Notice of Privacy Practices for Grundy County Memorial Hospital, our clinics and other facilities, and our organized healthcare arrangement.

Introduction

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

We are required by federal law to maintain the privacy of your medical information and to give you our Notice of Privacy Practices (this “Notice”) that describes our privacy practices, our legal duties and your rights concerning your medical information. This Notice applies to Grundy County Memorial Hospital, our clinics and other facilities and our organized healthcare arrangement. This Notice applies to and will be followed by: (1) all employees, staff, volunteers and other personnel of the Facility, clinics and other facilities, and (2) the physicians and other practitioners who are not employed by the Facility, but who have privileges to treat patients at the Facility and who are members of the Facility’s organized healthcare arrangement (see description of the Facility’s organized healthcare arrangement, below).

How We May Use And Disclose Your Medical Information
Except where such use or disclosure is otherwise prohibited by state or federal law, the Facility is permitted or required to use or disclose your medical information without your authorization (permission) in the following situations. Some, but not all, specific examples of the different types of disclosures have been listed.

• Treatment. To provide you with medical treatment or services (e.g., provide information to doctors, nurses, technicians, students or other personnel who are involved in your care).
• Payment. To collect payment from you, an insurance company or a third party for the treatment and services you receive (e.g., submitting a claim to your insurance company).
• HealthCare Operations. For Facility healthcare operations (e.g., to evaluate our staff and internal processes). As part of the Facility’s healthcare operations, certain limited information may be used or disclosed to conduct fundraising activities on behalf of the Facility. You have the right to request that you not receive fundraising materials from the Facility.
• Appointments and HealthCare Services. To provide you with appointment reminders or to notify you of possible treatment alternatives or health-related benefits or services.
• Facility Directory. While you are an inpatient, your name, location in the Facility, general condition (e.g., fair, serious, etc.), and religious affiliation may be included in the Facility directory and released (except religious affiliation) to people who ask for you by name. This information and your religious affiliation may be given to a member of the clergy, even if they do not ask for you by name. You have the right to request that your name not be included in the directory.
• Friends and Family. To a friend or family member involved in your medical care or payment for your care. If you are available, such disclosures will be made only if we have obtained your permission, if you do not object to the disclosure after having the opportunity, or if it is reasonable for us, based on the circumstances, to assume you have no objection to such disclosure. If you are unavailable, incapacitated or in an emergency situation, the Facility may disclose limited information to these persons if the Facility determines disclosure is in your best interest.
• HealthCare Providers. To another healthcare provider involved in your treatment in order for that provider to treat you, bill for its services and conduct certain of its healthcare operations.
• Disaster Relief. To a public or private entity assisting in a disaster relief effort (e.g., to notify your family about your location, condition or death).
• Public Health Activities. To public health authorities for public health activities as permitted or required by law (e.g., to report births, deaths, child abuse and neglect, immunizations and communicable diseases).
• Abuse, Neglect and Domestic Violence. The Facility may notify the appropriate government authority if it believes you have been the victim of abuse, neglect or domestic violence. Unless such disclosure is required by law, the Facility will only make this disclosure if you agree or under other limited circumstances when such disclosure is authorized by law.
• Health Safety Risks. Under certain circumstances, when necessary to prevent a serious threat to your health and safety or to the health and safety of the public or another person.
• Organ Donations. To organ procurement or organ, eye or tissue transplantation organizations, or to organ donation banks to facilitate organ or tissue donation and transplantation.
• Military and National Security. If you are a member of the armed forces, as required by military command authorities. We may also release medical information about foreign military personnel to the appropriate foreign military authority. The Facility may also release your medical information to authorized federal officials for intelligence, counterintelligence, and other authorized national security activities.
• Worker’s Compensation. To persons (e.g., employers, insurance carriers, attorneys) in order to comply with workers’ compensation laws or other similar programs providing benefits for work-related injuries.
• Health Oversight Activities. To a health oversight agency for activities authorized by law to monitor the healthcare system, government programs and compliance with civil rights laws (e.g., fraud and abuse investigations, inspections and licensure, or disciplinary actions).
• Legal Proceedings. If you are involved in a lawsuit or dispute, in response to a court or administrative order. The Facility may also disclose medical information about you in response to a subpoena or other lawful process by someone else involved in the dispute, but only if the party seeking the information demonstrates that reasonable efforts have been made to notify you of the request or to obtain a protective order from the court.
• Law Enforcement. To law enforcement authorities for law enforcement purposes, such as (1) in response to a court order, subpoena, warrant, summons or similar process, (2) to identify or locate a suspect, fugitive, material witness or missing person, (3) if you are the victim of a crime, but only if your agreement is obtained or in response to a subpoena, (4) about a death which is believed to be the result of criminal conduct, (5) to report a crime that occurred on Facility premises, and (6) in emergency circumstances, to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime. The Facility must comply with federal and state laws in making such disclosures.
• Deceased Individuals. To a coroner or medical examiner as necessary to carry out their duties (e.g., to identify a deceased person or determine the cause of death), or to funeral directors as authorized by law.
• Correctional Institutions. To a correctional institution where you are an inmate or to a law enforcement official who has custody of you for certain limited purposes (e.g., to provide you with healthcare).
• Research. For research-related activities that meet all privacy law requirements. Limited Medical Information. Limited medical information to a third party for research purposes, public health activities and Facility healthcare operations. The party to whom we disclose the information is required to keep it confidential.
• Required by Law. When required to do so by federal, state or local law (e.g., to report child or dependent adult abuse and violent wounds).
• Incidental Disclosures. Occasional incidental, unintended disclosures of your medical information which might occur during a permitted use or disclosure (e.g., information overheard during a discussion regarding your care with you or a member of your family). We will take reasonable steps to avoid these types of disclosures.
• Business Associates. Some of the activities described above are performed through contracts with outside persons or organizations, such as legal services. It may be necessary for the Facility to provide some of your medical information to outside business associates who assist the Facility with these activities. The Facility requires that its business associates appropriately safeguard the privacy of your information.
• Organized HealthCare Arrangement. The Facility is a clinically integrated care setting where patients receive care from Facility personnel and from independent doctors and other practitioners who provide care to patients at the Facility (collectively called “practitioners”). The Facility and these practitioners need to share medical information freely to provide care to patients, and to conduct Facility healthcare operations. Therefore, the Facility and the practitioners have agreed to follow uniform information practices when using or disclosing medical information related to inpatient or outpatient hospital services. This arrangement is called an “organized healthcare arrangement” and only covers information practices for services rendered through the Facility. It does not cover the information practices of the practitioners in their offices or at other care settings. It does not alter the independent status of the Facility and the
  practitioners or make them jointly responsible for the clinical services provided by them. In other words, the Facility is not responsible for (1) the negligence (or mistakes) of the independent practitioners providing care at the Facility; or (2) any violations of your privacy rights by the independent practitioners.

Your Rights

• You and Your Authorization. The Facility must also disclose your medical information to you, as described later in this Notice. Uses and disclosures of medical information not covered by this Notice or the laws that apply to us will be made only with your written permission. If you give us permission to use or disclose medical information about you, you may revoke (take back) that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose medical information about you for the reasons set forth in your written authorization. We are unable to take back any disclosures we have already made with your permission.
• Access to Medical Information. You may request to inspect and copy much of the medical information we maintain about you, with some exceptions. This includes most medical and billing records, but does not include psychotherapy notes. We may charge a fee for the costs of copying, mailing, and other supplies associated with your request.
• Request for Restrictions. You have the right to request a restriction on how we use or disclose your medical information for treatment, payment, or healthcare operations, or to certain family members or friends identified by you who are involved in your care or the payment for your care. We are not required to agree to your request, but will notify you if we are unable to agree.
• Amendment. You may request that we amend certain portions of your medical information if you believe that it is incorrect or incomplete. We may require you to give a reason to support your request. We are not required to make all requested amendments, but we will give each request careful consideration. If we deny your request, we will provide you with a written explanation of the reasons and your rights.
• Accounting. You have the right to receive a list of certain disclosures of your medical information made by us or our business associates. You must state a time period for your request, which may not be longer than six years and may not include dates before April 14, 2003. The first list in any 12-month period will be provided to you for free; you may be charged a fee for each subsequent list you request within the same 12-month period.
• Confidential Communications. You have the right to request that we communicate with you about medical matters in a different manner or at a different place. We will agree to your request if it is reasonable, and you specify an alternative means or location to contact you.
• Paper Notice. You are entitled to receive a written copy of this Notice at any time.

How to Exercise These Rights
All requests to exercise these rights must be in writing. We will follow written policies to handle requests, and we will notify you of our decision or actions and your rights. Contact the clinic manager or our Privacy Officer at the contact information at the end of this Notice for more information or to obtain request forms.

Complaints
If you believe your privacy rights have been violated, you may file a complaint with the Facility using the contact information at the end of this Notice. You may also submit a complaint to the Secretary of the Department of Health and Human Services. All complaints must be submitted in writing. You will not be penalized or retaliated against for filing a complaint.

Questions
If you have questions about this Notice, please contact the clinic manager or our Privacy Officer at the contact information at the end of this Notice.

About This Notice
The Facility is required to abide by the terms of the Notice currently in effect. The Facility reserves the right to change the terms of this Notice and make the new Notice provisions effective for all of your medical information that it maintains, including that which it created or received while the prior Notice was in effect. If the Facility makes a material change to its privacy practices, it will amend its Notice. We will post a copy of the current Notice in the Facility. The Notice will state the effective date.

The Privacy Officer for Grundy County Memorial Hospital may be reached by mail or by telephone:
Privacy Officer
Grundy County Memorial Hospital
201 East J Avenue

Grundy Center, IA 50638

Call: (319) 824-5421

INTERNET PRIVACY

Collecting and Using Personal Information
Welcome to Grundy County Memorial Hospital’s website. We appreciate your interest in us! When you visit and navigate our sites and when you communicate with us via our website, we will not collect personal information about you unless you provide us that information voluntarily. If you provide personal information to us voluntarily via our website, we will not sell, license or transmit that information outside of Grundy County Memorial Hospital and affiliated vendors/contractors who are involved in administering or providing services for fufillment of your specific information requests (newsletters and e-health information). We will disclose information in compliance with applicable laws and regulations and will require recipients to protect the information and use it only for the purpose provided.

By “personal information,” we mean data that is unique to an individual, such as a name, address, social security number or telephone number. We may request personal information from you at our site in order to deliver requested materials to you, respond to your questions or deliver a product or service.

E-Mail and Asking Questions
First of all, it is important that you realize that any online health services and health information is not intended as a substitute for direct information from a trained medical professional, such as a physician, nurse or caregiver. You should always consult directly with a medical professional for diagnosis and treatment of any specific health problems or immediate health concerns. The information on our website is not medical advice!

We welcome your health-related comments or questions or general questions about our website and have provided e-mail contact opportunities for that purpose. We will share your comments and questions with our customer service personnel (often My Nurse nurses, sometimes other clinical staff members) and those employees most capable of addressing your questions and concerns.

Please note that your e-mail, like most, if not all, non-encrypted Internet e-mail communications, may be accessed and viewed by other Internet users, without your knowledge and permission, while in transit to us. For that reason, to protect your privacy, please do not use e-mail to communicate information to us that you consider confidential. If you wish, you may contact us instead via telephone at the numbers provided at various locations on our sites or call the main My Nurse telephone number (1-877-242-8899).

Where you provide information to us using the “Ask a question” form, you will be advised that you are entering a secure transaction area. The information is placed on a secure server and then retrieved by personnel at My Nurse, our 24-hour a day health information and physician referral service. This information transmission is safer than ordinary e-mail. For your reply, please indicate whether you wish us to respond to you by telephone or by your e-mail address to you (please note that such an e-mail reply is not delivered in a secure server environment, hence not private—see notes about regular e-mail, above).

Beyond answering your question, website management personnel will periodically review questions (without patient identifiers or e-mail addresses) to determine if additional information should be placed on the web site that would benefit other patients.

Healthcare Content on this Site
The health care information provided on or accessed from this site has been authored by Iowa Health System and the staff members and physicians of its affiliates, with the exception of the health care information that has been authored by and purchased from third party vendors including, but not limited to, A.D.A.M., HealthDay and HeartAware, who are responsible for security and quality of information licensed by them.  Iowa Health System provides health care information for general knowledge and education and this content is not intended as a replacement for advice from your personal physician or direct caregivers.

Information Security
We will use security procedures to protect personal information you submit to us from misuse or unauthorized disclosure. The personal information that you submit to us is stored in a secure database behind an electronic firewall. You can access your personal information only by using a password. We encourage you to change your password regularly and not to share it with anyone.

Access to the data is limited to a few computer technicians for our site who need to maintain the database and who also use passwords for that access, as well as outside vendors who may occasionally assist us in maintaining and improving our hardware and software tools.

Grundy County Memorial Hospital will make every effort to safeguard your personal information. However, like other Internet sites, we cannot guarantee that it is completely secure from people who might attempt to evade security measures or intercept transmissions over the Internet.

Other Information/"Cookies"
You should also be aware that when you visit our website, we collect certain information that does not identify you personally, but provides us with “usage data,” such as the number of visitors we receive or what pages are visited most often. This data helps us to analyze and improve the usefulness of the information we provide online. We do not collect information about your specific use on the site or track what you view.

We use IP addresses to collect aggregate information about numbers of visitors and site usage. An Internet Protocol (IP) address is a number that is automatically assigned to your computer by your Internet Service Provider (ISP) whenever you access the Internet. This number may be the same each time you access the Internet or it may change. The address is logged on our server when your computer requests information. However, to allow users to access our site anonymously, your IP address is not linked with personal information about you. (We reserve the right, however, to use IP addresses to identify any individuals who threaten our site, service or customers.)

As our website develops, we may also use what is known as “cookie” technology. A "cookie" is an element of data that a website can send to your browser when you link to that website. It is not a computer program and has no ability to read data residing on your computer or instruct it to perform any step or function. By assigning a unique data element to each visitor, the website is able to recognize repeat users, track usage patterns and better serve you when you return to that site. The cookie does not extract other personal information about you, such as your name or address. Most browsers provide a simple procedure that will enable you to control whether you want to receive cookies by notifying you when a website is about to deposit a cookie file.

Linking to Other Sites
From time to time our website may provide links to other websites, not owned or controlled by Grundy County Memorial Hospital that we think might be useful or of interest to you. We cannot, however, be responsible for the privacy practices used by other website owners or the content or accuracy of those other websites. Links to various outside websites do not constitute or imply endorsement by Grundy County Memorial Hospital of these websites, any products or services described on these sites, or of any other material contained in them.

Changes to This Statement 
Grundy County Memorial Hospital may change this statement from time to time without notice. We plan to post notice on our home page for no less than a week if any significant changes occur. This privacy statement is not intended to and does not create any contractual or other legal rights in or on behalf of any party.