Patient Privacy

Fenway Health is required by law to maintain the privacy of your health information and to provide you with a description of our legal duties and privacy practices regarding your health information. Our current Notice will be available in the main reception area and on our website at www.fenwayhealth.org. The Notice will include the effective date and version. In addition, at your initial visit, we will make our best effort to provide you with a copy of this notice and we will request you acknowledge receipt of the Notice with your signature.

We are required by law to abide by the terms of this Notice and notify you if we make changes to this Notice, which may be at any time. Changes to the Notice will apply to your medical information that we already maintain as well as new information received after the change occurs. You may also request a revised Notice at your next appointment or appropriate visit. This Notice will also serve to advise you as to your rights with regard to your medical information.

The following categories describe examples of the way we use and disclose medical information. These examples are not meant to be exhaustive, but rather to describe for you the types of uses and disclosures that may be made:

• For Treatment: We may use medical information about you to provide, coordinate and manage your treatment or services. We may disclose medical information about you to other doctors, nurses, technicians, medical students, or other personnel who are involved in your care. For example, a laboratory or medical specialist may need to know information about you to run tests or to provide treatment. We may also provide a subsequent healthcare provider with copies of various reports that should assist him or her in treating you. For example, your medical information may be provided to a physician to whom you have been referred so as to ensure that the physician has appropriate information regarding your previous treatment and diagnosis. The amount of information shared will be the “minimum necessary” for a healthcare provider to make informed decisions about your care.
• For Payment: We may use and disclose medical information about your treatment and services to bill and collect payment from you, your insurance company or a third party payer. For example, we may need to give your insurance company information before it approves or pays for the health care services we recommend for you. The insurance company may use that information in connection with making a determination of eligibility or coverage for insurance benefits, reviewing services provided to you for medical necessity, and undertaking utilization review activities. For example, obtaining approval for a hospital stay may require that your relevant protected health information be disclosed to the health plan to obtain approval for the hospital admission.
• For Health Care Operations: We may use or disclose, as needed, your health information in order to support our business activities. These activities may include, but are not limited to quality improvement activities, employee review activities, training of medical students, licensing, marketing, fundraising, legal advice, accounting support, medical records storage, transcription and conducting or arranging for other business activities. For example, we provide medical records to a storage company for long-term safekeeping. In addition, we may also call you by name in the waiting room when your physician is ready to see you. We may use or disclose your protected health information, as necessary, to contact you to remind you of your appointment by telephone.
• Research: We may use your PHI for research purposes when our Institutional Review Board has reviewed the research proposal and approved the research based on established protocols to ensure the privacy of your PHI.
• Business Associates: There are some services provided in our organization through contracts with third parties, which we refer to as business associates. Examples include accounting, legal services and record storage. When these services are contracted, we may disclose your health information to our business associate so that they can perform the job that we have asked them to do or to bill you or your third-party payer for services rendered. To protect your health information, however, we require the business associate to appropriately safeguard your information through a written contract.
• Affiliated Covered Entities:  Fenway Health and AIDS Action Committee are related through a common ownership structure.  We may share what is considered “minimum necessary” information about you between these entities if you are a client of both organizations.

As a covered entity under HIPAA, Fenway Health permits the sharing certain types of health information for treatment and care continuity purposes. Fenway Health medical providers occasionally access health information exchanges, such as Hospital Connect, the Mass HIway, Prescription Monitoring Program, and Dr. First medication history lookup through Athena Health, our electronic health record. These information exchanges are secure ways of sending or obtaining health information on a strict need to know basis in order to provide you with high quality clinical care and to coordinate your care in an efficient way. While access to some health information systems like the Prescription Monitoring Program are mandated by state and federal law, patients are able to opt out of other systems at any time by sending your request in writing to [email protected].

We also may use and disclose your health information as set forth below. You have the opportunity to agree or object to the use or disclosure of all or part of your health information in these instances. If you are not present or able to agree or object to the use or disclosure of the health information (such as in an emergency situation), then your clinician may, using professional judgment, determine whether the disclosure is in your best interest. In this case, only the information that is relevant to your health care will be disclosed.

• Individuals Involved in Your Care or Payment for Your Care: Unless you object, we may disclose medical information about you to a friend, family member or any other person you identify who is involved in your medical care or who helps to pay for your care. In addition, we may disclose medical information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location. If you are unable to agree or object to such a disclosure, we may disclose such information as necessary if we determine that it is in your best interests, based on our professional judgment. We may use or disclose protected health information to notify or assist in notifying a family member, personal representative or any other person that is responsible for your care of your location, general condition or death. Finally, we may use or disclose your protected health information to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in your health care.
• Emergencies: In an emergency treatment situation, we may have to use or disclose your protected health information in a context in which consent for the release of information has not already been given. If this happens, we will try to obtain your consent to the release of information as soon as reasonably practicable after the delivery of the treatment. If we are required to treat you and have attempted to obtain your consent but are unable to obtain your consent, we may still use or disclose your protected health information to treat you.
• Future Communications: We may communicate to you via newsletters, mailings or other means regarding treatment options; information on health-related benefits or services, disease-management programs, wellness programs; to assess your satisfaction with our services; to remind you that you have an appointment for medical care; as part of fundraising efforts; for population based activities relating to improving health or reducing health care costs; for conducting training programs or reviewing competence of health care professionals; or other community based initiatives or activities in which our facility is participating. If you are not interested in receiving these materials, please contact our Privacy Officer.
• Research: We may disclose information to researchers when the research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your health information. This also may include preparing for research or telling you about research studies that might interest you.

There are other circumstances in which we may have to use or disclose your protected health information, even without your consent or authorization. These situations include:

• Communication Barriers: If we attempt to obtain consent from you but is unable to do so due to substantial communication barriers and we determine, using professional judgment, that you would consent to the use or disclosure under the circumstances, we may use and disclose your protected health information.
• Disclosure Required By Law: We may use or disclose your protected health information to the extent that the use or disclosure is required by law. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. You will be notified, as required by law, of any such uses or disclosures.
• Public Health: We may disclose your protected health information for public health activities and purposes to a public health authority that is permitted by law to collect or receive the information. The disclosure will be made for the purpose of controlling disease, injury or disability. We may also disclose your protected health information, if directed by the public health authority, to a government agency that is collaborating with the public health authority.
• Communicable Diseases: We may disclose your protected health information, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.
• Health Oversight: We may disclose protected health information to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, other government regulatory programs and civil rights laws.
• Abuse or Neglect: We may disclose your protected health information to a government authority that is authorized by law to receive reports of child abuse or neglect. In addition, we may disclose your protected health information if we believe that you have been a victim of abuse, neglect or domestic violence to the governmental entity or agency authorized to receive such information. In this case, the disclosure will be made consistent with the requirements of applicable federal and state laws.
• Food and Drug Administration: We may disclose your protected health information to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations, track products; to enable product recalls; to make repairs or replacements; or to conduct post marketing surveillance, as required.
• Legal or Administrative Proceedings or Investigations: We may disclose protected health information in the course of any judicial or administrative proceeding or investigation, in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), in certain conditions in response to a subpoena, discovery request or other lawful process or request.
• Law Enforcement: We may disclose protected health information, so long as applicable legal requirements are met, for law enforcement purposes. These law enforcement purposes include requests: (1) pursuant to legal processes or as otherwise required by law; (2) for limited information for identification and location purposes; (3) pertaining to potential victims of a crime; (4) relating to suspicion that a death has occurred as a result of criminal conduct; (5) in the event that a crime occurs at Fenway Health; or (6) relating to a medical emergency (not at Fenway Health) and it is necessary to alert law enforcement regarding a potential crime.
• Coroners, Funeral Directors, and Organ Donation: We may disclose protected health information to a coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose protected health information to a funeral director, as authorized by law, in order to permit the funeral director to carry out his/her duties. We may disclose such information in reasonable anticipation of death. Protected health information may be used and disclosed for cadaveric organ, eye or tissue donation purposes.
• Threat to Public Safety: Consistent with applicable federal and state laws, we may disclose your protected health information, if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose protected health information if it is necessary for law enforcement authorities to identify or apprehend an individual.
• State-Specific Requirements: Many states have requirements for reporting including population-based activities relating to improving health or reducing health care costs.

Set forth below is a statement of your rights with respect to your protected health information and a brief description of how you may exercise these rights.

• Inspect and Copy: You have the right to inspect and copy medical information that may be used to make decisions about your care. This means you may inspect and obtain an electronic or paper copy of protected health information about you that is contained in a designated record set for as long as we maintain the protected health information. A “designated record set” contains medical and billing records and any other records that Fenway Health uses regarding your care. We ask that you submit these requests in writing. If you are denied access to medical information, you may request that the denial be reviewed. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review. Requests for access to and copies of your medical information must be submitted to Fenway Health in writing. The practice may charge for copies of the medical record.
• Amend: If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information by submitting a request in writing. You have the right to request an amendment for as long as we keep the information. In certain cases, we may deny your request for an amendment and if this occurs, you will be notified of the reason for the denial.
• An Accounting of Disclosures: You have the right to receive an accounting of certain disclosures we have made, if any, of your protected health information. This right does not apply to all disclosures; in particular, it does not apply to disclosures for purposes necessary to carry out treatment, payment or healthcare operations as described in this Notice of Privacy Practices. It excludes disclosures we may have made to you, you, for a facility directory, to family members or friends involved in your care, or for notification purposes. The right to receive this information is subject to additional exceptions, restrictions and limitations. Fenway Health will provide the first accounting to you in any 12-month period without charge. We ask that you submit these requests in writing.
• Request Restrictions: You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not use or disclose information about a procedure that you had. We ask that you submit these requests in writing.We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you with emergency treatment.You have the ability to restrict your protected health information from payer disclosure when you pay for services yourself instead of having charges filed with an insurance carrier.
• Request Confidential Communications: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. We will agree to the request to the extent that it is reasonable for us to do so. For example, you can ask that we use an alternative address for billing purposes. We ask that you submit these requests in writing.
• A Paper Copy of This Notice: You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. To exercise any of your rights, please obtain the required forms from the Privacy Officer and submit your request in writing.

In accordance with Massachusetts General Law c.111, §70 Fenway Health maintains health records for a period of 20 years after the discharge or the final treatment of the patient to whom it relates. Following this period records may be destroyed after notifying the Department of Public Health, in accordance with regulations, that records will be destroyed.

If there is an unintended disclosure of your information you will be contacted with details of this breach. We are also required to notify the Secretary of Health and Human Services that a breach occurred, however, your protected health information will not be included in that initial breach report. If the unintended disclosure of your information was part of a breach that involved five hundred or more individuals, we would also be required to notify the media.

If you believe your privacy rights have been violated you may file a complaint with us by contacting our Privacy Officer, Amy Whitcomb Slemmer, at 617.927.6006 or through email at [email protected].  You can also contact the Secretary of the Federal Department of Health and Human Services. All complaints must be also submitted in writing. You will not be penalized for filing a complaint. 

Other uses and disclosures of medical information not covered by this Notice or the laws that apply to us will be made only with your written permission. If you provide us permission to use or disclose medical information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose medical information about you for the reasons covered by your written authorization. However, we are unable to take back any disclosures we have already made with your permission and we are required to retain our records of the care that we provided to you.