NOTICE OF PRIVACY PRACTICES
Effective date: April 14, 2003

In accordance with the Health Insurance Portability and Accountability Act (HIPAA)

THIS NOTICE DESCRIBES HOW INDIVIDUALLY IDENTIFIABLE INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

We at St. Mary Mercy Hospital are required by law to maintain the privacy of individually confidential health care information. We are also required to provide patients with a notice of privacy practices regarding confidential health care information. We will only use or disclose your confidential health care information as permitted or required by applicable state law. This notice applies to your individually identifiable health information in our possession including the medical records generated by us.

This Notice applies to the delivery of health care by St. Mary Mercy Hospital, its outpatient departments and clinics, its parent, and the St. Mary Mercy Hospital’s clinical staff. This Notice also applies to the utilization review and quality assessment activities of St. Mary Mercy Hospital as a member of Trinity Health.

St. Mary Mercy Hospital understands that your health information is highly personal, and we are committed to safeguarding your privacy. Please read this Notice of Privacy Practices and sign the attestation provided with the General Consent Form.

TREATMENT:
St. Mary Mercy Hospital will use and disclose your confidential heath care information as part of the care and treatment processes. This may include releasing the information to other health care professionals involved in providing or coordinating your care including your attending physician, consulting physician(s), nurses, technicians, medical students and other health care providers who have a legitimate need for such information in your care and continued treatment.

St. Mary Mercy Hospital will use and disclose your confidential health care information to obtain resources and inform you about appointment reminders, of possible treatment options or alternatives or other health-related benefits and services that may be of interest to you. Departments like Public Relations and Community Outreach may provide you periodic materials of interest.

PAYMENT:
St. Mary Mercy Hospital will release confidential health care information about you for the purposes of determining coverage, eligibility, funding, billing, claims management, medical data processing, stop loss reinsurance and reimbursement. The medical information will be released to an insurance company, third party payer, third party administrator, health plan or others involved in the payment of your medical bill and will include copies or excerpts of your medical records which are necessary for payment of your account. This may include disclosing PHI to collection agencies and other subcontractors engaged in obtaining payment for care.

HEALTH CARE OPERATIONS:
St. Mary Mercy Hospital will use and disclose your confidential health care information during routine health care operations including quality assurance, utilization review, medical review, internal auditing, accreditation, certification, payment, licensing or credentialing activities of the hospital. For instance, we may need to share your demographic information, diagnosis, treatment plan and health status for population based activities relating to improving health or reducing health care costs, protocol development, case management and care coordination, and contacting health care providers and residents with information about treatment alternatives, in order for us to operate our business in an efficient, safe and legal manner.

ORGAN PROCUREMENT:
We may disclose PHI to an organ procurement organization or entity for organ, eye or tissue donation purposes.

RESEARCH:
We may use or disclose your PHI as part of research that includes providing you with treatment. For example, if you are part of a research study that includes treatment, we may require that you sign an authorization to allow the researchers to use or disclose your PHI for this research.

CORONER / MEDICAL EXAMINER:
St. Mary Mercy Hospital will release your confidential health care information to a coroner or medical examiner. We will also release medical information to funeral directors as necessary to carry out their duties.

LAW ENFORCEMENT:
St. Mary Mercy Hospital will disclose your confidential health care information for law enforcement purposes, such as responding to a court order or subpoena, identifying a suspect or a missing person, or providing information about a crime victim or criminal conduct. If you are an inmate of a correctional institute or under the custody of a law enforcement officer, we will release your confidential health care information to the correctional institute or law enforcement official.

REQUIRED BY LAW:
St. Mary Mercy Hospital will disclose confidential health care information about you when required to do so by federal, state or local law. This may include but is not limited to judicial and administrative proceedings, in response to a court order or subpoena, incidents involving victims of abuse, neglect or domestic violence, military and veteran’s activities, national security and intelligence activities, and protective services for the President and others.

HEALTH OR SAFETY:
St. Mary Mercy Hospital will use and disclose confidential health care information to avert a serious threat to health and safety of a person or the public.

MARKETING AND FUNDRAISING:
St. Mary Mercy Hospital will use some of your confidential health care information for certain internal marketing and fundraising activities. For example, your name and address may be used to send you newsletters or general communications. We may also send you information based on your own health concerns. Any communication sent specifically to you will let you know how you may opt of receiving similar communications in the future.

OTHER USES:
Any other uses or disclosures that are not for treatment, payment or operations and that are not permitted or required for public policy purposes or by law will be made with your written authorization. Written authorizations will let you know why we are using your confidential health care information. You have the right to revoke such authorization at any time.

MORE STRINGENT STATE AND FEDERAL LAWS:
The State law of Michigan is more stringent than HIPAA in several areas. Currently State law is more stringent when it comes to access to medical records and offers greater protection from disclosure than under HIPAA.

Additionally, patients have more rights of access to behavioral health information. Michigan State law defines a minimum necessary standard for release of mental health information. Disclosure is permitted with consent and for treatment without consent but only in an emergency.

Finally, minors in Michigan have more rights to confidentiality and protection of certain information (reproductive health, behavioral health and substance abuse). State law requires facilities to adopt policies regarding release of information outside the facility. If the facility policy requires consent for release, then consent will be required. We will continue to abide by these more stringent state and federal laws when it comes to protecting your PHI.

Permitted Use or Disclosure with an Opportunity for You to Agree or Object
You have the right to object to the following permitted disclosures. To object patients should discuss their concerns at the point of registration or with the assigned healthcare provider.

Family/Friends:
We will disclose PHI about you to a friend or family member who is involved in your medical care. We will also give information to someone who helps you pay for your care. In addition, we will disclose PHI about you to an agency assisting in a disaster relief effort so that your family can be notified about your condition, status and location. If you object to this use no information about your care, condition or treatment will be given to any requesting family members.

Facility Directory:
We will include certain limited information about you in the Facility Directory and Resident Roster while you are a resident at this facility. This information will include your name, room number, your general condition (e.g., fair, stable, critical, etc.) and your religious affiliation. This is so your family and friends can visit you and know how you are doing. The directory information, except for your religious affiliation, will also be disclosed to people who ask for you by name. You have the right to request that your name not be included in either the Facility Directory. If you request to opt out of the Facility Directory, we cannot inform visitors of your presence, location, or general condition.

Spiritual Care:
Directory information including your religious affiliation will be given to a member of the clergy, such as a priest or rabbi, even if they don’t ask for you by name. Your name, location and general condition will be disclosed to members of the religious community. We may notify your local religious organization, by disclosing your name that you are at this facility and your condition. A spiritual care provider may be called in to consult regarding your care. Spiritual care providers are members of the health care team at this facility. You have a right to request that your name not be given to any member of the clergy.

Promotional Communications:
We do not share or sell your PHI to companies that market health care products or services directly to consumers for use by those companies to contact you, such as drug companies. St. Mary Mercy Hospital does maintain a database of individuals for promotional communications, disease management, health promotion, and fundraising purposes. This database includes individuals to whom we may have sent news about this facility previously and also individuals who have donated to or who have expressed an interest in donating to our facility. You may be included in this database. If you wish to be deleted from this database, you may notify the Privacy Officer designated at this facility.

PATIENT RIGHTS:
Although all records concerning your hospitalization and treatment obtained at St. Mary Mercy Hospital are property of the hospital, you have the following rights concerning your confidential health care information.

Confidential Communications:
You have the right to request that confidential communications of your protected health care information by alternative means or at alternative locations.

ACCESS:
You have the right to access your protected health information. However, St. Mary Mercy Hospital will deny your request for access to your PHI without giving you an opportunity to review that decision if:

• You don’t have the right to inspect the information; or it is otherwise prohibited or protected by law;
• You are an inmate at a correctional institution and obtaining a copy of the information would risk the health, safety, security, custody or rehabilitation of you or other inmates;
• The release of the information would threaten the safety of any officer, employee or other person at the correctional institution or who is responsible for transporting you;
• You are involved in a clinical research project and we created or obtained the PHI during that research. Your access to the information will be temporarily suspended for as long as the research is in progress;
• St. Mary Mercy Hospital obtained the information that you seek access to from someone other than the health care provider under a promise of confidentiality and your access request is likely to reveal the source of the information; or
• Under other limited circumstances however, St. Mary Mercy Hospital will allow the review of its decision by a health care professional that it has chosen. This person will not have been involved in the original decision to deny your request.

INSPECT AND COPY:
You have the right to inspect and copy your confidential health care information (at a reasonable time and you must pay copying cost) as long as we maintain it except for psychotherapy notes; information that will be used in a civil, criminal or administrative action or proceeding; and where prohibited or protected by law. You must make your requests to access and copy your PHI in writing. St. Mary Mercy Hospital will respond to your request within 30 days of its receipt. If we cannot, we will notify you in writing to explain the delay and the date by which we will act on your request. In any event, St. Mary Mercy Hospital will act on your request within 60 days of its receipt.

AMENDMENT:
You have the right to request an amendment of your confidential health care information for as long as we maintain it. You must make your request for amendment of your PHI in writing using the provided contact information, including your reason to support the requested amendment. We will respond to your request within 60 days of its receipt. If we cannot, we will notify you in writing to explain the delay and the date by which we will act on your request. In any event, St. Mary Mercy Hospital will act on your request within 90 days of its receipt.

However, St. Mary Mercy Hospital reserves the right to deny your request based on established laws and standards. For example, St. Mary Mercy Hospital will deny your request for amendment if:

• We did not create the information;
• The information is not part of the designated record set;
• The information would not be available for your inspection; or
• The information is accurate and complete.

If St. Mary Mercy Hospital denies your request for changes in your PHI, we will notify you in writing with the reason for the denial. We will also inform you of your right to submit a written statement disagreeing with the denial. You may ask that the St. Mary Mercy Hospital include your request for amendment and the denial any time that we disclose the information that you wanted changed. The hospital may prepare a rebuttal to your statement of disagreement and will provide you with a copy of that rebuttal.

ACCOUNTING:
You have a right to request a limited accounting of the disclosures of your confidential health care information that St. Mary Mercy Hospital has made except for the following disclosures:

• To carry out treatment, payment or health care operations;
• To you;
• To persons involved in your care;
• For national security or intelligence purposes;
• To correctional institutions or law enforcement officials;
• That occurred prior to April 14, 2003; or
• Disclosure made pursuant to authorizations you have signed.

In any given 12-month period, St. Mary Mercy Hospital will provide you with an accounting of the disclosures of your PHI at no charge. Any additional requests for an accounting will be subject to a reasonable fee in preparing the accounting. For each disclosure, you will receive: the date of the disclosure, the name of the receiving individual or institution and address if known, a brief description of the PHI disclosed and a brief statement of the purpose of the disclosure or a copy of your written authorization or a written copy of the request for the information, if any.

You must make your request for an accounting of disclosures of your PHI in writing to St. Mary Mercy Hospital. You must include the time period of the accounting, which will not be longer than 6 years following April 14, 2003. St. Mary Mercy Hospital will respond to your request within 60 days for its receipt. If we cannot, we will notify you in writing to explain the delay and the date by which we will act on your request. In any event, St. Mary Mercy Hospital will act on your request within 90 days of its receipt.

COPY OF YOUR RIGHTS:
You have the right to receive a paper copy of this Notice of Privacy Practices, upon request.

Sharing and joint use of your Health Information

In the course of providing care to you and in furtherance of our mission to improve the health of the community, St. Mary Mercy Hospital will share your PHI with other organizations who have agreed to abide by the terms described below:

Medical Staff:
The medical staff and St. Mary Mercy Hospital participate together in an organized health care arrangement to deliver health care to you at our hospital. Both St. Mary Mercy Hospital and its medical staff have agreed to abide by the terms of this Notice with respect to PHI created or received as part of delivery of health care services to you in our hospital. Physicians and allied health care providers of St. Mary Mercy Hospital will have access to and use your PHI for treatment, payment and health care operations purposes related to your care within our organization. St. Mary Mercy Hospital will disclose your PHI to the Medical Staff for payment, treatment and health care operations.

Business Associates:
St. Mary Mercy Hospital will use and disclose your PHI to business associates contracted to perform business functions on our behalf including Trinity Health, its parent who performs certain business functions for St. Mary Mercy Hospital. Whenever an arrangement between St. Mary Mercy Hospital and another company involves the use or disclosure of your PHI, that business associate will be required to keep your information confidential.

Membership in Trinity Health:
St. Mary Mercy Hospital, members of Trinity Health, and Trinity Health participate together in an organized health care arrangement for utilization review and quality assessment activities. We have agreed to abide by the terms of this Notice with respect to PHI created or received as part of utilization review and quality assessment activities of Trinity Health and its members. Members of Trinity Health will abide by the terms of their own Notice of Privacy Practices in using your PHI for treatment, payment or healthcare operations. As a part of Trinity Health, a national Catholic health care system, St. Mary Mercy Hospital and other hospitals, nursing homes, and health care providers in Trinity Health share your PHI for utilization review and quality assessment activities of Trinity Health, the parent company, and its members. Members of Trinity Health also use your PHI for your treatment, payment to the St. Mary Mercy Hospital and/or for the health care operations permitted by HIPAA.

COMPLAINTS:
If you believe your privacy rights have been violated, you may file a complaint with St. Mary Mercy Hospital or with the Secretary of the Department of Health and Human Services. You can use the following information to file a confidential compliant. There will be no retaliation for filing a complaint. You can also use this information should you have any questions about the issues covered by this Notice of Privacy Practice, please contact:

Privacy Officer
St. Mary Mercy Hospital
36475 Five Mile Rd.
Livonia, MI 48154
Telephone 734.655.4800
Privacy AlertLine: 1.866.477.4661
www.stmarymercy.org

CHANGES TO THIS NOTICE:
St. Mary Mercy Hospital will abide by the terms of the notice currently in effect. However, we reserve the right to change the terms of its notice and to make the new notice provisions effective for all confidential health care information that it maintains. St. Mary Mercy Hospital will provide you with the revised Notice at your first visit following the revision of the Notice.

Contact Us
If you have any questions about our site, or comments about how we can improve it to make it more enjoyable or useful, you can always contact us below:

Webmaster
St. Mary Mercy Hospital
36475 Five Mile Road
Livonia MI 48154

Send Email Message