NOTICE OF PRIVACY PRACTICES

1. Treatment. GSL may use your PHI to provide you with medical treatment or services, to coordinate or manage your health care services, or to facilitate consultation or referrals as part of your treatment. For example, a doctor treating you for an injury asks another doctor about your overall health condition.

2. Payment. GSL may use and disclose your medical record to send bills and collect payment from you, your insurance company or other third parties, for the treatment and services provided to you by GSL. For example, we give information about you to your health insurance plan, so it will pay for your services.

3. Health Care Operations. GSL may use and disclose PHI about you for GSL health care operations. We can use and share your health information to run our practice, improve your care, and contact you when necessary. For example, we use health information about you to manage your treatment and services.

4. Business Associates. There are some services at GSL that may be provided through contracts with business associates. To protect your health information, however, we require the business associate to appropriately safeguard your information.

5. Public Health. GSL may use and disclose medical information about you for public health activities, such as disclosures to a public health authority or other government agency that is permitted by law to collect or receive the information (e.g., the Food and Drug Administration).

6. Victims of Abuse, Neglect, or Domestic Violence. The Privacy Rule authorizes GSL to disclose your PHI to the appropriate government authority, including a social service or protective service agency, if GSL reasonably believes a patient or resident has been a victim of abuse, neglect, or domestic violence.

7. Health Oversight Activities. GSL is permitted to disclose PHI to a health oversight agency for activities authorized by law, including audits, investigations, inspections, licensure or disciplinary activities, and other similar proceedings. GSL may not disclose the PHI of a person who is the subject of an investigation that is not directly related to that person’s receipt of health care or public benefits.

8. To Avert a Serious Threat to Health or Safety. GSL may, consistent with applicable law and standards of ethical conduct, use or disclose your PHI to prevent or lessen a serious or imminent threat to the health or safety of a person or the public.

9. Funeral Directors, Medical Examiners, and Coroners. Sometimes, GSL may deem it necessary to release medical information to funeral directors, so that they can carry out their duties appropriately. Sometimes, when there are concerns about identification of a patient, or determining what caused a death, we will release medical information to medical examiners or coroners.

10. Organ and Tissue Donation. If you are an organ donor, GSL may disclose your PHI to organizations that facilitate organ, eye, or tissue procurement, banking, or transportation.

11. Workers’ Compensation. GSL may release medical information about you to insurers, government administrators, and employers for workers’ compensation or similar programs. This relates to care provided for work-related injuries or illness.

12. Specialized Government Functions. In certain circumstances, the Privacy Rule authorizes GSL to use or disclose your PHI to facilitate specified government functions to include:

13. Judicial and Administrative Proceedings. If you are involved in a lawsuit or dispute, the Privacy Rule allows GSL to disclose your PHI in response to a court or administrative order, or in certain situations, a subpoena.

14. Law Enforcement. We may disclose limited PHI to the police or other law enforcement official as required or permitted by law or in compliance with a court order or a grand jury or administrative subpoena.

15. Research. Under certain circumstances, GSL may use and disclose your PHI for research purposes. Before we use or disclose medical information for research, the project will have been approved through GSL research approval process, but we may disclose your medical information to people preparing to conduct the research project (e.g., to help the researchers look for patients with specific medical conditions or needs).

16. As Required by Law. GSL is permitted to disclose your PHI when required to do so by federal, state, or local law.

1. Hospital and Facility Directory. Unless you object, GSL may list certain information about you in the hospital directory while you are an inpatient at GSL. This information may include your name, where you are in GSL, a general description about your condition (e.g., fair, stable) and your religious affiliation. Information in the directory may be disclosed to anyone who asks for you by name; however, your religious affiliation may be given to members of the clergy even if they do not ask for you by name. If you choose to opt out, please call the Patient Access Center at (484) 526-1128 and ask them to remove you from the Hospital Directory.

2. Persons Involved in Your Care or Payment for Your Care. GSL may release PHI about you to a family member, friend, or someone you designate who is involved in your care or payment of medical bills. GSL may also disclose your health information to an entity authorized to assist in disaster relief so that those who care for you can receive information about your location or health status.

1. Other Uses of Medical Information. Other uses and disclosures of medical information not covered by this Notice or the laws that apply to us will be made only with your written permission. If you provide us permission to use or disclose medical information about you, you may revoke that permission, in writing, at any time. You understand that we are unable to take back any disclosure that GSL has already made with your permission, and that we are required to retain our records of the care that we provided to you.

2. Psychotherapy Notes. GSL must obtain your written authorization for most uses and disclosures of psychotherapy notes, except when required to do so by a court order.

3. Marketing. GSL must obtain your written authorization prior to using or disclosing your PHI for most marketing materials.

4. Sale of Your PHI. GSL must obtain your written authorization for any disclosure of your PHI which constitutes the sale of PHI.

1. Fundraising Activities. GSL may solicit contributions to support the expansion and improvement of services and programs we provide to the community. In connection with our fundraising efforts, we may disclose to our employees or business associates, demographic information about you (e.g., your name, address, and phone number), dates on which we provided health care to you, health insurance status, department of service, treating physician and general outcome information. If you do not wish to receive any fundraising requests in the future, you may contact the St. Luke's Foundation at (866) 468- 6251 or respond via one of the methods identified in the fundraising correspondence that you may receive in the future.

2. Treatment Options. GSL may use or disclose your PHI to tell you about or recommend possible treatment options or alternatives that may be beneficial to you. For example, your name, address, and electronic mail address may be used so we can send you newsletters or health care bulletins about GSL and the services we provide. We may also send you information about health-related products or services that we or others make available and that we think may be useful or of interest to you. You may write to St. Luke's Marketing and Communications Department Attn: InfoLink 801 Ostrum St., Bethlehem, PA 18015 or info.link@sluhn.org as notification that you do not wish to receive any of our newsletters or other information.

3. Health Information Exchange. A patient's PHI is available electronically to local, state, or national healthcare providers who participate in our Electronic Health Record (EHR) system or other similar programs. These programs facilitate the exchange of health information by allowing approved participating providers to have a more complete picture about a patient's health such as lab results, summary of care documents, and other medical data. Patients can choose to prohibit sharing their PHI for these purposes by completing a process referred to as Opting-Out. Opting-Out will prevent participating providers and its authorized users from viewing PHI, but the patient will still have access to view their PHI made available in our patient portal. To opt-out, please call our MyChart Service Desk at 1-866-STLUKES.

1. To the extent required by law, GSL will notify affected individuals, the federal Department of Health and Human Services, and the media, as applicable, of any Breach of unsecured PHI that compromises the security or privacy of the PHI. All suspected Breaches will be investigated, and all necessary notifications will be sent, in accordance with company policy. Examples of unsecured PHI include but are not limited to:

2. “Breach” means the unauthorized acquisition, access, use, or disclosure of PHI which compromises the security or privacy of the PHI, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information.

1. Right to Request Restrictions. You have the right to request restrictions or limitations on GSL uses or disclosures of PHI about you for treatment, payment, or health care operations. Any request for restrictions must be in writing, directed to the Medical Records Department 801 Ostrum St., Bethlehem, PA 18015, and should include (1) name and address of where services were received; (2) what information you want to limit; (3) whether you want to limit its use, disclosure, or both; and (4) to whom you want the limits to apply.

GSL is not required to agree to your request. If GSL does agree, it will comply with your request unless the information is needed to provide you emergency treatment.

2. Right to Request Confidential Communications. You have the right to request that GSL communicate with you about medical matters through specific channels, that is, in a certain way (e.g., “by cell phone only”) or at a certain location.

3. Right to Inspect and Copy. You have the right to inspect and copy a designated set of your medical records. This designated set typically includes medical and billing records but may not include psychotherapy notes. GSL may charge a reasonable fee for the costs of copying, mailing or other supplies associated with your request. GSL may deny your request to inspect and copy in certain circumstances. If you are denied access to your medical records, you may have the denial reviewed by a licensed health care professional chosen by GSL.

4. Right to Amend. You have the right to request that we amend your PHI that is maintained in a designated record set. We will comply with your request unless we believe that the information that would be amended is accurate and complete or other special circumstances apply. In the case of a denial, you will be provided with a written explanation for the basis of the denial and informed of subsequent measures you can take, if you choose to do so.

5. Right to an Accounting of Disclosures. You have the right to request an accounting of certain disclosures of PHI by GSL. A request for accounting of disclosures must specify a time period, which may not be longer than six years, and which may not include dates of service before April 14, 2003. Your written request should indicate in what form you want the disclosure. The first accounting within a 12-month period will be free; for additional accountings, GSL may charge for its costs after notifying you of the cost involved and giving you the opportunity to withdraw or modify your request before any costs are incurred.

6. Right to Complain. If you believe your privacy rights have been violated, you may file a complaint with GSL and/or with the federal Department of Health and Human Services (DHHS). GSL will not retaliate against you for filing such a complaint.

7. Right to a Paper Copy of this Notice. You have the right to a paper copy of this Notice. You may ask us to give you a copy of this notice at any time. You may also obtain a copy of the current version of GSL Notice of Privacy Practices at our Web site, https://geisingerstlukes.org.

8. Right to Breach Notification. You have a right to receive written notification when a breach of PHI has occurred. You shall receive notification no later than 60 days after the breach has been discovered.