The Notice of Privacy Practices describes how we may use and disclose protected
health information (PHI) and how you can access this information. Please
review the notice carefully. If you have any questions, please call our
Privacy Officer at (319) 768-1960.
PHI is medical and demographic information that may identify you. It includes
past, present or future physical or mental-health conditions and related
health care services. Great River Health System and independent providers
of diagnostic-testing interpretation services may use and disclose your
PHI to carry out treatment, seek payment, conduct health care operations
and for other purposes permitted or required by law.
Great River Health System includes Burlington Area Family Practice Center,
Great River Klein Center, Great River Health System Center, Great River
Physicians and Clinics, Heritage Medical Equipment and Supplies, Heritage
Pharmacies, and Home Health and Hospice.
Our promise to you
We are committed to providing you with high-quality care and complying
with legal requirements. We understand your PHI is private, and we will
Who must follow this notice?
- Business associates, such as people and businesses that create, maintain,
receive or send your PHI to provide services to us
- Our employees, health care providers and volunteers
Law requires us to:
- Follow the terms of this notice
- Give you this notice with your PHI
- Keep confidential PHI that identifies you unless otherwise permitted or
required by law
- Notify you, according to regulations, if there has been a breach of your
PHI resulting in compromised information
We may change the terms of our notice anytime, and a new notice will go
into effect for the PHI we maintain. On request, we will provide you with
a revised printed notice. You also may request a copy by calling Health
Information Management at (319) 768-1900, or asking for one when you register
for your next appointment. In addition, we will post the notice on our website,
How we may use and disclose your PHI
The following describe ways we may use and disclose your PHI without your
written approval. We will ask for your approval for anything not listed.
For treatment. We will use your PHI to provide, coordinate and manage your medical treatment
or services. We may disclose information to providers, nurses and other
health care providers involved in your care, whether they are affiliated
with us or not.
Examples: You may need surgery, and the surgeon may need a medical provider’s
recent history and physical before performing the procedure. If you have
diabetes, the provider may need to tell a dietitian so appropriate meals
are ordered. Other hospital departments also may share your medical information
to coordinate your care. This information may include medicines and diagnostic
tests. In addition, we may share your PHI with a referral provider to
ensure the provider has the necessary information to continue care, diagnose
or treat you.
For payment. We will use and disclose relevant PHI so services you receive at our
facility can be billed to and payment may be collected from you, an insurance
company or a third party. We also may use information for case-management
Example: We may tell your health-insurance plan about a scheduled procedure
or test to have it pre-certified and decide whether your plan will cover
the treatment or hospital stay.
For health care operations. We may use and disclose your PHI to operate Great River Health System
and ensure patients receive high-quality care.
Example: We may use medical or mental-health treatment information to review
our treatment and services and to evaluate the performance of our staff.
We also may disclose your PHI to physicians, nurses, medical students,
and other Great River Health System employees or consultants for review
and learning purposes.
To the extent permitted by law, we may disclose your PHI to another health
care entity for use in some health care operations if that entity and
Great River Health System have a relation to you, the information is about
this relation, the disclosure is for a quality-related health care activity
and for fraud detection.
For appointment reminders. Unless you tell us otherwise in writing, we may use or disclose your PHI,
as necessary, to remind you of an appointment.
For the hospital directory. Unless you object, we may include limited information about you in the
hospital directory while you are an inpatient. This information may include
your name and location in the hospital. We release directory information
only to people who ask for you by name, which shows they already know
you are a patient. We may disclose directory information to a member of
the clergy if you do not object. In addition, if you do not object, we
may disclose one-word descriptions of you condition: undetermined, good,
fair, serious or critical.
For treatment alternatives and health-related benefits and services. We may use or disclose your PHI, as necessary, to provide you with information
about treatment alternatives or other health-related benefits and services
that may interest you.
Example: We may send you a newsletter about services we offer. If you do
not want this information, call the Privacy Officer to have your name
removed from the mailing list.
To people involved in your care or payment for your care. We may release medical and mental PHI to a family member involved in your
medical care if such information concerns this person’s involvement.
We will only provide this information if you agree, are given the opportunity
to object and do not or if, in our professional judgment, it would be
in your best interest to allow the person to receive the information or
act on your behalf.
Example: We may give PHI, including prescription and appointment information,
to a friend or family member involved in your care. We also may give such
information to someone who pays for your care. In addition, we may disclose
PHI to a disaster-relief entity so they can tell your family about your
condition, status and location.
As required by law. We will disclose PHI when required by law without your consent or approval,
such as information to report child or dependent-adult abuse.
To avert a serious threat to health or safety. We may disclose PHI to prevent a serious threat to your health and safety
or the health and safety of the public or someone else. But any disclosure
would be only to someone who can help prevent the threat.
To business associates. We identify and enter into agreements with business associates who provide
services to us that may use minimally necessary PHI. We may disclose your
PHI to such business associates without your consent. Business associates
must maintain and comply with privacy laws and keep your PHI confidential.
Examples of business associates are accounting firms hired to audit billing
and payment information, and software vendors who help us maintain and
For research. We sometimes participate in research studies with entities such as drug
companies. We will disclose your PHI as permitted by law. In appropriate
cases, we will seek your approval to use and disclose such information.
We may disclose your information to researchers when a special committee
has approved their research and established protocols to ensure the privacy
of your PHI.
Military and veterans. If you are a member of the armed forces, we may release PHI as required
by military command authorities. We also may release PHI about foreign
military employees to the appropriate foreign military authority.
Workers’ compensation. We may release PHI for workers’ compensation or similar programs
without consent. These programs provide benefits for work-related injuries
or illnesses. For example, if you are injured on the job, we may release
applicable information to your employer or its workers’ compensation insurer.
Public-health activities. We may disclose PHI for public-health activities without your consent.
These activities include:
- Notifying someone who may have been exposed to a disease or may be at risk
of contracting or spreading a disease or condition
- Notifying the appropriate government authority if we believe a patient
has been the victim of abuse, neglect or domestic violence
- Preventing or controlling disease, injury or disability
- Reporting products regulated by the Food and Drug Administration to carry
out functions, such as collecting data about the safety of a product and
notifying people about recalls of products they may be using
- Reporting reactions to medicines or problems with products
Health oversight activities. We may disclose PHI to a health oversight agency, such as the Department
of Health and Human Services, for activities allowed by law. These oversight
activities include audits, investigations, inspections and licensing procedures.
These activities are necessary for the government to monitor the health
care system, government programs and compliance with civil rights laws.
Health information exchange (HIE). We may make your PHI available electronically through an electronic HIE.
An HIE transmits electronic health records or other clinical or public
health information between its participants. As an HIE participant, we
may provide your PHI to other health care providers and health plans that
request your information for their treatment, payment and health care
operations. Participation in an HIE also permits us to access their information
about you for our treatment, payment and health care operations.
Lawsuits and administrative proceedings. If you are involved in a lawsuit or dispute, we may disclose PHI for
a court or administrative order. We also may disclose PHI for a subpoena,
discovery request or other lawful process by someone involved in the dispute.
Any disclosure of mental PHI, drug treatment, or HIV or AIDS-related information
must comply with applicable laws. In addition, we may disclose PHI to
the opposing party in any lawsuit or administrative proceeding –
including mental-health, drug treatment, or HIV or AIDS-related information
– in which your physical or mental condition is at issue after you
have signed an approval to release the information.
Similarly, we may disclose PHI in proceedings in which you are not a party,
but only if we tried to tell you or your attorney about the request or
receive an order protecting the information requested.
Law enforcement. If asked by law enforcement, we may release PHI, excluding mental PHI, to:
- Identify or locate a suspect, fugitive, material witness or missing person
- Investigate a death we believe may be because of criminal conduct
- Investigate criminal conduct at Great River Health System
- Learn more about the victim of a crime if, under limited circumstances,
we cannot get the person’s agreement
- Report a crime in emergency circumstances. This information can include
the location of the crime or victims, and the identity, description or
location of the person who committed the crime.
- Respond to a court order, subpoena, warrant, summons or similar process
Coroners, medical examiners and undertakers. We may release PHI, including mental PHI, to a coroner or medical examiner
to, for example, identify a deceased person or verify the cause of death.
National-security and intelligence activities. We may release PHI to federal officials for intelligence, counterintelligence
and other national-security activities allowed by law.
Protective services for the president and others. We may disclose PHI to federal officials so they may provide protection
to the president, other dignitaries or foreign heads of state, and to
conduct special investigations.
Inmates. If you are an inmate of a correctional institution or under law-enforcement
custody, we may release PHI to the correctional institution or law enforcement.
This release would be necessary:
- For the institution to provide you with health care
- For the security of the correctional institution
- To protect your health and safety, or the health and safety of others
Uses and disclosures with your written approval
We can make some uses and disclosures of your PHI only with your written
approval, unless law otherwise permits or requires it (described in the
next section). You may revoke this approval in writing anytime, unless
the health system relies on the disclosure shown in the approval.
Examples of uses and disclosures we may only make with your written approval are:
AIDS- or HIV-related information, mental-health or substance-abuse treatment
only with written approval as required by law or regulation unless the law
permits or limits otherwise
- Marketing purposes. We will tell you if we will receive payment from a
third party for marketing.
only with an approval signed by you or your legal representatives, following
applicable law or regulation
We may contact you to raise funds, but you may opt out of receiving such
communications by calling Marketing and Public Relations at (319) 768-3300.
We will promptly honor your request unless we have already sent a communication
to you. If you provide approval for the disclosure of your PHI, you may
revoke it anytime by giving us notice according to our approval policy.
Your revocation will not be effective for uses and disclosures made in
reliance on your approval.
Your PHI rights
You have the following rights about the PHI we maintain:
Right to inspect and request a copy. You have the right to inspect and request a copy of your PHI to use in
making care decisions. We keep this PHI in a designated record that usually
includes medical and billing records, but does not include psychotherapy notes.
If we maintain the information electronically and you ask for an electronic
copy, we will provide the information to you in the format you requested,
assuming it is readily producible. If we cannot readily produce the record
in the format you request, we will produce it in another readable electronic
form we agree to.
If you request a copy of the information, we may charge a fee for the costs
of copying, mailing and other supplies associated with your request. We
will limit the cost of providing an electronic copy of information from
your electronic medical record to labor and supplies. If you want to inspect
your records, we may charge an inspection fee that reflects staff time
in pulling the records and participating in the inspection.
We may deny your request to inspect or receive a copy in limited circumstances.
If we deny your access to PHI, you may choose another licensed health
care professional to review your request and the denial. The person conducting
the review will not be the person who denied your request. We will comply
with the outcome of the review.
Right to request amendment. If you think PHI we have is incorrect or incomplete, you may ask us to
change the information. You have the right to request an amendment for
as long as we keep the information in a designated record set.
To request an amendment, you must contact Health Information Management.
We will mail a Health Information Request for Amendment form to you. You
must complete this form and return it to the Privacy Officer. You must
provide a reason that supports your request.
We may deny your request for an amendment if it is not in writing or does
not include a reason to support the request. In addition, we may deny
your request if you ask us to change information that:
- Is accurate and complete
- Is not part of the information you can inspect and copy
- Is not part of the PHI we keep
- Was not created by us, unless the person or entity that created the information
is no longer available to make that amendment
Right to an accounting of disclosures. You have the right to request a list of the disclosures our business
associates or we have made about your PHI. An accounting from paper records
will not include disclosures for treatment, payment and health care operations.
An accounting from your electronic medical record will include disclosures
for treatment, payment and health care operations for three years before
The first accounting of disclosures you request in a 12-month period will
be free. For additional lists, we may charge you for the costs of providing
the list. We will tell you the cost involved and you may choose to withdraw
or modify your request before you incur costs.
Right to request restrictions. You have the right to request a restriction on the PHI we use or disclose
for treatment, payment or health care operations. You also have the right
to request a limit on the PHI we disclose to someone involved in your
care or in the payment for your care, like a family member or friend.
For example, you may request your spouse or child involved in your care
not receive some information about your condition.
We are not required to agree to your request, unless the disclosure is
to a health plan or other payer to carry out payment or health care operations,
and you have paid for the services in full. If we agree to other restriction
requests, we will comply unless we need the information to provide you
with emergency treatment.
To request restrictions, you may call Health Information Management at
(319) 768-1900, and request a form or send a written request that includes:
- To whom you want the limits to apply (for example, disclosures to your spouse)
- What information you want limited
- Whether you want to limit routine access, use or disclosures for treatment,
payment or operations
You may send requests to Health Information Management Department, Great
River Health System, 1221 S. Gear Ave., West Burlington, IA 52655.
Right to request confidential communications. You have the right to request how and where we communicate with you about
medical matters. For example, you can ask we only contact you at work
or by mail.
To request confidential communications, you must make your request in writing
to Health Information Management Department, Great River Health System,
1221 S. Gear Ave., West Burlington, IA 52655. We will not ask the reason
for your request. We will accommodate reasonable requests. Your request
must specify how or where you want us to contact you.
Right to request a copy of this notice. You have the right to request a paper copy of this notice. This notice is also
available for download.
If you think we have violated your privacy, please call the health system’s
Privacy Officer at (319) 768-1931, or contact the U.S. Secretary of Health
and Human Services. We will not retaliate for filing a complaint.