Notice of privacy practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Initial effective date: 4/2003; revised 7/2024.

Cass Regional Medical Center (“Cass Regional” or “we”) respects your privacy and is committed to protecting it. This notice explains how we use and disclose medical information about you, your health information rights, our responsibilities, how to file a complaint, and who to contact for more information. This Notice of Privacy Practices (this “Notice”) is provided to you no later than the date of your first visit to Cass Regional or any clinic location operated by Cass Regional. By using any services within Cass Regional or its clinics, you agree to accept the terms of this notice.

Our Pledge Regarding Health Information

We are committed to protecting health information we collect in order to provide services to you. Your personal information is captured for a record to the reflect care and services provided to you at Cass Regional’s hospital and/or clinics. Any health information that may identify you as a patient of Cass Regional, such as your past, present, or future health conditions, and/or the health care services provided to you, is kept secure. We strive to protect patient confidentiality at all times.

Protected health information (“PHI”) is any information in your medical record that is created, used, or disclosed in the course of providing health care services to you. We are required by law to maintain the privacy of your PHI, provide you with a description of our legal duties and privacy practices regarding PHI, and notify you following a breach of unsecured PHI. We must abide by the terms of this Notice.

How We May Use and Disclose Health Information About You

PHI may be used and disclosed for treatment, payment, and operations, as described below.

For Treatment

PHI may be used and disclosed for coordinating your treatment across different departments within Cass Regional and/or its clinic locations. For example, we might disclose information about your overall health condition to physicians who are treating you for a specific injury or condition. PHI may also be used and disclosed when you are referred to another health care provider outside of Cass Regional.

For Payment

We may use and disclose PHI to bill and collect payment from you, your insurance company, and/or a third-party payer. For example, we share your PHI with your health insurance plan so it will pay for the services you receive. Related activities may include but are not limited to:

Eligibility or coverage determination.
Risk adjustments.
Review of planned health care services to determine medical necessity, coverage, and justification of charges.
Utilization review.

For Health Care Operations

PHI may be used and disclosed for certain administrative, financial, legal, and quality improvement activities necessary to run our organization and to support the core functions of treatment and payment. These activities may include but are not limited to:

Quality assessment and improvement programs.
Competence, evaluation, training, accreditation, certification, licensing, or credentialing activities.
Underwriting related to the creation, renewal, or replacement of a health insurance contract or health benefits.
Conducting medical review, legal, and auditing services, including fraud and abuse detection and compliance programs.
Business planning and development, cost-management, and analyses related to managing and operating our organization.

We may also use and disclose PHI to contact you for:

Appointment reminders.
Treatment alternatives.
Health-related benefits and services.

Business Associates

We may use and disclose your PHI to outside persons or entities that perform services on our behalf, such as auditing, legal, or transcription services (“Business Associates”). The law requires these Business Associates to protect your PHI in the same way we do. Additionally, we have a contract called a Business Associate Agreement (“BAA”) in place with each of these outside businesses. The BAAs require our Business Associates to protect the information we share with them and to provide you with access to your information and a list of any of your PHI that they disclose.

Other Uses and Disclosures

We may share your information in other ways, usually for public health or research purposes or to contribute to the public good. For more information on permitted uses and disclosures, see www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html.

Special Circumstances That May Require the Release of Your PHI Without Written Authorization

Research: We may release non-identifiable PHI for certain research purposes when approved by an institutional review board with established rules to ensure privacy, and where the disclosure involves minimal privacy risks.
Required by Law: We may discuss PHI when required to do so by federal, state or local law. For example, we will share your PHI if the Department of Health and Human Services requires it when investigating our compliance with privacy laws.
Averting Serious Threat to Health or Safety: We may use and disclose PHI when necessary to prevent a serious threat to your health and safety, or the health and safety of the public or another person.
Organ and Tissue Donation: If you are an organ donor, we may release PHI, as necessary, to organizations that handle organ procurement or organ, eye or tissue transplantation, or to an organ donation bank to facilitate organ or tissue donation and transplantation.
Workers’ Compensation: We may release PHI for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illnesses.
Health Oversight Agencies: We may disclose PHI to a health oversight agency for activities authorized by law. These may include audits, investigations, inspections and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil right laws.
Lawsuits and Disputes: We may disclose PHI in response to a court or administrative order. We may also disclose PHI in response to a subpoena, discovery request, warrant, summons, or other lawful process.
Law Enforcement: We may disclose PHI to law enforcement officials:
To identify or locate a suspect, fugitive, material witness or missing person.
To report a death that we believe may be the result of criminal conduct.
To report criminal conduct at Cass Regional and/or its clinics.
In emergency circumstances to report a crime, the location of the crime and victims, or the identity, description or location of the people who committed the crime.
Other Government Requests: We may use and disclose your PHI for specialized government functions, such as military and veterans’ activities, national security and intelligence, presidential protective services, or medical suitability.
Coroners, Medical Examiners and Funeral Directors: We may disclose PHI to a coroner or medical examiner when an individual dies. This may be necessary to identify a deceased person or determine the cause of death. We may also release PHI to funeral directors as necessary for them to carry out their duties.
Inmates: We may release the PHI of an inmate to a correctional institution or law enforcement official. The release of PHI would be necessary for the institution to provide health care, and to protect the inmate’s health and safety, the health and safety of others, and the safety and security of the correctional institution.
Disaster Relief: We may disclose PHI to entities assisting with disaster relief so that your family can be notified about your condition and location. However, you do have the right and the choice to preemptively tell us that you do not want your information shared in a disaster relief circumstance.
Public Health Activities: We may disclose PHI for public health activities, such as:
To prevent or control disease, injury or disability.
To report births, injuries, and deaths.
To report child abuse or neglect.
To report reactions to medications or problems with products.
To notify people of recalls of product they may be using.
To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.
To notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence.

Individuals Involved in Your Care or Payment for Your Care

You have the right to tell us if you do not want us to share information such as your PHI, general condition, or location with your family, friends, or others involved in your care. If you are not able to tell us your preference, for example if you need emergency care or are unconscious, we may share your information with a friend or family member who is involved in your medical care if we believe it is in your best interest, according to our best judgment. We may also share your information with a friend or family member who is involved in your medical care when needed to lessen a serious and imminent threat to health or safety.

Employers

We may release PHI to your employer(s) with a signed consent from you.

Fundraising Activities

We may disclose PHI to Cass Regional Medical Center Foundation so that the foundation may contact you in an effort to raise funds for facilities, equipment, and programs that benefit Cass Regional’s patients. If you do not want the foundation to contact you for fundraising efforts, you must notify Cass Regional in writing to opt out.

Hospital Directory

We may include certain limited information about you in the directory while you are a patient at Cass Regional. This information may include:

Your name.
Your location in the facility.
A general statement of your condition (such as fair, stable, etc.).
Your religious affiliation.

This information, except for your religious affiliation, may be released to people who ask for you by name. Your religious information may be given to a member of the clergy. If you wish to be omitted from the directory, you must inform us and sign an “Opt Out” request.

Disclosures Requiring Your Written Permission

In these cases, we will not share your information unless you give us your written permission to do so:

Most sharing of a mental health care professional’s notes (e.g., psychotherapy notes);
Marketing purposes;
Other uses and disclosures not described in this notice.

If you have given your written permission for us to share your information for any of the foregoing purposes, you may revoke that permission at any time, but it will not affect information that we have already used and disclosed.

Your Rights Regarding Your PHI

Although your health record is the physical property of the health care provider or facility that compiled it, you have the following rights with regard to your PHI:

Inspect and Copy

You have the right to inspect and obtain a copy of your PHI. This may include medical and billing records, but does not include psychotherapy notes.

To inspect and obtain a copy of your PHI, you must submit your request in writing to Cass Regional’s Health Information Management Department or the applicable clinic manager. If you request a copy of the information, we may charge a fee for the costs of copying, mailing, or other supplies associated with your request.

We may deny your request to inspect and obtain a copy in certain very limited circumstances. If you are denied access to your PHI, we will provide a written denial with the basis for our decision. You may request that the denial be reviewed. Another licensed health care professional chosen by Cass Regional will review your request and the denial. The person conducting the review will not be the person who denied the request. We will comply with the outcome of the review. To request a review, contact Cass Regional’s privacy officer at (816) 887-0365.

Amend

You have the right to request a correction or update to the PHI that is entered in your medical records. Medical records that have been signed by the health care provider are considered legal documents, and the information they contain cannot be deleted or removed. If you feel that information contained your medical record is incorrect, you may request an amendment to the information. To request an amendment, please contact Cass Regional’s Health Information Management Department. You will need to complete the “Request for correction/amendment” form and provide reasons to support your request. A review will be completed and you will receive a written response within 60 days.

We may deny your request to amend information that:

Wasn’t created by us, unless the person or entity that created the information is no longer available to make an amendment.
Is not part of the medical information kept by or for Cass Regional or its clinics.
Is not part of the information that you would be permitted to inspect and copy.
Is accurate and complete.

An Accounting of Disclosures

You have the right to request an accounting of disclosures of your PHI. The “accounting” is a list of certain disclosures we made of PHI for purposes other than disclosures for treatment, payment, health care operations, disclosures where an authorization was not required, and certain other disclosures, such as any you asked us to make.

Request Restrictions

You have the right to request a restriction or limitation on the PHI we use or disclose about you for treatment, payment or health care operations. If we agree to your request, we will comply with the requested restriction or limitation unless the information is needed to provide you emergency treatment. If your PHI is disclosed to a health care provider for your emergency treatment, we will request that such health care provider not further use or disclose the information. You also have the right to request that we not disclose information about you to someone who is involved in your care or the payment for your care, such as a family member or friend.

We are not required to agree to your request. However, we will agree not to disclose information to a health plan for purposes of payment or health care operations if (i) the requested restriction concerns a health care item or service for which you or another person, other than the health plan, paid in full out-of-pocket; (ii) you request that we not disclose PHI related solely to those health care items or services; and (iii) the disclosure is not otherwise required by law.

To request restrictions, you must make your request in writing to Cass Regional’s privacy officer at the contact information described below.

Request Confidential Communications

You have the right to request that we communicate with you about health matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail.

To request confidential communications, you must make your request in writing to Cass Regional’s Health Information Management Department or the applicable clinic manager. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted. We reserve the right to contact you by other means and at other locations if you fail to respond to any communication from us that requires a response.

A Paper Copy of This Notice

You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice.

Changes to This Notice

We reserve the right to change this notice, and the revised notice will be effective for PHI we already have, as well as information we receive in the future. Any changes will become effective when the revised notice is posted. The revised notice will also be available on request at Cass Regional and its clinics. Your use of our services following these changes means you accept the revised privacy practices. We recommend that you review this notice each visit to stay informed of our privacy practices.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with Cass Regional, its clinic(s), or with the Secretary of the Department of Health and Human Services. To file a complaint with Cass Regional, contact the privacy officer at (816) 887-0365. To file a complaint with one of Cass Regional’s clinics, contact the applicable clinic manager. All complaints must be submitted in writing. You will not be penalized or subject to retaliation by us for filing a complaint.

Other Uses of Health Information

Other uses and disclosures of PHI not covered by this notice or the laws that apply to us will be made only with your written permission. If you provide us permission to use or disclose health information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose health information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your authorization, and that we are required to retain our records of the care that we provided to you.

If you have any questions about this Notice of Privacy Practices, please contact our privacy officer at (816) 887-0365.