Effective Date 09/23/2013
THIS NOTICE DESCRIBES HOW YOUR MEDICAL INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
What is a Notice of Privacy Practices?
Boston Children’s Hospital (BCH) knows your medical information is personal and private. Medical information referred to as Protected Health Information (PHI) is individually identifiable information about you or your health care and includes all paper and electronic records. PHI may include notes from doctor’s appointments and hospital stays, reports from surgery, test and lab results, and copies of X-rays or other images. These are just a few examples.
By law, we must protect the privacy of your PHI and provide this Notice of Privacy Practices (Notice) that tells you:
• How BCH may use or disclose your PHI
• Your rights and responsibilities concerning the privacy of your PHI, including how you may look at or get a copy of your information from BCH
• Who to contact if you have questions or want to make a complaint
If you are a parent or legal guardian receiving this Notice because your child receives care at BCH, please understand that when we say “you” in this Notice, we are referring to your child. We are talking about the privacy of his or her PHI.
Who Must Follow the Rules in this Notice?
This Notice applies to all staff at Boston Children’s Hospital, its physicians, nurses, and other personnel. It applies to PHI at Boston Children’s, at affiliated clinical sites owned and operated by Boston Children’s, and at Boston Children’s Physician Practices (collectively “BCH”).
Boston Children’s has joint programs with other institutions and health care providers. We may share resources and services with these programs for diagnosis, treatment, education, and research related to specific diseases, therapies, or conditions. Participating providers may share medical, quality assurance, administrative, fundraising, or research information. Some of the affiliated practices and joint programs include, but are not limited to:
Affiliated Clinical Sites
• Boston Children’s Community Early Intervention
• Boston Children’s at Lexington
• Boston Children’s at Peabody
• Boston Children’s at Waltham
• Boston Children’s Physicians Weymouth
• Boston Children’s Physicians at Beverly Hospital; at Good Samaritan Medical Center; at Norwood Hospital; at Holy Family Hospital and Medical Center; at South Shore Hospital; at Winchester Hospital and at St. Luke’s Hospital (Southeast Hospitals Group)
• Martha Eliot Health Center
• Dana Farber Children’s Hospital Cancer Care
• Regional Center for Poison Control and Prevention
• The Boston Hemophilia Center (a collaboration with Brigham & Women’s Hospital)
• Brigham and Women’s Hospital, Beth Israel Deaconess Medical Center and Dana Farber Cancer Institute (share many clinical services and programs with Boston Children’s)
My child is younger than 18 years old. What are his or her rights?
Patients younger than the age of 18 are usually considered minors. Most of the time, the parents or legal guardians of minor patients make decisions about their children’s medical care and have the privacy rights described in this Notice. However, there are times a minor may exercise these rights and may even legally keep information confidential from his or her parents or guardians. For example, a minor has the rights of an adult with respect to diagnosis and care of some conditions (defined by law) such as sexually transmitted diseases, drug dependency, and pregnancy. In addition, minor patients who are married, have given birth to a child, or meet other legal criteria are considered “emancipated” and have the rights of an adult. When minor patients are allowed by law to make decisions about their own medical care, they can usually control the release of their medical information even to their parents/legal guardians.
How do we share your information without your permission/authorization?
Generally, we may use and share your PHI to provide patient care, receive payment for services, support health care operations, contact you and perform research. The most common reasons are listed below along with some examples and exceptions:
Members of the BCH healthcare team may use and share your PHI among each other and with others to provide you with care. For example, we may share information to:
• Provide, coordinate or manage health care and related services. We may share information with other health care providers. For example, we may use and disclose PHI when you need a prescription, lab work, an X-ray, or other services
• Refer you to another health care provider such as a specialist, home health agency, ambulance or transport company, early intervention services, educational or assistance services, crisis counseling, and or rehabilitation hospital
• Communicate with clinicians who previously treated or referred you to Boston Children’s, including your primary care physician and to clinicians who will treat you after you leave Boston Children’s
Payment for Services
Staff at BCH may use and share your PHI so we can get paid for your care. For example, we may use or disclose PHI to:
• Obtain approval from your health insurance company to pay for your medical services
• Collect payment from you, your health insurance company or another person who has agreed to pay for your healthcare
There are some exceptions. For example, payers may not receive information (defined by law) when a minor patient identifies a visit as confidential, or when you pay for services for an item in full and out-of-pocket. It is the responsibility of the patient to inform BCH if one of these exceptions applies.
Health Care Operations
Staff at BCH may use or disclose PHI to perform administrative and business activities (health care operations). Examples include using or disclosing PHI to:
• Review and improve health care quality, lower costs, coordinate care, and provide information about treatment alternatives, educational programs, or new procedures
• Review and evaluate the skills, qualifications, and performance of our staff or others
• Provide training programs for students, health care providers, and other professionals to help them learn, practice or improve skills
• Cooperate with organizations, government agencies, or accrediting groups to review the quality of care we and others provide, including preparing for inspections or reviews of our facilities
• Cooperate with organizations that evaluate, certify, or license health care providers, staff, programs, or facilities
• Plan and manage Boston Children’s operations and services, including alliances, joint ventures, asset sales, and mergers
• Maintain and support information and computer systems
• Investigate and resolve a family, patient, or staff complaint
• Investigate and follow-up on abuse or fraud complaint
• Comply with this Notice and with applicable laws.
How else may we may use or share your information without your permission?
Staff at BCH may use your PHI to contact you at the address and telephone numbers you give us (including leaving phone messages). We may also contact you at the email address you provide in some cases. We may contact you to:
• Remind you of an appointment or to notify you that it has been canceled or rescheduled
• Discuss registration, insurance, billing, or payment
• Conduct pre-procedure assessments and to provide pre-procedure instructions
• Provide test results, patient care information, and/or follow-up care instructions
• Recommend care options or alternatives, benefits, services, programs, products and/or other health care providers
• Notify you in the event of a breach of the privacy or security of your PHI
• Provide you with the opportunity to participate in a survey
• Ask if you would like to participate in our public relations or marketing efforts, or to help us advocate for government funding services, legal changes, and programs to benefit other patients and families. We will not publicly disclose your PHI for these purposes without your written authorization. Examples include sharing your story in:
• Boston Children’s publications or external print or electronic media outlets (newspapers, books, brochures, magazines, film, videotape, television, radio or Internet broadcasts)
• Boston Children’s advocacy, outreach efforts, and special events such as the Boston Children’s Hospital Telethon
If you are not available, or unless you tell us otherwise (see Right to Request Confidential Communication below), we may leave a message on your answering machine or with a person who answers your telephone.
BCH does research to learn more about health and disease. You will never receive health care solely for research purposes without your consent. However, in some cases, informational research may be done without your written authorization. For example, Boston Children’s researchers may work with health information that does not include names or other personal information.
Boston Children’s may use or disclose PHI for research that is approved by the Boston Children’s Hospital Institutional Review Board (IRB) if it involves minimal risks, protects against misuse and disclosure, and meets other legal requirements. Staff may use PHI to prepare for research or contact you about research studies for which you qualify.
PHI acquired, used, or created for research may be used or disclosed for care, payment, health care operations, or other purposes where authorization is not required. For example, we may tell your doctors of clinical research activities that could affect your care.
Public Health and Safety
We may disclose or report PHI as required by federal, state, or local law or if we in good faith believe that it will prevent or lessen a serious threat to the health and safety of the public or another person. We may report to public health, child protection, domestic violence, health care system oversight, government benefits, public safety, medical research, and/or product safety agencies. For example, we report:
• Some infectious diseases, births, and deaths, abuse and neglect, burn injuries, cancers, childhood vaccine injuries, some wounds, and sexual assaults
• Communicable diseases (except as prohibited by law) to people who may have been exposed or who are at risk of contracting or spreading a disease or condition, or to a public health authority managing a communicable disease investigation or intervention
• PHI necessary to perform the duties of coroners, medical examiners or funeral directors
• Medication reactions or product problems to assess the safety and effectiveness of some drugs and medical equipment or to notify product users of recalls
• Government-regulated product tracking information
• Information we believe can help prevent or lessen a public safety threat, including giving information to the potential subject of the threat.
• Information requested by authorized federal officials and permitted by law for intelligence, counterintelligence, and other national security activities
• Information requested by authorized federal officials and permitted by law to protect government officials or foreign heads of state, or to conduct special investigations into threats against those persons
Organ and Tissue Donation
We may share PHI with organ donor banks and groups involved in organ, eye or tissue procurement, transplantation or donation.
Health Institution Oversight Activities
We may share PHI with agencies that oversee healthcare programs. These agencies use the information to issue licenses, conduct investigations and monitor whether healthcare providers follow the law. For example, these activities may include audits, investigations, inspections and licensure. The government uses this information to monitor government programs, and compliance with civil rights laws.
We may share PHI to comply with workers’ compensation or similar programs that provide benefits for work-related injuries or illness.
Respond to a Court Order, Subpoena or Other Lawful Request
We may share your PHI in other situations when allowed or required to do so by law. For example, we report information to respond to a
• Court or administrative order
• Subpoena, discovery request, or other lawful process, without a court or administrative order or request, if we receive satisfactory assurances that the party seeking the PHI has made reasonable effort to tell you about the request or to obtain an order that protects the confidentiality of the information.
Certain highly sensitive “privileged” information, such as sexual assault counseling, psychotherapy details, substance abuse information or some social work PHI can only be shared with a lawyer or other authorized official if a court order is obtained, or with your permission or under certain circumstances.
We may release PHI to a law enforcement official, with some limitations. Examples include:
• In an emergency to report a crime, the location of a crime or victims; and the identity, description, or location of the person who committed the crime
• Report certain types of wounds, if required by law, such as wounds caused by firearms
• In response to a court order, administrative order or request, grand jury subpoena, judicial subpoena, warrant, summons or similar process
• To identify or locate a suspect, fugitive, material witness, or missing person
• To provide PHI about a victim of a crime or domestic violence (if the victim agrees), or if immediate law enforcement activity against someone other than the victim depends on disclosure and the information is not intended for use against the victim
• Alert law enforcement about a death we suspect may be caused by criminal conduct
• Respond to a request for information, if you are the victim of a crime and agree to information sharing or in certain cases are not able to agree due to your injuries
• Evidence of criminal conduct at Boston Children’s
• To identify or catch an individual who has escaped a cor-
rectional institution or other lawful custody, or who has
admitted participation in a violent crime that we reasonably believe may have caused serious physical harm to a victim
• If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release your PHI to the institution or official. This may be necessary for the institution to provide health care to you, protect your health and safety or the health and safety of others, or for the safety and security of the correctional institution.
Special Government Activities
We may share your PHI with authorized federal officials for:
• National security activities permitted by law
• Protection of government officials or foreign heads of state or to conduct investigations of threats against these persons
• Military and veteran activities as allowed by law if you are or were a member of the armed forces
Provide Services on Behalf of BCH
We may share your PHI with individuals and organizations that assist BCH with our business activities.
BCH has agreements with these individuals and organizations which require that the information we share with them is protected and only used and shared to provide services on our behalf. For example, we may share your information with others who:
Invoice insurance companies on our behalf
Provide us with software support to assist with maintenance of our computer systems
Evaluate our operations to help us improve
Assist us with our fundraising programs
Proof of Immunization to a School
We may share documentation with schools including most child care facilities showing that your child (or you if you are an adult or an emancipated minor) has been immunized as required under law, as long as we have your verbal or written agreement or you have requested that we share this information.
How we may use or share your information if you do not object?
If you can make your own health care decisions you can object to sharing information with others. If you cannot make your wishes known, we will use our best judgment to decide whether to share information. Unless you object, we may use or disclose your PHI as follows:
We may include your name, room number, and health status in the patient directory during your stay. We may provide this information to anyone who asks for you by name unless you object. We may also give directory information, including your religion (if you share that with us) to members of the clergy so that they can visit you.
Involvement in Care
At your request, or if we believe it is in your best interest, we may share your PHI with others who are not your parent or legal guardian that you identify as participants in your care. We will share only PHI directly related to that person’s involvement in or payment for your care. We may also share PHI necessary to notify them of your location, or general condition. We will only share information that we believe others need to know. This does not permit other people to get any information they want about you. Instead, it allows us to share information with those people if the staff believes it is in your best interest and if you have not specifically objected to its use or disclosure. In some cases, laws prevent sharing PHI with your parents or guardians without your consent. We will follow all such Massachusetts and federal laws.
We rely on fundraising to support advances in pediatric care, research and education and to provide many special services and programs to our patients and the community. We may use certain information (such as your name, address, age, gender, date of birth, telephone number and other contact information (such as email address), dates when you received care at BCH, department of service, the name of your treating physician, your treatment outcome and health insurance status) to contact you to support our fundraising activities. You may receive calls, letters or other communication from the Boston Children’s Hospital Trust which does fundraising for BCH or from an outside organization helping BCH with fundraising, asking you to consider making a donation. Any fundraising communications you receive from BCH will include information about how you can be removed from our contact list and will include a toll free number 1-888-362-4453 and email address Info@chtrust.org. Your decision will have no impact on your treatment and payment for services at BCH.
Disaster Relief Services
We may share information necessary for disaster relief activities with the Red Cross or other similar relief agencies so that we can tell your family members where you are, your health condition, or to assist with coordination of other relief services.
Display Items you Share with Us
We may display photographs, letters, cards, or artwork that you give us. We may display these items, but we will not show your full name, address or other identifying information. Please tell us if you do not want this information displayed when you give it to us.
When is your written permission needed to use and share your information?
Any Other Use or Disclosure of your PHI Other Than Previously Described in this Notice Requires Your Authorization
For any use or sharing of your PHI not described in this Notice, we need your specific and complete written permission (also called an authorization). For example, we need written permission if we were to use or share your information for marketing purposes or if we were to sell your information. Your authorization (permission) must describe who will use, disclose and/or receive your PHI, the purpose of the use or disclosure, the date your request expires and your signature. You may cancel your permission in writing at any time by submitting your cancellation request to the same person to whom you gave your written authorization. Although we cannot take back any disclosure we already made with your authorization, we will make reasonable efforts to notify persons we have shared it with of your wishes.
Certain Types of Information are Given Additional Protection under Federal and State Laws
Certain types of highly sensitive medical information are given extra protections under Federal and State law. We may be required under these laws to get your written permission to share the following:
• psychotherapy notes written and kept by your therapist, except for purposes related to treatment, payment or our hospital’s operations to avoid a serious threat to health or safety, or as required by law.
• other mental health information
• substance (drug and alcohol) abuse treatment information
• HIV/AIDS testing, diagnosis or treatment information
• Information about reproductive health issues, such as sexually transmitted diseases or pregnancy
What are your privacy rights?
You have the following rights concerning your medical information. If you would like to make use of any of these rights, contact your doctor or other healthcare provider at BCH or contact our Health Information Management Department at the address listed below. You may need to send your request in writing in some cases.
You Can Request Limits on Uses and Disclosures of Your PHI
You have the right to ask us to limit how we use and share your PHI, including the information we share with someone involved in your care or payment for your care. We will carefully consider all requests, and tell you whether we can agree to your request. Please understand that we will not be able to agree to most requests because they may prevent us from using or sharing information needed for treatment, payment and to manage our healthcare facilities. However, if you ask us not to share your medical information with your health plan regarding a service or item paid in full out-of-pocket, we will comply with your request.
You Can Request to See and/or Receive a Copy of Your PHI
You have the right to look at and get a copy of your medical records, billing records and other records used by BCH to make treatment or billing decisions about you with certain exceptions. If you request a copy of information held electronically, BCH is required to provide access to the electronic information in the electronic form and format as agreed by the requester and BCH. If you request a copy of your records, whether in electronic or hard copy, we may charge a reasonable fee for copying as allowed by state law and must comply within required timeframes.
To access your medical record, submit your written request to:
Health Information Services
Release of Information, Fegan B-014
Boston Children’s Hospital
300 Longwood Avenue
Boston, MA 02115
Billing or financial record:
Patient Financial Services Correspondence-
Boston Children’s Hospital
300 Longwood Avenue
Boston, MA 02115
Note: If the offices listed above do not have the PHI you are looking for, contact the office where you received care.
We may deny your request to see and/or copy your information if:
• You do not provide proper identification
• You are requesting disclosure that the law does not allow
• The record contains confidential information from someone other than a health care provider and disclosing it would put that person at risk
• The PHI was collected to prepare for a civil, criminal, or administrative case.
If you are denied access to your request for information, you can ask that the denial be reviewed. Except in cases where you have no legal right of review, BCH will ask another licensed health care provider to review your request and the denial. The reviewer will not be the person who denied your original request. We will comply with the outcome of the review.
Right to Request a Change to Your Medical Information
You have the right to request a change to information you believe is wrong or incomplete in your medical record or other records used by BCH to make treatment or billing decisions about you. Generally, content cannot be removed from your record, but corrections or clarification can be added. Submit your written request to the Director of Health Information Management at the address noted above and include the reason for the change. We will carefully consider all requests and inform you whether the change you requested can be made.
We may deny your request if:
• Your request is not in writing or does not include a reason to support it
• We did not create the information. We may fulfill an amendment request if the person or entity that created the PHI is no longer available
• The PHI of the request is not information kept by or for Boston Children’s
• The PHI is not information that you would be allowed to see and/or copy
• We believe the PHI is accurate and complete.
Right to a List of Certain Disclosures of Your Medical Information
You have the right to ask for a list of some PHI disclosures. Unless a government agency requests that we delay our response, we will provide you with a list of PHI disclosures except those
• That you authorized
• Made for purposes of treatment, payment or health care operations
• Made to you, or to others designated by you
• That occurred as a result of permitted uses and disclosures
• From the hospital inpatient directory
• For national security and intelligence, or to law enforcement or correctional officials
• That do not include identifiable data
• Made before April 14, 2003
Submit your written request to the Boston Children’s Hospital Privacy Officer. Contact information is provided at the end of this notice.
Right to Request Confidential Communication
You have the right to ask us to communicate with you in a certain way or at a certain place to better protect your privacy. For example, you may ask us to contact you only at work or only at home. You do not have to give a reason for the request. We will make reasonable efforts to meet your request within the limits of our current system. If agreeing to a request could prevent BCH from collecting payment for your care, you will need to provide more information about how your bill will be paid.
Right to Revoke an Authorization
You have the right to change your mind after you sign a permission form allowing BCH to release your PHI. You can cancel your written permission at any time. If you cancel your permission, we will not release any more of your information of which you are entitled to prevent us from disclosing. However, we cannot take back information we have already released.
Right to Request Paper Copy of this Notice and Availability of Notice on Website
You have the right to request a paper copy of the current version of this Notice at any time even if you have agreed to receive the Notice electronically. Contact the Center for Families or BCH Privacy Officer (address below). A copy of our current Notice can also be found on our website at bostonchildrens.org/records.
Right to Receive Notification of a Breach of Your Information
You have the right to and will receive notification in the event of a breach of the privacy or security of your PHI.
Medical Record Retention
Boston Children’s maintains medical records for at least 20 years after the patient’s discharge or after the final treatment, as required by state law. A copy of the hospital’s medical record retention policy is available upon request.
Revisions to this Notice
As the law permits, we reserve the right to change this Notice and to do so without advance notice or consent. We also reserve the right to make the revised Notice effective for PHI we already have as well as information we receive in the future. We will post a copy of the current Notice in the hospital and on our website. The effective date of a version of the Notice will be written in the top right corner of the first page.
Whom to Contact if Your Privacy Rights have Been Violated or if you Have a Question About this Notice?
If you believe the privacy of your medical information has been violated, you may file a complaint directly with the BCH Privacy Officer or BCH Center for Families either by telephone or in writing (see contact information below). We respect your right to file a complaint and all complaints are reviewed and fully investigated. Boston Children’s prohibits our staff from retaliating against you for making a complaint. If you believe that this has happened, immediately contact Boston Children’s Hospital.
You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. Information on how to file a complaint with this government agency may be found at:
http://www.hhs.gov/ocr/privacy/hipaa/complaints/index.html or by calling 1-800-368-1019
Department of Health and Human Services, Office for Civil Rights,
Region I, Government Center, JFK Federal Building, Room 1875,
Government Center, Boston, MA 02203-0002
Whom to Contact if You Have Questions About this Notice?
If you have any questions about this Notice or need help exercising any of your privacy rights, you can contact the BCH Privacy Officer or BCH Center for Families (see contact information below):
Compliance Department - BY357
Boston Children’s Hospital
300 Longwood Avenue, Boston, MA 02115
Center for Families
Boston Children’s Hospital
300 Longwood Avenue, Boston, MA 02115
Download our Notice of Privacy Practices
Copyright © 2013 Boston Children’s Hospital, 300 Longwood Avenue, Boston, MA 02115. All rights reserved.
This Privacy Notice is adapted to meet regulatory requirements implementing the Health Insurance Portability and Accountability Act (HIPAA), 45 CFR Parts 160 and 164. It may therefore contain incidental text, including terminology, from that regulation, which is not subject to Boston Children’s reservation of rights. It is otherwise protected by United States copyright law, and except as specifically authorized by Boston Children’s Hospital or applicable law, may not be copied or distributed, in whole or in part, without express permission of Boston Children’s Hospital.