INTERMOUNTAIN MEDICAL IMAGING
NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
We at Intermountain Medical Imaging understand that medical information about you and your health is personal. We are required by law to maintain the privacy of individually identifiable patient health information (this information is known as “protected health information” and is referred to in this document as “PHI”). We are required by law to provide patients with a copy of our notice of privacy practices regarding PHI. We are also required to post the information contained in this notice in a prominent place within our facility. A copy of this notice is also accessible on our website at www.aboutimi.com. We will only use or disclose your PHI as is permitted under the terms of our Notice of Privacy Practices that may be currently in effect at any given time.
I. Persons Governed by this Notice
This notice applies to the delivery of health care by employees and staff of Intermountain Medical Imaging as well as to the radiologists who provide services to our patients and interpret imaging studies performed at Intermountain Medical Imaging. These radiologists belong to a group known as Gem State Radiology, LLP. Saint Alphonsus Regional Medical Center, Inc. (SARMC) is one of the owners of Intermountain Medical Imaging. Gem State Radiology and its radiologists; IMI and its employees and workforce; and SARMC (collectively referred to herein as “IMI” or “we”) have all agreed to be bound by the terms of this, or any subsequently applicable, Notice of Privacy Practices. This Notice of Privacy Practices will apply to PHI obtained by IMI in providing services to you at any IMI facility. In addition, all persons and entities participating in IMI, including Intermountain Medical Imaging; Gem State Radiology and its radiologists, and SARMC, may share your PHI with each other for the treatment, payment, or health care operations purposes and other purposes as described in this Notice. Although Gem State Radiology, its radiologists, and SARMC participate with Intermountain Medical Imaging in its privacy practices as outlined in this Notice for care you receive at an Intermountain Medical Imaging Center facility, please be aware that neither the radiologists of Gem State Radiology nor are employees of SARMC employees of Intermountain Medical Imaging.
II. How IMI May Use or Disclose Your PHI
IMI may use and disclose PHI about you in different ways. All of the ways which we may use or disclose information fall within one of the following described categories, however, not every potential use or disclosure within a category is listed in this Notice of Privacy Practices.
A. Uses and Disclosures Which do not Require Patient Authorization or Permission
The following uses and disclosures of information by IMI may be made without your permission or authorization and without notice to you:
i. For Treatment.
IMI may use your PHI to provide you with medical treatment, services, and supplies. For example, we may use your PHI, such as a history of heart disease, to assess your health and perform requested diagnostic services. In addition, we may disclose the findings of our treatment or diagnostic procedures to other health care providers, such as your referring physician, so that they may provide treatment to you, just as we may obtain PHI from other health care providers who have provided treatment to you, so that we may better provide treatment, services, or supplies to you.
- Appointment and Other Reminders. IMI may use and disclose PHI to contact you as a reminder that you have an appointment, that you need to schedule an appointment, or what steps you need to take to prepare for an appointment, such as whether and for how long you must abstain from food or drink prior to your appointment.
ii. For Payment.
IMI will use and disclose PHI about you to bill for our services and to collect payment from you and/or your insurance company. For example, we may give payor information about your medical condition so that payor will make payment to us for the imaging or other services that we have furnished to you. We may also inform your payor of the tests you are going to receive, as well as other PHI about you, in order to obtain prior approval or to determine whether the services we are going to provide to you are covered by your insurance. We also may provide PHI to other health care providers, payors, or other persons, including those responsible to make payment for services provided to you, to help secure payment for our services, or for other health care providers to obtain payment for their services.
iii. For Health Care Operations.
We may use and disclose PHI about you for business, administrative and the general operations of IMI. For example, we may utilize PHI to arrange for accreditation, organization review, use by auditors or other business and legal consultants to review our practice, to evaluate our operations, and to assist us in improving the quality and delivery of our services.
iv. Business Associates.
IMI may use or disclose your PHI to other persons or entities with whom IMI, or any of its members, such as Intermountain Medical Imaging, Gem State Radiology, or SARMC have an agreement or an arrangement by which such other person or entity uses or discloses PHI for obtaining payment, health care operations, and other permissible functions on behalf of IMI or its members. An example of a business associate would include billing and collection companies, or persons who might provide auditing or legal services. Any business associate of IMI or its agents and subcontractors will be required to guarantee that they will maintain the confidentiality of your PHI to the same extent IMI would if it were performing these tasks itself. Furthermore, business associate and their subcontractors are directly accountable for protecting your PHI and they are required to promptly inform IMI should your PHI be compromised.
v. Public Policy and Other Uses and Disclosures Permitted By Law.
There are a number of reasons why we may disclose PHI about you pursuant to federal or state law, or applicable public policy. We may disclose PHI about you when we are allowed or required to do so by federal, state, or local law. Types of such use and disclosure of your PHI include the following:
(1) Public Health Reporting. We may disclose PHI about you in connection with public health reporting activities. For example, we may disclose PHI to a public health authority authorized to collect or receive PHI for the purpose of preventing or controlling disease, injury, or disability. Also, we may disclose PHI about you at the direction of a public health authority or to an official of a foreign government agency that is acting in collaboration with a public health authority. A public health authority may include state health departments, the Center for Disease Control, the Food and Drug Administration, the Occupational Safety and Health Administration, and the Environmental Protection Agency, to name but a few.
(2) Abuse and Neglect Reports and Patient Safety. We are also permitted to disclose PHI about you to a governmental agency or other entity authorized by law to receive reports of child abuse or neglect, or neglect or abuse of vulnerable adults. PHI about you may also be used or disclosed as necessary to prevent a serious threat to your health and safety or to the health and safety of others.
(3) Food and Drug Reports. We may disclose PHI to a person subject to the Food and Drug Administration’s oversight, including, for example, the following activities: to report adverse events, product defects or problems, or biological product deviations, to track products, to enable product recalls, repairs or replacements, or to conduct post marketing surveillance.
(4) Health Oversight Activities. We may disclose PHI concerning you in connection with certain health oversight activities of licensing and other agencies. For example, health oversight activities include audit, investigation, inspection, licensure or discipline activities and actions, and civil, criminal, or administrative proceedings or actions or any other activity necessary for the oversight of the health care system; governmental benefit programs for which health information is relevant to determining beneficiary eligibility; entities subject to governmental regulatory programs for which health information is necessary to determine compliance with program standards, or subject to civil rights for which health information is necessary for determining compliance.
(5) Law Enforcement and Legal Proceedings. We may disclose PHI in response to a warrant, subpoena, or other order of a court or administrative hearing body, and in connection with certain government investigations and law enforcement activities, including identifying a criminal suspect or a missing person; or providing certain information about crime victims or criminal conduct, including to report a crime that we suspect occurred on our premises. We may also disclose your PHI in connection to legal administrative proceedings that involve you. We may release such information upon an order of a court or administrative tribunal. We may release such PHI also in the absence of such an order and in response to discovery or other lawful requests, if efforts have been made to notify you or secure a protective order limiting or preventing the disclosure of PHI.
(6) Coroners and Transplant Procurement. We may also release PHI to a coroner or medical examiner to identify a deceased person or determine the cause of death. We may release PHI to organ procurement organizations, transplant centers, and eye or tissue banks.
(7) Workplace Injury or Illness. IMI may use or disclose your PHI to comply with workplace illness and injury laws, including obligations for workplace medical surveillance and worker’s compensation laws.
(8) Military, Government and National Security. If you are a member of the armed forces, we may release or use your PHI as required by military command authorities. We may also release PHI about foreign military personnel to the appropriate foreign military authority. Likewise, we may disclose PHI for national security intelligence activities, and for the provision of protective services of the President of the United States and other officials or foreign heads of state.
(9) Disclosure Regarding Inmates. If you are an inmate, we may release PHI about you to a correctional institution where you are incarcerated or to law enforcement officials who may have custody of you.
(10) Certain Research Uses. We may use or disclose PHI about your condition and treatment for research purposes where an institutional review board or similar body referred to as a privacy board, determines that your privacy interests will be adequately protected in this setting by the limited use of PHI. We may also use and disclose your PHI to prepare or analyze a research protocol. Researchers will be required to safeguard the PHI they receive.
III. Permitted Use or Disclosure with the Opportunity for You to Agree or Object
IMI and its members may use or disclose your PHI in certain circumstances without your authorization, but you have the opportunity to ask that such uses or disclosures not occur. These uses and disclosures include the following:
IMI may disclose PHI about you to a friend or family member who is involved in your medical care. IMI will also give information to someone who helps you pay for your care. In addition, IMI will disclose PHI about you to an agency assisting in a disaster relief effort so that your family can be notified about your condition, status, or location. You have a right to request that your PHI NOT be shared with some or all of your family, friends, or otherwise as described above.
B. Promotional Communications
IMI does not share or sell your PHI to companies that market health care products or services directly to customers for use by those companies to contact you, such as drug companies. IMI may maintain a database of individuals for communications concerning disease management or detection, health promotion, and regarding products that IMI believes may be of benefit to you and your health condition. Individuals in this database under certain circumstances may receive information about the programs and services of Intermountain Medical Imaging, Gem State Radiology, or SARMC. You may request to be deleted from this database by contacting the IMI Privacy Officer.
IV. Use or Disclosure Requiring Your Authorization
The following disclosures or use of your PHI will occur only upon your providing written authorization for us to use or disclose the information for the purposes described below:
IMI is not permitted to provide your PHI to any other person or entity for marketing any products or services to you, other than Intermountain Medical Imaging’s, Gem State Radiology’s, or SARMC’s products or services, or otherwise as described in paragraph III (B) above, unless you have signed an authorization permitting such use or disclosure.
IMI will use or disclosure your PHI as part of research that includes providing you with treatment if you have signed a written authorization permitting the use or disclosure for such research purposes. For example, if you are part of a research study that includes treatment, IMI will require that you sign an authorization to allow the researcher to use or disclose your PHI for this research. However, IMI may condition the provision of such medical care or treatment that is part of the research upon your signing the research authorization.
C. Other Uses
Any other uses or disclosures that are not for purposes of treatment, payment, or health care operations of IMI, or that are not otherwise permitted as described herein, will be made only with your written authorization. When disclosure is permitted only with written authorization, the authorization will inform you of why we are requesting use or disclosure of your PHI and to whom the PHI may be disclosed or by whom it may be used. If we are required to obtain an authorization that you signed, you may, in writing, revoke such authorization to the extent that IMI has not already relied upon the authorization in the use and disclosure of your PHI.
V. Your Health Information Privacy Rights
IMI maintains records related to the care and services you receive at an IMI location, which includes records pertaining to care provided by Intermountain Medical Imaging employees and work force members, Gem State Radiology, and in some cases, SARMC. These records are owned by IMI, but you have the following rights concerning your PHI maintained by IMI:
A. Right to Request Restrictions
You may ask IMI to not use or disclose any part of your PHI for purposes of treatment, payment, or health care operations. Your request must be put in writing and specify the restriction requested and the scope to which you would like the restriction to apply. IMI is not required to agree to such a restriction that you may request, however. If IMI does agree to the requested restriction, it will do so only in writing, and IMI will not use or disclose your PHI to the extent agreed to in writing by IMI, unless it is necessary for you to receive emergency treatment, or if the restriction is terminated by you, or by IMI by notifying you of our termination of agreement to the restriction. If, however, you pay for your care yourself, out of your own pocket, you may request we not share your PHI about this care with your health plan or health insurer, and IMI is required to comply with this request.
B. Right to Request to Receive Communication by Alternative Means
IMI will accommodate reasonable requests to receive communications by alternative means or to an alternative location (e.g., by calling you at work or sending information to a different address). Such requests must be made in writing. IMI may condition this accommodation by requiring you to provide information as to how payment will be handled and by requiring specification from you of an alternative address or other method of contact. Such a request should be made in writing to our Privacy Officer.
C. Right to Access your Private Health Information by Inspection and/or Copying
You have a right to access your PHI and to inspect and copy your PHI contained in your designated record set as long as it is maintained by IMI except, that no such right of access shall apply to psychotherapy notes; information that will be used in a civil, criminal, or administrative action or proceeding; PHI to which by law, IMI may elect or be required to deny you access. Depending upon the basis for denial of a request to access your PHI, that decision to deny access may be reviewable by another health care professional that IMI may choose, so long as that person was not involved in the original decision to deny your request for access. Some denials are not subject to any right of review. To the extent we maintain your medical records in electronic format, you may request to receive a copy of such records in electronic form. Before providing copies of your PHI, IMI may require the payment by you of a reasonable cost-based copying charge for medical records and medical images. You must make your request to access and copy your PHI in writing to IMI’s Privacy Officer. IMI will respond to your request within thirty (30) days of the receipt of the written request. If IMI cannot respond to your request within that time frame, IMI will notify you in writing to explain the delay and the date by which IMI will act upon your request.
D. Right to Request Amendment
You may request an amendment of PHI about you that is maintained by IMI in a designated record set for as long as IMI maintains this information. You must submit a written request for amendment that provides the reasons for the requested amendment. IMI may deny the request for amendment for any reason permitted by law, including for example, that IMI did not create the information; the information is not part of IMI’s designated record set, the information is not of a type that would be available for you to access, or the information is accurate and complete. If IMI denies your request for amendment, you may file a statement of disagreement with us. You may ask that IMI include your request for amendment and the denial of the same any time that IMI discloses the information about which you requested amendment. IMI may prepare a rebuttal to your statement of disagreement and will provide you with a copy of that rebuttal. Please contact the IMI Privacy Officer if you wish to make such a request for amendment to your PHI.
E. Right to An Accounting of Certain Disclosures of PHI
You have the right to receive an accounting of certain disclosures of your PHI that IMI has made. However, IMI does not and will not provide an accounting of the following disclosures:
1) Disclosures to carry out treatment, payment, or health care operations, or that are incidental to such activities;
2) Disclosures to you;
3) Disclosures that are incidental;
4) Disclosures to persons involved in your care such as family and friends;
5) Disclosures pursuant to a written authorization
6) Disclosures for national security or intelligence purposes;
7) Disclosures to correctional institutions or law enforcement officials;
8) Disclosures that occurred prior to April 14, 2003; and
9) Other disclosures for which accounting is not required in accordance with applicable law.
The first accounting requested by you and provided within the twelve (12) month period will be provided without charge. However, you will be charged for subsequent accountings requested by you within the same twelve (12) month period based upon a reasonable cost-based fee for preparing the accounting.
For each disclosure for which we must account, you will receive: the date of the disclosure, the name of the receiving organization and address if known, a brief description of the PHI disclosed and a brief statement of the purpose of the disclosure or a copy of the written request for the information, if there was one. However, for certain research disclosures, we will provide more limited information to you.
You must make your request for an accounting of disclosure of your PHI in writing to IMI. You must include the time period for which you are requesting the accounting, which may not be longer than six (6) years. IMI will respond to your request within sixty (60) days from the receipt of the written request. IMI will notify you within the sixty (60) day period in writing if it needs additional time to respond to your request. In any event, IMI will act on your request and provide such accounting within ninety (90) days of the receipt of the original request for accounting.
F. Right to Receive a Copy of This Notice
If you received this Notice electronically, you have a right to receive a paper copy of this Notice of Privacy Practices upon request.
G. Breach Notification
IMI and/or its’ Business Associate(s) are required to notify when the privacy of your “unsecured” protected health information (PHI) is breached, unless it is determined, consistent with applicable regulations or laws, that we are not required to provide such notice because we determine you are not at risk of harm as a result of such breach.
VI. Idaho Health Data Exchange
Intermountain Medical Imaging has chosen to participate in the Idaho Health Data Exchange (IHDE). IHDE is a secure statewide internet based health information exchange available to participating health care facilities. Access to this information can contribute to the improved coordination and quality of care and enhanced patient safety. Our providers will be able to quickly obtain information in obtaining a complete and accurate health record.
All participating providers are regulated by HIPAA, as well as state and federal privacy laws. HIPAA regulates the use and disclosure of your personal health information for purposes of treatment, payment, and operations, as has been discussed in detail in this notice.
If you do not want to participate in the IHDE and do not wish to have your health care information shared with other medical providers, you can opt out of the participation. In order to opt out you must complete and sign the “Request to Restrict Disclosure of Health Information” form and mail or fax the form to IHDE. These forms are available at our registration desks. Further information can be obtained at www.idahohde.org/restrictdisclosure.
IHDE cannot exclude specific visits, tests, providers of care, and/or health insurers. If you do not want some or all of your health information made available through the IHDE, you may wish to complete the restriction of disclosure form to opt out of IHDE. If you do not complete this form, we may share your health information with other participating healthcare providers involved in your care through the IHDE.
For more information on understanding the IHDE, please contact the exchange at:
Or, you can contact the IMI Privacy Officer at (208) 384-9073.
VII. Changes to this Notice
IMI reserves the right to make changes to this Notice at any time. We reserve the right to make the revised notice effective for personal health information we already have about you as well as any information we receive in the future. In the event there is a material change to this Notice, the revised Notice, or if permitted, a summary of such Notice will be posted at our facilities and on our website (www.aboutimi.com). You may also obtain a copy of the current Notice by contacting the Privacy Officer or by going to any IMI facility.
We at IMI are committed to compliance with this Notice of Privacy Practices and the requirements imposed upon us by applicable federal and state law. If you believe that your privacy rights have been violated, you may file a complaint with IMI, or with the Secretary of the Department of Health and Human Services, Office of Civil Rights. To file a complaint with IMI, please contact the IMI Privacy Officer. All complaints must be submitted in writing and directed to the IMI Privacy Officer. IMI assures you that there will be no retaliation for filing of a complaint and that all complaints will be treated seriously.
VIII. Additional Information and Privacy Officer Contact
For further information regarding the issues covered by this Notice of Privacy Practice, or any other questions regarding the privacy of your PHI as a patient of IMI, including to exercise any of the rights you have as explained in this Notice, please contact the following:
HIPAA Privacy Officer
Intermountain Medical Imaging
927 W. Myrtle Street
Boise, Idaho 83702