Effective April 14, 2003
REVISED JULY 2, 2012
Nothing is more important than ensuring your privacy
At DuPage Medical Group, we understand your privacy is vitally important. As your medical provider, we are very proactive in safeguarding your information. We understand that with each office visit, you are placing your trust in us. And we will do everything we possibly can to ensure this trust is not breached.
This booklet was developed to provide you with information regarding your rights to privacy and confidentiality. It contains our policies regarding privacy according to Health Insurance Portability and Accountability Act (HIPAA) rules and regulations. We encourage you to read this information so that you are fully informed and comfortable with the manner in which we treat your privacy. We welcome any questions you may have regarding this information.
Notice of privacy practices
DuPage Medical Group maintains the privacy of Protected Health Information (PHI) and provides individuals with notice of our legal duties and privacy practices with respect to PHI as described in this Notice.
Provision of Notice
DuPage Medical Group provides its Notice of Privacy Practices to every patient with whom it has a direct treatment relationship. The Notice is provided no later than the date of the first treatment to the patient after April 14, 2003.
DuPage Medical Group makes its Notice available to any member of the public to enable prospective patients to evaluate the Group’s privacy practices when making his or her decision regarding whether to seek treatment from the Group. The Group provides its Notice at each office to any patient or other individual who so requests the Notice.
Documentation of Provision of Notice
When a direct treatment patient receives the Notice from the Group, the Group asks the patient to sign its “Receipt of Notice of Privacy Practices” form. The form is filed with the patient’s medical record. If the patient refuses to sign the form, it is noted in the medical record that the patient was given the Notice and refused to sign the form.
Effective Date & Changes to Notice
This Notice was dated April 14, 2003 and was revised effective July 2, 2012. DuPage Medical Group reserves the right to revise this Notice whenever there is a material change to the uses or disclosures, the individual’s rights, the covered entity’s legal duties or other privacy practices stated in the Notice. Except when required by law, a material change to any term of the Notice will not be implemented prior to the effective date of the notice in which such material change is reflected.
If the Notice is revised, the Group makes the revised Notice available upon request beginning on the revision’s effective date. The revised notice is posted in the Group’s reception area and made available to all patients, including those who have received a previous Notice. Upon receipt of a revised Notice, a patient is asked to acknowledge receipt of the Notice.
DuPage Medical Group, Ltd., which includes current and future subsidiaries*, maintains its patient health record through the use of an electronic health record system (“EHR system”) shared with Edward Health Services Corporation (“Edward”). Through the EHR system, PHI of DMG patients is combined with that of Edward, such that each patient has a single, longitudinal health record with respect to health care services provided by DMG and Edward.
Through the EHR system, DMG and Edward have formed an organized system of health care in which DMG and Edward participate in joint utilization management and/or Quality Assurance activities and as such qualify to participate in an Organized Health Care Arrangement (“OHCA”). With limited exceptions, as OHCA participants, DMG and Edward may use and disclose the PHI contained within the EHR system for treatment, payment and health care operations purposes of the OHCA participants.
DuPage Medical Group allows all patients and their agents to file complaints with the Group and with the Secretary of the Federal Department of Health and Human Services. A patient or his or her agent may file a complaint with the Group whenever he or she believes that the Group has violated their rights.
Complaints to DuPage Medical Group must be in writing, must describe the acts or omissions that are the subject of the complaint and must be filed within 180 days of the time the patient became aware or should have become aware of the violation. Complaints must be addressed to the attention of the DuPage Medical Group’s privacy officer at the Group’s address. The Group investigates each complaint and may, at its discretion, reply to the patient or the patient’s agent.
Complaints to the Secretary of the Department of Health and Human Services must be in writing, must name the Group, must describe the acts or omissions that are the subject of the complaint and must be filed within 180 days of the time the patient became aware or should have become aware of the violation.
Complaints must be addressed to:
Office for Civil Rights
U.S. Department of Health and Human Services
200 Independence Avenue SW, Washington, D.C. 20201
DuPage Medical Group does not take any adverse action against any patient who files a complaint (either directly or through an agent) against the Group.
DuPage Medical Group has a privacy officer who serves as the contact person for all issues related to the Privacy Rule.
If you have any questions about this Notice, please contact:
Privacy Officer at DuPage Medical Group
1100 W. 31st Street, Suite 300, Downers Grove, IL 60515.
*A list of DMG subsidiaries will be provided upon request.
Uses & Disclosures of PHI
DuPage Medical Group reasonably ensures that PHI requests, uses and disclosures for any purpose are the minimum amount of PHI necessary for that purpose.
DuPage Medical Group treats all qualified individuals as personal representatives of patients. The Group generally allows individuals to act as personal representatives of patients. The two general exceptions to allowing individuals to act as personal representatives relate to emancipated minors and abuse, neglect or endangerment situations.
DuPage Medical Group makes reasonable efforts to ensure that PHI is only used by and disclosed to individuals that have a right to PHI. Toward that end, the Group makes reasonable efforts to verify the identity of those using or receiving PHI.
Treatment, Payment & Healthcare Operations
DuPage Medical Group uses and discloses PHI for payment, treatment and healthcare operations. Treatment includes those activities related to providing services to the patient, including releasing information to other healthcare providers involved in the patient’s care. Payment relates to all activities associated with getting reimbursed for services provided, including submission of claims to insurance companies and any additional information requested by the insurance company so they can determine if they should pay the claim. Healthcare operations include a number of areas, including quality assurance and peer review activities.
Not Requiring Authorization
Disclosure to Those Involved in Individual’s Care
DuPage Medical Group discloses PHI to those involved in a patient’s care when the patient approves or, when the patient is not present or not able to approve, when such disclosure is deemed appropriate in the professional judgment of DuPage Medical Group.
When the patient is not present, the Group determines whether the disclosure of the patient’s PHI is authorized by law and if so, discloses only the information directly relevant to the person’s involvement with the patient’s healthcare.
DuPage Medical Group does not disclose PHI to a suspected abuser, if, in its professional judgment, there is reason to believe that such a disclosure could cause the patient serious harm.
Uses & Disclosures Required by Law
DuPage Medical Group uses and discloses PHI to appropriate individuals as required by law.
DuPage Medical Group discloses PHI to public health officials when required by law. This includes reporting of communicable diseases and other conditions, sexually transmitted diseases, lead poisoning, Reye’s Syndrome and mandated reports of injury, medical conditions, procedures or food-borne illness including but not limited to adverse reactions to immunizations, cancer, adverse pregnancy outcomes, death, or birth.
DuPage Medical Group discloses PHI regarding victims of abuse, neglect or domestic violence. DuPage Medical Group discloses information about a minor, disabled adult, nursing home resident or person over 60 years of age whom the Group reasonably believes to be a victim of abuse or neglect to the appropriate authorities as required by law or, if not required by law, if the individual agrees to the disclosure. This includes child abuse and neglect, elder abuse and exploitation, abused and neglected nursing home residents or disabled adults abuse.
DuPage Medical Group informs the individual of the reporting unless DuPage Medical Group, in the exercise of professional judgment, believes informing the individual would place the individual at risk of serious harm or DuPage Medical Group would be informing a personal representative and DuPage Medical Group believes the personal representative is responsible for the abuse, neglect or other injury and that informing such person would not be in the best interests of the individual as determined by the professional judgment of the Group.
Uses & Disclosures for Health Oversight Activities
DuPage Medical Group uses and discloses PHI as required by law for health oversight activities. The information may be used and released for audits, investigations, licensure issues and other health oversight activities, including, but limited to hospital peer review, managed care peer review or Medicaid or Medicare peer review.
Disclosures for Judicial & Administrative Proceedings
In general, DuPage Medical Group discloses information for judicial and administrative proceedings in response to an order of a court or an administrative tribunal; or a subpoena, discovery request or other lawful process, not accompanied by a court order or an ordered administrative tribunal.
Disclosures for Law Enforcement Purposes
DuPage Medical Group discloses PHI for law enforcement purposes to law enforcement officials.
Uses & Disclosures Related to Decedents
DuPage Medical Group uses and discloses PHI as required to a coroner or medical examiner and funeral directors as required by law. The attending physician is required to sign the death certificate and provide the coroner with a copy of the decedent’s PHI.
Uses & Disclosures Related to Cadaveric Organ, Eye or Tissue Donations
DuPage Medical Group uses and discloses PHI to facilitate organ, eye or tissue donations.
Uses & Disclosures to Avert a Serious Threat to Health or Safety
DuPage Medical Group uses and discloses PHI to public health and other authorities as required by law to avert a serious threat to health or safety.
Uses & Disclosures for Specialized Government Functions
DuPage Medical Group uses and discloses PHI for military and veterans activities, national security and intelligence activities and other activities as required by law.
Uses & Disclosures in Emergency Situations
DuPage Medical Group uses and discloses PHI as appropriate to provide treatment in emergency situations. In those instances where DuPage Medical Group has not previously provided its Notice of Privacy Practices to a patient who receives direct treatment in an emergency situation, DuPage Medical Group provides the Notice to the individual as soon as practicable following the provision of the emergency treatment.
DuPage Medical Group does not use or disclose any PHI for marketing purposes. The Group does engage in communications about products and services that encourages recipients of the communication to purchase or use the product or service for treatment, to direct or recommend alternative treatments, therapies, healthcare providers or settings of care to the individual. These activities are not considered marketing.
In addition, DuPage Medical Group may contact the individual with appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to the individual.
Uses & Disclosures for Research
Under certain circumstances, DuPage Medical Group may use and disclose medical information about you for research purposes, or we may contact you about research projects that you may qualify for. For example, a research project may involve comparing the health and recovery of all patients with the same condition who received one medication to those who received another medication. All research projects are subject to a special approval process. This process evaluates a proposed research project and its use of medical information to ensure patient medical information is only used and disclosed as necessary for the research project. Normally we use or disclose medical information for research only after the project has been approved through the research approval process. However, we may disclose medical information about you to researchers to help them identify patients with specific medical needs. In this case, we will not allow researchers to copy or otherwise transmit your medical information outside of DuPage Medical Group without your authorization. At times, you may be asked to give authorization before we share your information with others for use in research. If your information is used, the researcher must keep your information safe and confidential.
Uses & Disclosures That Do Not Apply to The Group
Other Uses & Disclosures
DuPage Medical Group does not use or disclose PHI to an employer or health plan sponsor, for underwriting and related purposes, for facility directories, to brokers and agents or for fundraising.
If an individual wants DuPage Medical Group to release his or her PHI to employers or health plan sponsors, for underwriting and related purposes, for facility directories or to brokers and agents, then he or she can contact DuPage Medical Group and complete an appropriate written authorization.
Accounting for Disclosures of PHI
DuPage Medical Group tracks all disclosures of a patient’s PHI that occur for other than the purposes of treatment, payment and healthcare operations, that are not made to the individual or to a person involved in the patient’s care, that are not made as a result of a patient authorization and that are not made for national security or intelligence purposes or to correctional institutions or law enforcement officials.
DuPage Medical Group allows an individual to request one accounting within a 12-month period free of charge. The Group charges a reasonable fee for more frequent accounting requests. The charge will be in accordance with Illinois law for copying medical records. An individual can request an accounting of disclosures for a period of up to six years prior to the date of the request. Requests for shorter accounting periods will be accepted. However, patients may only request an accounting of disclosures made on or after April 14, 2003.
DuPage Medical Group responds to all requests for an accounting of disclosures within 60 days of receipt of the request. If DuPage Medical Group intends to provide the accounting for disclosures and cannot do so within 60 days, DuPage Medical Group informs the requester of such and provides a reason for the delay and the date the request is expected to be fulfilled. (Only one 30-day extension is permitted.) A request for an accounting for disclosures must be made in writing and mailed or sent to DuPage Medical Group. It should be marked “Attention: Privacy Officer”.
Inspect & Copy PHI
DuPage Medical Group allows individuals to inspect and copy their PHI, documents all requests, responds to those requests in a timely fashion, informs individuals of their appeal rights when a request is rejected in whole or in part and charges a reasonable fee for the copying of records.
DuPage Medical Group reviews the request in a timely fashion and acts on a request for access generally within 30 days. DuPage Medical Group may have a single extension of 30 days, if needed to act on the request. Each request will be accepted or denied and the requester notified in writing. If a request is denied, the requester is informed if the denial is “reviewable” or not. The requester has the right to have any denial reviewed by a licensed healthcare professional who is designated by DuPage Medical Group as a reviewing official and who did not participate in the original decision to deny. DuPage Medical Group informs the requester of the decision of the reviewing official and adheres to the decision.
DuPage Medical Group charges reasonable fees based on actual cost of fulfilling the request. DuPage Medical Group will determine the appropriate charge for providing the requested records and inform the requester in advance of providing the records. If the requester agrees to pay the fee in advance, the records will be provided. Otherwise, the records will not be provided, unless the privacy officer determines that the charge is burdensome to the requester.
Illinois law determines the set fee for copying medical records. Please contact your primary care office for detailed copying rates.
Requests for the inspection and copying of records must be sent to the Group in writing. It should be marked “Attention: Privacy Officer”.
Request Amendment to PHI
DuPage Medical Group allows an individual to request that the Group amend the PHI maintained in the patient’s medical record or the patient’s billing record. DuPage Medical Group documents all requests, responds to those requests in a timely fashion and informs individuals of their appeal rights when a request is denied in whole or in part.
Generally, DuPage Medical Group will act on a request for amendment no later than 60 days after receipt of such a request. If DuPage Medical Group cannot act on the amendment within 60 days, DuPage Medical Group extends the time for such action by 30 days and, within the 60-day time limit, provides the requester with a written statement of the reasons for the delay and the date by which DuPage Medical Group will complete action on the request. Only one such extension is allowed.
If DuPage Medical Group denies the request, in whole or in part, DuPage Medical Group provides the requester with a written denial in a timely fashion. DuPage Medical Group allows a requester to submit a written statement disagreeing with the denial of all or part of the initial request. The statement must include the basis of the disagreement. DuPage Medical Group limits the length of a statement of disagreement to one page.
Requests to amend the PHI maintained by the Group must be in writing and should be marked “Attention: Privacy Officer”.
Request Confidential Communications
DuPage Medical Group accommodates all reasonable requests to keep communications confidential. DuPage Medical Group determines the reasonableness based on the administrative difficulty of complying with the request.
A request for confidential communications must be in writing, must specify an alternative address or other method of contact and must provide information about how payment will be handled. The request must be addressed to the Group’s privacy officer. No reason for the request needs to be stated.
DuPage Medical Group accommodates all reasonable requests. The reasonableness of a request is determined solely on the basis of the administrative difficulty of complying with the request. DuPage Medical Group will reject a request due to administrative difficulty if no independently verifiable method of communication such as a mailing address or published telephone number is provided for communications, including billing; or if the requester has not provided information as to how payment will be handled.
DuPage Medical Group will not refuse a request: if the requester indicates that the communication will cause endangerment; or based on any perception of the merits of the requester’s request.
Request Restriction of Disclosures
DuPage Medical Group allows an individual to request restriction(s) of disclosure of PHI. DuPage Medical Group has the right to deny all or part of a request under certain circumstances.
For restrictions to a health plan for payment or health care operations, the charge must be paid in full at the time of service. All requests for restriction(s) of disclosure must be submitted in writing. They must be sent to the attention of the Group’s privacy officer. DuPage Medical Group will notify the requester in writing of the Group’s decision to approve or deny all or part of a request within 60 days after receipt of such a request.
DuPage Medical Group obtains a written authorization from a patient or the patient’s representative for the use or disclosure of PHI for other than treatment, payment or healthcare operations; however, DuPage Medical Group will not get an authorization for the use or disclosure of PHI specifically allowed under the Privacy Rule in the absence of an authorization. DuPage Medical Group will provide a patient upon request, a copy of any authorization initiated by DuPage Medical Group (as opposed to requested by the patient) and signed by the patient.
DuPage Medical Group does not condition treatment of a patient on the signing of an authorization, except disclosure necessary to determine payment of claim (excluding authorization for use or disclosure of psychotherapy notes); or provision of healthcare solely for purpose of creating PHI for disclosure to a third party (e.g., pre-employment or life insurance physicals).
In Illinois, a specific written authorization is required to disclose or release mental health treatment, alcoholism treatment, drug abuse treatment or HIV/Acquired Immune Deficiency Syndrome (AIDS) information.
DuPage Medical Group allows an individual to revoke an authorization at any time. The revocation must be in writing and must be sent to the attention of the Group’s privacy officer; however, in any case DuPage Medical Group will be able to use or disclose the PHI to the extent DuPage Medical Group has taken action in reliance on the authorization.
Waiver of Rights
DuPage Medical Group never requires an individual to waive any of his or her individual rights as a condition for the provision of treatment, except under very limited circumstances allowed under law.
1100 W. 31st Street, Suite 300
Downers Grove, IL 60515