HIPAA Policy

STANFORD HEALTH CARE

STANFORD MEDICINE CHILDREN’S HEALTH

NOTICE OF PRIVACY PRACTICES

Effective Date: July 26, 2022

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

OUR PLEDGE TO PROTECT YOUR PRIVACY

Stanford Health Care and Stanford Medicine Children’s Health (the “Hospital” for purposes of this Notice) is committed to protecting the privacy of health information we create or receive about you. Health information that identifies you (“protected health information,” or “health information”) includes your medical record and other information relating to your care or payment for care.

We are required by law to:

• Make sure that your health information is kept private (with certain exceptions);
• Give you this Notice of our legal duties and privacy practices with respect to health information about
  you; and
• Follow the terms of the Notice currently in effect.

WHO WILL FOLLOW THIS NOTICE

The following parties share the Hospital’s commitment to protect your privacy and will comply with this Notice:

• Any health care professional authorized to update or create health information about you.
• All departments and units of the Hospital, including our outpatient clinics.
• All employees, volunteers, trainees, students, and medical staff members of the Hospital.
• All affiliated entities, sites and locations.

HOW WE MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU

The following sections describe different ways that we use and disclose your health information:

FOR TREATMENT

We may use health information to provide you with medical treatment or services. We may use and share health information about you with physicians, residents, nurses, technicians, medical students, or other Hospital personnel involved in your care. For example, a provider treating you for a condition may need to know what medications you are taking to assess risks related to drug interactions. Different departments of the Hospital may also share health information about you to coordinate the services you need, such as pharmacy, lab work and x-rays.

We may also disclose your health information to providers not affiliated with the Hospital to facilitate care or treatment they provide you. For example, we may disclose your health information to your personal physician for care coordination purposes. In addition, we may provide access to your health information to affiliated entities and locations, such as affiliated provider groups for care coordination purposes.

Electronic exchange of health information helps ensure better care and coordination of care. The Hospital participates in health information exchange(s) that allow outside providers who need information to treat you to access your health information through a secure health information exchange.

FOR PAYMENT

We may use and disclose your health information to bill and receive payment for health care services that we or others provide to you. This includes uses and disclosures to submit health information and receive payment from your health insurer, HMO, or other party that pays for some or all of your health care (payor) or to verify that your payor will pay for your health care. We may also tell your payor about a treatment you are going to receive to determine whether your payor will cover the treatment. For certain services, if your permission is needed to release health information to obtain payment, you will be asked for permission.

FOR HEALTH CARE OPERATIONS

We may use and disclose health information for health care operations. This includes functions necessary to run the Hospital or assure that all patients receive quality care, and includes many support functions such as appointment or procedure scheduling. We may also share your information with affiliated health care providers so that they may jointly perform certain business operations along with the Hospital. We may combine health information about many of our patients to decide, for example, what additional services the Hospital should offer, what services are not
needed, and whether certain new treatments are effective. We may share information with doctors, residents, nurses, technicians, medical students, clerks and other personnel for quality assurance and educational purposes. We may also compare the health information we have with information from other hospitals to see where we can improve the care and services we offer.

BUSINESS ASSOCIATES

The Hospital contracts with outside entities that perform business services for us, such as billing companies, management consultants, quality assurance reviewers, accountants or attorneys. In certain circumstances, we may need to share your health information with a business associate so it can perform a service on our behalf. We will have a written contract in place with the business associate requiring protection of the privacy and security of your health information.

APPOINTMENT REMINDERS AND OTHER COMMUNICATION

We may use and disclose health information to contact you as a reminder that you have an appointment for care at the Hospital. We will communicate with you using the information (such as telephone number and email address) that you provide. Unless you notify us to the contrary, we may use the contact information you provide to communicate general information about your care such as appointment location, department, date and time.

TREATMENT ALTERNATIVES

We may use and disclose health information to tell you about or recommend possible treatment options or alternatives that may be of interest to you.

HEALTH-RELATED BENEFITS AND SERVICES

We may use and disclose health information to tell you about health-related benefits or services that may be of interest to you.

HOSPITAL DIRECTORY AND RELIGIOUS AFFILIATION

We may include your name and your location (but not specific health information) in the Hospital’s Patient Directory while you are receiving inpatient care. We make this information available so that individuals can contact or visit you. Unless you specifically request that your information be excluded from the Patient Directory, we may release this directory information to people who ask for you by name. We may also provide information about your religious affiliation to members of the clergy employed in our Spiritual Care Services Office, unless you specifically request that we not do so.

INDIVIDUALS INVOLVED IN YOUR CARE

We may release health information about you to a family member or friend who is involved in your medical care. We may also give information to someone who helps pay for your care. Unless there is a specific written request made to and agreed to by the hospital privacy office from you, we may also notify a family member, personal representative or another person responsible for your care about your location and general condition. This does not apply to patients receiving treatment for certain conditions, such as substance/alcohol abuse. In addition, we may disclose health information about you to an organization assisting in a disaster relief effort (such as the Red Cross) so that your family can be notified about your condition, status and location.

FUNDRAISING ACTIVITIES

Consistent with applicable state and federal laws, we may provide limited information such as your contact information, provider name and dates of care to the Lucile Packard Foundation for Children’s Health or the Stanford University Office of Medical Development to conduct fundraising activities for the advancement of care and research on behalf of the Medical Center.

RESEARCH

As part of an academic medical center, the Hospital has an active research program. For example, research is ongoing to advance care, to evaluate investigational procedures to treat conditions, to compare the health of patients who have received one medication with those who have received another medication for the same condition, and to learn from medical record studies. We generally ask for your written authorization before using your health information or sharing it with others to conduct research. Under limited circumstances, we may use and disclose your health information without your authorization. In most of these latter situations, we must comply with law and obtain approval through an independent review process to ensure that research conducted without your authorization poses minimal risk to your privacy. Researchers may also contact you to see if you are interested in or eligible to participate in a study.

TO PREVENT A SERIOUS THREAT TO HEALTH OR SAFETY

We may use and disclose certain information about you when necessary to prevent a serious threat to your health and safety or the health and safety of others. However, any such disclosure will only be to someone able to prevent or respond to the threat, such as law enforcement, or a potential victim. For example, we may need to disclose information to law enforcement when a patient reveals participation in a violent crime.

SPECIAL SITUATIONS THAT DO NOT REQUIRE YOUR AUTHORIZATION

WORKERS’ COMPENSATION

We may release health information about you for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.

PUBLIC HEALTH ACTIVITIES

We may disclose health information about you for public health activities. These activities include, but are not limited to the following:

• To prevent or control disease, injury or disability;
• To report births and deaths;
• To report the abuse or neglect of children, elders and dependent adults;
• To report reactions to medications or problems with products;
• To notify you of the recall of products you may be using;
• To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
• To notify the appropriate government authority if we believe you have been the victim of abuse, neglect or domestic violence; we will only make this disclosure when required or authorized by law;
• To report all inpatient admissions, emergency department visits and same-day surgeries to California’s Office of Statewide Health Planning and Development; and
• To notify appropriate state registries, such as the Northern California Cancer Center or the California Emergency Medical Services Authority, when you seek treatment at the Hospital for certain diseases or conditions.

HEALTH OVERSIGHT ACTIVITIES

We may disclose health information to a health oversight agency, such as the California Department of Public Health or the Center for Medicare and Medicaid Services, for activities authorized by law. These oversight activities include audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

LAWSUITS AND DISPUTES

If you are involved in a lawsuit or a dispute, we may disclose health information about you in response to a court or administrative order. We may also disclose health information about you in response to a subpoena, legally enforceable discovery request, or other lawful process by someone else involved in the dispute.

LAW ENFORCEMENT

We may release health information at the request of law enforcement officials in limited circumstances, for example:

• In response to a court order, subpoena, warrant, summons or similar process;
• To identify or locate a suspect, fugitive, material witness, or missing person;
• About the victim of a crime if, under certain limited circumstances, the victim is unable to consent;
• About a death we believe may be the result of criminal conduct;
• About criminal conduct at the Hospital; and
• In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.

CORONERS, MEDICAL EXAMINERS AND FUNERAL DIRECTORS

We may release health information to a coroner or medical examiner. This may be necessary to identify a deceased person or determine the cause of death. We may also release health information about patients of the Hospital to funeral directors as necessary to carry out their duties with respect to the deceased.

ORGAN AND TISSUE DONATION

We may release health information to organizations that handle organ, eye, or tissue procurement or transplantation, as necessary to facilitate organ or tissue donation. The procurement or transplantation organization needs your authorization for any actual donations.

MILITARY AND VETERANS

If you are a member of the armed forces, we may release health information about you as required by military command authorities. We may also release health information about foreign military personnel to the appropriate foreign military authority.

NATIONAL SECURITY AND INTELLIGENCE ACTIVITIES

Upon receipt of a request, we may release health information to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law. We will only provide this information after the Privacy Officer has validated the request and reviewed and approved our response.

INMATES

If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release health information about you to the relevant correctional institution or law enforcement official. This release may be necessary for the institution to provide you with health care; to protect your health and safety or the health and safety of others; or for the safety and security of the correctional institution.

OTHER USES OR DISCLOSURES REQUIRED BY LAW

We may also use or disclose health information about you when required to do so by federal, state or local laws not specifically mentioned in this Notice. For example, we may disclose health information as part of a lawful request in a government investigation.

SITUATIONS THAT REQUIRE YOUR AUTHORIZATION

For uses and disclosures not generally described above, we must obtain your authorization. For example, the following uses and disclosures will be made only with your authorization:

• Uses and disclosures for marketing purposes;
• Uses and disclosures that constitute the sale of PHI;
• Most uses and disclosures of psychotherapy notes; and
• Other uses and disclosures not described in this Notice

If you provide us authorization to use or disclose health information about you, you may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose health information about you for the activities covered by the authorization, except if we have already acted in reliance on your permission. We are unable to take back any disclosures we have already made with your authorization, and we are required to retain records of health information.

YOUR RIGHTS REGARDING HEALTH INFORMATION ABOUT YOU

You have the following rights regarding health information we maintain about you:

RIGHT TO INSPECT AND COPY

You have the right to inspect and obtain a paper or electronic copy of health information that may be used to make decisions about your care. Usually, this includes medical and billing records, but may not include some mental health information. We reserve the right to charge a fee to cover the cost of providing your health information records to you.

RIGHT TO AMEND

If you believe that health information the Hospital has on file about you is incorrect or incomplete, you may ask us to amend the health information. To request an amendment you must file an appropriate written request with the Health Information Management Services (HIMS) Department. In addition, you must provide a reason that supports your request. The Hospital can only amend information that we created or that was created on our behalf. If your health information is accurate and complete, or if the information was not created by the Hospital, we may deny your request to amend. If we deny your request, we will reply to you in writing with our reasons for doing so.

Even if we deny your request to amend, you have the right to submit a written addendum to the Health Information Management Services (HIMS) Department. Addendums may not exceed 250 words for each item or statement in your record you believe is incomplete or incorrect.

RIGHT TO AN ACCOUNTING OF DISCLOSURES

You have the right to request an “accounting of disclosures” which is a list describing how we have shared your health information with outside parties. This accounting is a list of the disclosures we made of your health information for purposes other than treatment, payment, health care operations, and certain other purposes consistent with law. You may request an accounting of disclosures for up to six years before the date of your request. If you request an accounting more than once during a twelve month period, we will charge you a reasonable fee.

RIGHT TO REQUEST RESTRICTIONS

You have the right to request restrictions on certain uses or disclosures of your health information. For example, you may request that your name not appear in the Hospital’s Patient Directory while you are here as an inpatient. Requests for restrictions must be in writing. In most cases, we are not required to agree to your requested restriction. However, if we do agree, we will comply with your request unless the information is needed to provide you emergency treatment or comply with the law. If we do not agree to your request, we will reply to you in writing with the reason. We are legally required to accept certain requests not to disclose health information to your health plan for payment or health care operations purposes as long as you have paid out- of-pocket and in full in advance of the particular service included in your request. If the service or item is part of a set of related services, and you wish to restrict disclosures for the set of services, then you must pay in full for the related services. It is important to make the request and pay before receiving the care so that we can work to fully accommodate your request. We will comply with your request unless otherwise required by law.

RIGHT TO REQUEST CONFIDENTIAL COMMUNICATIONS

You have the right to request that we communicate with you about your health information or medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work, rather than at your home. We will not ask you the reason for your request. We will work to accommodate all reasonable requests. Your request must be in writing and specify how and where you wish to be contacted.

RIGHT TO OPT-OUT OF FUNDRAISING COMMUNICATIONS

As part of fundraising activities, the Lucile Packard Foundation for Children’s Health or the Stanford University Office of Medical Development may contact you to make you aware of giving opportunities for the Medical Center. You have the right to opt-out of receiving fundraising communications. Fundraising communications will include information about how you can opt out from receiving future fundraising communications if you wish.

RIGHT TO BE NOTIFIED OF A BREACH

The Hospital is committed to safeguarding your health information and proactively works to prevent health information breaches from occurring. If a breach of unsecured health information occurs, we will notify you in accordance with applicable state and federal laws.

RIGHT TO A COPY OF THIS NOTICE

You have the right to a copy of this Notice. It is available in registration areas and by clicking the link “Patient Privacy” on the bottom of our internet home page.

REQUEST FOR COPY OF HEALTH INFORMATION

To obtain more information about how to request a copy of your health information, receive an accounting of disclosures, amend or add an addendum to your health information, please contact:

Stanford Medicine Children’s Health

In Person Location:
Health Information Management Services
750 Welch Road, Suite 214, MC5901
Palo Alto, CA 94304
Phone: 650-497-8334

Mailing Address:
Health Information Management Services,
Stanford Children’s Health
4700 Bohannon Drive, MC5900
Menlo Park, CA 94025

Stanford Health Care
In Person Location and Mailing Address:
Health Information Management Services
450 Broadway, PAV-C, Room C14, MC5200
Redwood City, CA 94063
Phone: 650-723-5721 Fax: 650-725-9821

COMPLAINTS

If you believe your privacy rights have been violated, you may file a written complaint with our Hospital Privacy Office via email at PrivacyOfficer@stanfordhealthcare.org, by telephone at 650-724-2572, or by mail at Privacy Office, 300 Pasteur Drive MC 5780 Stanford, CA 94305.

You may also file a written complaint with the Director, Office for Civil Rights of the U.S. Department of Health and Human Services. Upon request, our Privacy Office will provide you with the current address for the Director. We will not retaliate against you for filing a complaint with us or the Director.

CHANGES TO THIS NOTICE

We reserve the right to change our privacy practices and update this Notice accordingly. We reserve the right to make the revised or changed Notice effective for health information we already have about you as well as any information we receive in the future. We post copies of the current Notice in the Hospital and on our Internet sites and copies are available at registration areas. If the Notice is significantly changed, we will post the new Notice in our registration areas and provide it to you upon request. The Notice contains the effective date on the first page, in the top right-hand corner.

QUESTIONS ABOUT OUR PRIVACY PRACTICES

The Hospital values the privacy of your health information as an important part of the care we provide to you. If you have questions about this Notice or the Hospital’s privacy practices, please contact the Hospital Privacy Office by telephone at 650-724-2572, by email at PrivacyOfficer@stanfordhealthcare.org, or by mail at Privacy Office, 300 Pasteur Drive MC 5780 Stanford, CA 94305.