• Medical Records Privacy
• Internet Privacy

Medical Records Privacy

Scope: Brandywine Valley Cardiovascular Associates and Brandywine Cardiac Rehabilitation Center

Effective date: February 26, 2003

This notice describes how medical information about you may be used and disclosed, and how to get access to this information.  Please read it carefully.  If you have any questions regarding this notice, you may contact our privacy officer at:

•  Brandywine Valley Cardiovascular Associates
•  Attention: Privacy Officer
•  3025 C.G. Zinn Road
•  Thorndale, PA  19372
•  610-384-2211 ext. 240

I.   YOUR PROTECTED HEALTH INFORMATION

We are required by federal privacy rule to maintain the privacy of your health information that is protected by the rule, and to provide you with notice of our legal duties and privacy practices with respect to your protected health care information.  We are required to abide by the terms of the notice currently in effect.

Generally speaking, your protected health information is any information that relates to your past, present, or future physical or mental health or condition, the provision of health care to you, or payment for health care provided to you, and individually identifies you or reasonably can be used to identify you.

Your medical and billing records at our practice are examples of information that usually will be regarded as your protected health information.

II.  USES AND DISCLOSURES OF YOUR PROTECTED HEALTH INFORMATION

A.      Treatment, Payment, and Health Care Operations

This section describes how we may use and disclose your protected health information for treatment, payment, and health care operations purposes.  The descriptions include examples.  Not every possible use or disclosure for treatment, payment, and health care purposes will be listed.

1.       Treatment

We may use and disclose your protected health information for our treatment purposes as well as the treatment purposes of other health care providers.  Treatment includes the provision, coordination, or management of health care services to you by one or more health care providers.  Some examples of treatment uses and disclosures include:

• During an office visit, practice physicians and other staff involved in your care may review your medical record and share and discuss your medical information with each other.
• We may share and discuss your medical information with an outside physician to whom we have referred you for care.
• We may share and discuss your medical information with an outside physician with whom we are consulting regarding you.
• We may share and discuss your medical information with an outside laboratory, radiology center, or health care facility where we have referred you for testing.
• We may share and discuss your medical information with an outside home health agency, durable medical equipment agency, or other health care provider to whom we have referred you for health care services and products.
• We may share and discuss your medical information with a hospital or other health care facility where we are admitting or treating you.
• We may share and discuss your medical information with another health care provider who seeks this information for the purposes of treating you.
• We may use a patient sign-in sheet in the waiting area which is accessible to all patients.
• We may page patients in the waiting room when it is time for them to go to an examining room.
• We may contact you to provide appointment reminders.
• We may leave a message on your answering machine, voicemail, work number or with a person who answers your phone on behalf of you with normal test results or information to contact our office.
• We may release all of your medical information to your spouse.  If you would like information released to anyone other then your spouse, you will need to notify the Privacy Officer in writing.

2.       Payment

We may use and disclose your protected health information for our payment purposes as well as the payment purposes of other health care providers and health plans.  Payment uses and disclosures include activities conducted to obtain payment for the care provided to you or so that you can obtain reimbursement for that care--for example, from your health insurer.  Some examples of payment uses and disclosures include:

• Sharing information with your health insurer to determine whether you are eligible for coverage or whether proposed treatment is a covered service.
• Submission of a claim form to your health insurer.
• Providing supplemental information to your health insurer so that your health insurer can obtain reimbursement from another health plan under a coordination of benefits clause in your subscriber agreement.
• Sharing your demographic information (for example, your address) with other health care providers who seek this information to obtain payment for health care services provided to you.
• Mailing you bills in envelopes with our practice name and return address.
• Provision of a bill to a family member or other person designated as responsible for payment for services rendered to you.
• Providing medical records and other documentation to your health insurer to support the medical necessity of a health service.
• Allowing your health insurer access to your medical record for a medical necessity or quality review audit.
• Providing consumer reporting agencies with credit information (your name and address, date of birth, social security number, payment history, account number, and our name and address).
• Providing information to a collection agency or our attorney for purposes of securing payment of a delinquent account.
• Disclosing information in a legal action for purposes of securing payment of a delinquent account.

 3.       Health Care Operations

We may use and disclose your protected health information for our health care operations purposes as well as certain health care operation purposes of other health care providers and health plans.  Some examples of health care operation purposes include:

• Quality assessment and improvement activities.
• Population-based activities relating to improving health or reducing health care costs.
• Reviewing the competence, qualifications, or performance of health care professionals.
• Conducting training programs for medical and other students.
• Accreditation, certification, licensing, and credentialing activities.
• Health care fraud and abuse detection and compliance programs.
• Conducting other medical review, legal services, and auditing functions.
• Business planning and development activities, such as conducting cost management and planning-related analyses.
• Sharing information regarding patients with entities that are interested in purchasing our practice and turning over patient records to entities that have purchased our practice.
• Other business management and general administrative activities, such as compliance with the federal privacy rule and resolution of patient grievances.
• Contacting you to solicit funds for our practice

B.      Uses and Disclosures for Other Purposes

We may use and disclose your protected health information for other purposes.  This section generally describes those purposes by category.  Each category includes one or more examples.  Not every use or disclosure in a category will be listed.  Some examples fall into more than one category – not just the category under which they are listed.

1.       Individuals Involved in Care or Payment for Care

We may disclose your protected health information to someone involved in your care or payment for your care, such as a spouse, a family member, or close friend.  For example, if you have surgery, we may discuss your physical limitations with a family member assisting in your post-operative care.

2.       Notification Purposes

We may use and disclose your protected health information to notify, or to assist in the notification of, a family member, a personal representative, or another person responsible for your care, regarding your location, general condition, or death.  For example, if you are hospitalized, we may notify a family member of the hospital and your general condition.  In addition, we may disclose your protected health information to a disaster relief entity, such as the Red Cross, so that it can notify a family member, a personal representative, or another person involved in your care regarding your location, general condition, or death.

3.       Required by Law

We may use and disclose protected health information when required by federal, state, or local law. For example, we may disclose protected health information to comply with mandatory reporting requirements involving births and deaths, child abuse, disease prevention and control, vaccine-related injuries, medical device-related deaths and serious injuries, gunshot and other injuries by a deadly weapon or criminal act, driving impairments, and blood alcohol testing.

4.       Other Public Health Activities

We may use and disclose protected health information for public health activities, including:

• Public health reporting, for example, communicable reports.
• Child abuse and neglect reports.
• FDA-related reports and disclosures, for example, adverse event reports.
• Public health warnings to third parties at risk of a communicable disease or condition.
• OSHA requirements for workplace surveillance and injury reports.

5.       Victims of Abuse, Neglect or Domestic Violence.

We may use and disclose protected health information for purposes of reporting of abuse, neglect or domestic violence in addition to child abuse, for example, reports of elder abuse to the Department of Aging or abuse of a nursing home patient to the Department of Public Welfare.

6.       Health Oversight Activities

We may use and disclose protected health information for purposes of health oversight activities authorized by law.  These activities could include audits, inspections, investigations, licensure actions, and legal proceedings.  For example, we may comply with the Drug Enforcement Agency inspection of patient records.

7.     Judicial and Administrative Proceedings

We may use and disclose protected health information disclosures in judicial and administrative proceedings in response to a court order or subpoena, discovery request or other lawful process.  For example, we may comply with a court order to testify in a case at which your medical condition is at issue.

8.     Law Enforcement Purposes

We may use and disclose protected health information for certain law enforcement purposes, such as to:

• Comply with legal process, for example, a search warrant.
• Comply with a legal requirement, for example, mandatory reporting of gun shot wounds.
• Respond to a request for information for identification/location purposes.
• Respond to a request for information about a crime victim.
• Report a death suspected to have resulted from criminal activity.
• Provide information regarding a crime on the premises.
• Report a crime in an emergency 

9.      Coroners and Medical Examiners

We may use and disclose protected health information for purposes of providing information to a coroner or medical examiner for the purpose of identifying a deceased patient, determining a cause of death, or facilitating their performance of other duties required by law.

10.      Funeral Directors

We may use and disclose protected health information for purposes of providing information to funeral directors as necessary to carry out their duties.

11.     Organ and Tissue Donation

For purposes of facilitating organ, eye and tissue donation and transplantation, we may use protected health information and disclose protected health information to entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue.

12.     Threats to Public Safety

We may use and disclose protected health information for purposes involving a threat to public safety, including protection of a third party from harm and identification and apprehension of a criminal.  For example, in certain circumstances, we are required by law to disclose information to protect someone from imminent serious harm.

13.     Specialized Government Functions

We may use and disclose protected health information for purposes involving specialized government functions including:

• Military and veterans activities
• National security and intelligence.
• Protective services for the President and others.
• Medical suitability determines for the Department of State.
• Correctional institutions and other law enforcement custodial situations 

14.     Workers’ Compensation and Similar Programs

We may use and disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault.  For example, this would include submitting a claim for payment to your employer’s workers’ compensation carrier if we treat you for a work injury.

15.     Business Associates

Certain functions of the practice are performed by a business associate such as a billing company, an accountant firm, transcriptionist, or a law firm.  We may disclose protected health information to our business associates and allow them to create and receive protected health information on our behalf.  For example, we may share with our billing company information regarding your care and payment for your care so that the company can file health insurance claims and bill you or another responsible party.

16.     Creation of De-Identified Information

We may use protected health information about you in the process of de-identifying the information.  For example, we may use your protected health information in the process of removing those aspects which could identify you so that the information can be disclosed to a researcher without your authorization.

17.     Incidental Disclosures

We may disclose protected health information as by-product of an otherwise permitted use or disclosure. For example, other patients may overhear your name being paged in the waiting room or overhear information during an oral or telephone conversation.

C.      Uses and Disclosures with Authorization

For all other purposes which do not fall under a category listed under section III.A and III.B, we will obtain your written authorization to use or disclose your protected health information.  Your authorization can be revoked at any time except to the extent that we have relied on the authorization.

III.   PATIENT PRIVACY RIGHTS

A.      Further Restriction on Use or Disclosure

You have a right to request that we further restrict use and disclosure of your protected health information to carry out treatment, payment, or health care operations, to someone who is involved in your care or the payment for your care, or for notification purposes.  We are not required to agree to a request for a further restriction.

To request a further restriction, you must submit a written request to our privacy officer.  The request must tell us: (a) what information you want restricted; (b) how you want the information restricted; and (c) to whom you want the restriction to apply.

B.      Confidential Communication

You have a right to request that we communicate your protected health information to you by a certain means or at a certain location.  For example, you might request that we only contact you by mail or at work.  We are not required to agree to requests for confidential communication that are unreasonable.

To make a request for confidential communications, you must submit a written request to our privacy officer.  The request must tell us how or where you want to be contacted.  In addition, if another individual or entity is responsible for payment, the request must explain how payment will be handled.

C.      Accounting of Disclosures

You have a right to obtain, upon request, an “accounting” of certain disclosures of your protected health information by us (or a business associate for us).  This right is limited to disclosures within six years of the request and other limitations.  Also, in limited circumstances we may charge you for providing the accounting.  To request an accounting, you must submit a written request to the privacy officer.  The request should designate the applicable time period.

D.      Inspection and Copying

You have a right to inspect and obtain a copy of your protected health information that we maintain in a designated records set.  This right is subject to limitations and we may impose a charge for the labor and supplies involved in providing copies.

To exercise your right of access, you must submit a written request to our privacy officer.  The request must: (a) describe the health information to which access is requested, (b) state how you want to access the information, such as inspection, pick-up of copy, mailing of copy, (c) specify any requested form or format, such as paper copy or an electronic means, and (d) include the mailing address, if applicable.

E.       Right to Amendment

You have a right to request that we amend protected health information that we maintain about you in designated records set if the information is incorrect or incomplete.  This right is subject to limitations.  To request an amendment, you must submit a written request to our privacy officer.  The request must specify each change that you want and provide a reason to support each requested change.

F.       Paper Copy of Privacy Notice

You have a right to receive, upon request, a paper copy of our Notice of Privacy Practices.  To obtain a paper copy, contact our privacy officer.

IV.   CHANGES TO THIS NOTICE

We reserve the right to change this notice at any time.  We further reserve the right to make any change effective for all protected health information that we maintain at the time of the change – including information that we created or received prior to the effective date of the change.

We will post a copy of our current notice in the waiting room for the practice as well as on our website.  At any time, patients may review the current notice by contacting our privacy officer.

V.   COMPLAINTS

If you believe that we have violated your privacy rights, you may submit a complaint to the practice or the Secretary of Health and Human Services.  To file a complaint with the practice, submit the complaint in writing to our privacy officer.  We will not retaliate against you for filing a complaint.

VI.   LEGAL EFFECT OF THIS NOTICE

This notice is not intended to create contractual or other rights independent of those created in the federal privacy rule.

Internet Privacy

Brandywine Valley Cardiology Associates recognizes that respecting user privacy over the Internet is of utmost importance. This privacy statement is designed to provide information about the privacy and data collection practices for the site: http://www.BVCAHearts.com. The site is operated by Brandywine Valley Cardiology Associates.

If you have questions or concerns regarding this statement, you should first contact our site coordinator at Webmaster@BVCAHearts.com or by postal mail to:

• Brandywine Valley Cardiology Associates
• 3025 C.G. Zinn Rd.
• Thorndale, PA
• 19335

A.      Identifying Information

In general, you can visit the site without telling us who you are or providing any information about yourself. In some areas of the site, we ask you to provide information that will enable us to process an order, offer services that require registration, assist you with technical support issues or to follow up with you. Generally, Brandywine Valley Cardiology Associates requests identifying information when you:

• Register on any of our web sites.
• Request an appointment confirmation
• Request a prescription drug refill
• Request information or files from technical support or customer service.
• Provide feedback to an online survey or tell us about an idea or suggestion.
• Participate in a rebate program, contest, or other promotional offer.

In these instances, Brandywine Valley Cardiology Associates will ask for your name, address, e-mail address, phone number and other appropriate information needed to provide you with these services. In all instances, if you receive a newsletter or other mailing from us, you will always be able to unsubscribe to these mailings at any time.

B.      What BVCA Will Do With Your Information

If you choose to give us personal information for any of the purposes above, this information is retained by Brandywine Valley Cardiology Associates and will only be used by Brandywine Valley Cardiology Associates to support your customer relationship with us. We will not add you to a mailing list or newsletter without your registration for this service. We will only contact you if further information is required from you to complete a service.

C.      What Others May Do With Your Information

Brandywine Valley Cardiology Associates does not share, rent, or sell any personally identifying information provided through our site (such as your name or email address) to any outside organization for use in its marketing or solicitations. From time to time Brandywine Valley Cardiology Associates may use agents or contractors who will have access to your personal information to perform services for Brandywine Valley Cardiology Associates (such as database maintenance, e-mail upkeep, and website design); however, they are required by us to keep the information confidential and may not use it for any purpose other than to carry out the designated services for Brandywine Valley Cardiology Associates. In addition, Brandywine Valley Cardiology Associates may also share aggregate information about its customers and its website visitors to advertisers, business partners, and other third parties. For example, we might share that our users are x percent PCs users and y percent Macintosh users. None of this information, however, will contain personal, identifying information about our users.

D.      Third Party Links

Other Internet sites and services have separate privacy and data collection practices. Once you leave www.BVCAHearts.com, Brandywine Valley Cardiology Associates cannot control and has no responsibility for the privacy policies or data collection activities at another site.

E.      Cookies

At times, we will use a feature on your web browser to send your computer a "cookie". We do not use cookies to retrieve any personal information from your computer. We only use cookies to learn ways to enhance our sites, and to give you better, more personalized service while in our web site. You can reset your browser to refuse all cookies or indicate when a cookie is sent; however, some functions of the sites will not function if you refuse cookies.

E.      Children's Privacy Protection

Brandywine Valley Cardiology Associates is sensitive to the heightened need to protect the privacy of children under the age of 13. The vast majority of the material on our web site is not intended for children and is not targeted to children under the age of 13. We do not knowingly collect data from children and, if we learn that we have received personal data from a child, we will remove this information from our database.

F.      Changes to this Policy

Brandywine Valley Cardiology Associates may from time to time revise its privacy policy. You should therefore periodically visit this page, so you are aware of any such revisions. We will not, however, use your existing information in a manner not previously disclosed. You will be advised and have the opportunity to opt out of any new use of your information.

G.      Contacting Us

If you have any questions about our internet privacy policy and/or the practices of our web site, you can write to:

• Brandywine Valley Cardiology Associates
• 3025 C. G. Zinn Rd.
• Thorndale, PA
• 19372