Notice of Health Information Privacy Practices
Summary Notice of Privacy Practices Effective April 14, 2003, Revised March 4, 2015
Your Health Information
Each time you visit a hospital or go to the doctor or other health care provider, your health information is recorded. This is called your medical record. It may be kept in a computer or paper folder with your name on it. The policy of each of our member organizations is to keep your health information safe.
Privacy and Your Health Information
By law, your health information is private. Each of the hospitals and other organizations listed at the end of this brochure must give you this Notice of Privacy Practices. This Notice tells you how your health information may be used and who can see your medical record. This first page is only a summary. The remaining pages provide you with more details.
Your Rights and Your Health Information
Under federal law, you have the right to:
Sharing Your Health Information
Each of the hospitals and other organizations listed at the end of this brochure may need to share your health information for the following reasons:
Special Privacy Protection
There are some medical records that have special protection. Your written permission to share these types of medical records will be sought before they are shared with others. Special protection may include records about your:
For additional information, please refer to the contents of this Notice of Health Information Privacy Practices.
Your Health Information – 2
Your Rights Regarding Your
Health Information – 2
Our Responsibilities Regarding
Your Health Information – 3
How We May Use and Disclose
Health Information about You – 3
For Treatment – 3
For Payment – 4
For Health Care Operations – 4
For Appointment Reminders,
Treatment Alternatives, and Health
Related Beneﬁts and Services – 4
To Individuals Involved in Your
Care or Payment for Your Care – 5
In Hospital Directories – 5
To Avert a Serious Threat
to Health or Safety – 5
To Address Public Health Risks – 5
For Health Oversight – 6
To Law Enforcement – 6
As Required By Law – 6
In Lawsuits and Disputes – 6
For National Security and
Intelligence Activities – 6
For Protective Services for
the President and Others – 6
For Research – 7
For Organ and Tissue Donation – 7
To Medical Examiners
and Funeral Directors – 7
For Fundraising and
Marketing Communications – 7
Military and Veterans – 7
Workers’ Compensation – 7
Other Uses and Disclosures
Electronic Health Records – 7
Maine HealthInfoNet (HIN) – 9
Your Authorization – 8
More Details Regarding Your Rights
and Your Health Information
Right to Inspect and Copy
Your Health Record – 8
Right to Request Changes
In Your Health Record – 9
Right to Authorize Other Uses and
Disclosures of Your Health Record – 9
Rights Concerning Your Electronic
Access to Health Information
(MyChart Patient Portal) – 10
Right to Request Restrictions on
Disclosure of Your Health Record – 10
Right to Request Special
Arrangements in the Manner in
Which Your Health Information is Communicated to You – 10
Right to an Accounting of
Disclosures of Your Health Record – 11
Rights Related to Mental Health
Treatment Records – 11
Rights Related to HIV
Testing Information – 11
Rights Related to Alcohol and
Drug Abuse Treatment Records – 11
Complaint Process and Notification – 12
Future Changes to Privacy Practices – 12
Questions – 12
MaineHealth Member Organizations – 13
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
If you have been given this brochure, it is likely because one or more of the hospitals or other health care organizations listed at the end of this brochure may be providing you with health care. This brochure describes the practices and procedures followed by your health care provider in maintaining your health information. When this brochure uses the term “we,” it is referring to the organization listed at the end of this brochure that is providing your health care.
Your Health Information
Each time you visit a hospital, doctor, or other health care provider, information about your visit is recorded in a chart. We refer to this collection of recorded entries as your health record or medical record. Your health record may include such things as your symptoms, test results, diagnoses, treatment, and a plan for care. In this brochure, we describe your rights with respect to your health record that is in our custody, the uses we may make of your health record information, and the circumstances under which your health information may be disclosed to other persons or entities.
Your Rights Regarding Your Health Information
Under federal law, you have the right to:
There are some exceptions and additional qualifications to these rights. Please see the section of this Notice entitled “More Details Regarding Your Rights and Your Health Information” for additional information.
Please direct any requests for information regarding your health information to the health information office or the privacy officer at the hospital, clinic or physician office where you receive health care services. Note: If you are receiving mental health services, see Page 11 under Rights Related to Mental Health Records.
Our Responsibilities Regarding Your Health Information
We are required by the Federal health information privacy regulations to:
We will use or disclose your health information only as described in this Notice, unless we have your prior authorization for an additional use or disclosure, or until this Notice is revised. We reserve the right to change our health information practices and the terms of this Notice of Privacy Practices. Should our health information practices change, we will post a revised Notice of Privacy Practices on the internet at http://www.mainehealth.org and make available the revised Notice at the locations listed on the last page of this Notice.
How We May Use and Disclose Health Information about You
Listed below are the ways that we use and disclose health information. For each use or disclosure we explain what we mean and give some examples. Not every use or disclosure is indicated by the examples, but all of the ways we can use and disclose information will fall within one of these categories.
We will use and disclose your protected health information to provide, coordinate and manage your health care and related services. This may include consulting with other health care providers for both planned and unplanned transitions of care within and outside the States of Maine and New Hampshire. For example:
We may use and disclose your health information to obtain payment for our services or to assist other providers in obtaining payment for their services. For example, we may need to give your health plan information about the health care services that you received, so your health plan will pay us or reimburse you for that care. We may disclose your health information to your health plan if you need prior authorization for a treatment in order for it to be covered by the plan, or to find out if the treatment will be covered by the plan.
For Health Care Operations
We may use and disclose health information about you for the purpose of advancing health care quality, which can include such activities as evaluating treatment outcomes, developing clinical guidelines and protocols, population-based health improvement initiatives, healthcare cost-reducing activities, case management and care coordination, peer review and student training conducted by our member organizations or related providers’ practice. For example:
For Appointment Reminders, Treatment Alternatives, and Health Related Benefits and Services
We may use your health information to contact you or those involved in your care to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you.
To Individuals Involved in Your Care or Payment for Your Care
We may disclose health information about you to a friend or family member who is involved in your care. We may also give information to a person who helps pay for your care. When in the hospital, we may also tell your family and friends your condition and that you are currently receiving care. We may disclose health information about you to an agency assisting in a disaster relief effort so that your family can be notified about your condition, status, and location. Please let a staff person or your doctor know if you would not like us to disclose information to a family member or friend.
In Hospital Directories
We may include certain information about you in the hospital directory while you are a patient at one of the hospitals listed in this Notice. This information may include your name, location in the hospital, your general condition (e.g. fair, critical, etc.). The directory information may also be disclosed to people who ask for you by name. This information is disclosed to allow your family, friends and clergy to visit you and know, in a general way, how you are doing. In some instances, we may respond to inquiries from members of the media who ask about your condition if your hospitalization is the result of an accident or other event of public interest. You may choose not to be listed in the hospital directory, but that would mean that you may not be able to receive visitors, telephone calls, flowers and/or mail. Unless you direct us not to do so, we may also provide a member of the clergy, such as a priest or rabbi, with information about your presence in a health care facility, including room number, place of residence and religious affiliation.
To Avert a Serious Threat to Health or Safety
We may use and disclose health information about you when needed to prevent a threat to your health and safety or the health and safety of the public or another person. Any disclosure would only be to someone able to help prevent or reduce the threat.
To Address Public Health Risks
We may disclose health information about you for public health reasons. These include the following:
For Health Oversight
We may disclose health information to a health oversight agency for actions required by law. Actions may include, for example, audits, investigations, inspections, and licensure. These actions are needed for the government to monitor the healthcare system, programs, and compliance with civil rights laws
To Law Enforcement
We may disclose health information for law enforcement purposes under the following circumstances:
As Required By Law
We will disclose health information about you when required to do so by federal, state, or local law.
In Lawsuits and Disputes
If you are involved in a lawsuit or dispute, we may disclose health information about you in response to a court order or as required by law.
For National Security and Intelligence Activities
We may disclose health information about you to federal officials for the conduct of lawful intelligence, counter intelligence, or any other national security activity authorized by law.
For Protective Services for the President and Others
We may disclose health information about you to federal officials so they may protect the President, other persons authorized by statute, or foreign heads of state, or for the conduct of special investigations authorized by statute.
All patient research is subject to a special review process required by law that reviews protections for patients involved in research. We may use and disclose health information about you for research purposes, subject to the confidentiality requirements of state and federal law. Information that may identify patients will not be disclosed for research purposes without written permission from the patient or the patient’s authorized representative.
For Organ and Tissue Donation
As required by Federal law, we may disclose health information to agencies that procure organs, eyes or tissues for transplantation or donation.
To Medical Examiners and Funeral Directors
We may disclose health information to a medical examiner. This may be required, for example, to identify a deceased person or decide the cause of death. We may also disclose health information about patients to funeral directors, consistent with applicable law, as needed to carry out their duties.
For Fundraising Communications
We may use certain demographic information (name, address, other contact information, date of service, date of birth, age and gender) to contact you in the future regarding charitable fund-raising to expand and improve the services and programs that we provide to the community. We may also use the dates your health care was provided and the department where you received service, the treating physician, outcome information, and health Insurance status. This Notice of Health Information Privacy Practices serves as notification of your option not to receive fundraising communications.
If you do not wish to be contacted for our fundraising efforts, you must notify the entity providing your care and we will honor your request. See the last page of this Notice for contact information.
For Marketing Communications
From time to time, we may communicate with you about matters relating to treatment, alternative therapies, health care providers, settings of care, care management and care coordination. We may also communicate with you about health-related products or services, health insurance coverage for our services, and our participation in health insurance plans. Otherwise, we will obtain your written authorization prior to using your protected health information for marketing of our products and services. We will not sell your protected health information without first obtaining your written authorization. Any such authorization will state that we will receive remuneration in the transaction.
Military and Veterans
If you are a member of the armed forces, we may disclose health information about you as required by the military. We may also disclose health information about foreign military staff to the appropriate foreign military agency.
We may disclose health information about you for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.
Other Uses and Disclosures
Electronic Health Records
Your health information may be recorded in an electronic medical record known as a shared electronic health record maintained for MaineHealth member hospitals, and for physicians and other health care providers associated with these hospitals. The shared electronic health record will provide a single record reflecting your care by many different health care providers, and will be accessible by MaineHealth member organizations and associated physician and other health care provider practices or other providers who require access to this information. The shared electronic health record is intended to allow your caregivers quickly to obtain more comprehensive information about your care history and treatment. Your health information also may include a facial image of you which will be used for patient identification purposes within the MaineHealth system.
Sensitive Health Information
If you have been tested, diagnosed or treated for HIV, received genetic testing or counseling, are participating in a federally-assisted alcohol or drug abuse diagnosis or treatment program, or if you are receiving mental health treatment, then you understand that MaineHealth member hospitals usually will obtain your specific consent on a separate written authorization form to disclose this information within and outside of the shared electronic health record. This information, however, still will be available to authorized users as deemed necessary within the shared electronic health record in the problem list, medications, diagnosis and allergy fields and among the member hospital’s professional staff for the purposes of your diagnosis or treatment and to complete their professional care responsibilities. Additionally, references to this sensitive health information in the problem list, medications, diagnosis and allergy fields of the shared electronic health record also may appear in continuity of care documents sent to other healthcare providers for planned and unplanned transitions of care both within and outside the States of Maine and New Hampshire.
Health Information Exchanges:
As part of your care and treatment, we may share patient health information through a health Information exchange to other health care providers involved in your care.
Maine HealthInfoNet (HIN)
We send patient health care information to a state-sponsored electronic health information exchange known as Maine HealthInfoNet (HIN). Many other health care providers also send patient health care information to HIN. HIN allows other health care providers that participate in HIN, including providers not affiliated with a MaineHealth member organization, to access patient health care information from multiple sources when treating patients, and for quality and payment reform initiatives. We do not control the health information security and privacy policies and practices of HIN, the data submitted by other health care providers to HIN, or the manner in which your health information is linked and released to other providers. As part of your care and treatment and participation in the MaineHealth shared electronic record, we may also share patient health information through the New Hampshire Health Information Organization (NHHIO), the state-sponsored electronic health information exchange in New Hampshire.
New Hampshire Health Information Organization (NHHIO)
The New Hampshire Health Information Organization (NHHIO) is a New Hampshire non-profit organization that has been authorized to operate a New Hampshire statewide electronic health information network to share patient health information between health care providers in a timely, secure and confidential manner. You may request that we not share your name and address and/or your health information through the NHHIO. As part of your care and treatment and participation in the MaineHealth shared electronic record, we may also share patient health information through Maine HealthInfoNet (HIN), the state-sponsored electronic health information exchange in Maine.
Opting Out of Health Information Exchanges
Opting Out of HIN:
If you do not want your information sent to HIN, you must fill out a form that lets HIN know that you do not want to participate. You can obtain this form from the Maine hospital, clinic or physician office where you received treatment. If you choose not to participate, HIN will delete all health information about you that it has in its system at that time, but maintain basic demographic information about you so that it can honor your choice not to participate. You can also change your mind about participating in HIN’s system at any time by filling out a form that your health care provider will make available, calling HIN toll free (#866-592-4352) or by going to the website www.hinfonet.org and making your wishes known.
Opting Out of NHHIO:
If you do not want your information sent to NHHIO, you must fill out a form that lets NHHIO know that you do not want to participate. You can obtain this form from the New Hampshire hospital, clinic or physician office where you received treatment.
We may make other uses and make other disclosures of health information for purposes and in a manner not covered by this Notice if you provide us with written authorization to do so. Please see the section entitled “Right to Authorize Other Uses and Disclosures of Your Health Record.”
More Details Regarding Your Rights and Your Health Information
Right to Inspect and Copy Your Health Record
You have the right to inspect and copy health information that may be used to make decisions about your care. This includes health and billing records. To inspect and copy health information, you must submit your request in writing to the health information department or manager at the hospital, clinic, physician office, or home health agency where you receive treatment. If you request a copy of the information, we may charge a fee for the costs of copying, mailing, or other supplies needed to respond to your request.
In rare circumstances specified by federal and state laws, we may deny your request to inspect and copy your health information. In most such circumstances, we will allow you to designate in writing another person to inspect and copy your medical record. You may also request that the denial be reviewed and the person that we select to review the decision will be different from the person who denied your initial request. We will comply with the decision of the reviewing person.
Right to Request Changes in Your Health Record
If you believe that information in your health record is incorrect or incomplete, you may ask us to change (amend) the information. You have the right to request a change for as long as the information is kept by or for the treating organization, physician practice, or home health agency. Your request to change your health record must be made in writing, and must provide a reason that supports your request. Your request should be sent to the health information department or manager at the hospital, clinic or physician office where you receive treatment.
If you request a change to your treatment record, we will include your written changes as part of the medical record. We may add a response to the record, and will provide you a copy of our response.
We may deny your request for a change if you ask us to amend information that:
If you request a change to a non-treatment record, we may deny your request if it is not in writing or does not include a reason to support the request.
Right to Authorize Other Uses and Disclosures of Your Health Record
You have the right to authorize or direct us to make other uses and disclosures of health information not covered by this Notice, by providing us with written authorization to do so. If you allow us to use or disclose health information about you, you may revoke that authorization at any time except to the extent that action has already taken place on your authorization. In that case, we will no longer use or disclose health information about you for the reasons covered by your written authorization. You understand that we are unable to cancel any disclosures of health information we have already made with your consent, and that we are required to retain our records of the care that we provided to you. Your authorization is required for most disclosures of psychotherapy notes, uses and disclosures of patient information for marketing purposes, and disclosures that constitute a sale of patient information. Other uses and disclosures not described in this Notice will be made only with your authorization.
You may request and be provided an electronic copy of your health record if it is maintained electronically and is readily producible. If not readily producible, the information will be provided to you in a readable electronic format.
Rights Concerning Your Electronic Access to Health Information
You may choose to authorize others to access your medical record directly through a Patient Portal where available. A Patient Portal is an internet-based method for a patient to access certain health information electronically. As an adult you may authorize members of your family or others who may care for you to have proxy access to your medical record through the Patient Portal. Parents also can have proxy access to their child’s Patient Portal record. In Maine, parent proxy access may continue until the child reaches the age of 18, according to applicable laws. In New Hampshire, parent proxy access may continue until the child reaches age 12, according to applicable laws.
If you determine that you no longer want to share your medical information with others via proxy access, you can revoke proxy access independently through the Patient Portal or by contacting the Patient Portal customer service department specified on the Patient Portal site.
Right to Request Restrictions on Disclosure of Your Health Record
You have the right to request a limit on the health information we use or disclose about you for treatment, payment, or health care operations.
To request restrictions, we ask that you make your request in writing to the Privacy Officer at the hospital, clinic, physician office, or home health agency where you receive health care services. In your request, you must tell us: (1) what information you want to limit; (2) whether you want to limit our use, disclosures, or both; and (3) to whom you want the limits to apply, for example, disclosures to your spouse.
We are not generally required by law to agree to your request. If we do agree, we will comply with your request to the extent of the agreement, and subject to any limitations that may be imposed unless the information is needed to provide you with emergency treatment or is required to be disclosed by law.
We are required to agree to your request to not provide your insurance carrier with your health information if you have paid in full for the health care services.
Right to Request Special Arrangements in the Manner in Which Your Health Information is Communicated to You
You have the right to request that we communicate with you about medical matters in a certain way or in a certain location. For example, you can ask that we only contact you at work or by mail.
To request that communications be made by confidential means, we ask you to make your request in writing to the Privacy Officer at the hospital, clinic, physician office, or home health agency where you receive health care services. We will not ask you the reason for your request. We will support all reasonable requests. Your request must specify how or where you wish to be contacted.
Right to an Accounting of Disclosures of Your Health Record
You have the right to request an accounting of disclosures. This is a list of disclosures of your health record information that we made for reasons other than treatment, payment, or health care operations, and which were not authorized by you.
To request this list or accounting of disclosures, you must submit your request in writing to the Health Information Management Director or Privacy Officer at the hospital, clinic, physician office, or home health agency where you receive health care services. Your request must state a time period, which may not be longer that six (6) years, and may not include dates before April 14, 2003. The first list you request within a 12-month period will be free. For additional lists, we may charge you for the cost of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
Rights Related to Mental Health Treatment Records
For some purposes, mental health treatment information has a higher level of protection than other types of health information. If you are receiving services at our mental health treatment facilities, we will not disclose information about your mental health treatment to your family, friends or to other non-treating healthcare providers, unless we have your written permission to do so, or unless there is an emergency or disclosure of such information is permitted by law. Additionally, we will obtain your written permission before disclosing mental health information for purposes of inclusion in the facility’s patient directory or for fundraising or marketing. We will not disclose psychotherapy notes without your written authorization except in very limited circumstances as permitted by law. Psychotherapy notes are those created for the therapist’s own use and maintained separately from the medical record. Mental health treatment information will be included in your continuity of care documents that are sent to other healthcare providers for planned and unplanned transitions of care both within and outside the State of Maine. We may send you a survey, asking for feedback on the care provided. For more information about your rights, please ask a staff member or request a copy of Rights of Recipients of Mental Health Services or Rights of Recipients of Mental Health Services Who Are Children in Need of Treatment.
Rights Related to HIV Testing Information
In most circumstances, we may ask for written permission before sharing any information relating to a patient’s HIV testing or status. If you have any such information in your health record, we may ask you to identify each physician to whom you would like us to disclose this information.
Rights Related to Alcohol and Drug Abuse Treatment Records
Federal law protects the confidentiality of patient records maintained in connection with any federally assisted alcohol and drug abuse treatment program. If you are receiving alcohol or drug abuse treatment services in a federally assisted program from us, we will not disclose such information to other persons, including non-treating health care providers , or disclose any information identifying you as part of a federally assisted alcohol or drug treatment program, unless you authorize the disclosure in writing, or the disclosure is allowed by a court order, or the disclosure is made to the organization or physician practice staff involved in a medical emergency or to qualified personnel for research, audit, or program evaluation purposes. Federal law regulates the disclosure of patient records maintained in connection with any federally assisted alcohol and drug abuse treatment program. Violation of such law can be a crime, and suspected violations may be reported to appropriate authorities in accordance with Federal regulations.
Rights Related to Genetic Information
In most cases we will ask for written permission before sharing any information relating to a patient’s genetic testing. If you have any such information in your health record, we may ask you to identify each physician to whom you would like us to disclose this information.
Complaint Process and Notification
If you believe your privacy rights have been violated, you may file a complaint with the Privacy Officer at the hospital, clinic, physician office, or home health agency where you receive health care services. We ask that you make your complaint in writing. There will be no action taken against you for filing a complaint. Alternatively, you may file a complaint with the Secretary of the Department of Health and Human Services.
If a MaineHealth member organization identifies that your protected health information has a high probability of having been compromised, then you will be notified.
Future Changes to Privacy Practices
The effective date of this Notice is indicated at the bottom of the cover page. We reserve the right to change our health information practices and the terms of this Notice of Privacy Practices. We may make the revised or changed Notice effective for health information we already have about you as well as any information we receive in the future. If we change our health information privacy practices described in this Notice, we will post a revised Notice of Privacy Practices on the internet at http://www.mainehealth.org and make available the revised Notice at the locations listed on the last page of this Notice. In addition, each time you register at or are admitted to a MaineHealth member organization for treatment or health care services as an inpatient or outpatient, you may request a copy of the current Notice in effect.
If you have any questions about this Notice, please speak to the person who gave it to you or contact the Privacy Officer at the hospital, clinic or physician office where you receive treatment as listed on the next page. Contact information is also provided on the last page of this Notice.
MaineHealth Member Organizations
Franklin Memorial Hospital
111 Franklin Health Commons
Farmington, ME 04938
HomeHealth Visiting Nurses
15 Industrial Park Road
Saco, ME 04072
Lincoln County Healthcare
35 Miles Street
Damariscotta, ME 04543
Maine Medical Center
Information Services Department
22 Bramhall Street
Portland, ME 04101
Maine Behavioral Healthcare
78 Atlantic Place
South Portland, ME 04106
3073 White Mountain Highway
North Conway, NH 03860
301A U.S. Route 1
Scarborough, ME 04074
(800) 773-5814 (toll free)
Pen Bay Health Care
c/o Health Information Department
6 Glen Cove Drive
Rockport, ME 04856
Southern Maine Health Care
One Medical Center Drive
P.O. Box 626
Biddeford, ME 04005-0626
Waldo County Healthcare
P.O. Box 287
118 Northport Avenue
Belfast, ME 04915
Western Maine Health
c/o Medical Records
181 Main Street
Norway, ME 04268
These providers include the organizations that are members of the MaineHealth family of health care providers. This list, and related contact information, may be updated from time to time and is available for viewing at http://www.mainehealth.org
Effective April 14, 2003, Revised August 15, 2013, March 4, 2015