Notice of Privacy Practices

Effective April 14, 2003 Revised September 23, 2014

View this as a PDF.

This notice describes how health information may be used and disclosed and how you can get access to this information. Please review carefully.

Seattle Indian Health Board respects your privacy and the confidentiality of your personal health information. We have many policies, procedures and practices in place to safeguard your personal information. It is our policy to not disclose your information to others unless you tell us to do so or unless the law authorizes or requires us to do so.

This notice tells you about our privacy practices and explains how we use health information about you and when we share that information with others. It also tells you about your rights with respect to your health information and how you may exercise those rights.

The law protects the privacy of the health information we create and keep to provide care and services to you. Federal and state laws allow us to use and disclose your health information for purposes of treatment and healthcare operations. State law requires us to get your authorization to disclose this information for payment purposes.

Our Privacy Practices

Seattle Indian Health Board (SIHB) employees are required to comply with our policies and procedures to protect the confidentiality of your health information. Any employee who violates our privacy policy is subject to discipline. Employee access to your health information is limited on a business “need-to-know” basis, such as to provide treatment, to manage care, to bill for services, to perform quality improvement activities, to handle complaints, or other activities necessary to provide your care and to operate our clinics and services. This means that our employees can only access that part of your personal information necessary to do their job.

We maintain physical, electronic, and process safeguards that restrict unauthorized access to your health information. Such safeguards include secured records areas, locked file cabinets, and controlled computer network systems and password accounts.

How We May Use or Share Your Information

Your health information is sometimes called “protected health information” or PHI. This information includes demographic information such as your name, age, social security number, or any other information that may identify you and your healthcare services. This protected health information might be sent or shared orally, in writing, or electronically by computer and fax.

Some examples of how we may use or share your health information for treatment, payment, and health operations are shown below.

For Treatment

We use the information recorded in your health record to help decide what care may be right for you and to provide you with care. We may also share this information with others providing you care such as to a hospital or a specialist.

For Payment

We use your health information when we request payment from your health insurance plan including Medicaid, Medicare, or other coverage. Information may include your diagnoses, procedures performed, or recommended care.

For Health Care Operations

We may use or share certain health information for necessary health care operations. Examples of these uses are

  • to perform quality assessment and improvement activities;
  • to review the qualifications and performance of our providers and to train our staff;
  • to contact you to remind you about appointments;
  • to give you information about treatment alternatives or other health-related benefits and services;
  • to let you know about special events and to raise funds;
    • NOTE: You have an option to opt out of any fundraising communications.
  • to perform audit and compliance functions;
  • to conduct or arrange for services including
    • medical quality review by your health plan;
    • collections, legal, risk management, and insurance services;
    • governmental auditing functions.
Notification of Family and Others

Unless you object, we may release health information about you to a friend or family member who is directly involved in your healthcare. An example of when we might release information is if a friend or family member was taking care of you and needed information on your illness or medications in order to provide that care for you. We may also give information to someone who helps pay for your care. We may tell your family or friends if we send you to a hospital.

Business Associates

We may share your health information with other individuals or agencies to conduct or arrange for services. These individuals or agencies are called business associates. We will not share your health information with these business associates unless they agree in writing to protect the privacy of your information. Examples of our business associates are

  • the records storage company where we store inactive records.
  • the computer companies that help run our systems.
  • the copying company that makes and sends copies of records.
Special Circumstances and State and Federal Laws

Special situations and certain state and federal laws may require us to use or release your health information. For example, we may have to release your health information to

  • report information to local, state, and federal agencies that regulate our business, such as the State Department of Health for audits, inspections, licensing, or peer review activities.
  • assist with public health activities, such as to the Food and Drug Administration for problems with food, prescription drugs, or faulty medical devices.
  • report information to public health agencies if we believe there is a serious threat to your health and safety or that of the public or another person, including disaster relief efforts to protect public health and safety; to prevent or control disease, injury, or disability; or to report vital statistics such as births or deaths.
  • assist court or administrative agencies when we receive a subpoena, court order, or other legal processes.
  • support law enforcement activities, such as locating missing persons or if you are a victim of a crime.
  • correctional institutions if you are an inmate or under the custody of a law enforcement official as necessary for your health and the health and safety of others.
  • report to public authorities regarding suspected abuse, neglect, or domestic violence to carry out duties of a coroner or funeral director as required by law.
  • report to organ procurement or transplant agencies or persons who obtain, store, or transplant organs, eyes, or tissues.
  • report information about job-related injuries as required by state worker compensation laws.
  • share information related to specialized government functions, such as military functions and national security.
  • researchers when their research has been approved by an institutional review board that has approved the research proposal and established protocols to ensure the privacy of your health information.
Information Not Personally Identifiable

We may use or share your health information when it has been “de-identified.” Health information becomes de- identified when it does not personally identify you. We may also use a “limited data set” that does not contain any information that can directly identify you. This limited data set may only be used for the purposes of research, public health matters, or health care operations. For example, a limited data set may include your city, county, and zip code but not your name or street address.

Written Permission to Use or Share Your Information

For any other activity or purpose not listed above or as otherwise permitted by law, we must obtain your written permission (known as “authorization”) before we use or share your health information. SIHB requires your signed authorization for

  • the release of “psychotherapy” notes.
  • use of your PHI for marketing purposes.
  • any sale of your PHI.

If you provide a written authorization and then change your mind, you can cancel your authorization in writing at any time.

NOTE: Once an authorization has been cancelled, we will no longer use or share the information on the authorization form. However, you should be aware that we may not be able to retract a use or disclosure that was made between the time you gave the authorization and the time you cancelled it.

Other Restrictions On the Use and Disclosure of Your Information

There are additional laws covering the use and disclosure of certain health information such as HIV status, communicable diseases, reproductive health, mental health, and substance abuse. In general, these laws have more restrictions on the use and sharing of your information. Seattle Indian Health Board also follows the requirements of these laws in protecting the privacy of your health information.

Your Health Information Rights

The health and billing records we create and store are the property of Seattle Indian Health Board. The protected health information in them, however, is available to you. You have a right to

  • receive, read, and ask questions about this Notice and to request and receive from us a paper copy of the most current Notice of Privacy Practices for Protected Health Information (“Notice”).
  • ask us to restrict certain uses and disclosures. You must deliver this request in writing to us. Please note that while we will try to honor your requests, we may not be able to agree to all of them.
  • request that you be allowed to see and get a copy of your protected health information. You must make a request for a copy in writing. We have a form available for this type of request. You will be charged a fee for copying the documents. Under certain circumstances, we may deny your request to see or get a copy of your health information.
    • If you request an electronic copy (USB, CD, etc.) of your record, it will be processed within three days of request.
  • have us review a denial of access to your health information, except in certain circumstances.
  • ask us to change your health information. You must give us this request in writing. You may write a statement of disagreement if your request is denied. This statement will be stored in your record and included with any future release of your records.
  • request a list of disclosures of your health information. You may receive this information without charge once every 12 months. We will notify you of the cost if you request this information more than once in 12 months. The list will not include disclosures to third party payors; information shared for your treatment, payment, or health care operations; and certain other information. It will also not include any information collected before April 14, 2003.
  • ask that your health information be given to you by another means or at another location. For example, if you believe that sending your information to your current mailing address would put your safety at risk, you may ask us to send information in a different way (such as by fax) or to an alternate address. We will accommodate reasonable requests for confidential communication of your information.
  • cancel prior authorizations to use or disclose health information by giving us a written revocation (cancellation). This will not affect information that has already been released. It also does not affect any action that may have been taken before your revocation was received. Sometimes, you cannot cancel an authorization if it was to obtain insurance.
  • opt out of receiving any fundraising communications. If you wish to opt out, please visit our patient enrollment desk.
  • restrict disclosures of PHI to a health plan with respect to health care for which you have paid out-of-pocket and in full. In order for payments to be considered in lieu of billing insurance, they must be made by the end of your visit, and you must let the cashier know you wish to execute this right. In the case of a new medication, ask your provider to print your medication to paper instead of electronically submitting it to your pharmacy. This will give you an opportunity to pay in-full for your prescription prior to insurance billing and to execute this right. In the case of a medication refill, explicitly tell your pharmacy that you wish to pay out of pocket and execute this right at the time of your refill request.
  • request a copy of your lab results directly from the lab that is processing your lab work i.e. LabCorp. You must contact and follow the corresponding laboratory’s policies and procedures for obtaining copies of lab results.

Our Responsibilities

We are required to

  • keep your protected health information private.
  • give you this Notice.
  • follow the terms of this Notice.
  • notify you of any breach of your unsecured PHI.

We have the right to change our practices regarding the protected health information we keep. If we make changes, we will update this Notice. You may receive the most recent copy of this Notice by calling and asking for it or by visiting our patient services desk to pick one up.

Questions About Use and Disclosure and Your Privacy Rights

If you have any questions about how we use or share your health information or about your rights, you may call our HIPAA Privacy Officer at (206) 324-9360 Ext. 2586.

If you believe that your privacy rights have been violated, you may file a complaint with any staff member. You may also contact the SIHB Deputy Director by phone at (206) 324-9360, by mail at P.O. Box 3364, Seattle, WA 98114 or by leaving your written complaint addressed to the Deputy Director with any staff member. You may also file a complaint with the U.S. Secretary of Health and Human Services.

We respect your right to file a complaint with us or with the U.S. Secretary of Health and Human Services. We will not take any action against you for filing a complaint.