THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice describes how we may use and disclose protected health information about you. Protected health information means any of your health information that could be used to identify you. In this notice, we call all of that protected health information “PHI.”

This notice also describes your rights and our duties with respect to your PHI. In addition, it tells you how to complain to us if you believe we have violated your privacy rights.

This notice applies to the Elmhurst Outpatient Surgery Center, LLC, as well as the radiologists, anesthesiologists, and pathologists who may provide care for you at the facility. The independent medical staff members listed herein agree to protect the privacy of your PHI and abide by the terms of this notice while caring for you at the Surgery Center.

We are committed to the protection of PHI in accordance with applicable law and accreditation standards regarding patient privacy. Your PHI is personal. A record of the care and services you receive at our facility is needed to provide you with quality care and to comply with legal requirements. The law requires us to make sure that your PHI is kept private. The law also requires us to provide a copy of this notice to you which explains our legal duties and privacy practices with respect to your PHI, and follow the terms of this notice currently in effect. 

How We May Use and Disclose Your PHI 

We use and disclose your PHI for a number of different purposes. Each of those purposes is listed below.

I.     Treatment

We may use your PHI to provide, coordinate or manage your healthcare and related services. We may disclose your PHI to doctors, nurses, hospitals and other healthcare facilities who become involved in your care. In the course of your treatment here, your PHI may be disclosed to indirect healthcare providers such as our independent contractor radiologists and pathologists. Similarly, we may refer you to another healthcare provider and as part of the referral process share your PHI with that provider. An example of this would be if you were being treated for a broken leg, and the physician needed to know if you had diabetes, because diabetes may slow the healing process. So the physician treating your leg may refer you to another physician who specializes in treating diabetic patients and in doing so, will share your PHI with that physician.

II.     Payment 

We may use and disclose your PHI so we can be paid for the services we provide to you. This can include billing you, your insurance company, or a third party payor. For example, we may need to give your insurance company information about the healthcare services we provide to you such as your dates of service so that your insurance company will pay us for those services or reimburse you for amounts that you have paid. We may also provide your name, address and insurance information to other healthcare providers who care for you while you are being treated here so that they may submit bills for their care of you. Additionally, we may need to provide your insurance company or a government program, such as Medicare or Medicaid, with information about your medical condition and the healthcare you need to receive to determine if you are covered by that insurance or program. 

III.     Healthcare Operations 

We may use and disclose your PHI for our own healthcare operations. These uses and disclosures are necessary to run our organization and to make sure that all of our patients are receiving quality care and cost-effective services. For example, we may use PHI to review the quality of our treatment and services, to develop new programs, to determine whether new treatments are effective, and to evaluate the performance of our staff in caring for you.  We may use your PHI to contact you after your discharge from our care to discuss your satisfaction with your stay with us and your current health status.   

Additionally, we may share your PHI with accrediting and licensing bodies in order to continue to be a licensed and accredited healthcare facility. We may also combine your PHI with PHI from other healthcare organizations to improve our services. When we do so, we may remove information that identifies you as an individual from the shared PHI. 

We may also share your PHI with other healthcare organizations who have or have had a relationship with you if that information is related to and needed for the healthcare operations of the other healthcare organization. 

IV.     Media 

Should your stay with us attract media attention (for example if you are involved in an accident or are a celebrity) we will follow the Metropolitan Chicago Healthcare Council guidelines for release of information to the media. We will do so if your PHI is not governed by other applicable law or you have not requested that we withhold information from the media. If you want us to withhold information from the media, please advise the registration staff of your request.  

V.     Appointment Reminders  

We may use and disclose PHI to contact you to remind you of an appointment you have with us. We may contact you by telephone or by mail at either your home or your office. We may, at your request, leave messages for you on the answering machine or voicemail. If you want to request that we communicate to you in a certain way or at a certain location, see “Right to Request Confidential Communications” addressed on page 9 of this notice. 

VI.     Health Related Benefits, Services, and Alternatives 

We may use and disclose your PHI to contact you about health-related benefits, services and treatment alternatives that may be of interest to you. 

VII.     Individuals Involved in Your Care 

We may disclose to a family member, other relative, close personal friend, or any other person identified by you, your PHI that is relevant to that person’s involvement in your care or payment related to your care. An example of this is if a family member accompanies you to surgery and the surgeon speaks with your family member regarding how your surgery went. 

We may also use or disclose your PHI to notify, or assist in notifying, those persons of your location or general condition. If there is a family member, other relative, close personal friend or other person to whom you do not wish us to disclose the above information, please notify the registration and admitting staff or the person who is providing care to you of your request. 

VIII.     Public Health and Government Functions 

We may disclose your PHI to a health oversight agency for activities authorized by law, including audits, investigations, inspections, licensure or disciplinary actions. We may disclose your PHI to the government or a health oversight agency for the following additional purposes: to control or prevent a communicable disease, injury, or disability, to report deaths, to report adverse events that occur after administering a vaccine, to report other adverse events, to report instances of food poisoning or product defects, to track products, to enable product recalls, or to conduct post-market surveillance as required by law. If necessary, we may disclose your PHI to another healthcare provider who has or who will be providing care to you for purposes of controlling or preventing a communicable disease. 

IX.     Required by Law 

We are required by law to release your PHI as it relates to: a federal, state, county or law enforcement agency regarding reporting, investigating or prosecuting threatened or suspected child or elder abuse, or relinquishment of an infant 72 hours old or less. We are also required to release your PHI to an agency or law enforcement agency investigating abuse, neglect, physical injury, violent crimes and death, an agency that investigates animal bites, injuries due to the discharge of a firearm, and the inappropriate transfer of a patient by another facilities’ emergency department. We are also required by law to release your PHI to your court-appointed guardian, an agent you appoint under a healthcare power of attorney, and, if you are in custody or incarcerated, the appropriate law enforcement official or correctional institution. 

X.     Judicial and Administrative Proceedings 

We may disclose your PHI in the course of any judicial or administrative proceeding in response to an order of the court or administrative tribunal. We may also disclose your PHI in response to a subpoena, discovery request, or other legal process but only if efforts have been made to tell you about the request, it appears from the request that you know of its existence, or an order is obtained protecting the information to be disclosed.  

XI.     Law Enforcement Purposes 

We may disclose your PHI to a law enforcement official for the following law enforcement purposes: as required by law, in response to a court, grand jury, or administrative order or subpoena, to identify a suspect, fugitive, material witness, or missing person, about an actual or suspected victim of a crime, regarding a death if we suspect the death may have resulted from criminal conduct, about crimes that occur at our facility, and to report a crime in emergency circumstances. 

XII.      Research 

Under certain circumstances, we may disclose your PHI for research. For example, a research project might compare the health and recovery of all patients who received one medication to those who received another medication for the same condition. For this type of project, we remove information that identifies you from your PHI. In other circumstances, you will be asked to give your consent to participate in a research project. You may choose not to participate in a research project and your care and treatment will not be affected by your decision. All research projects are approved through a process that evaluates the needs of the research project with your need for privacy of your PHI. 

XIII.     Serious Threat to Health or Safety 

We may use or disclose your PHI if we believe the use or disclosure is necessary to prevent or lessen a serious or imminent threat to the health or safety of a person or the public. We may also release information about you if we believe the disclosure is necessary for law enforcement authorities to identify or apprehend an individual who admitted participation in a violent crime or who is an escapee from a correctional institution or from lawful custody. 

XIV.     Military 

If you are a member of the Armed Forces, we may use and disclose your PHI for activities deemed necessary by the appropriate military command authorities to assure the proper execution of the military mission. We may also release information about foreign military personnel to the appropriate foreign military authority for the same purposes.  

XV.     National Security 

We may disclose your PHI to authorized federal officials for the conduct of intelligence, counter-intelligence, and other national security activities authorized by law. Additionally, we may also disclose your PHI to authorized federal officials so they can provide protection to the President of the United States, certain other federal officials, or foreign heads of state. We may use your PHI to make medical suitability determinations and may disclose the results to officials in the United States Department of State for purposes of a required security clearance or service abroad. 

XVI.     Inmates and Persons in Custody 

We may disclose your PHI to a correctional institution or law enforcement official having custody of you. The disclosure will be made if the disclosure is necessary to provide healthcare to you, for the health and safety of others, or the safety, security and good order of the correctional institution. 

XVII.     Workers Compensation 

We may disclose your PHI to the extent necessary to comply with workers’ compensation and similar laws that provide benefits for work-related injuries or illness.  

XIV.     Other Uses and Disclosures 

Other uses and disclosures will be made only with your written authorization. You may revoke such authorization at any time by notifying the Business Office, Elmhurst Outpatient Surgery Center, LLC, 1200 S. York Road, Suite 1400 Elmhurst, IL, 60126-6533, of your desire to revoke it. If you revoke such an authorization, however, it will not have any affect on actions taken in reliance upon it. 

XV.     Application of Notice of Privacy Practices 

As discussed in the introduction to this notice, the Elmhurst Outpatient Surgery Center, LLC has entered into an agreement with the radiologists, anesthesiologists, and pathologists to share this notice of privacy practices and abide by its terms for purposes of your treatment at the Surgery Center. We agreed to do so to facilitate the efficient flow of information for patient care purposes. This is being done for your convenience and to improve your access to the delivery of healthcare services. 

Despite the above agreement, the physicians are independent contractors and are not agents, servants, or employees of the Elmhurst Outpatient Surgery Center, LLC and are solely responsible for their judgment and conduct in treating you and for their compliance with state and federal privacy laws. Nothing in this notice is meant to imply, infer or create any agency or employment relationship between the physicians and the Surgery Center, either actual or apparent, nor is this privacy notice intended to alter or limit any other consents for treatment or procedures you may sign during the time you are provided care at the facility. 

In all instances where we deal with your PHI, we follow a “minimum necessary” standard. Each person accessing your PHI makes every reasonable effort to limit the use and disclosure of your PHI to that information necessary to accomplish the intended purpose or job. 

Your Health Information (PHI) Rights

I.     Right to Request Restrictions 

You have the right to request that we restrict the uses or disclosures of your PHI to carry out treatment, payment or healthcare operations. You also have the right to request that we restrict the uses or disclosures we make to someone who is involved in your care or the payment for your care. We are not required to agree to your request if it inhibits the provision of patient care, treatment, payment or healthcare operations.

If we do agree to the restriction, we will comply with your request unless the information is needed to provide you emergency treatment.  If we agree to a restriction and later disclose your PHI for emergency treatment purposes to another healthcare provider, we will ask that provider not to use or disclose the information other than for treatment purposes. A request for a restriction should be made in writing to the Business Office. Your request should specify what information you want to limit, whether you want to limit use or disclosure or both, and to whom you want the limits to apply. 

If we agree to a restriction, you can request orally or in writing that we end that agreement and lift the restriction. If you make an oral request, we will document that you requested that the restriction be lifted in your medical record. We may also decide to end the agreement and lift the restriction and if we decide to do so we will advise you of our decision. 

II.     Right to Inspect and Copy 

You have the right to inspect and obtain a copy of your health records with limited exceptions as allowed by law.  To obtain a copy of your health records or your billing information, you must fill out an authorization form and submit it to the Business Office.  We will respond to your request within 30 calendar days of receipt of the completed authorization form. 

We may deny your request to inspect and copy your health records if the information involved is psychotherapy notes, or information compiled in anticipation of, or use in, a civil, criminal or administrative action or proceeding. We may also deny your request if your PHI was obtained from someone other than a healthcare provider under a promise of confidentiality and your accessing the PHI would reveal the source of the PHI. We may also deny a request by you or your legal representative to inspect and copy your PHI if doing so may endanger the life or physical safety of you or another person. 

If we deny your request, in its entirety or in part, we will inform you in writing of the basis of the denial, how and under what circumstances you may have your denial reviewed, and how you may complain. If you request a review of our denial, it will be conducted by a licensed healthcare professional designated by us who was not directly involved in the denial. We will comply with the outcome of that review. 

III.     Right to Amend 

You have the right to ask us to amend your PHI as long as the PHI is maintained by us. You may request an amendment by notifying the Business Office of your desire to amend the record and completing the “Amendment Form” utilized for that purpose. The Business Office will provide a written response to your request within 30 calendar days of receipt of the completed “Amendment Form.”  

We may deny your request if we determine that your PHI: a) was not created by us, b) is not part of the record set, c) is protected from access by law, or d) we believe your PHI is accurate and complete.  

IV.     Right to a List of Disclosures 

You have the right to receive a list of disclosures we have made of your PHI. Certain types of disclosures are not included in that list such as disclosures to you or your legal representative, disclosures to carry out treatment, payment and healthcare operations, disclosures made as discussed in paragraphs XIII, XVIII, XV, or XVI of this notice, or those disclosures made in response to a signed authorization. To request a list of disclosures, you should submit your request in writing to the Business Office. Your request must indicate a time period for the disclosures.  

The first list you request from us within a 12-month period will be provided at no charge. For additional lists, we may charge you for the costs associated with providing the list. We will notify you of the cost involved, and you may choose to withdraw or modify your request at that time before any costs are incurred.  

The list of disclosures will include the following information about the disclosures: a) the date the disclosure was made, b) the name and address of the person or entity to whom it was made, c) a brief description of what was disclosed, and d) a brief statement of the purpose of the disclosure. We will attempt to provide the list to you within 60 days after receipt of your request. If we are unable to do so within that time frame, we will let you know. 

V.     Right to Request Confidential Communications 

You have the right to request that we communicate with you about your PHI in a certain way or at a certain location. For example, you may ask that we only contact you by mail or at work. Our standard means of communication is in person, by telephone, or in writing. If you wish to make a request for an alternative means of communication, you must do so in writing to the Business Office. Your request must state how or where you can be contacted, but does not need to explain the reason for your request. We will accommodate all reasonable requests. 

VI.     Right to Revoke Authorization 

Uses and disclosures of PHI not covered by this Notice of Privacy Practices or applicable laws will be made only with your written authorization. If you authorize us to use or disclose your PHI, you may revoke that authorization, in writing, at anytime. We are unable to take back any disclosures we have already made with your permission. To revoke an authorization, you must contact the Business Office. 

VII.     Right to Complain 

If you believe your privacy rights have been violated, you may complain to the hospital or to the United States Department of Health and Human Services. To complain to the Surgery Center, please contact the Business Office at (630) 758-8803 and indicate that you have a complaint regarding a breach of privacy. The Privacy Officer of the Elmhurst Outpatient Surgery Center, LLC will address your complaint. To complain to the United States Department of Health and Human Services, contact the Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, D.C., 20201. There will be no retaliation against you for making your complaint. 

Important Note regarding this Notice of Privacy Practices 

We reserve the right to change this Notice of Privacy Practices. We reserve the right to make the new notice’s provisions effective for all PHI that we maintain, including that created or received by us prior to the effective date of the new notice. The effective date of this notice is set forth on the bottom of each page of this notice. A copy of our current Notice of Privacy Practices will be posted in all patient registration areas. A copy of the current notice will also be posted on our web site at eosc.org. In addition, each time you register at the Surgery Center, a copy of the current notice will be available to you. If you have any questions after reading this notice, please contact the Surgery Center’s Privacy Officer.