Notice of Privacy Practices

This Notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Effective Date: November 1, 2018

Original Date: April 4, 2003 
Revised: March 12, 2007 
Revised: November 1, 2010
Revised: September 1, 2013
Revised: November 1, 2018

NORMAN REGIONAL HEALTH SYSTEM (NRHS) and all of its affiliated entities (collectively referred to as "NRHS") are committed to protecting your medical information. We are required by law to:

• Maintain the privacy of your medical information;
• Give you a notice of our legal duties and privacy practices with respect to your medical information; and
• Follow the terms of the notice currently in effect.

What is this document?

This Notice of Privacy Practices describes how we may use and disclose your medical information. It also describes your rights to access and control your medical information.

What does this Notice cover?

This Notice of Privacy Practices applies to all of your medical information used to make decisions about your care that we generate or maintain, including sensitive information such as mental health, communicable disease and drug and alcohol abuse information. It applies to your medical information in written and electronic form. Different privacy practices may apply to your medical information that is created or kept by other people or entities.

Who does this Notice cover?

This Notice of Privacy Practices will be followed by aII NRHS employees; any health care professional who provides treatment to you at NRHS; and any member of a volunteer group that provides services at NRHS.

What will you do with my medical information?

The following categories describe the ways that we may use and disclose your medical information without obtaining your prior written authorization. Not every use or disclosure in a category will be listed.

If you are concerned about a possible use or disclosure of any part of your medical information, you may request a restriction. Your right to request a restriction is described in the section below regarding patient rights.

Treatment. We will use your medical information to provide you with medical treatment and services.

We maintain medical information about our patients in an electronic medical record that allows us to share medical information for treatment purposes. This facilitates access to medical information by other health care providers who provide care to you.

Example: Your medical information may be disclosed to doctors, nurses, technicians, students or other personnel who are involved in taking care of you.

We may disclose your medical information for the treatment activities of any other health care providers.

Example: We may send a copy of your medical record to a physician who needs to provide follow-up care.

Payment. We may use medical information about you for our payment activities. Common payment activities include, but are not limited to:

• Determining eligibility or coverage under a plan; and
• Billing and collection activities.

Example: Your medical information may be released to an insurance company to obtain payment for services.

We may disclose medical information about you to another health care provider or covered entity for its payment activities.

Example. We may send your health plan coverage information to an outside laboratory that needs the information to bill for tests that it provided to you.

Operations. We may use your medical information for operational or administrative purposes. These uses are necessary to run our business and to make sure patients receive quality care. Common operation activities include, but are not limited to:

• Conducting quality assessment and improvement activities; 
• Reviewing the competence of health care professionals; 
• Arranging for legal or auditing services; 
• Business planning and development; 
• Business management and administrative activities; and 
• Communicating with patients about our services.

Examples: (1) We may use your medical information to conduct internal audits to verify that billing is being conducted properly. (2) We may use your medical information to contact you for the purposes of conducting patient satisfaction surveys or to follow-up on the services we provided.

We may disclose medical information about you to another health care provider or covered entity for its operation activities under certain circumstances.

Health Information Exchange. We may participate in a health information exchange (HIE). Generally, an HIE is an organization in which providers exchange patient information in order to facilitate health care, avoid duplication of services (such as tests) and to reduce the likelihood that medical error will occur. By participating in a HIE, we may share your health information with other providers that participate in the HIE or participants of other health information exchanges. If you do not want your medical information to be available through the HIE, you must request a restriction using the process outlined in the “Right to Request Restrictions” section.

Communicable Diseases. Oklahoma law only permits disclosure of communicable disease information (such as HIV, AIDS, Hepatitis, etc.) under the following circumstances: (i) with the patient's written authorization; (ii) if release is ordered by a court; (iii) if release is required by the State Department of Health to protect the public; (iv) if release is made to a person exposed to such diseases; (v) if release is required to health professionals, appropriate state agencies or a court to enforce Oklahoma law; (vi) if release is required for statistical purposes without patient identity, (vii) if release is required to health care providers and related parties for diagnosis and treatment purposes; or (viii) when the patient is an inmate in the custody of the Department of Corrections or related party and such release is necessary to (a) prevent serious and imminent threat to a person or the public, or (b) permit law enforcement authorities to identify an individual suspected of having escaped from a correctional institution.

Business Associates. We may disclose your medical information to other entities that provide a service to us or on our behalf that requires the release of patient medical information. However, we only will make these disclosures if we have received satisfactory assurance that the other entity will properly safeguard your medical information.

Example: We may contract with another entity to provide transcription or billing services.

Treatment Alternatives. We may use and disclose your medical information to tell you about or recommend possible treatment options or alternatives that may be of interest to you.

Individuals Involved in Your Care or Payment for Your Care. We may release medical information about you to a friend, family member or legal guardian who is involved in your medical care. We may tell your family or friends your condition and that you are in the hospital. In addition, we may disclose medical information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.

Health-Related Benefits and Services. We may use and disclose medical information to tell you about health-related benefits or services that may be of interest to you.

Directory. We may include certain information about you in our directory while you are a patient at NRHS. This information may include your name, location in NRHS, your general condition and your religious affiliation. The directory information, except for your religious affiliation, may be released to people who ask for you by name. Your religious affiliation may be given to a member of the clergy, such as a minister, priest or rabbi, even if they do not ask for you by name. This is so your family, friends and clergy can visit you in the hospital and generally know how you are doing. If you do not want to be in our directory, you will need to notify NRHS personnel at registration. You will be asked to complete an "opt out" form.

Organ and Tissue Donation. If you are an organ donor, we may release medical information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

Research. We may use and disclose medical information about you to researchers. In most circumstances, you must sign a separate form specifically authorizing us to use and/or disclose your medical information for research. However, there are certain exceptions. Your medical information may be disclosed without your authorization for research if the authorization requirement has been waived or altered by a special committee that is charged with ensuring that the disclosure will not pose a great risk to your privacy or that measures are being taken to protect your medical information. Your medical information also may be disclosed to researchers to prepare for research as long as certain conditions are met. Medical information regarding people who have died can be released without authorization under certain circumstances. Limited medical information may be released to a researcher who has signed an agreement promising to protect the information released.

Fundraising. We may use medical information about you to contact you in the future to raise money for NRHS. We may disclose medical information to a foundation related to NRHS so that the foundation may contact you to raise money on our behalf. We only will release limited information, such as your name, address and phone number, the dates you received treatment or services at NRHS, the department in which you received services, your treating physician and your health insurance status for fundraising purposes. Each solicitation will include information on how to opt-out of receiving further fundraising communications from NRHS. You also may notify NRHS, in writing, addressed to the Norman Regional Health Foundation, PO Box 1308, Norman, Oklahoma 73070-1308, to opt-out of receiving further fundraising communications.

Can you ever use and disclose my medical information without my authorization?

Yes. The following categories describe the ways that we may be required to use and disclose your medical information without your authorization. Not every use or disclosure in a category will be listed.

Required by Law. We may disclose your medical information when required to do so by federal, state or local law.

Examples: (1) We may release your medical information for workers' compensation or similar programs. (2) We are required by law to report cases of suspected abuse and neglect. These reports may include your medical information.

Deceased Information. Your medical information may be released, after your death, to a personal representative as defined by state law. It may also be released to family members and others who are involved in your care to the extent permitted by state law, unless doing so is inconsistent with any of your prior expressed preferences that are known to us. We may also disclose a deceased patient’s medical information without authorization to a healthcare provider who is treating a surviving relative for a similar medical condition such as an inherited disease.

Public Health. We may disclose medical information about you for public health activities intended to:

• Prevent or control disease, injury or disability;
• Report births and deaths; 
• Report abuse, neglect or violence as required by law; 
• Report reactions to medications or problems with products;
• Notify people of recalls of products they may be using; or 
• Notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.

Public Safety. We may use and disclose medical information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure would only be to someone able to help prevent the threat.

Food and Drug Administration (FDA). We may disclose to the FDA and to manufacturers health information relative to adverse events with respect to food, supplements, product and product defects, or post-marketing surveillance information to enable product recalls, repairs or replacements.

Health Oversight Activities. We may disclose medical information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. If you are involved in a lawsuit or a dispute, we may disclose medical information about you in response to a court or administrative order. In limited circumstances, we may disclose medical information about you in response to a subpoena or discovery request.

Law Enforcement. We may release medical information if asked to do so by law enforcement official:

• In response to a court order, warrant, summons or other similar process;
• To identify or locate a suspect, fugitive, material witness, or missing person;
• About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person's agreement; 
• About a death we believe may be the result of criminal conduct; 
• About criminal conduct at the hospital; and 
• In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.

Coroners, Medical Examiners and Funeral Directors. We may release medical information to a coroner or medical examiner.

National Security and Intelligence Activities. We may release medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

Protective Services for the President and Others. We may disclose medical information about you to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.

Military/Veterans. We may disclose your medical information as required by military command authorities, if you are a member of the armed forces.

Inmates. If you are an inmate of a correctional facility or under the custody of a law enforcement official or agency, we may release your medical information to the correctional facility or law enforcement official or agency.

What if you want to use and/or disclose my medical information for a purpose not described in this Notice?

We must obtain a separate, specific authorization from you to use and/or disclose your medical information for any purpose not covered by this notice or the laws that apply to us. If you provide us with authorization to use or disclose your medical information, you may revoke the authorization, in writing, at any time.

If you revoke your authorization, we will not use or disclose your medical information for the reasons covered by your authorization. However, your revocation will not apply to disclosures already made by us in reliance on your authorization.

Your authorization is required for the following purposes:

• Psychotherapy notes. We must obtain your authorization to use or disclose notes maintained by a mental health professional about a counseling session.
• Sale of Medical Information. We must obtain your authorization virtually any time we intend to sell your medical information, with minor exceptions.
• Marketing. We must obtain your authorization to communicate with you about a particular product or service virtually any time we are paid to make the communication, with minor exceptions.

What are my rights regarding my medical information?

You have the rights described below in regard to the medical information that we maintain about you. You are required to submit a written request to exercise any of these rights. You may contact our medical record department or Privacy Official to obtain a form that you can use to exercise any of the rights listed below.

Right to Inspect and Copy. You have the right to inspect and obtain a copy of medical information used to make decisions about your care. We will provide you with access to your medical information in the form or format requested if it is available in such format. We may charge a fee for the costs associated with your request, including the cost of copies, postage or other supplies, consistent with state law. We may deny your request to inspect and/or copy your medical information in certain circumstances. If you are denied access, you may request that the denial be reviewed. A licensed health care professional chosen by us will review your request and the denial. The person conducting the review will not be the person who denied your original request. We will comply with the outcome of the review.

Right to Amend. If you feel that medical information that we created is incorrect or incomplete, you may submit a request for an amendment for as long as we maintain the information. You must provide a reason that supports your amendment request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask to amend information that:

• We did not create, unless the person or entity that created the information is not available to make the amendment; 
• Is not part of the medical information that we maintain; 
• Is not part of the information that you would be permitted to inspect and copy; or 
• Is accurate and complete.

Right to an Accounting of Disclosures. You have the right to request one free "accounting of disclosures" every 12 months. This is a list of certain disclosures we made of your medical information. There are several categories of disclosures that we are not required to list in the accounting. For example, we do not have to keep track of disclosures that are authorized. Your request must state a time period, which may not be longer than 6 years and may not include dates before April 14, 2003.

If you request more than one accounting in a 12-month period, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to Request Restrictions. You have the right to request a restriction or limitation on the medical information we use or disclose about you unless our use and/or disclosure is required by law. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. You can request a restriction if you do not want us to disclose your medical information to an HIE.

We are not required to agree to your request unless you are requesting a restriction on the disclosure of information to your health plan and you pay out of pocket for the medical treatment provided. If we agree to a restriction, we will comply with your request unless the information is needed to provide emergency treatment to you.

In your request, you must indicate:

• The type of restriction you want and the information you want restricted; and
• To whom you want the limits to apply, for example, your spouse.

Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail.

We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to a Paper Copy of This Notice. You have the right to a paper copy of this notice. Copies of this notice always will be available in our medical record department.

Can you change this notice?

We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for medical information we already have about you as well as any information we receive in the future. Copies of the current notice will be posted at NRHS and will be available for you to pick up on each visit to NRHS.

What happens if my medical information is used by or disclosed to a person or entity that should not have access to it?

We are required to notify you of any acquisition, access, use, or disclosure of your medical information that is inconsistent with the federal law governing the protection of medical information (known has HIPAA).

What if I have questions or need to report a problem?

If you believe your privacy rights have been violated, you may file a complaint with us or with the Office of Civil Rights of the Department of Health and Human Services. To file a complaint with us, or if you would like more information about our privacy practices, contact NRHS's Privacy Officer at 405-307-1405 or by mail at 901 N Porter Ave, Norman, OK 73071. To file a complaint with the Office of Civil Rights of the Department of Health and Human Services, you must submit the complaint within 180 days of when you knew or should have known of the circumstance that led to the complaint. The complaint must be submitted in writing. Information on how to file a complaint can be located on the Office of Civil Rights website HERE or our Privacy Official can provide you with current contact information. You will not be penalized for filing a complaint.

Discrimination is Against the Law.

Norman Regional Health System complies with applicable Federal civil rights laws and does not discriminate on the basis of race, color, national origin, age, disability, or sex. Norman Regional Health System does not exclude people or treat them differently because of race, color, national origin, age, disability, sex or gender identity.

Norman Regional Health System:

1. Provides free aids and services to people with disabilities to communicate effectively with us, such as:
    • Qualified sign language interpreters
    • Written information in other formats (large print, audio, accessible electronic formats, 
       other formats)
2. Provides free language services to people whose primary language is not English, such as:
      • Qualified interpreters
      • Information written in other languages

For assistance with these services please contact the Patient Liaison at:
(405-307-1060) or the Compliance/Regulatory Officer (405-307-1405).

If you believe that Norman Regional Health System has failed to provide these services or discriminated in another way on the basis of race, color, national origin, age, disability, sex or gender identity you can file a grievance with:
Patient Liaison – 901 N. Porter. Norman, OK 73071

• Phone: 405-307-1060 • Fax: 405-307-1433
• Email: NonDiscrimination@nrh-ok.com

If you have questions on how to file a grievance related to discrimination you may contact the Patient Liaison (405-307-1060) or the Compliance/Regulatory Officer (405-307-1405).

You can also file a civil rights complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, electronically through the Office for Civil Rights Complaint Portal, available at
https://ocrportal.hhs.gov/ocr/portal/lobby.jsf, or by mail or phone at:

Dallas Office: U.S. Department of Health and Human Services – Office of Civil Rights, 1301 Young Street Ste 1169, Dallas, TX 75202 • www.hhs.gov/ocr • 1-800-368-1019 or TDD 1-800-537-7697

Complaint forms are available at
https://www.hhs.gov/civil-rights/filing-a-complaint/index.html