Patient Privacy Policies (HIPAA)
NOTICE OF PRIVACY PRACTICES
This notice describes:
- HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
- YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION
- HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION
YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH THE PRIVACY OFFICER AT 610-225-6204 OR PRIVACY@MLHS.ORG IF YOU HAVE ANY QUESTIONS.
I. Who We Are.
This Notice describes the privacy practices of Main Line Health ("MLH") which includes Bryn Mawr, Paoli, Riddle and Bryn Mawr Rehabilitation Hospitals, Lankenau Medical Center, Mirmont Treatment Center ("Mirmont"), Main Line HealthCare, and Main Line Health HomeCare & Hospice.
While treating you, our employees, volunteers, students and healthcare professionals affiliated with MLH follow this Notice. In addition, any person involved in your care, entities, sites and locations may share medical information about you with each other for treatment, payment or healthcare operations as described in this notice.
We are required by law to maintain the privacy of your health information and to provide you with this Notice.
II. Our Duties to Safeguard your Protected Health Information.
Protected Health Information ("PHI") is any information related to your healthcare that is shared or maintained in any manner. It includes your insurance information as well. This Notice applies to all PHI generated by Main Line Health or any of its entities. Non-Main Line Health physicians or practices may have different policies or notices regarding their use and disclosure of your medical information created in their offices.
This Notice will tell you about the ways in which we may use and disclose your PHI. We also describe your rights and certain obligations we have regarding the use and disclosure of your PHI.
We are required by law to:
- make sure that your PHI is kept private;
- give you this Notice of our legal duties and privacy practices related to your PHI;
- to notify you following a breach of any unsecured versions of your records and,
- follow the terms of this Notice.
III. How We May Use and Disclose Your PHI - Treatment, Payment, and Healthcare Operations.
The following are uses and disclosures of your protected health information that do not require an authorization:
Treatment. We may use and disclose your PHI to provide, coordinate, or manage your treatment and related services. This includes sharing your PHI, as necessary, with other doctors, healthcare professionals, and healthcare facilities (within and outside of MH) involved in your care.
Payment. We may use and disclose your PHI to obtain payment for the healthcare services we provide to you. For example, we may share your PHI with your health insurance plan or other payers to determine eligibility for coverage, request prior authorization for services, or submit claims for payment.
Healthcare Operations. We may use and disclose your PHI for our business and healthcare operations. This includes activities related to evaluating treatment effectiveness, teaching and learning purposes, evaluating the quality of our services, and investigating complaints related to service.
Other Healthcare Provider Payment and Operations. We may also disclose your PHI to other healthcare providers when such PHI is required for them to receive payment for services you receive or conduct certain healthcare operations. For example, we will share your PHI with an ambulance company so the ambulance company can be reimbursed for transporting you to the hospital.
Health Information Exchange. A health information exchange ("HIE") is a network that allows HIE participants to share patients’ PHI for treatment, payment and healthcare operations purposes and other lawful purposes to the extent permitted by law ("Permitted Purposes"). HIEs make it possible for us to electronically share patients' PHI to coordinate their care, obtain billing information, and participate in quality improvement, public health and population health initiatives, among other things. Participants in the HIE may be healthcare providers, their billing companies, insurers, health plans, and accountable care organizations ("Participants"). Note that sensitive information (such as information relating to mental health, drug and alcohol treatment, HIV status and sexually transmitted diseases) may be contained in the documents accessed through the HIE.
MLH participates in various HIEs from time to time solely for Permitted Purposes, including Health Share Exchange of Southeastern Pennsylvania ("HSX"). More information on HSX can be found on its website: http://www.hsxsepa.org.
Opting Out of HIEs. You may opt out of participating in all the HIEs MLH participates in by contacting the MLH Privacy Office or by going to this link and completing the opt out form: www.mainlinehealth.org/about/policies/opt-out-of-electronic-transmittal-of-protected-health-information. You may also opt out of the HSX HIE directly on the HSX website by completing the HSX Opt Out form at: www.healthshareexchange.org/patient-options-opt-out-back.
IV. Other Uses and Disclosures of Your PHI for which Authorization is Not Required.
Hospital Directory. Inpatients are automatically listed in our hospital directory. The directory includes your name, room number, general health condition and religious affiliation. Unless you disagree or object, information in the directory may be disclosed to anyone who asks for you by name or to clergy members of your religious affiliation.
Disclosure to Relatives and Close Friends. We may disclose your PHI to a family member, other relative, a close personal friend, or any other person if we: 1) obtain your agreement; 2) provide you with the opportunity to object to the disclosure; or, 3) we can reasonably infer that you do not object to the disclosure.
Incapacity or Emergency Circumstances. If you are not present, or the opportunity to agree or object to a use or disclosure cannot practicably be provided because of your incapacity or an emergency circumstance, we may exercise our professional judgment to determine whether a disclosure to relatives and/or close friends is in your best interest. If we disclose information to a family member, other relative or a close friend, we will disclose only information that is directly relevant to the person's involvement with your healthcare.
Fundraising. For Patients of Bryn Mawr, Paoli, Riddle and Bryn Mawr Rehabilitation Hospitals, Lankenau Medical Center, Main Line Health Behavioral Health Services, Main Line HealthCare, Main Line Affiliates, and Main Line Health HomeCare & Hospice, we may contact you to request a contribution to support important activities of Main Line Health or its entities. In connection with any fundraising, we may use and disclose your demographic information as well as the dates on which you received healthcare services, the department where you received your services, your treating physician and outcome information related to your care. If you do not want to receive any fundraising requests, you may contact us at: www.mainlinehealth.org/optout or:
Main Line Health Development Office
240 N. Radnor Chester Road
Radnor, PA 19087
For patients of Mirmont Treatment Center, we may use or disclose your records to fundraise for the benefit of Mirmont only if you are first provided with a clear and conspicuous opportunity to elect not to receive fundraising communications.
Public Health Activities. We may disclose your PHI for public health activities including the following:
- Reporting births or deaths
- To prevent or control disease, injury or disability
- To report child abuse or neglect
- To report reactions to medications or problems with products
- To notify individuals who may have been exposed to a disease or may be at risk for contracting a disease or condition
- Reporting PHI to your employer as required by laws addressing work-related illnesses and injuries or workplace medical surveillance
Victims of Abuse, Neglect or Domestic Violence. If we reasonably believe you are a victim of abuse, neglect or domestic violence, in accordance with current Pennsylvania law, we may disclose your PHI to a governmental authority, including a social service or protective services agency, authorized by law to receive reports of such abuse, neglect, or domestic violence.
Health Oversight Activities. We may disclose your PHI to a health oversight agency that is responsible for ensuring compliance with rules of government health programs such as Medicare and Medicaid. These oversight activities include, for example, audits, investigations, inspections and licensure.
Legal Proceedings and Law Enforcement. We may disclose your PHI in response to a court order, subpoena, or other lawful process.
Deceased Persons. We may release PHI to a coroner or medical examiner authorized by law to receive such information.
Organ and Tissue Donation. We may disclose your PHI to organizations that obtain organs or tissues for banking and/or transplantation.
Public Safety. We may use or disclose your PHI to prevent or lessen a serious or imminent threat to the safety of a person or the public.
Research. Usually, we will ask for your permission or authorization before using your PHI for research purposes. However, we may use and disclose your PHI without your authorization if Main Line Hospital's or another qualified Institutional Review Board (IRB) has waived the authorization requirement. An IRB is a committee that oversees and approves research involving human subjects.
Disaster Relief Efforts. We may disclose your PHI to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.
Military, National Defense, and Security. We may release your PHI if required for military, national defense and security and other special government functions.
Workers' Compensation. We may release your PHI for workers' compensation or similar programs. These programs provide benefits for work-related injuries or illnesses.
Appointment Reminders and Instructions. We may use and disclose your PHI to remind you of upcoming appointments. For example, we may call, text, or e-mail you to remind you of a scheduled appointment or to provide instructions prior to a test or surgery.
Health-Related Benefits and Services. We may use or disclose your PHI to identify health-related services and products that may be beneficial to your health, such as notification of a new physician and/or additional products and services and then contact you about those products and services. If you do not wish to receive information of this type, please contact us at www.mainlinehealth.org/optout or:
Main Line Health Marketing Office
240 N. Radnor Chester Road
Radnor, PA 19087
As Required by Law. We may use and disclose your PHI when required to do so by any other laws not already referenced above.
V. Uses and Disclosures Requiring Your Specific Authorization.
Highly Confidential Information. Federal and State laws require special privacy protections for certain highly confidential information about you. This includes PHI that is: 1) maintained in psychotherapy notes; 2) documentation related to mental health or developmental disabilities services; 3) drug and alcohol abuse, prevention, treatment and referral information; and, 4) information related to HIV status, testing and treatment as well as any information related to the treatment or diagnosis of sexually transmitted diseases. Generally, we must obtain your authorization to release this type of PHI. However, there are limited circumstances under the law when this type of PHI may be released without your consent. For example, certain sexually transmitted diseases must be reported to the Department of Health.
Substance Use Disorder Treatment Records. This section of the Notice specifically and exclusively applies to Substance Use Disorder ("SUD") treatment records maintained by Mirmont and is prepared in accordance with the regulations governing the privacy of SUD treatment records found at 42 C.F.R. Part 2 ("Part 2").
Uses and Disclosures Without Patient Consent. Unless Mirmont has a consent signed by you, it may only disclose your SUD records for the following purposes:
- Communications within Mirmont or MLH based on need to know;
- Communications with a Qualified Service Organization (QSO);
- Report to law enforcement crime or threats (i) on Mirmont's premises or (ii) against Mirmont personnel;
- For bona fide medical emergencies if your prior written consent cannot be obtained;
- For audits of Mirmont by government and accreditation agencies; and
- As otherwise permitted under state and federal law.
Uses and Disclosures Requiring Patient Consent. Mirmont will make uses and disclosures of your SUD records not described above in this Notice only with your written consent. For example, Mirmont will not release SUD records to a family member involved in your care without your prior written consent.
Single Consent. You may provide a single consent for all future uses or disclosures of your SUD records to your treating providers, health plans, third-party payers, and people helping to operate Mirmont's program for the purposes of treatment, payment, and/or healthcare operations pursuant to Part 2. Your SUD records that are disclosed to certain people or facilities subject to Part 2 and/or HIPAA pursuant to your single consent may be further disclosed by those people or facilities without your written consent to the extent the HIPAA regulations permit such disclosure.
Revocation. Even after you give consent, you have the right to revoke that consent at any time in writing delivered to the address in the header of this Notice or as directed on Mirmont's consent forms. After Mirmont receives your written notice to revoke, it will terminate your earlier consent within five (5) business days. Prior to such termination, Mirmont may have shared some or all of your information or otherwise taken action in reliance on your consent; neither Mirmont nor any of its representatives are liable for any release of information during such time.
Patient Rights. You have the following patient rights as provided in Part 2. To exercise any of the following rights, please contact Mirmont in person, via mail, via telephone, or via email at the address in the header of this Notice. Include a description of the right that you wish to exercise, a description of how you wish to exercise it, and your contact information so that we may contact you with questions.
- The right to request restrictions of disclosures made with prior consent for purposes of treatment, payment, and healthcare operations.
- The right to request and obtain restrictions of disclosures of your SUD to your health plan for those services for which you have paid in full.
- The right to an accounting of disclosures of your SUD records in electronic form for the past three (3) years, and a right to an accounting of disclosures as set forth in the HIPAA regulations for all other disclosures made with consent.
- The right to a list of disclosures by an intermediary for the past three (3) years.
- The right to obtain a paper or electronic copy of this Notice upon request.
- The right to discuss and ask questions about this Notice.
- The right to elect not to receive fundraising communications.
- You have the right to submit a complaint to Mirmont and to the Secretary of the Department of Health and Human Services if you believe your privacy rights have been violated. You will not be retaliated against for filing a complaint.
Judicial Matters.
- Records, or testimony relaying the content of such records, will not be used or disclosed in any civil, administrative, criminal, or legislative proceedings against you unless based on specific written consent or a court order.
- Records will only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to you and/or Mirmont as the holder of the record as required by 42 U.S.C. § 290dd-2 and 42 C.F.R. Part 2, which are a federal statute and set of regulations that protect the privacy of SUD treatment records.
- A court order authorizing use or disclosure must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the record is used or disclosed.
Other Uses or Disclosures Not Described in this Notice. Other uses and disclosures of PHI not covered by this Notice or permitted under the laws that apply to us will be made only with your written permission. Except as permitted under this Notice or as permitted by law, we will seek your written permission prior to using or sharing your information for marketing purposes or selling your information. If you provide us permission to use or disclose your PHI, you may revoke that permission, in writing, at any time to the address in the header of this Notice or to privacy@mlhs.org. If you revoke your permission, we will no longer use or disclose your PHI for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain a record of the care that we provided to you.
VI. Your Rights Regarding Medical Information About You.
You have the following rights regarding PHI we maintain about you:
Right to Obtain. You have the right to request your PHI, excluding psychotherapy notes, in a hard-copy or electronic format, if we maintain the PHI in an electronic format. You may be charged a fee for the costs of copying, mailing or other supplies associated with your request. Instructions on how to request your PHI are at: https://www.mainlinehealth.org/patient services/medical-records.
Right to Inspect and Copy. You have the right to inspect and copy PHI that may be used to make decisions about your care, excluding psychotherapy notes. Instructions on how to request your PHI are at: https://www.mainlinehealth.org/patient-services/medical-records.
We may deny your request to inspect and copy in certain very limited circumstances. You may request a professional review of the denial. If you request a review, then we will designate another MLH licensed healthcare professional to review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.
Right to Amend. You have the right to request that we amend the PHI we keep about you in your medical and billing records. Instructions on how to request an amendment to your PHI are at: https://www.mainlinehealth.org/patient-services/medical-records.
We will ask your provider(s) to review amendment requests to the medical record. We may deny your request if we believe the information you wish to amend is accurate, current and complete without your requested amendment, or the PHI was not created by Main Line Health, or other special circumstances apply.
Right to an Accounting of Disclosures. You have the right to request a record of all disclosures of your PHI. We are not required to give you an accounting of information we have used or disclosed for treatment, payment or healthcare operations or information you authorized us to disclose.
To request this list or accounting of disclosures, you must submit your request in writing to:
Health Information Management,
3803 West Chester Pike Suite 160
Newtown Square, PA 19073.
Your request may cover any disclosures made in the six years prior to the date of your request.
Right to Request Restrictions. You have the right to request a restriction or limitation on the PHI we use or disclose about you for treatment, payment or healthcare operations. We are not required to agree to your request. If we agree to a restriction, we will abide by restrictions unless a disclosure is needed to provide you emergency treatment. If you request that we not share your PHI with your medical insurer or other third-party payer, we will honor your request provided you pay in full for the healthcare item or service.
To request restrictions, you must make your request in writing to the appropriate Main Line Health office or department. In your request, you must tell us: (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and, (3) to whom you want the limits to apply, for example, disclosures to your spouse.
Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location.
To request confidential communications, you must make your request in writing to the appropriate Main Line Health office or department. We will accommodate reasonable requests. Your request must specify how or where you wish to be contacted.
Right to Revoke Your Authorization. You may revoke an authorization for us to use and disclose your PHI at any time, except to the extent we have already relied upon it, by submitting a request in writing to the appropriate office or department.
VII. Links and Interfaces to Third-Party Products and Services
For convenience, we offer some digital services including MyChart patient portal and application programming interfaces ("Digital Services"). Some Digital Services can connect parts of your MLH electronic health record ("EMR") to some third-party mobile applications, websites, and online products and services ("Non-MLH Services"). If you connect to Non MLH Services, those services can access and receive information from your EMR. We do not own or control the Non-MLH Services. Their access to your information is outside our Digital Services, even if you connect to them with your patient portal credentials.
Because we do not own or control the Non-MLH Services or the companies that operate them including any that are co-branded (defined below) with us ("Non-MLH Services and Companies"), we do not control and are not liable for (i) their content, products or services (ii) your use of them; (iii) anything they do or do not do, and your use of them is at your sole risk. We make NO representation, warranty or guaranty about the security and privacy of any data or information that you give to the Non-MLH Services and Companies or allow them to access, including your personal and electronic health record information. We have no obligation to update your information in Non-MLH Services unless you make a specific request.
The Non-MLH Services and Companies are not covered by this Notice of Privacy Practices or any other MLH policies. We have no control, responsibility or liability for any policies or practices of the Non-MLH Services and Companies. The provisions of this paragraph apply even if the Non-MLH Services and Companies help you manage your health or take and fulfill orders for products or services purchased from us or are co-branded with us, or both. Co-branded means that a product or service or content has both the name(s) of the Non-MLH Services and Companies and our name and logo.
If our Digital Services contain advertisements, still we make NO representation, warranty or guaranty about the advertised products, content and services and we have no responsibility or liability for any of them.
You are not required to connect to any Non-MLH Services and Companies, even if co-branded or advertised. Before you decide to connect to Non-MLH Services and Companies, review their privacy policies, terms and conditions of use and anything else you think is important to ensure you are satisfied with them and their protection of the privacy and security of your personal and medical information.
VIII. Changes to This Notice.
We reserve the right to change this Notice. Revised Notices will be posted in appropriate locations and on-line at http://www.mainlinehealth.org/. We reserve the right to make the revised or changed Notice effective for medical information we already have about you as well as any information we receive in the future. A copy of the current Notice is available upon request.
IX. Complaints.
If you believe your privacy rights have been violated, you may file a complaint, in writing, with the Main Line Health Chief Privacy Officer, Corporate Compliance Office, 240 N. Radnor Chester Road., Radnor, PA 19087.
You may also wish to file a complaint with the Office for Civil Rights of the U. S. Department of Health and Human Services. The Privacy Officer can supply the correct address for the Office for Civil Rights.
A complaint must be made in writing and will not in any way affect the quality of care we provide you.
X. Breach Notification.
We will notify you in the event of a breach (as defined by HIPAA) of your PHI.
This Notice is effective: April 14, 2003
Updated: 5/11, 7/13, 7/14, 10/16, 12/16, 10/17, 1/18, 10/18, 4/21, 6/22, 10/23, 2/25, 2/26
Downloadable Notice of Privacy Practices (PDF)
Non-Discrimination and Availability of Services Notice
Main Line Health does not discriminate or exclude people on the basis of race, religion/creed, color, national origin (including limited English proficiency and primary language), age, disability, sex (including sex characteristics, intersex traits, pregnancy or related conditions, sexual orientation, gender identity, and sex stereotypes), parental status, political affiliation, military service, relationship status, or source of payment or any other categories protected by federal, state or local law.
Main Line Health provides reasonable modifications for individuals with disabilities, and free aids and services to people with disabilities to communicate effectively with us, such as:
- Qualified sign language interpreters
- Written information in other formats (including large print, audio, accessible electronic formats)
- Free language services to people whose primary language is not English, such as:
- Qualified interpreters
- Information written in other languages
If you need these services, ask a doctor, nurse or department manager where you are receiving care.
If you believe that Main Line Health has failed to provide these services or discriminated in another way on the basis of race, color, national origin, age, disability or sex (including pregnancy, sexual orientation and gender identity), you can obtain a copy of our grievance procedure and file a grievance with Patient Guest Relations/Patient Advocacy for the facility in which you received care by calling 484.337.2662. You can also mail your written grievance to our Section 1557 Coordinator:
Office of the Chief Diversity and Equity Officer
240 N. Radnor Chester Road
Radnor, PA 19087
or email mlhpatientrelations@mlhs.org.
You can also file a civil rights complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, electronically through the Office for Civil Rights Complaint Portal, available at https://ocrportal.hhs.gov/ocr/portal/lobby.jsf, or by mail or phone at:
U.S. Department of Health and Human Services
200 Independence Avenue, SW
Room 509F, HHH Building
Washington, DC 20201
1.800.368.1019, 800.537.7697 (TDD)
Complaint forms are available at https://www.hhs.gov/ocr/complaints/index.html.
Content created by Office for Civil Rights (OCR)