Notice of Privacy Practices
We Care About Your Privacy

This notice applies to patients of Martin’s Point Health Care Centers.

This notice describes how medical information about you may be used and disclosed and how you can get access to this information.

Please review it carefully.

1. Your Medical Information — Our Pledge

The privacy of your medical information is important to us. We understand that your medical information is personal and we are committed to protecting it. We create a record of care and services you receive at Martin’s Point (your “medical record”). We need this record to provide you with quality care and to comply with certain legal requirements.

This notice will tell you about the ways we may use and share medical information about you and certain duties we have regarding the use and disclosure of medical information. It also describes your individual rights regarding your personal health information. This Notice of Privacy Practices (“Notice”) is required by the Health Insurances Portability and Accountability Act (“HIPAA”).

2. Our Legal Duties and Rights

We Have the Duty to:
 - Keep your protected health information (“PHI”) secure and private
 - Notify you about our legal duties and privacy practices regarding PHI and notify you in the event of a breach of your unsecured PHI
 - Follow the terms of the Notice currently in effect

We Have the Right to:
 - Change our privacy practices and the terms of this Notice at any time, provided that the changes are permitted by law
 - Make the changes in our privacy practices and the new terms of our Notice effective for all medical information that we keep, including information previously created or received before the changes

Notice of Change to Privacy Practices:
Before we make an important change in our privacy practices, we will change this Notice and make the new Notice available upon request and also on our website at www.martinspoint.org.

3. Use and Disclosure of Your Protected Health Information (PHI)

The following section describes different ways that we use and disclose PHI. Please know that we will not use or disclose your PHI for any purpose not listed in this Notice without your authorization. However, not every specific example of a permitted or required use or disclosure is listed in this Notice. Please also know that the use or disclosure of certain sensitive health information may be further limited by applicable state or federal law. Sensitive health information may include certain information related to mental health treatment, HIV test results, alcohol and drug abuse treatment, and genetic testing and test results. Martin’s Point will comply with the stricter provisions when they apply, and we will request an authorization from you for any use or disclosure that requires your express authorization.

If you have given an authorization for a use or disclosure of your PHI, you may revoke your authorization at any time by providing us with a written notification of revocation. Please be aware that a revocation will not affect certain disclosures, such as those made in reliance of your authorization before your revocation was communicated. 

USES AND DISCLOSURES OF PHI THAT DO NOT REQUIRE YOUR AUTHORIZATION INCLUDE THE FOLLOWING:

Treatment
Our Health Care Centers may use or disclose your PHI for treatment purposes, which include the provision, coordination, or management of your health care and related services by our Health Care Centers and other health care providers involved in your care. We may disclose medical information about you to doctors, nurses, technicians, medical students, or other people who are taking care of you. We may also share medical information about you with your other health care providers to assist them in treating you.

Payment
We may use and disclose your PHI for payment purposes. A bill may be sent to you or a third-party payer. The information on or accompanying the bill may include your PHI.

Health Care Operations
We may use and disclose your PHI for health care operations. This might include case management and care coordination, evaluating practitioner and provider performance, credentialing activities, underwriting and enrollment activities, medical review, legal services and auditing functions, or business management and general administrative activities. 

Business Associates
Martin’s Point Health Care may contract with other organizations called “business associates” to provide services on our or your behalf. We enter into agreements with business associates that explicitly set forth the requirements associated with the protection and safeguarding of your PHI as required under HIPAA.

Health Information Exchange
The Health Care Center you visit may participate in a Health Information Exchange (“HIE”) active in the state where your Health Care Center is located. If your Health Care Center participates in your state’s HIE, the HIE will receive certain PHI about you and make that information available to other health care providers who may be treating you. When applicable, we will provide you with the choice of opting out of the health information exchange program by furnishing you with an “Opt- Out Form,” which is also available at our check-in area or upon request from any health care staff member. If you choose to opt out, your health information will still be sent to the HIE but it will not be made available to other providers. Currently, all Martin’s Point Health Care Centers located in Maine participate in Maine’s HIE.

OTHER USES AND DISCLOSURES OF PHI THAT DO NOT REQUIRE YOUR AUTHORIZATION INCLUDE THE FOLLOWING:

Family and Friends
We may disclose your PHI to others involved in your care or payment of your care, which may include family members, a close friend, or another person you identify.

Parents as Personal Representatives of Minors
In most cases, your minor child’s PHI may be disclosed to you. However, we may be required by law to protect a minor’s PHI for certain diagnoses or treatments that involve sensitive health information, such as information about sexually transmitted diseases, family planning, abortion, substance abuse, or mental health services.

Appointment Reminders and Treatment Options
We may use and disclose your PHI to contact you to remind you of an appointment or to inform you of potential treatment options or alternatives. Your appointment reminder may be automated in order to improve our operations.

Workers' Compensation
Your PHI may be used or disclosed in order to comply with laws and regulations related to Workers’ Compensation.

Public Health Activities
Your PHI may be used or disclosed for public health activities, such as to assist public health authorities to prevent or control disease, injury, or disability, or to report child abuse or neglect.

Research
We may use and disclose your PHI for research purposes in certain limited circumstances. Any research that includes the use of PHI is required to undergo additional review for compliance with the HIPAA requirements for uses and disclosures of PHI for research purposes.

Legal Proceedings
Your PHI may be disclosed in the course of any legal proceeding, in response to an order of a court or an administrative tribunal and, in certain cases, in response to a subpoena, discovery request, or other lawful process.

Health Oversight
Your PHI may be disclosed to a government agency authorized to oversee the health care system or government programs or its contractors, such as the US Department of Health and Human Services, a state insurance or health department, or the US Department of Labor, for activities authorized by law, such as audits, examinations, investigations, inspections, and licensure activity.

Fundraising
Martin’s Point Health Care is a not-for-profit organization and we may engage in fundraising efforts to support our mission. We may use and disclose your PHI to contact you regarding our fundraising efforts. You have the right to opt out of receiving future fundraising communications by following the opt-out instructions on the communication you receive or by contacting our Privacy Officer and making a request to opt out of receiving fundraising communications.

De-Identified Information
We may use your PHI to create de-identified information or we may disclose your information to a business associate so that the business associate can create de-identified information on our behalf. Once de-identified, the information will not identify your or be able to be used to identify you.

Limited Data Set
We may use and disclose a limited data set that does not contain specific, readily identifiable information about you for research, public health, and health care operations.

To Avert Serious Threat
We may use or disclose your PHI to prevent or reduce a serious and imminent threat to the health or safety of yourself, another person, or the public

As Required by Law
We may use and disclose information about you as required by law. For example, we may disclose information to make a report related to victims of abuse, neglect, or domestic violence, or to assist law enforcement officials in performing their duties.

Government Functions
We may disclose your PHI to authorized federal officials for national security purposes.

Inmates
If you are an inmate, your PHI may be disclosed to a correctional institution or a law enforcement official having lawful custody for certain permitted purposes, such as if the provision of such information is necessary to provide you with health care, protect your or another’s health and safety, or maintain the safety and security of the correctional institution.

Decedents
PHI may be disclosed to funeral directors, coroners, or medical examiners to enable them to carry out their lawful duties.

Organ, Eye, and Tissue Donation
Your PHI may be used or disclosed to organ procurement organizations to facilitate cadaveric organ, eye, or tissue donation and transplantation purposes.

USES AND DISCLOSURES OF PHI THAT MAY REQUIRE YOUR AUTHORIZATION INCLUDE THE FOLLOWING:

Marketing Communications
We may use your health information to send you certain types of communications that do not require your authorization, such as communications for treatment, including case management, care coordination, or recommended alternative treatments, providers, or settings of care. We may also communicate with you to inform or update you about health-related products or services provided by Martin’s Point. In most other circumstances, we are required by law to receive your written authorization before we use or disclose your health information for marketing purposes.

Psychotherapy Notes
Most uses and disclosures of psychotherapy notes require your authorization. However, if the psychotherapy notes were created by your Martin’s Point provider, we may, without your authorization, use the notes for certain permitted treatment, payment, or health care operations, such as use by your provider to treat you or for limited internal training programs, to defend ourselves in a legal action brought by you, for certain oversight activities, to coroners and medical examiners involved in identification or cause of death determinations, or as necessary to prevent or lessen a serious and imminent threat to the health and safety of you, another individual, or the public. 

4. Your Rights Regarding Your PHI

You Have the Right to:
Access Your PHI Through Our Patient Portal
You have the right to view information from your medical record and communicate with your provider through our secure, internet-based patient portal, MyMartinsPoint. You may choose to opt out of having access to our patient portal at any time by informing someone in our check-in areas that you would like to opt out and following the steps described to you. 

Access and Receive Copies of Your PHI
You have the right to request and receive a copy of your health care records. We may ask you to make your request in writing and to provide us with the specific information we need to fulfill your request. You also have the right to receive a copy of your PHI in electronic format, if we maintain your PHI in an electronic format and we can readily produce a readable electronic copy. We reserve the right to charge a reasonable fee for the cost of producing and mailing these copies. There are certain cases in which we are not permitted to fulfill your request to access or receive your records.

Amend Your PHI
If you believe that your PHI is incorrect or incomplete, you have the right to ask us to amend it. All requests for amendment must be in writing. In certain cases, we may deny your request, for example, if we did not create the PHI or if we determine that the PHI is accurate and complete.

Request Confidential Communications
You have the right to request, and we must accommodate reasonable requests, to receive communications from Martin’s Point about your PHI in a manner or at a location you determine better protects the confidentiality of your PHI. Requests should be made in writing to our Privacy Officer.

Request Restrictions on Uses and Disclosures of Your PHI
You have the right to ask us to place restrictions on the way we use or disclose your PHI for treatment, payment, or health care operations, as well as for certain other permitted or required uses or disclosures of PHI. Requests should be made in writing to our Privacy Officer. In most cases, we are not required by law to agree to any requested restrictions.

Accounting of Disclosures of PHI
You have the right to receive an accounting of certain instances in which we disclosed your PHI. An accounting will not include disclosures made for treatment, payment, or health care operations, unless such disclosures were made through an electronic health record, in which case you have the right to an accounting of such disclosures for treatment, payment, or health care operations made within the last three years. An accounting will also not include certain other disclosures, such as disclosures made directly to you or persons involved in your care, disclosures made pursuant to an authorization, or disclosures made as part of a limited data set. 

Receive Notice of Privacy Practices
You have a right to receive a paper copy of the Notice of Privacy Practices by requesting one at any time from a staff member in the check-in area at any of our Health Care Centers or from our Privacy Officer.

Breach Notification
You have the right to receive notice of any breach that compromises the privacy or security of your PHI. We are required to comply with all applicable breach notification requirements under HIPAA.

Questions and Complaints

If you have any questions about this Notice, please let a check-in staff member know you would like to speak to our Privacy Officer.
If you believe your privacy rights have been violated, you may file a written complaint with our Privacy Officer at:

Privacy Officer
c/o Compliance and Legal Affairs Department
331 Veranda Street
PO Box 9746
Portland, ME 04104
Phone: 207-791-3848

You may also notify the Secretary of the Department of Health and Human Services by sending your complaint to: Centralized Case Management Operations, US Department of Health and Human Services, 200 Independence Avenue SW, Room 509F, HHH Building, Washington, DC, 20201.You may also send the information by email to [email protected] or file a complaint through the Office for Civil Rights Complaint Portal at https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf.

Martin’s Point Health Care will not take retaliatory action against you if you file a complaint.
Revision dates:
November 2011
September 23, 2013
September 29, 2014
November 15, 2018