OF HEALTH INFORMATION PRACTICES
Date: March 28, 2017
This notice describes how medical
information about you may be used and disclosed and how you can get access to
this information. Please review it
PURPOSE: This Notice of Health
Information Practices describes how we may use and disclose your Protected
Health Information (PHI) to carry out treatment, payment, or healthcare
operations and for other purposes permitted or required by law.
Health Information” is information that may identify you and that relates to
your past, present, or future physical or mental health, and may include your
name, address, phone numbers, and other identifying information. That information is accessible to Cherokee
Nation Health Services staff.
understand that medical information about you and your health is personal and
confidential, and we are committed to protecting the confidentiality of your PHI. We are required by law to protect your privacy
and the confidentiality of your PHI. Proper
safeguards are in place to discourage improper uses or access.
will be asked to sign an acknowledgement when you come to a Cherokee Nation
facility or program. Our purpose is to
make you aware of the possible uses and disclosures of your PHI and your
privacy rights. Cherokee Nation Health
Services will care for you even if you refuse to sign the acknowledgement. Even if you
sign the acknowledgement, we
WILL use and disclose PHI as outlined
in this notice.
permitted by law, we reserve the right to amend or modify our privacy policies
and practices. These changes in our
policies and practices may be required by changes in law or regulations. Upon request, we will provide you with the
most recently revised Notice at any time.
The revised policies and practices will be applied to all PHI we
Federal Privacy Laws
Notice is provided to you as a requirement of the Health Insurance Portability
and Accountability Act (HIPAA). There
are several other privacy laws which also apply. These laws have not been superseded and have
been taken into consideration in developing our policies and this Notice of how
we will use and disclose your PHI.
Understanding Your Health Record/Information
time you visit a Cherokee Nation Health Services facility, a record of your
visit is made. This record typically contains
your symptoms, examination and test results, diagnoses, treatment, and a plan
for future care or treatment. This
information is often referred to as your medical record or “chart” and includes
your billing information. Your medical
record or chart is systematically created and retained on a variety of media,
which may include computers, paper, and films.
If you are referred to another provider through Contract Health
Services, a record is also kept of those services.
Your medical record is used as a:
Basis for planning for
your care and treatment;
between health care professionals;
Tool with which we can
check results and continually work to improve the care we provide;
Means by which Medicare,
Medicaid, or private insurance payers can verify the services billed;
Tool for education of
health care professionals;
Source of information
for public health authorities charged with improving the health of the public;
Source of data for
Legal document that
describes the care you receive.
Understanding what is in
your medical record and how the information is used, helps you to:
ensure its accuracy,
better understand why others may review your health information, and make an
informed decision when authorizing disclosures.
Your Health Information Rights
information contained in your health record belongs to you. However, the actual
file itself and the paper or other medium it is written on, belong to Cherokee
Nation. You have the right to:
Obtain a paper copy of
this Notice of Information Practices;
Inspect and receive a
copy of your health record, except as prohibited by law. Some records such as physical abuse,
behavioral health, alcohol and substance abuse records may be exempt from
Request a restriction on
certain uses and disclosures of your information. For example, you may ask that we not disclose
information to a family member. We are
not required to agree to your request, but if we do agree, we will comply with
your request, but if we do agree, we will comply with your request unless the
information is needed to provide you with emergency services.
communications concerning your medical condition treatment. For example, you may ask that we send mail to
you at a different address than your home or by a different means such as a telephone;
Revoke your written
authorization to disclose PHI. This does not apply to information already
disclosed, or where we have acted in reliance on your authorization; or when an
insurer has a legal right to contest a claim you have filed;
Request a correction or
amendment to your medical record if you believe the information we have about
you is incomplete or incorrect;
Receive a listing of
certain disclosures we have made of your PHI.
This record of disclosures is maintained for six (6) years.
We are required by law
to maintain the confidentiality of your PHI and to provide you with this Notice
of Information Practices. We are also
required to abide by the policies and practices outlined in this notice.
If you request a restriction
to your medical records, we must notify you if we are unable to agree to the
We must accommodate
reasonable requests you may have to communicate health information by
alternative means or at alternative locations.
Cherokee Nation Health
Services will not use or disclose your PHI without your permission, except as
described in this Notice.
Cherokee Nation may use or disclose your PHI without
your authorization for the following purposes:
Treatment and Treatment
is recorded in your medical record and used to determine the course of
treatment for you. Your health care
provider will document his or her instructions to members of the healthcare
team for the purpose of evaluating your health, diagnosing medical conditions
and providing treatment. For example,
results of laboratory tests and procedures will be recorded for use by all
health professionals who treat you or who are consulted concerning your
treatment. The actions taken and
observations made by members of your healthcare team will be recorded in your
medical record so your provider will know how you are responding to
treatment. PHI may be provided to
pharmacists about other drugs you are taking to identify potential
you are referred or transferred to another health care provider, we may
disclose your PHI to that provider for treatment decisions. We may disclose your PHI to medical students
working within our facilities.
may be required to sign-in for services and your name may be called in the
waiting room or over the loudspeaker in order to let you know that the staff
member is ready to see you.
may contact you to provide information about treatment alternatives, management
of your medical condition, or other types of health-related benefits and
services that may be of interest to you.
For example, we may contact you about availability of a new treatment or
services for diabetes.
Payment. Your PHI may be used to seek payment from
Medicare, Medicaid, grant programs (such as the CDC Breast and Cervical Cancer
Detection Program and the Diabetes Program), private insurance or other sources
of coverage such as an automobile insurer.
The PHI on or accompanying the bill will include information that
identifies you, as well as your diagnosis, procedures, and supplies used for
your treatment. If you are referred to
another provider under the Contract Health program, we may disclose PHI to that
We are not required to obtain your permission to bill your
insurance company; Medicare, Medicaid or other persons or entities (such as
liability carriers) for your care.
file a lien against any settlement which may compensate you for injuries or
illnesses if we provided care to you for the injury or illness. If you receive a settlement for an accident
or illness, we may release information to the settling party to obtain
reimbursement for care we provided to you related to the injury or illness.
Health Care Operations
health information may be used as necessary to support the day-to-day
activities and management of Cherokee Nation Health Services such as budgeting
and financial reporting, evaluating your care and treatment outcomes and to
continually improve the quality and effectiveness of the services we provide.
may disclose your PHI to internal and external auditors, accreditation
surveyors, and tribal, state, and federal employees acting within the scope of
their official duties. We may use your
PHI to detect, prevent or prosecute fraud, waste and abuse. We may use your PHI to prevent an injury to
health care worker or to prevent a crime on Cherokee Nation property.
Appointment Reminders: We may use your PHI to
remind you of an appointment or to contact you if you need to return earlier
than scheduled. We may send you a
postcard or letter, or may leave a message on your home answering machine or
message phone, or in a message left with the person answering the telephone at
the number you have provided.
Business Associates: We provide some healthcare services and related
functions through the use of contracts with business associates. For example, we may have contracts for
outside lab services and medical transcription.
We may disclose PHI to business associates so they can perform their
jobs. We require our business associates
to protect and safeguard your PHI in accordance with all applicable laws.
Child and Elder
We may use or disclose
PHI to public health authority or other government authority authorized by law
to receive reports of child or elder abuse or neglect. This includes Indian Child Welfare, Oklahoma
Department of Human Services, and Adult Protective Services.
If you are an inmate of
a correctional institution or jail, we may disclose your PHI necessary for your
health and the health and safety of other individuals.
Examiners, Funeral Directors, Decedents.
We may use or disclose PHI to a coroner or
medical examiner for the purpose of identifying a deceased person, determining
a cause of death, or other duties as authorized by law. We may also disclose PHI to funeral directors
consistent with applicable law as necessary to carry out their duties. We may disclose PHI about decedents where
required under the Freedom of Information Act or otherwise required by law.
Directory. If you are admitted to an inpatient facility, we
may use or disclose your name, general condition, religious affiliation, and
location within our facility, for facility directory purposes, unless you
notify us that you object to the information being listed. We may provide your religious affiliation
only to members of the clergy.
Disaster. We may disclose PHI
about you to an entity assisting in a disaster relief effort so that your
family can be notified about your condition, status and location.
Family. Unless you notify us of your objection, we may
disclose to another person PHI
relevant to that person’s involvement in
your care or payment related to your care.
We may use or disclose PHI
to notify or assist in notifying a family member, personal representative, or
another person responsible for your care, your location and general condition.
Food and Drug
We may disclose your PHI
to the FDA in connection with any FDA-regulated produce or activity. For example, we may disclose to the FDA
information concerning adverse events to track FDA-regulated products to
conduct product recalls, replacements, look backs (including locating people
who have received products that have been recalled or withdrawn), or post
Foster Care. For children who are placed in foster care, we
may disclose PHI to the foster parents and the foster care agency.
We may use or disclose
PHI to health oversight agencies for investigations, audits, inspections, and
other actions necessary for the government to monitor the health care system,
government benefit programs, and entities subject to government regulatory
programs and/or civil rights law for which health information is necessary to
Homeland Security. We may disclose PHI as required by the Homeland
We may disclose immunization
information to schools and daycare.
Interpreters. If we use interpreters to facilitate your
care, this may require the use or disclosure of PHI to the interpreter.
Judicial Proceedings. We may disclose PHI in the course of
judiciary and administrative proceedings if required or authorized by law.
Law Enforcement. We may use or disclose PHI for law
enforcement activities as authorized by law or in response to a court competent
we believe you are a victim of a crime and
we are unable to obtain your authorization because of incapacity or other emergency circumstances, we may disclose
information to law enforcement if we determine such disclosure would be in your best interests.
We may disclose
PHI to report a crime committed on
our premises or when we are providing emergency health
care. When a healthcare worker is a victim
of a crime, we may disclose information to
law enforcement to assist in identifying
and locating the perpetrator. We may also report
circumstances pertaining to
victims of crime,
medical emergencies and death from
Lawsuits and Disputes. If you are involved in a lawsuit or a
dispute which puts your medical condition at issue, we may disclose PHI in
response to a court order, administrative order, or other lawful process.
Legal Guardians. Subject to the
limitations outlined below under the heading of "Minors," we may
disclose PHI to a legal guardian of any individual who is a minor, or a person
who has been declared incompetent due to physical or mental incapacity by a
court of competent jurisdiction.
Military. If you are a member of the military, we may
release PHI about you to the appropriate military command authorities.
Minors. Minors may access and
control the PHI of any services which they are eligible to consent to. This
includes family planning, alcohol and substance abuse treatment, and diagnosis
and treatment of sexually transmitted diseases.
National Security. We may release PHI to authorized federal
officials for national security activities authorized by law.
Notification. We may use or disclose PHI to notify or assist
in notification of a family member; personal representative or other authorized
person(s) responsible for your care, unless you notify us that you object.
Organ Procurement. We may
disclose PHI to organ procurement organizations or other entities engaged in
the procurement, banking, or transplantation of organs for the purpose of
tissue donation and transplant.
parents have exactly the same rights to PHI
concerning minor children.
Personal Representatives. We
may disclose PHI to the personal representative designated by you in writing.
For example, if an adult son or daughter accompanies you to appointments or
assists in your healthcare, you may want to designate them as a personal
representative to assure they will always be able to talk with your providers
and access your health care information. Designation as a Personal
Representative does NOT permit them to make health care decisions.
Protected Services for the President and Others. We may disclose PHI to authorized federal
officials so they may provide protection to the President and other authorized
persons or to conduct special investigations related to such protective
Public Health: We may disclose your health information to public
health agencies that are authorized to collect or receive such information for
the purpose of preventing or controlling disease, injury or disability, or
conducting public health surveillance, investigations and interventions.
may disclose information to researchers when their research has been approved
by an institutional review board (I.R.B.) that has reviewed the research
proposal and established protocols to ensure the privacy of your PHI.
Threat to Health or Safety: We may disclose PHI if
we believe that its use or disclosure is necessary to prevent or lessen a
serious and imminent threat to the health and safety of a person or the public.
are not in violation of this Notice or HIPAA if any of our employees or our
contractors disclose PHI to an authority authorized by law to investigate or
oversee our activities if the employee or contractor in good faith believe we
have engaged in conduct that is unlawful or otherwise violates clinical and
professional standards or that the care or services provided has the potential
of endangering one or more patients or members of the workforce or the public.
may disclose PHI to your employer concerning a work-related illness or injury
or workplace-related medical surveillance. We may disclose PHI to the extent
authorized by and to the extent necessary to comply with laws relating to
Disclosures Requiring Your Authorization
Disclosure of your PHI
for any purpose other than those listed above requires your specific written
authorization. If you change your mind after authorizing a use or disclosure of
your information, you may submit a written revocation of the authorization.
However, your decision to revoke the authorization will not affect or undo any
use or disclosure of information that occurred before you notified us of your
decision to revoke your authorization.
Requests to Inspect Protected Health Information
You may generally
inspect or receive a copy of the PHI that we maintain. We require that requests
to inspect or copy PHI be submitted in writing. You may obtain a form to
request access to your records by contacting the medical records department
where you received care. Your request will be reviewed and will generally be
approved unless there are legal or medical reasons to deny the request. We must
respond to your request within 30 days or notify you in writing why your
request cannot be granted.
Your Right to File a Complaint.
believe your privacy rights have been violated, please submit your complaint in
writing to the address listed below.
Cherokee Nation Health Services
Health Privacy Officer
may also file a complaint with the Clinic Administrator or Chief Executive
Officer of the facility where your record is kept, or with the Health Services Executive
Director. You will not be penalized or otherwise retaliated against for filing
file a complaint with the Secretary of the Department of Health and Human
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.