NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

C3HIE Notice of Privacy Practices
Effective Date: March 11, 2014 (Updated August, 2022)

C3HIE is a nonprofit, community health information exchange that facilitates electronic exchange of patient information between physicians, hospitals, labs, pharmacies, patients and other providers. Sharing this information helps hospitals and physicians save patients’ time and provide better treatment.

How can C3HIE use and disclose protected health information about an individual?

C3HIE is not a healthcare provider. Rather, C3HIE helps doctors in the community share medical records so that each patient gets the best quality of care available. C3HIE values your privacy and meets all the same standards your doctor does to protect your health information while it is in our care. C3HIE does not create or change your protected health information. As a community health information exchange (HIE), we only supply protected health information to those individuals and organizations that are already allowed to have access under federal and state law. Doctors are responsible for obtaining signed or electronic opt-out, revocation and authorization forms from their patients that comply with the requirements under federal and state privacy laws. Situations in which we may share your medical record include, but are not limited to:

Treatment.

C3HIE provides access to your protected health information (PHI) to those who provide your medical care. We disclose medical information to your primary healthcare provider and others who are involved in providing the care you need. For example, if your doctor sends you to see a specialist, C3HIE can make your medical record available to that specialist on their computer. Or the C3HIE network may share this information with a pharmacist who needs it to dispense a prescription to you, or a laboratory that performs a test.

Payment.

Your physician may use C3HIE to access medical information about you to obtain payment for the services they provide. For example, your physicians may give your health plan the information it requires before it will pay them.

Health Care Operations.

Healthcare providers that are partnered with C3HIE may use and disclose medical information about you to operate their medical practice. For example, a hospital can look at medical records to improve the quality of care they provide, or to measure the performance of their staff.

Public Health

Your healthcare providers may, and are sometimes required by law to, disclose your health information to public health or other authorities. For example, your doctor may report all flu cases to the Department of Health and Human Services to help them decide where the flu vaccine is most needed. As a community health information exchange, C3HIE may assist doctors in accessing the information which they are obligated to report.

Breach Notification.

In the case of a breach of unsecured PHI, you will be notified as required by law. In some circumstances C3HIE’s provider members may provide the notification. C3HIE may also provide notification by other methods as appropriate.

Sale of Health Information.

C3HIE does not sell PHI. In accordance with HIPAA regulations, C3HIE cannot sell your information without your express permission.

What are C3HIE’s legal duties with regard to protected health information?

C3HIE is held to the same legal standards as your doctors when it comes to protecting your medical records. While this notice focuses on privacy requirements, C3HIE is also required to meet federal and state standards for protecting the security of your information. C3HIE understands that this information is private and only supplies the minimum information necessary to ensure you receive quality care. C3HIE is required by law to maintain the privacy of this PHI. In certain instances, C3HIE does provide information to organizations to determine community health needs, provide trending reports, or assist health care providers in identifying patients with particular health needs. Please note that once entities have received your information through C3HIE, they can redisclose this information as allowed by federal and state law.

C3HIE has a responsibility to ensure that the information shared through the system is the same as the information received from your providers. In other words, C3HIE must protect data integrity, so that the accuracy and consistency of your information is maintained.

C3HIE must keep a record of who sees your PHI and why they looked at it. C3HIE checks its records and investigates any unusual use of the network. C3HIE uses a system that only lets people who have the legal right to view your information see your medical record, and only when they need to see it.

What rights do I have with regard to my protected health information?

C3HIE keeps accurate and up-to-date records on file for your doctor. While the physical medical records belong to doctors, the information in them belongs to the individual patient. Due to this ownership, patient rights with regard to C3HIE include, but are not limited to:

Right to Opt Out of Information Sharing.

C3HIE is dedicated to protecting your information and improving the overall quality of healthcare in our region through effective exchange of information among our members. While this information exchange is an important tool for physicians and hospitals to coordinate your care, you can deny C3HIE the right to share your health information with those who provide you healthcare services. In order to do this, you simply need to complete an opt-out form available from your provider or the C3HIE.org website. If your provider shares information with C3HIE, they are responsible to give you information about C3HIE and how to opt-out if you wish. Opting out of information sharing means your information will not be shared by C3HIE, even in the case of an emergency. It will not impact your ability to receive care from your providers, just their ability to get information through the C3HIE system from your other providers.

Right to Request Special Privacy Protections.

You have the right to request restrictions on certain uses and disclosures of your health information by a written request to your doctor saying what information you want to limit, and what limits you want to set. We reserve the right to accept or reject any other request, and will notify you of our decision.

Right to Inspect and Copy.

You have the right to inspect and ask for a copy your health information, with limited exceptions through C3HIE’s patient portal. C3HIE wants everyone to be able to view and manage their health records. To access your medical information, you need to write your doctor and tell him what information you want, whether you want to just look at it or get a copy of it, and if you want a copy, your preferred form and format.

Right to an Accounting of Disclosures.

You have the right to know who has had access to your PHI through C3HIE. C3HIE does not have to account for when you access your own information or when you specifically say someone can see your information. We don’t have to tell you every time someone uses your record for treatment, payment, health care operations, or specialized government functions. We don’t tell you when we give information for purposes of public health that cannot be traced back to you, or which are incident to a use or disclosure otherwise permitted or authorized by law, or the disclosures to a health oversight agency or law enforcement official if C3HIE has received notice from that agency or official that says we have to by law. In order to see who else viewed your records, you may either submit a request through the C3HIE.org website or ask your doctor, who will request the information from us for you.

You have a right to have a copy of this Notice of Privacy Practices.

You have a right to a notice of our legal duties and privacy practices with respect to your health information, including a right to a paper copy of this Notice of Privacy Practices, even if you have received it through email or can see the information on our website.

If you would like to have a more detailed explanation of these rights or if you would like to exercise one or more of these rights, contact our Privacy Officer listed at the top of this Notice of Privacy Practices.

Complaints about this Notice of Privacy Practices or how C3HIE handles your health information should be directed to our Privacy Officer listed at the top of this Notice of Privacy Practices. If you are not satisfied with the manner in which this office handles a complaint, you may submit a formal complaint to the federal Office of Civil Rights, which enforces federal privacy and security compliance:

Civil Rights Office
Health and Human Services Commission
701 West 51st St., mail code W206
Austin, Texas 78751

Or Call (512) 438-4313

If you have any questions, you can contact C3HIE’s Privacy Officer at the following address:

C3HIE Privacy Officer
5535 Fredericksburg Road, Suite 220
San Antonio, TX 78229
(210) 918-1357

*Revised on August 2022