Privacy Practices
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review the information in this notice carefully.
This notice provides you with information to protect the privacy of your confidential health care information, hereafter referred to as protected health information (PHI). The notice also describes the privacy rights you have and how you can exercise those rights. This notice serves as a joint notice from Conway Regional Health System and members of the Conway Regional Health System medical staff through an organized health care arrangement.
The law requires that we have privacy protections for PHI and to give you notice of our legal responsibilities to individuals. We are required to follow the terms and conditions contained in this Notice of Privacy Practices, but we reserve the right to change the privacy practices described in it. A current version of this notice is posted on our website and in prominent areas of our facilities. We are also required to notify you if a breach of your health information occurs.
Uses and Disclosures of Your Health Care Information
Treatment Purposes: Your PHI may be used by and disclosed to other health care professionals for the purpose of providing you with health care services. This may also include the need for us to obtain PHI from your current or previous health care providers. For example, information obtained by a nurse, physician, or other member of your healthcare team will be recorded in your medical record and used to determine the course of treatment that should work best for you. We may disclose your PHI to other health care providers, public health reporting entities or health care plans for treatment, payment or operational purposes using the State Health Alliance for Records Exchange (SHARE) unless you have opted out of participation in SHARE. For more information on SHARE, you may visit the Arkansas Office of Health Information Technology website at https://sharearkansas.com/. To opt-out of participation in SHARE, you should contact the Hospital’s Privacy Officer to obtain and complete an opt-out form.
Payment Purposes: Your PHI may be used by and provided to your health plan or insurance provider for the purpose of receiving payment for health care services. Your insurer also has a right to access your health care information for payment determinations or for conducting quality activities. PHI may also be disclosed to comply with workers compensation laws and similar programs. Your PHI may be shared with other health care providers, if necessary, for payment purposes.
Health Care Operations: Your PHI may be used or disclosed for health care operations. Our staff members and independent contractors may be required to access PHI for certain business operations and for quality improvement purposes. These uses and disclosures are necessary to operate Conway Regional Health System to help ensure that all of our patients receive quality care. For example, we may use PHI about your health care condition to evaluate the performance of our staff in caring for you.
Business Associates: There are some services in our organization that are provided through contract with business associates and subcontractors of business associates. Your health care information may be used by or disclosed to our business associate(s) to provide and bill for services. These business associates will sign an agreement that requires them to have procedures in place to protect the privacy of your PHI. Business associates are also required to be compliant with the HIPAA regulations.
Patient Directory: Your PHI will be used to maintain a listing of the names, locations, general condition, and religious affiliation of patients in our facilities. The information may be disclosed to members of the clergy and to others who specifically request the information by identifying the patient by name. You may inform our admissions staff or a caregiver if you choose to object to this use or disclosure.
Notification of and Communication with Family: Your PHI may be used, or disclosed, to notify, or assist in notifying, a family member, personal representative, or another person responsible for your care, location, and general condition. Health professionals, using their judgment, may disclose to a family member or any other person you identify, health information relevant to that person’s involvement in your care or payment related to your care.
Fundraising: We may contact you as part of a fundraising effort for the hospital. In addition to utilizing contact information such as your name, address, telephone number and potentially the date(s) you received services from our organization, we may use and or disclose the department of service, treating physician, outcome information, and health insurance information. If you do not want to be contacted for fundraising efforts, you may opt out of receiving these communications. Please contact either the Conway Regional Health Foundation or the Privacy Officer.
Contacts: We may contact you to provide appointment reminders or to tell you about new treatments or services.
As Required by Law: Your PHI will be used or disclosed when we are legally required to do so. If this occurs, we will limit the PHI used or disclosed to the minimum necessary to comply with the law.
Inmates: If you are an inmate, your PHI may be used or disclosed to the correctional institution or agents thereof when necessary for your health and the health and safety of others.
Emergencies: Your PHI may be used or disclosed in an emergency treatment situation. Your acknowledgement will be obtained as soon as possible following the emergency.
Workers’ Compensation: We may disclose PHI to file workers’ compensation claims.
To Avert a Serious Threat to Health or Safety: We may use and disclose PHI about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.
Organ Procurement Organizations: Consistent with applicable law, we may disclose PHI to organ procurement organizations for the purpose of organ and tissue donation and transplant.
Military: If you are or have been a member of the armed forces, we may release PHI about you as required by military command authorities.
Research: We may disclose PHI about you for research purposes when the research has been approved by an institutional review board and privacy protocols have been established. Your research-related treatment may be conditioned on signing an authorization to use and disclose your PHI in the research. You may also be asked to sign an authorization that would allow your PHI to be used in future research studies.
Public Health Authorities: As required by law, we may disclose your PHI to the public health or legal authorities charged with preventing or controlling disease, injury, or disability. For example, reporting births and deaths, reporting suspected abuse or neglect, and reporting communicable disease information as required by public health authorities.
Health Oversight Activities: We may disclose PHI to a health oversight agency for activities authorized by law, including, audits, investigations, inspections, medical device reporting and licensure.
Legal Proceedings: We may disclose your PHI in the course of any judicial or administrative proceeding or in response to a court order, subpoena, discovery request, or other lawful process, as allowed by law.
Law Enforcement Officials: We may release PHI for law enforcement purposes as required by law such as to identify or locate a suspect, fugitive, material witness, or missing person; about the victim of a crime if, under certain circumstances, we are unable to obtain the person’s agreement; about a death we believe may be the result of criminal conduct; about criminal conduct at or during services being provided by Conway Regional Health Systems; and in emergency circumstances to report a crime, the location of the crime or victim(s), or the identity, description, or location of the person who committed the crime.
Coroners, Medical Examiners, and Funeral Directors: We may disclose PHI to coroners, medical examiners or funeral directors consistent with applicable law to allow these individuals to carry out their duties.
National Security and Intelligence Activities: We may release PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
Sale of Information: Conway Regional Health System will not sell your information without your prior authorization or as otherwise allowed by law.
Required Uses and Disclosures: Conway Regional Health System must make disclosures when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the HIPAA Privacy Regulations.
Your PHI may be used or disclosed for other purposes not identified above based on your signing of a specific authorization form. You can revoke this authorization at any time provided you submit the revocation in writing to the Conway Regional Health System Privacy Officer. However, Conway Regional Health System is unable to “take back” any uses or disclosures that were made pursuant to the authorization prior to its revocation.
Your Health Information Rights
Right to Request a Restriction of Uses and Disclosures: You have the right to request in writing a restriction on certain uses and disclosures of your PHI. We are not required to agree to the requested restrictions, unless you are requesting to restrict certain information from your health plan and you have paid Conway Regional Health System for those services in full prior to receiving those services.
Right to Request Confidential Communications: You have the right to request that we communicate with you about your PHI in a certain way or at a certain location to protect the confidentiality of the information.
Right to Inspect and Copy: You have the right to request to inspect or obtain a copy of your PHI in paper or electronic form. There are a few exceptions to this right such as psychotherapy notes. For copies of your PHI, we may charge a reasonable fee for copying, postage (if mailed) and other costs associated with your request.
Right to Amend: You have the right to request that we amend your PHI that we created if you feel that the information is incorrect or incomplete. To request an amendment, you must submit the request in writing to our Privacy Officer. You must also provide reasoning to support your request. In addition, we may deny your request if you ask us to amend information that (1) was not created by us, unless the person or entity that created the information is no longer available to make the amendment; (2) is not part of the information kept by or for us; (3) is not part of the information which you would be permitted to inspect or copy; or (4) is accurate and complete.
Right to Receive an Accounting of Disclosures: You have the right to request a record of certain disclosures of your PHI.
Right to Receive a Paper Copy of this Notice: You have a right to receive a paper copy of our Notice of Privacy Practices. You may request a copy of this notice from the Admissions desk. The notice is also posted on our website at www.conwayregional.org.
Right to File a Complaint: You have the right to file a complaint if you believe we are not in compliance with our Notice of Privacy Practices and the Healthcare Information Portability and Accountability Act (HIPAA) or if you believe your privacy rights have been violated. Your complaint can be submitted to our Privacy Officer via phone, writing, or in person. We value your opinion and we will not retaliate against you in any manner for filing a complaint. You also have a right to file a complaint with the Secretary of the Department of Health and Human Services.
Notice of Privacy Practices for Substance Use Disorder Treatment Information
Conway Regional Health System
This notice describes how health information related to Substance Use Disorder (SUD) treatment. This notice describes how health information related to SUD treatment by Conway Regional Health System (CRHS) may be used and disclosed, your rights with respect to your SUD treatment information and how to file a complaint concerning a violation of the privacy or security of your SUD treatment information, or of your rights concerning your SUD treatment information. You have a right to a copy of this notice, in paper or electronic form, and to discuss it with our Privacy Officer whose contact information is listed below if you have any questions.
This notice supplements the information in our HIPAA Notice of Privacy Practices and describes the additional protections for records related to SUD treatment information. We are required to provide patients with notice of our legal duties and privacy practices with respect to SUD records and to notify affected patients following a breach of unsecured SUD records.
This notice is applicable to SUD treatment information protected under 45 CFR Part 2 which is limited to SUD treatment programs and does not apply to information related to care provided outside these programs such as substance abuse screening that is performed in emergency rooms or by your primary care provider.
How We May Use and Share Your Information
The confidentiality of SUD patient records maintained by us is protected by Federal law and regulations. We will share your SUD treatment information amongst our staff as needed to provide care to you or to bill you for services. Generally, however, we may not say to a person outside the addiction medicine program that you are a patient of the program or disclose any information identifying you as a person with substance use disorder except in the circumstances described below.
Instances where we may share information without your consent:
- The disclosure is made to medical personnel in a medical emergency;
- The disclosure is made to qualified service organizations providing services on our behalf who agree in writing to protect the information in the same way that we are required to protect the information;
- The disclosure is made to law enforcement to report a crime you commit, or threaten to commit, in our facility or against our personnel;
- The disclosure is made to report suspected child abuse and neglect as required by state law;
- The disclosure is made to qualified personnel for research subject to ethics board approval and oversight;
- The disclosure is made to qualified personnel for audit or program evaluation who a) agree in writing to protect the information as required under our policies, b) represent federal, state, or local government agencies that are authorized by law to oversee our program, or c) provide financial assistance to the program or provide payment for health care;
- The disclosure is allowed by a court order and that order includes a subpoena or other legal mandate requiring that we share your information. In particular, note that records, or testimony about your records, cannot be shared in any civil, administrative, criminal, or legislative proceedings against you unless there is specific written consent or a court order. If there is a court order, we must let you know and provide you will an opportunity to object.
In all other circumstances, we will ask for your consent to release your information outside of our program. Instances where we may share information with your consent:
- When you ask us in writing to share your information;
- When you consent to allow us to share information about you outside of our program for all future treatment, payment, and healthcare operations purposes. If you consent to our sharing your information, you can change your mind and ask us not to at any time by letting us know in writing. If you change your mind, we will stop any future sharing of your information but will be unable to retrieve any information that has already been released.
Your Rights as a Patient in the Program
As a patient in a CRHS SUD treatment program you have certain rights with regard to your information in addition to those rights described in our HIPAA Notice of Privacy Practices:
- You have a right to request restrictions of disclosures made with your prior consent for purposes of treatment, payment, and health care operations. We will review your request but are not required to agree unless the request relates to sharing information with your insurance provider and your care has already been paid by another source. If we agree to your request, we may still share your information where needed for emergency care or where required by law.
- You have a right to an accounting of disclosures of electronic records of your care by the treatment program to people outside our program for the past 3 years. In addition, if you provided consent to share your information for treatment through a health information exchange, care management organization, or other intermediary, you have a right to a list of disclosures by an intermediary for the past 3 years.
- You have a right to obtain a paper or electronic copy of this notice as well as our HIPAA Privacy Notice upon request. You may also find this notice at https://www.conwayregional.org/patients-visitors/patients/privacy-practices.
- You have a right to elect not to receive fundraising communications.
Our Commitment to You
We respect the need to maintain the confidentiality of your care. We are required to follow the terms of the notice currently in effect. If we make changes to how we manage your records, we will change our notice and provide you with a new notice at your next visit if you are still receiving care. If you are no longer receiving care in this program, you may request an updated copy or our notice or you may find the most recent notice in effect on our website.
If you have a concern or question about this notice or your privacy you may contact the Privacy Officer at 501 329 3831 or [email protected]. In addition, you have a right to file a complaint to the Secretary of the Department of Health and Human Services. For directions on how to contact the Secretary, please contact the Privacy Officer. You will not be retaliated against for filing a complaint.
For More Information
If you have any questions or would like further information about this Notice, please contact our Privacy Officer:
Privacy Officer
Conway Regional Health System
2302 College Avenue
Conway, AR 72034
501-450-2132