Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Your Medical Records / Information

Each time you visit a Health Services Department facility for services, a record of your visit is made. If you are referred by the Health Services Department through the Purchased/Referred Care (“PRC”) program, the Health Services Department also keeps a record of your PRC visit. Typically, this record contains your symptoms, examination, test results, diagnoses, treatment, and a plan for future care. This information, often referred to as your medical record, serves as a:

Plan for your care and treatment.

  • Communication source between health care professionals.
  • Tool with which we can check results and continually work to improve the care we provide.
  • Means by which Medicare, Medicaid, or private insurance payers can verify the services billed.
  • Tool for education of health care professionals.
  • Source of information for public health authorities charged with improving the health of the people.
  • Source of data for medical research, facility planning, and marketing.
  • Legal document that describe the care you receive.

Understanding what is in your medical record and how the information is used helps you to:

  • Ensure its accuracy.
  • Better understand why others may review your protected health information.
  • Make an informed decision when authorizing disclosures.

2. What Is “Protected Health Information”?

Your protected health information (“PHI”) is individually identifiable health information, including demographic information, about your past, present or future physical or mental health or condition, health care services you receive, and past, present or future payment for your health care. Demographic information means information such as your name, social security number, address, and date of birth.

PHI may be in oral, written or electronic form. Examples of PHI include your medical record, claims record, enrollment or dis-enrollment information, and communications between you and your health care provider about your care.

Your individually identifiable health information ceases to be PHI 50 years after your death.

If you are a patient or client of the Health Services Department and also an employee of the Ponca Tribe of Nebraska, PHI does not include the health information in your employment records.

3. Our Responsibility to Protect Your PHI

Pursuant to the Health Insurance Portability and Accountability Act (“HIPAA”), we must:

  • Maintain the privacy of your PHI.
  • Tell you about your rights and our legal duties with respect to your PHI.
  • Accommodate reasonable requests you may have to communicate PHI by alternative means or at alternative locations.
  • Notify you if we are unable to agree to a requested restriction.
  • Notify you if there is a breach that may have compromised the privacy or security of your PHI.
  • Tell you about our privacy practices and follow this Notice of Privacy Practices as currently in effect.

We reserve the right to change this Notice and our privacy practices at any time, as long as the change is consistent with applicable law. Any revised Notice will be made available on the Ponca Tribe of Nebraska’s Web site at https://poncatribe-ne.org/health-services.

We understand that your PHI is personal and we are committed to protecting your PHI. We take these responsibilities seriously and have put in place administrative safeguards (such as training and policies and procedures), technical safeguards (such as encryption and passwords), and physical safeguards (such as locked areas and requiring badges) to protect your PHI.

4. Your Rights Regarding Your PHI

Although your medical record is the physical property of the Health Services Department, the information belongs to you. You have the right to:

  • View or get a copy of your PHI that we maintain in records relating to your care or decisions about your care or payment for your care. Requests must be in writing. After we receive your written request, we will let you know when and how you can see or obtain a copy of your record. In certain circumstances, if you agree, we will give you a summary or explanation of your PHI instead of providing copies. We are permitted to charge you a fee for the copies, summary, or explanation. If we do not have the record you asked for but we know who does, we will tell you who to contact to request it. In limited situations, we may deny some or all of your request to see or receive copies of your records, but if we do, we will tell you why in writing and explain your right, if any, to have our denial reviewed.
  • Request that we correct or your record if you believe there is a mistake in your PHI or that important information is missing. Requests must be in writing and tell us what corrections or additions you are requesting and why the corrections or additions should be made. We will respond in writing after receiving your request. If we approve your request, we will make the correction or addition to your PHI. If we deny your request, we will tell you why and explain your right to file a written statement of disagreement.
  • Ask us to send your PHI to you at a different address (for example, your work address) or by different means (for example, fax instead of regular mail).
  • Request a copy of your records in an electronic format offered by the Health Services Department if your PHI is stored electronically. You may also make a specific written request to us to transmit the electronic copy to a designated third party. If the cost of meeting your request involves more than a reasonable additional amount, we are permitted to charge you our costs that exceed that amount.
  • Receive a listing certain disclosures of your PHI. We maintain outpatient records for six (6) years. An accounting does not include disclosures such as those made to carry out treatment, payment and health care operations; for which we had a signed authorization; of your PHI to you; from a Health Services Department directory; for notifications for disaster relief purposes; to persons involved in your care and persons acting on your behalf; or not covered by the right to an accounting.
  • Request that we limit our uses and disclosures of your PHI for treatment, payment, and health care operations purposes. We are not required to agree to your request, except to the extent that you request a restriction on disclosures to a health plan or insurer for payment or health care operations purposes and the items or services have been paid for out of pocket in full. However, we can still disclose the information to a health plan or insurer for the purpose of treating you. For requests to restrict your PHI for payment or health care operations purposes, please request the restriction prior to receiving services at the clinic or facility where you receive your care. If we deny your request, we will notify you in writing.
  • Revoke your written authorization to use or disclose PHI. This does not apply to PHI already disclosed or used or in circumstances where we have taken action in reliance on your authorization or the authorization was obtained as a condition of obtaining insurance coverage and the insurer has a legal right to contest a claim under the policy or the policy itself.
  • Designate someone to act on your behalf. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI. We will use reasonable efforts to make sure the person has this authority and can act for you.
  • Receive a paper copy of this notice upon request.
  • File a complaint if you feel your rights are violated.

5. Use and Disclosure of Your PHI

Sometimes, we are allowed by law to use and disclose certain PHI without your written permission. How much PHI is used or disclosed without your written permission will vary depending, for example, on the intended purpose of the use or disclosure. Sometimes we may only need to use or disclose a limited amount of PHI, such as to send you an appointment reminder or to confirm that you are eligible for services. At other times, we may need to use or disclose more PHI such as when we are providing medical treatment. The following categories describe how we may use and disclose PHI:

  • For treatment: We may use or disclose PHI to aid in your treatment or the coordination of your care. For example, we may disclose information to your physicians or hospitals to help them provide medical care to you.
  • For payment: Your PHI may be needed to determine our responsibility to pay for, or to permit us to bill and collect payment, including subrogation, for, treatment and health-related services that you receive. For example, if you have private insurance, Medicare, or Medicaid coverage, a bill will be sent to your health plan for payment that will include information that identifies you, as well as your diagnosis, procedures, and supplies used for your treatment. If we refer you to another health care provider under the PRC program, we may disclose your PHI with that provider for health care payment purposes.
  • For health care operations: We may use or disclose PHI to evaluate your care and treatment outcomes with our quality improvement team. This includes health care services provided under PRC program. For example, we might talk to your physician to suggest a disease management or wellness program that could help improve your health or we may analyze data to determine how we can improve our services.
  • To business associates: The Health Services Department provides some services and related functions through the use of contracts with business associates. When these services are contracted, we may disclose your PHI to business associates so that they can perform their jobs. We require our business associates to protect and safeguard your PHI in accordance with all applicable laws.
  • In facility directories: If you are admitted to an inpatient facility of the Health Services Department, we may use or disclose your name, room location, general condition and, to clergy only, your religious affiliation for facility directory purposes, unless you notify us that you object to this information being listed. If you do object, we will not disclose it to visitors and other members of the public.
  • For notification: We may use or disclose your PHI to notify or assist in the notification of a family member, personal representative or other authorized person(s) responsible for your care, unless you notify us that you object.
  • For communication with family: Sometimes a family member or other person involved in your care will be present when we are discussing your PHI with you. If you object, please tell us and we won’t discuss your PHI or we will ask the person to leave. Unless you object, we may also use or disclose your PHI to others responsible for your care, when you are incapacitated or in an emergency, or when you agree or fail to object when given the opportunity. If you are unavailable or unable to object, we will use our best judgment to decide if the disclosure is in your best interests. Special rules apply regarding when we may disclose PHI to family members and others involved in a deceased individual’s care. We may disclose PHI to any persons involved, prior to the death, in the care or payment for care of a deceased individual, unless we are aware that doing so would be inconsistent with a preference previously expressed by the deceased.
  • To personal representatives of adults and emancipated minors or parents or legal guardians: We shall treat a personal representative or legal guardian of any individual who has been declared incompetent due to physical or mental incapacity by a court of competent jurisdiction for the purposes of the use and disclosure of PHI as it relates to such personal representation. In most cases, we may disclose your minor child’s PHI to you. In some situations, however, we are permitted or even required by law to deny your access to your minor child’s PHI – for example, information about drug use or addiction, certain mental health services, and venereal disease.
  • To interpreters: In order to provide you proper care and services, we may use the services of an interpreter. This may require the use or disclosure of your PHI to the interpreter.
  • For research: We may use or disclose your PHI for research purposes that has been approved by an Institutional Review Board (“IRB”) that has reviewed the research proposal and established protocols to ensure the privacy of your PHI. We may also use or disclose your PHI for research purposes based on your written authorization.
  • For organ donation: We may use or disclose information to entities that handle procurement, banking or transplantation of organs, eyes or tissue to facilitate donation and transplantation.
  • To provide information regarding decedents: We may disclose information to a coroner or medical examiner to identify a deceased person, determine a cause of death, or as authorized by applicable law. We may also disclose information to funeral directors as necessary to carry out their duties.
  • For treatment alternatives and other health-related benefits and services: We may contact you to provide information about treatment alternatives or other types of health-related benefits and services that may be of interest to you. For example, we may contact you about availability of new treatment or services for diabetes.
  • To the Food and Drug Administration: We may use or disclose your PHI to the Food and Drug Administration (“FDA”) in connection with a FDA-regulated product or activity. For example, we may disclose to the FDA information concerning adverse events involving food, dietary supplements, product defects, or problems, and information needed to track FDA-regulated products or to conduct product recalls, repairs, replacements, or locating people who have received products that have been recalled or withdrawn.
  • For appointment reminders: We may use your PHI to remind you about appointments for treatment or other health care you may need or to advise you of a missed appointment.
  • For workers’ compensation: We may use or disclose your PHI for workers’ compensation purposes as authorized or required by applicable law.
  • For public health purposes: We may use or disclose your PHI to public health or other appropriate government authorities for the purpose of preventing or controlling disease, injury, or disability, or conducting public health surveillance, investigations, and interventions.
  • To report abuse or neglect: We may use or disclose your PHI to appropriate government authorities to report child or adult abuse or neglect, including sexual assault, or domestic violence as required by applicable law or to identify suspected victims of abuse, neglect, or domestic violence; and
  • To avoid a serious threat to health or safety: We may use or disclose your PHI if we believe it is necessary to avoid a serious threat or harm. We may disclose your PHI to an individual who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition. In some situations (for example, if you are employed by the Tribe or if necessary to prevent or lessen a serious and imminent threat to the health and safety of an individual or the public), we may disclose to your employer PHI concerning a work-related illness or injury or a workplace-related medical surveillance.
  • To correctional institutions or law enforcement officials: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may use or disclose your PHI to the institution or official if necessary for your health and the health and safety of other individuals such as officers or employees or other inmates.
  • For law enforcement purposes: We may use or disclose your PHI for law enforcement activities as authorized by law or in response to a court having proper jurisdiction.
  • For health oversight: We may use or disclose your PHI to a health oversight agency with jurisdiction over the Health Services Department for activities authorized by law, such as licensure, governmental audits and fraud and abuse investigations.
  • For military activity: If you are a member of the military services, we may use or disclose your PHI if necessary to the appropriate military command authorities as authorized by law.
  • For disaster relief: We may use or disclose your PHI during a disaster and for disaster relief purposes.
  • When required or authorized by law: We may use or disclose your PHI when applicable law requires or allows it, including response to an order or subpoena from a court having proper jurisdiction.
  • For other compelling circumstances: We may use or disclose your PHI in certain other situations involving compelling circumstances affecting the health or safety of an individual or the public. For example:
    • We may disclose limited PHI where requested by a law enforcement official for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person;
    • If you are believed to be a victim of a crime, we may disclose PHI where a law enforcement official requests information about you and we are unable to obtain your consent because of incapacity or other emergency circumstances and we determine that such disclosure would be in your best interests;
    • We may use or disclose PHI as we believe is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person;
    • We may use or disclose PHI in the course of judiciary and administrative proceedings if required or authorized by law;
    • We may use or disclose PHI to report a crime committed on Health Services Department premises or when we are providing emergency health care;
  • For lawsuits and other legal disputes: We may use and disclose PHI to the extent permitted by law to defend a lawsuit, arbitration or other legal dispute.

Certain applicable laws may require special privacy protections that restrict the use and disclosure of certain health information, including highly confidential information about you. “Highly confidential information” may include confidential information about drug and alcohol abuse, AIDS and HIV, mental health, genetic testing, and artificial insemination. However, there are still circumstances in which these types of information may be used or disclosed without your authorization. If you become a patient in our substance abuse program, we will give you a separate written notice, as required by law, about your privacy rights for your substance abuse program PHI.

Except for those uses and disclosures described above, other uses and disclosures of your PHI, including for marketing purposes or sale of your PHI, will be made only with your written authorization, which you may later revoke in writing at any time.

6. Health Services Department Divisions Subject to this Notice

This notice applies to all divisions, clinics, and programs of the Health Services Department. To provide you with the health care you expect, to treat you, to pay for your care and to conduct our operations, such as quality assurance, accreditation, licensing and compliance, Health Services Department divisions and personnel share your PHI with each other. Our personnel may have access to your PHI either as employees, physicians, volunteers or persons working with us in other capacities.

This Notice of Privacy Practices does not apply to our contracted providers, including providers available through Purchased/Referred Care (“PRC”), who are not part of the Health Services Department workforce. Please contact those providers directly for information about their privacy practices

7. How to Contact Us about this Notice or to Complain about Our Privacy Practices

To exercise your rights under this Notice, to ask for more information, or to report a problem contact us at:

Chief Executive Officer
Health Services Department
Ponca Tribe of Nebraska
2602 J Street
Omaha, NE 68107

You also may notify the Secretary of the Department of Health and Human Services to lodge a complaint about our privacy practices. We will not take retaliatory action against you if you file a complaint about our privacy practices.

8. Reservation of Rights

While this Notice is designed to comply with the terms and provisions of the HIPAA, compliance is voluntary on the part of the Ponca Tribe of Nebraska and the Health Services Department and is made for the convenience of the Tribe, the Department, and patients and clients. The Ponca Tribe of Nebraska does not concede that the HIPAA applies to it or any of its departments, agencies, organizations, officers, agents, or employees. Nothing in this Notice shall be read or construed to effect, modify, limit, or waive the sovereign rights, including sovereign immunity and other immunities, of the Ponca Tribe of Nebraska, its departments, agencies, organizations, officers, agents, and/or employees.

This notice is effective on February 25, 2014.