Privacy Policy

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Community Health Center of Cape Cod (CHC) strongly believes in safeguarding the privacy of our patients’ protected health information (PHI). PHI is information which:

• Identifies you (or can reasonably be used to identify you) and

• Relates to your physical or mental health condition, the provision of health care to you or the payment for that care.

We are required by law to maintain the privacy of your PHI and to provide you with notice of our legal duties and privacy practices with respect to your PHI. This Notice of Privacy Practices describes how we may collect, use and disclose your PHI, and your rights concerning your PHI.

Understanding Your Personal Health Information

Every time you visit the Health Center and are seen by a provider or receive other services a record is made of that visit. This medical record usually contains your symptoms, examination and test results, diagnoses, treatment, and a plan for future care or treatment. The medical records for the Health Center are stored on paper or on computer.

Medical information may also be used and stored by other departments in the Health Center in the regular course of business. This information may be stored on paper or on computer. The Health Center also may receive information about your health from providers or facilities not part of CHC and store such information with your CHC medical record. All of this information is considered confidential and is subject to the protections mentioned in this privacy notice.

Your medical information is used for many purposes, including:

•           Planning your care and treatment

•           Communication among the health care providers who take care of you

•           Proving that services billed to your insurance company were actually provided

•           Helping to improve the quality of care provided to Health Center patients

•           Assisting public health officials in improving the health of the public

•           Providing a legal record of the care and treatment you received

Understanding what is in your PHI and how it is used helps you to:

•           Ensure its accuracy and completeness

•           Understand who, what, where, why, and how others may access your PHI

•           Make informed decisions about authorizing disclosures to others

•           Better understand the PHI rights detailed below

Your Individual rights

Your PHI is the property of the Health Center, but you or your legally recognized representative have the right to:

•           Obtain a paper copy of this notice upon request

•           Request a restriction on some uses and disclosures of the information contained in your medical record

•           Obtain a copy of your medical record

•           Request to make an amendment to your medical record

•           Receive an accounting or list of disclosures of your medical record

•           Request that we provide your health information to you in an alternative way or at an alternative location in a confidential manner

•           Revoke your authorization to use or disclose medical information except in cases where information has already been used or disclosed upon your previous authorization

The Health Center is required to:

•           Protect the privacy of your medical information

•           Provide you with a notice about our legal duties and privacy practices in regard to the information we collect and keep about you

•           Follow the terms of this notice

•           Let you know if we cannot agree to a requested restriction on the use or disclosure of your medical information

•           Let you know if we cannot agree to a requested amendment to your medical information

•           Agree to reasonable requests to communicate medical information by alternative means or at alternative locations than we usually use

The Health Center has the right to change the practices we follow. Should this happen we will let you know by having revised privacy notices posted and available at the Health Center.

We will not use or disclose your medical information except as described in this notice.

Examples of uses of medical information for treatment, payment, and health care operations

We will use your medical information for treatment

For example: Each time you visit the Health Center a record is made of the symptoms, examination and test results, diagnoses, treatment and a plan for future care or treatment. All of the health care providers at CHC who take care of you are allowed to look at this information every time you return to the clinic for a visit or service.

We will use your medical information for payment

For example: When a bill is sent to an insurance company charging them for a visit it usually includes your name, other identifying information such as your date of birth and address, and information about the reason for your visit, the treatment given, and any supplies used.

We will use your medical information for regular health care operations

For example: The Health Center contracts with financial companies to audit the billing and payment processes. As part of auditing the billing and payment processes the contractor may need to review medical information related to the bill they are auditing. In all situations where a contractor or business associate receives access to protected health information, the Health Center requires the contracted person or company to protect the privacy of the medical information received. The Health Center may contact you to provide appointment reminders or information about health related benefits or services that may be of interest to you.

Health Information Exchange

The Health Center participates in Health Information Exchanges in order to share information securely and electronically with other providers and facilities involved in your care, including:

Massachusetts Immunization System (MIIS) – patients may opt out from MIIS sharing their immunization history with other practices

     Massachusetts HIway – CHC uses Direct Messaging to communicate with some providers about your care. If the receiving provider’s Direct Message address is a Mass HIway address the patient information will be transmitted securely through the Mass HIway.  No data is stored on the Mass HIway. Direct Messaging is a secure, electronic means of communication that replaces methods like mail or fax.

      Epic Care Everywhere – Providers involved in a patient’s care who use the Epic Electronic Health Record system can share information securely. Patients may opt out from their information being shared via Epic Care Everywhere.

Use or disclosure of medical information without authorization

The Health Center is allowed by federal or state law or regulation to disclose medical information without authorization from the patient or legally recognized representative in the following circumstances:

•           In medical emergency situations medical information about a patient may be disclosed to another medical professional or facility taking care of the patient, and as necessary, to a patient’s family member

•           When a patient is being referred to another provider or facility for medical care, information that the receiving provider or facility needs to take care of the patient may be disclosed to the receiving facility

•           Insurance companies paying for services delivered to a patient are able to receive information about the services they are paying for

•           Licensing or accrediting agencies receive information about patients in order for them to decide if the Health Center is providing good medical care

•           The Health Center is required by state law to report suspected cases of abuse, neglect and domestic violence to state agencies; in such cases patient medical information may be disclosed to the state agency

•           When a person dies who has been a patient at the Health Center and the medical examiner is investigating the death the Health Center is required by state law to provide patient medical information to the medical examiner if he or she requests it

•           When a person has filed a claim with the Industrial Accident Board the Health Center may disclose patient medical information to the board if they request it

•           When information has been requested by a valid court order, the Health Center is required by law to disclose the information requested

•           The Health Center is required to report certain illnesses and conditions to state agencies overseeing the public health

•           If a health care provider thinks that a patient may harm another person or if a patient has made a threat to harm another person the health care provider may contact law enforcement authorities and disclose information about the patient and the threat(s)

•           The Health Center is required by law to provide information to the Food and Drug Administration (FDA) if requested to do so in regard to the quality, safety or effectiveness of products or activities regulated by the FDA

•           Employers are entitled by law to receive information related to medical surveillance of the workplace or to evaluate whether or not a person has a work related illness or injury

•           The law requires that the Health Center provide information to health oversight agencies if requested to do so

•           Certain requests from law enforcement agencies may be responded to

•           When there has been a disaster, the Health Center is allowed to share information as necessary to public or private agencies providing disaster relief

Business Associates

We provide some services through contracts with business associates. Examples include but are not limited to, paper shredding copy service to make copies of medical records, and the like. When we use these services, we may disclose your health information to the business associate so that they can perform the function(s) we have contracted with them to do. To protect your health information however, we require our business associates to appropriately safeguard your information.

Current business associates also include health center controlled networks such as the Massachusetts League of Community Health Centers (MLCHC) and OCHIN. The MLCHC and OCHIN are engaged in quality assessment and improvement activities on behalf of CHC of CC and other network participants to establish best practice standards and assess clinical benefits that may be derived from the use of electronic health record systems. MLCHC and OCHIN also work collaboratively with the CHC of CC to work collaboratively in improving the internal and external management of referrals.

OCHIN also supplies information technology and related services to CHC and other OCHIN participants. OCHIN helps participants work collaboratively to improve the management of internal and external patient referrals. Your personal health information bay be shared by CHC with other OCHIN participants or a health information exchange only when necessary for medical treatment or for the health care operations purposes of the organized health care arrangement. Health care operations can include among other things geocoding your residence location to improve clinical benefits you receive.

The personal health information may include past, present and future medical information as well as information outlined in the Privacy Rules. The information to the extent disclosed will be disclosed consistent with the Privacy Rules or any other applicable law as amended from time to time. You have the right to change your mind and withdraw this consent, however, the information may have already been provided as allowed by you. This consent will remain in effect until revoked by you in writing. If requested, you will be provided a list of entities to which your information has been disclosed.

Use or disclosure with authorization

Disclosures of information from your medical record other than those included in this privacy notice will be made upon your written authorization or the written authorization of the person legally able to act on your behalf.

For more information or to report a problem

If you have any questions about this notice or want more information you may contact the Compliance Officer at 508-477-7090.

If you think your privacy rights have been violated you can file a complaint with the Compliance Office by mail at Community Health Center of Cape Cod, 107 Commercial Street, Mashpee, MA 02649, or by calling the Compliance Officer at 508-477-4090. These calls will be confidential and will not adversely affect your relationship with CHC.