HIPAA privacy policy

Questions? Contact us.

THIS JOINT HIPAA NOTICE OF PRIVACY PRACTICES (THE “NOTICE”) DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who Will Follow this Notice?

The VNS Health Organized Health Care Arrangement (the “VNS Health OHCA,” “we” or “us”), is an organized health care arrangement that is comprised of the entities listed below (each an “OHCA Member” and collectively, the “OHCA Members”).  For purposes of our privacy practices, we are considered one single entity.

• Visiting Nurse Service of New York Home Care II d/b/a/
  VNS Health Home Care

• New Partners, Inc. d/b/a
  VNS Health Personal Care

• VNS CHOICE d/b/a
  VNS Health Health Plans

• Visiting Nurse Service of New York Hospice Care d/b/a
  VNS Health Hospice Care

• Medical Care at Home, P.C.

• VNS Health Behavioral Health, Inc.

The VNS Health OHCA was formed for the primary purpose of improving the quality of care provided to you. Membership in the VNS Health OHCA permits the OHCA Members to share medical information amongst ourselves to manage joint operational activities. In order to provide care or pay for your services, the OHCA Members must collect, create and maintain health information about you, which includes any individually identifiable information that we obtain from you or others that relates to your past, present or future physical or mental health, the health care you have received, or payment for your health care. Each OHCA Member is required by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended from time to time (collectively, “HIPAA”) to maintain the privacy and security of this information.

This Notice describes how OHCA Members use and disclose your health information and explains certain rights you have regarding this information. Each OHCA Member is required by law to provide you with this Notice and we will comply with the terms as stated. The privacy practices in this Notice will be followed by all OHCA Members, including their workforce members and business associates.  We will only use or disclose your health information as described in this Notice, unless you notify us in writing, at the address provided below, that we have permission to use your health information other than as described in this Notice.  This Notice does not alter the independent status of any OHCA Member nor does it make any of the OHCA Members jointly responsible for the negligence, mistakes, or violations of any of the other OHCA Members.

The OHCA Members protect your health information from inappropriate use and disclosure. The OHCA Members will use and disclose your health information for only the purposes listed below:

1. Uses and Disclosures for Treatment, Payment and Health Care Operations. We may use and disclose your health information in order to provide your care or treatment, obtain payment for services provided to you and in order to conduct our health care operations as detailed below.

   1. Treatment and Care Management. We may use and disclose health information about you to facilitate treatment provided to you by the OHCA Members and coordinate and manage your care with other health care providers. For example, your OHCA Member clinician may discuss your health condition with your doctor to plan the clinical services you receive at home. We may also leave health information in your home for the purpose of keeping other caregivers informed of needed information.

   2. Payment. We may use and disclose health information about you for our own payment purposes and to assist in the payment activities of other health care providers. Our payment activities include, without limitation, determining your eligibility for benefits and obtaining payment from insurers that may be responsible for providing coverage to you, including Federal and State entities.

   3. Health Care Operations. We may use and disclose health information about you to support our functions, which include, without limitation, care management, quality improvement activities, evaluating our own performance and resolving any complaints or grievances you may have. We may also use and disclose your health information to assist other health care providers in performing health care operations.

2. Uses and Disclosures Without Your Consent or Authorization. We may use and disclose your health information without your specific written authorization for the following purposes:

   1. As Required by Law. We may use and disclose your health information as required by any applicable state, federal and local law.

   2. Public Health Activities. We may disclose your health information to public authorities or other agencies and organizations conducting public health activities, such as preventing or controlling disease, injury or disability, reporting births, deaths, child abuse or neglect, domestic violence, potential problems with products regulated by the Food and Drug Administration or communicable diseases.

   3. Victims of Abuse, Neglect or Domestic Violence. We may disclose your health information to an appropriate government agency if we believe you are a victim of abuse, neglect, domestic violence and you agree to the disclosure or the disclosure is required or permitted by law. We will let you know if we disclose your health information for this purpose, unless we believe that advising you or your caregiver would place you or another person at risk of serious harm.

   4. Health Oversight Activities. We may disclose your health information to federal or state health oversight agencies for activities authorized by law such as audits, investigations, inspections and licensing surveys.

   5. Judicial and Administrative Proceedings. We may disclose your health information in the course of any judicial or administrative proceeding or in response to a subpoena, discovery request or other lawful purpose.

   6. Law Enforcement Purposes. We may disclose your health information to a law enforcement agency to respond to a court order, warrant, summons or similar process, to help identify or locate a suspect or missing person, to provide information about a victim of a crime, a death that may be the result of criminal activity, or criminal conduct on our premises, or, in emergency situations, to report a crime, the location of the crime or the victims, or the identity, location or description of the person who committed the crime.

   7. Deceased Individuals. We may disclose your health information to a coroner, medical examiner or a funeral director as necessary and as authorized by law.

   8. Organ or Tissue Donation. We may disclose your health information to organ Procurement organizations and similar entities for the purpose of assisting them in organ or tissue procurement, banking or transplantation.

   9. Research We may use or disclose your health information for research purposes, such as studies comparing the benefits of alternative treatments received by our patients or investigations into how to improve our care delivery. We will use or disclose your health information for research purposes only with the approval of our Institutional Review Board (“IRB”), which must follow a special approval process. Before permitting any use or disclosure of your health information for research purposes, our IRB will balance the needs of the researchers and the potential value of their research against the protection of your privacy. When required, we will obtain a written authorization from you prior to using your health information for research.

   10. Health or Safety. We may use or disclose your health information to prevent or lessen a serious or imminent threat to the health or safety of you or the general public. We may also disclose your health information to public or private disaster relief organizations such as the Red Cross or other organizations participating in bio-terrorism countermeasures.

   11. Specialized Government Functions. We may use or disclose your health information to provide assistance for certain types of government activities. If you are a member of the armed forces of the United States or a foreign country, we may disclose your health information to appropriate military authority as is deemed necessary. We may also disclose your health information to federal officials for lawful intelligence or national security activities.

   12. Workers’ Compensation. We may use or disclose your health information as permitted by the laws governing the workers’ compensation program or similar programs that provide benefits for work-related injuries or illnesses.

   13. Individuals Involved in Your Care. We may disclose your health information to a family member, other relative or close personal friend assisting you in receiving health care services. If you are available, we will give you an opportunity to object to these disclosures, and we will not make these disclosures if you object. If you are not available, we will determine whether a disclosure to your family or friends is in your best interest, taking into account the circumstances and based upon our professional judgment.

   14. Communications Regarding Appointments, Information and Services. We may contact you or your designated personal representative via email, as well as text messages or telephone (including cell phone) calls using automated or prerecorded messages to provide appointment and visit reminders, patient satisfaction surveys, program welcome emails and newsletters, or information about treatment alternatives or other health-related services. The frequency of these messages will vary. You have the right to opt out of receiving calls and text messages by following the applicable unsubscribe or opt-out instructions provided, by texting “STOP” or by contacting VNS Health or its designated third-party vendor. Standard message and data rates may apply. If you no longer wish to receive emails, you may click on the hyperlink titled “Unsubscribe” at the bottom of any email sent to you by VNS Health, and then follow the directions to unsubscribe from the email. Your consent to receive phone calls, text messages and/or emails is not a condition of your obtaining other health care services from VNS Health. Please note that communications transmitted via unencrypted email, text message or over an open network may be inherently unsecure, and there is no assurance of confidentiality for information communicated in this manner. Additionally, emails and text messages have inherent privacy risks, especially when access to your computer or mobile device is not password protected.

   15. Fundraising. As a not-for-profit health care organization, our parent agency, VNS Health, may identify you as a patient for purposes of fundraising and marketing. You have the right to opt out of receiving such fundraising communications by contacting us at the email address or phone number we provide in the fundraising communication or by filling out and mailing back a preprinted, prepaid postcard contained in the fundraising communication.

   16. Incidental Uses and Disclosures. Incidental uses and disclosures of your health information sometimes occur and are not considered to be a violation of your rights. Incidental uses and disclosures are by-products of otherwise permitted uses or disclosures which are limited in nature and cannot be reasonably prevented.

   17. Organized Health Care Arrangement. We may share your health information amongst our OHCA Members to perform health care operations, unless otherwise limited by another law or regulation. For example, your health information may be shared across the VNS Health OHCA in order to assess quality, effectiveness, and cost of care.

   18. Personal Representative. We may disclose your health information to your authorized personal representative, such as your lawyer, administrator, executor health care proxy or another authorized person responsible for you or your estate.

   19. Business Associates. We may disclose your health information to other companies or individuals, known as “Business Associates,” who provide services to us.  For example, we may share your health information with a company that provides billing or care management services on our behalf. Our Business Associates are required to protect the privacy and security of your health information and notify us of any improper use or disclosure of your health information.

   20. De-identification and Partial De-identification. We may de-identify your health information by removing identifying features as determined by law to make it extremely unlikely that the information could identify you, and may use or disclosure such de-identified information.  We may also use and disclose “partially de-identified” health information about you for research, public health or health care operations purposes if the person or entity who will receive the information signs an agreement to protect the privacy of the information as required by federal and state law.  Partially de-identified health information will not contain any information that would directly identify you (such as your name, street address, social security number, phone number, fax number, electronic mail address, website address or license number).

3. Health Information Exchanges. We participate in secure HIEs, such as those operated by Healthix and Bronx RHIO.  HIEs help coordinate patient care efficiently by allowing health care providers involved in your care to share information with each other in a secure and timely manner.  If you provide consent, OHCA Members may use, disclose and access your health information via the HIEs in which the VNS Health OHCA participates for purposes of treatment, payment and healthcare operations.

4. Special Treatment of Certain Records. HIV-related information, genetic information, alcohol and/or substance abuse records, mental health records and other specially protected health information may enjoy certain special confidentiality protections under applicable state and federal law. Any disclosures of these types of records will be subject to these special protections. Specifically, if applicable to you, substance use disorder patient records protected pursuant to 42 C.F.R. Part 2 and will not be shared amongst the OHCA Members, unless such disclosure is permitted by Part 2.

5. Obtaining Your Authorization for Other Uses and Disclosures. Certain uses and disclosures of your health information will be made only with your written authorization, including uses and/or disclosures: (a) of psychotherapy notes (where appropriate); (b) for marketing purposes; and (c) that constitute a sale of health information under the HIPAA Privacy Rule. The OHCA Members will not use or disclose your health information for any purpose not specified in this Notice, other than those uses or disclosures otherwise permitted or required by law, unless we obtain your express written authorization or the authorization of your legally appointed representative. If you give us your authorization, you may revoke it at any time, in which case we will no longer use or disclose your health information for the purpose you authorized, except to the extent we have relied on your authorization to provide your care. A revocation of authorization must be submitted to the VNS Health Privacy Officer at the address provided at the end of this Notice.

6. Children’s and Family Services or Behavioral Health Services. If you decide to receive services from other VNS Health programs, such as Children’s and Family Services or Behavioral Health services, you will be informed of specific privacy practices that relate to those programs in addition to the practices contained in this notice.

You have the following rights regarding your health information:

1. Right to Inspect and Copy. You, or your authorized representative, have the right to inspect or request a copy of health information about you that we maintain. Requests should be sent to the Medical Records Department via email to [email protected]. Your request should describe the information you want to review and the format in which you wish to review it. If we maintain an electronic health record containing your information, you have the right to request that we send a copy of your health information in electronic format to you or a third party that you identify.  We may refuse to allow you to inspect or obtain copies of this information in certain limited cases. We may charge you a reasonable, cost-based fee. We may also deny a request for access to health information under certain circumstances if there is a potential for harm to yourself or others. If we deny a request for access for this purpose, you have the right to have our denial reviewed in accordance with the requirements of applicable law, by filing a request for review with the VNS Health Privacy Officer.

2. Right to Request Amendments. You have the right to request changes to any health information we maintain about you if you state a reason why this information is incorrect or incomplete. Your request must be in writing and must explain why the information should be corrected or updated. We may deny your request under certain circumstances and provide a written explanation.

3. Right to an Accounting of Disclosures. You have the right to receive a list of the disclosures of your health information by each of the OHCA Members. The list will not include disclosures made for certain purposes including, without limitation, disclosures for treatment, payment or health care operations or disclosures you authorized in writing. Your request should specify the time period covered by your request, which cannot exceed six years. The first time you request a list of disclosures in any 12-month period, it will be provided at no cost. If you request additional lists within the 12-month period, we may charge you a nominal fee.

4. Right to Request Restrictions. You have the right to request restrictions on the ways which we use and disclose your health information. While we will consider all requests for additional restrictions carefully, an OHCA Member is not required to comply with your request except for restrictions on uses or disclosures for the purpose of carrying out payment or health care operations, where you have paid the bill “out-of-pocket” in full. If we do agree to a requested restriction, we will not disclose your health information in accordance with the agreed-upon restriction.

5. Right to Request Confidential Communications. You have the right to ask us to send health information to you in a different way or at a different location. Your request for an alternate form of communication should also specify where and/or how we should contact you.

6. Right to Receive Notification of Breach. You have the right to receive a notification,
   in the event that there is a breach of your unsecured health information, which requires notification under the HIPAA Privacy Rule.

7. Right to Paper Copy of Notice. You have the right to receive a paper copy of this Notice at any time. You may obtain a paper copy of this Notice, by writing to the VNS Health Privacy Officer. You may also print out a copy of this Notice by going to our website at vnshealth.org.

8. Choose Someone to Act for You. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure that person has this authority and can act for you before we take any action.

9. HIE Opt-Out. You have the right to opt-out of the disclosure of your health information to or via an HIE.  However, information that is sent to or via an HIE prior to processing your opt-out may continue to be maintained by, and be accessible through, the HIE.

10. Complaints. If you believe your privacy rights have been violated you have the right to file a complaint with the VNS Health Privacy Officer. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services (“HHS”). We will provide you with the address to file your complaint with HHS upon request. You will not be penalized or retaliated against by the OHCA Members, or their parent, VNS Health, for filing a complaint.

Breach Notification.  We are required by law to notify you following the discovery that there has been a breach of your unsecured health information, unless we determine that there is a low probability that the privacy or security of your health information has been compromised.  You will be notified in a timely manner, no later than sixty (60) days after discovery of the breach, unless state law requires notification sooner.

Questions. If you have any questions or comments about our privacy practices or this Notice, or if you would like a more detailed explanation about your privacy rights, please contact the VNS Health Privacy Officer using the contact information provided at the end of this Notice.

Changes to this Notice. The OHCA Members may change the terms of this Notice of Privacy Practices at any time. If the terms of the Notice are changed, the new terms will apply to all of your health information, whether created or received by VNS Health OHCA before or after the date on which the Notice is changed. Any updates to the Notice will be made available on vnshealth.org.

Contact Information. When communicating with us regarding this Notice, our privacy practices or your privacy rights, please contact the VNS Health Privacy Officer using the following contact information:  VNS Health, 220 East 42nd Street, 6th Floor, New York, New York 10017; Attn: Privacy Officer; Telephone: (212) 609-7470; Email: [email protected].

Effective November 1, 2020; Last Revised May 2022