following uses of your PHI. Patient Directories: Your name, location, and general condition may be put into our patient directory, for disclosure to callers or visitors who ask for you by name. Additionally, your religious affiliation may be shared with clergy only. To families, friends, or other involved in your care: We may share information with these people directly related to their involvement in your care, or payment for your care. We may also share PHI with these people to notify them about your location, general condition, or death. Special Protections: In some situations, North Carolina or federal law may prove additional protections for your PHI. Where state or federal law requires that we obtain your written consent before disclosing your PHI, we will do so. In the situations described below, we use or disclose your PHI only as described below in accordance with the other provisions of this Joint Notice. Communicable Diseases: Under North Carolina law, if you suffer from a communicable disease (for example tuberculosis, syphilis or HIV/AIDS), we will use and discloses your PHI without your written consent or the written consent of your guardian only under the following circumstances: * For statistical purposes in a way that does not identify you; * To health care personnel providing you with treatment; * To protect public health and as provided by the regulations of the North Carolina Commission for Health Services; * To report as required by law; * Pursuant to a subpoena or court order; and * As otherwise specifically authorized or required by law. Treatment for Drug Dependence: Under North Carolina law, if you request treatment and rehabilitation for drug dependence, we will not disclose PHI related to your treatment or rehabilitation to any police officer or other law-enforcement officer unless we obtain your consent. Mental Health, Substance Abuse and Developmental Disabilities Services: Under North Carolina law, one or more facilities covered under this Joint Notice may be required to afford special protections to information about you related to treatment for mental health, substance abuse, and developmental disabilities. If applicable, such information may be disclosed without your written consent or the written consent of your personal representative only as follows: * Within the facility among employees, students, consultants, or volunteers when needed to carry out their responsibilities in serving you; * To other mental health, developmental disabilities, and substance abuse facilities when necessary to coordinate appropriate and effective care, treatment, or rehabilitation and when failure to share the information would be detrimental to you; * When in the opinion of a responsible professional there is an imminent danger of your health or safety or another individual or there is the likelihood of the commission of a felony or violent misdemeanor; * To a State or governmental agency when we believe you may be eligible for financial benefits through such agency; * When a court orders disclosure; * For purposes of filing a petition for involuntary commitment or petition of the adjudication of incompetency, if disclosure is in your best interests, and to court and attorneys involved in cases regarding involuntary commitment or voluntary admission; * To an attorney who represents the facility or an employee of the facility; * To the Department of Correction, as requested, regarding an inmate determined to be in need of treatment for mental illness, developmental disabilities and/or substance abuse; * To a clerk of court, prosecuting attorney or district attorney, and to your attorney in a case where you are a criminal defendant and a mental examination has been ordered by the court; * To researchers if there is justifiable documented need for the information (such research shall have been approved by an Institutional Review Board); * To report suspected abuse, neglect, dependency, or maltreatment as required by law; * To your next of kin, upon request, if the next of kin plays a legitimate role in the therapeutic services provided to the client; otherwise only the fact of admission to or discharge from a facility may be disclosed to next of kin; * To a health care provider who is providing emergency medical services to you; * To a physician or psychologist who referred you to the facility; * To the Secretary of the Department of Health and Human Services or other licensing agencies during the course of an inspection of the facility; * To an attorney upon your request; and * To a provider or support services to the facility pursuant to a written agreement. Federally Assisted Alcohol and Drug Treatment Programs: Under federal law, if you are receiving treatment in a federally assisted alcohol and drug treatment program, your health information may be disclosed without your written consent or the written consent of your personal representative only as follows: * Within the program for activities related to the provision of substance abuse diagnosis, treatment, or referral for treatment; * To respond to a medical emergency; * When required by a court order issued in accordance with regulations; * To communicate with law enforcement personnel about a crime or threatened crime on the premises of a program or against program personnel; * To qualified personnel for research, audit or evaluation activity; and * To comply with state law mandating the reporting of child abuse or neglect. Uses and Disclosing Requiring Authorization: For uses and disclosures other than for those purposes identified in Sections I, II, III, and IV above, we are required to have your written authorization. Authorizations can be revoked in writing, at any time, to stop future disclosures. We are unable to retract any disclosures we have already made with your authorization. Your Rights Regarding Your PHI You have the following rights relating to your PHI: Right to request restrictions on uses/disclosures: You have the right to ask that we limit how we use or disclose your PHI. We will consider your request, but we are not legally bound to agree to any such restriction. To the extent that we do agree to any restrictions on our use/disclosure of your PHI, we will put any such agreement in writing and abide by it except in emergency situations. We cannot agree to limit uses/disclosures that are required by law. Right to choose how we contact you: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you may ask that we contact you at work, home or another location. The facility grants requests for confidential communications at alternative locations and/or via alternative means only if the request is reasonable, is submitted in writing, the written request includes a mailing address where the individual receives bills for services rendered by the facility and related correspondence regarding payment for services, and the request indicates other means or other locations in which we can contact you if you fail to respond to any communication from us that requires a response. We will notify you in accordance with your original request prior to attempting to contact you by other means or at another location. Right to inspect and request a copy of your PHI: You have the right to inspect and request a copy of your PHI that is maintained in a designated record set- records used to make decisions about your care (i.e. medical and/or billing records). Your request must be in writing and submitted to facility medical records custodian. We may charge you related fees. We may deny your request in limited circumstances. You may request that the denial be reviewed, and other licensed healthcare professional chosen by the hospital will review your request and the denial. You will be informed of the results of this review. Right to request amendment of your PHI: You have the right to request an amendment to your PHI maintained in a designated record set. Your request must be made in writing and submitted to facility medical record custodian. In addition, you must include the reason for the amendment. * If your request is approved, the amendment is included in your records. We make reasonable efforts to inform others of the amendment, including persons you name who have received PHI about you, and who needs the amendment. * Your request may be denied if the PHI is: (1)correct and complete; (2) not created by us (unless you show that the creator of the information is no longer available to respond to the request for amendment); (3) not part of the records used to make decisions about your care; (4) not available for review. If your request for amendment is denied, we will inform you in writing of the reasons for the denial and explain your rights to have the request and denial, along with any statement in response that you provide, appended to your PHI. Right to find out what disclosures have been made: You have a right to receive a list of disclosures of your PHI. You may ask for disclosures made up to six years before your request (not including disclosures made prior to April 14, 2003). This list of disclosures of your PHI does not include disclosures made for following purposes: * For your treatment; * For billing and collection of payment for your treatment; * For our health care operations; * Incidentally, in connection with an otherwise authorized disclosure; * Made to or requested by you, or that you authorized; * Made to individuals involved in your care; * For directory or notification purposes; * Allowed by law when the use or disclosure relates to certain specialized government functions, correctional institutions, or other law enforcement custodial situations; and * As a part of a limited set of information which does not contain certain information which could identify you. This list will include the date of the disclosure, the name (and address if available) of the person or organization receiving the information, a brief description of the information disclosed, and the purpose of the disclosure. If you request a list of disclosures more than once in twelve (12) months, we can charge you a reasonable fee for the subsequent request. Right to receive a copy of this Joint Notice: You have the right to receive a paper copy of this Joint Notice. We will provide a copy of this Joint Notice no later than the date you first receive service from us or in emergency situations as soon as practicable. You may request a copy of this Joint Notice at any time. You may also access this Joint Notice electronically via the Health System infoweb at www.capefearvalley.com. We would like to have the opportunity to work with you to resolve any questions or concerns you may have about our privacy practices or your privacy rights. You may contact any of the following by mail or phone to discuss your concerns or to file a complaint: HIPAA Project Manager 910-609-4406 Privacy Officer 910-609-4901 The Confidential Message Line 910-609-6140 c/o Cape Fear Valley Health System P.O. Box 2000 Fayetteville, NC 28302 You also have the right to file a complaint with the Secretary of the U.S. Department of Health and Human Services (USDHHS). You may write to USDHHS as: 200 Independence Avenue SW Washington D.C., 20201 Toll Free: 1-877-696-6775 We will take no retaliatory action against you if you file a complaint. Effective Date: This Joint Notice of Privacy Practices is effective on April 14, 2003.