Sitrin

Revised and effective as of September 16, 2013

NOTICE OF PRIVACY INFORMATION PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. 

PLEASE REVIEW IT CAREFULLY.

Please contact the HIPAA Privacy Officer at (315) 737-2710 if you have any questions regarding this notice.

I. Affiliated Covered Entities.

This privacy notice applies to the Charles T. Sitrin Health Care Center, Inc., Gan Kavod, Inc., and Cedarbrook Village, Inc. who have designated themselves as affiliated covered entities. Affiliated covered entities are considered as one covered entity for HIPAA privacy purposes. Affiliated covered entities may share information amongst themselves as permitted by law, including for purposes of treatment, payment, and health care operations.

II. General Description and Purpose of Notice.

We are committed to preserving the privacy and confidentiality of your health information created, received, and/or maintained at our facility. Certain state and federal laws and regulations require us to: (i) maintain the privacy of your health information; (ii) implement policies and procedures to safeguard the privacy of your health information; (iii) provide you with this notice of our legal duties and privacy practices with regard to your health information and (iv) notify you in the event of a breach involving your unsecured health information (see Section VI). Except as may be otherwise required by law, our obligations and your rights under this Notice terminate after fifty (50) years following your death.

This notice will provide you with information regarding our privacy practices and applies to all of your health information created and/or maintained at our facility, including any information that we receive from other health care providers or facilities. The notice describes the ways in which we may use or disclose your health information and also describes your rights and our obligations regarding any such uses or disclosures. We will abide by the terms of this notice, including any future revisions that we may make to the notice, as required or authorized by law.

When making a permitted or required use or disclosure of health information, we will make reasonable efforts to limit the health information used or disclosed to the minimum necessary to accomplish the intended purpose of the use or disclosure. In this regard, we will limit access to health information to those employees, contractors and volunteers to whom such health information is necessary to carry out their treatment, payment or health care operation duties. Also, we will make reasonable efforts to limit the health information provided to such employees, contractors and volunteers to that which is reasonably necessary for them to carry out their duties. This obligation does not apply to the following situations:

1. disclosures to or requests by a health care provider for treatment purposes;
2. uses or disclosures made to you;
3. uses or disclosures made to the Department of Health and Human Services to investigate or determine whether we are in compliance with applicable federal privacy requirements;
4. uses or disclosures pursuant to a valid authorization;
5. uses or disclosures that are otherwise required by law; and
6. uses or disclosures that we are required to make in order to comply with applicable federal privacy requirements.

We will not directly or indirectly receive remuneration in exchange for any of your health information, except pursuant to your valid written authorization or for certain limited purposes as permitted by law.

III. Uses or disclosures of your health information.

We may use or disclose your health information in one of the following ways:

1. to you or your legal representative (to the extent permitted in this privacy notice);
2. for treatment, payment or health care operation purposes;
3. pursuant to your verbal agreement (for use in our facility directory or to discuss your health condition with family or friends who are involved in your care);
4. as permitted by law;
5. as required by law;
6. incidental uses and disclosures that may occur as a by-product of a permissible use or disclosure; and
7. pursuant to your written authorization for any and all other uses and disclosures of your health information.

The following describes the different ways that we may use or disclose your health information. Where appropriate, we have included examples of the different types of uses or disclosures. While not every conceivable use or disclosure is identified, we have included all of the categories in which we may make such uses or disclosures.

A. Uses for treatment, payment and health care operations.

We may use or disclose your health information for purposes of treatment, payment or health care operations.

1. Treatment. We may use your health information to provide you with health care treatment and services. We may disclose your health information to doctors, nurses, nursing assistants, medication aides, technicians, medical and nursing students, rehabilitation therapy specialists, or other personnel who are involved in your health care. For example, your physician may order physical therapy services to improve your strength and walking abilities. Our nursing staff will need to talk with the physical therapist so that we can coordinate services and develop a plan of care. In addition to treatment provided directly by our staff and employees, treatment includes the coordination or management of health care and related services by us with other health care providers, which may include the coordination or management of health care by us with a third party, consultation by our staff and another health care provider, such as a specialist, or the referral of you for health care to another provider. For example, we may disclose health information to a hospital when you are transferred to the hospital in the event of a medical emergency or to receive care and services to address a medical condition which cannot be treated at our facility.

• Appointment reminders. We may use or disclose your health information for purposes of contacting you to remind you of a health care appointment.
• Treatment alternatives, Health-related benefits and services. We may use or disclose your health information for purposes of contacting you to inform you of treatment alternatives or health-related benefits and services that may be of interest to you.

2. Payment. We may use or disclose your health information so that we may bill and collect payment from you, an insurance company, or another third party for the health care services you receive at our facility. For example, we may need to give information to your health plan regarding the services you received from our facility so that your health plan will pay us or reimburse you for the services. We also may tell your health plan about a treatment you are going to receive in order to obtain prior approval for the services or to determine whether your health plan will cover the treatment. We may also use or disclose your health information to another health care provider who has provided services, treatment or supplies indirectly to you through us in order for them to bill or collect payment for their services or supplies. For example, we have arrangements with various suppliers of medical equipment whereby they provide medical equipment and supplies to you through us and they bill third party payers (including Medicare and Medicaid) directly for the services and supplies provided. Under such circumstances, we are permitted to provide the health information necessary for them to seek payment for the services and supplies which they provided for your care and treatment.

3. Health care operations. We may use or disclose your health information to perform certain functions within our facility. These uses or disclosures are necessary to operate our facility and to make sure that our residents receive quality care. For example, we may use your health information to review our treatment and services and to evaluate the performance of our staff in caring for you. We may combine health information about many of our residents to determine whether certain services are effective or whether additional services should be provided. We may disclose your health information to physicians, nurses, nursing assistants, medication aides, rehabilitation therapy specialists, technicians, medical and nursing students, and other personnel for review and learning purposes. We also may combine health information with information from other health care providers or facilities to compare how we are doing and see where we can make improvements in the care and services offered to our residents. We may remove information that identifies you from this set of health information so that others may use the information to study health care and health care delivery without learning the specific identities of our residents. We may disclose to another health care provider or health plan subject to federal privacy regulations your health information for that provider or health plan to use for certain of its health care operations (limited to items 1 and 2 below), provided both our facility and such provider or health plan has or had a relationship with you and the information disclosed pertains to that relationship.

Health care operations mean the following activities:

• Conducting quality assessment and improvement activities;
• Reviewing the competency and qualification of health care professionals, evaluating practitioner and provider performance, conducting training programs for students, trainees or practitioners, training of non-health care professionals, accreditation, certification, licensing or credentialing activities;
• Conducting or arranging for medical review, legal services, auditing function, including fraud and abuse detection and compliance programs;
• Business planning and development, such as conducting cost management and planning related analysis relating to managing and operating the facility;
• Business management and general administrative activities including but not limited to management activities relating to implementation of and compliance with privacy requirements, customer service, resolution of internal grievances;
• The sale, transfer, merger or consolidation of all or part of the facility;
• Creating de-identified health information or a limited data set and fundraising for the covered entity;

h. Fundraising activities. We may, or a professional fundraiser or related foundation may on our behalf, contact you to raise funds for us. We may, without your written authorization, use limited health information to raise funds for our own benefit or disclose limited health information to a professional fundraiser or related foundation for purposes of fundraising for our benefit. The limited health information that we may use or disclose is: demographic information relating to you, including, your name, address, other contact information, age, gender, and date of birth; dates of health care provided to you by us; department of service information; treating physician; and outcome information. We cannot use, or disclose to a professional fundraiser or related foundation, any other form of health information without your written authorization. Any written fundraising materials sent by us or on our behalf by a professional fundraiser or related foundation will contain, in a clear and conspicuous manner, a provision indicating how you can elect not to receive any further fundraising communications from us or our related foundation or a professional fundraiser. If you wish to advise us now or at a later time that you do not want our facility or affiliated foundation to contact you for these fundraising purposes, you must notify the Director of Community Relations in c/o the Sitrin Health Care Center in writing. We may not condition your treatment on your choice with respect to the receipt of fundraising communications.

B. Uses or disclosures made pursuant to your verbal agreement.

We may use or disclose your health information, pursuant to your verbal agreement, for purposes of including you in our facility directory or for purposes of releasing information to persons involved in your care as described below.

1. Facility directory. We may use or disclose certain limited health information about you in our facility directory while you are a resident at our facility. This information may include your name, your assigned unit and room number, your religious affiliation, and a general description of your condition. Your religious affiliation may be given to a member of the clergy. The directory information, except for religious affiliation, may be given to people who ask for you by name.

2. Uses and disclosures to individuals involved in your care or for notification purposes. We may disclose to a family member, other relative, or a close personal friend, or any other person identified by you, health information directly relevant to such person’s involvement with your care or who helps pay for your care. We may also use and disclose health information to notify or to assist in the notification of a family member, a personal representative of you or another person responsible for your care of your location, general condition, or death. If you are present at the time of such disclosure or otherwise available prior to such disclosure and you have the capacity to make health care decisions, we may only make such use or disclosure of your health information under this section if we obtain your verbal agreement or we provide you with an opportunity to object to the disclosure and you do not express an objection or we reasonably infer from the surrounding circumstances and based on our professional judgment that you do not object to the disclosure. If you are not present for or there is no opportunity for you to agree or object to the use or disclosure or you do not have the capacity to make health care decisions, we may make the use or disclosure under this section if we determine, based on our professional judgment, that the disclosure is in your best interests. In addition, we may use or disclose health information to a public or private entity authorized by law or organized to assist in disaster relief efforts, for the purpose of coordinating with such organization, for purposes of notifying your family or friends involved in your care about your condition, status or location. Any use or disclosure in connection with disaster relief purposes will comply with the requirements of this section except if we determine based on the exercise of our professional judgment that these requirements interfere with the organizations ability to respond to the emergency situation.

3. Uses and disclosures after your death. We may disclose your health information after your death to a family member, other relative, close friend or any other person previously identified by you who were involved with your care or payment for your care prior to your death to the extent that such disclosure is relevant to such person’s involvement with your care or payment for your care, unless doing so is inconsistent with any prior expressed preference of yours that is known to us.

C. Uses or disclosures permitted by law

Certain state and federal laws and regulations either require or permit us to make certain uses or disclosures of your health information without your permission. These uses or disclosures are generally made to meet public health reporting obligations or to ensure the health and safety of the public at large. The uses or disclosures which we may make pursuant to these laws and regulations include the following:

1. Business Associates. Sometimes we engage other individuals or organizations to perform certain functions and activities on our behalf. These individuals and organizations are our business associates. We may use and disclose to a business associate or we may allow a business associate to create or receive health information on its behalf for our use without your authorization. However, we are required to obtain a written assurance from our business associates that they will use and disclose your health information only as permitted by law. We may engage business associates for purposes of claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, billing and practice management. In addition, we may engage business associates to perform legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services to or for our benefit.

2. Legal Representative. We may use or disclose health information to your legal representative. A legal representative is an individual under law who has the authority to act on your behalf in making health care decisions. A legal representative includes a health care agent authorized pursuant to a written health care proxy or a court appointed guardian with authority to make health care decisions for you. Under certain circumstances, we may elect not to use or disclose information to your personal representative if:

a. We reasonably believe that you have been or may have been subject to domestic violence, abuse or neglect by such individual or treating the individual as your personal representative could endanger you; and

b. If in the exercise of our professional judgment, we decide it is not in your best interests to treat the individual as your personal representative.

3. Whistleblowers and Work Force Member Crime Victims. Our employees or business associates may disclose health information if, in good faith, they believe that we have engaged in conduct that is unlawful or otherwise violates professional or clinical standards or that the care, services or conditions provided by us endangers one or more of our patients, employees or the public, provided that such disclosure by our employees or business associates is to a health oversight agency or public health authority or to an attorney retained by such individual(s) for purposes of determining their legal options with regard to our conduct described in this section. In addition, our employees may disclose to a law enforcement official health information about you if you are the suspected perpetrator of a crime, provided that the information disclosed relates to:

• your name and address
• your date of birth and place of birth;
• your social security number;
• blood type and RH factor;
• type of injury;
• date and time of treatment;
• date and time of death, if applicable;
• a description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair, scars and tattoos.

4. Public health activities. We may use or disclose your health information to public health authorities or governmental authorities that are authorized by law to receive and collect health information for the purpose of preventing or controlling disease, injury or disability. In connection with FDA regulated products and activities we may use or disclose your health information to individuals or organizations under the jurisdiction of the FDA, such as product manufacturers. If we use or disclose your health information to report a suspected or actual abuse, neglect or domestic violence involving you, we will promptly inform you of such report except where we believe, in the exercise of our professional judgment, that informing you would place you at risk of serious harm or we would be informing your personal representative and we reasonably believe that your personal representative is responsible for the abuse, neglect or other injury and we determine, in the exercise of our professional judgment, that such disclosure would not be in your best interest. Such activities that we may use or disclose your health information include, but are not limited to:

• To report births and deaths;
• To report suspected or actual abuse, neglect, or domestic violence involving a child or an adult;
• To report adverse reactions to medications or problems with health care products;
• To notify individuals of product recalls; and
• To notify an individual who may have been exposed to a disease or may be at risk for spreading or contracting a disease or condition.

 5. Health oversight activities. We may use or disclose your health information to a health oversight agency that is authorized by law to conduct health oversight activities. These oversight activities may include audits, investigations, inspections, or licensure and certification surveys. These activities are necessary for the government to monitor the persons or organizations that provide health care to individuals and to ensure compliance with applicable state and federal laws and regulations.

6. Judicial or administrative proceedings. We may use or disclose your health information to courts or administrative agencies charged with the authority to hear and resolve lawsuits or disputes. We may disclose your health information pursuant to a court order, a subpoena, a discovery request, or other lawful process issued by or on behalf of the other person involved in the dispute, but only if efforts have been made to (i) notify you of the request for disclosure or (ii) obtain an order protecting your health information.

7. Worker’s compensation. We may use or disclose your health information to worker’s compensation programs when your health condition arises out of a work-related illness or injury.

8. Law Enforcement official. We may use or disclose your health information in response to a request received from a law enforcement official for the following purposes: 

• In response to a court order, subpoena, warrant, summons or similar lawful process;
• To identify or locate a suspect, fugitive, material witness, or missing person;
• Regarding a victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement;
• To report a death that we believe may be the result of criminal conduct;
• To report criminal conduct at our facility;
• In emergency situations, to report a crime, the location of the crime and possible victims, or the identity, description, or location of the individual who committed the crime.

9. Coroners, medical examiners, or funeral directors. We may use or disclose your health information to a coroner or medical examiner for the purpose of identifying a deceased individual or to determine the cause of death. We also may use or disclose your health information to a funeral director for the purpose of carrying out his/her necessary activities.

10. Organ procurement organizations or tissue banks. If you are an organ donor, we may use or disclose your health information to organizations that handle organ procurement, transplantation, or tissue banking for the purpose of facilitating organ or tissue donation or transplantation.

11. Research. We may use or disclose your health information for research purposes under certain limited circumstances. Because all research projects are subject to a special approval process, we will not use or disclose your health information for research purposes until the particular research project for which your health information may be used or disclosed has been approved through this special approval process. However, we may use or disclose your health information to individuals preparing to conduct the research project in order to assist them in identifying residents with specific health care needs who may qualify to participate in the research project. Any use or disclosure of your health information which may be done for the purpose of identifying qualified participants will be conducted onsite at our facility. In most instances, we will ask for your specific permission to use or disclose your health information if the researcher will have access to your name, address or other identifying information.

12. To avert a serious threat to health or safety. We may use or disclose your health information when necessary to prevent or lessen a serious and imminent threat to the health or safety of you or other individuals. Any such use or disclosure would be made solely to the individual(s) or organization(s) that have the ability and/or authority to assist in preventing the threat.

13. Military and veterans. If you are a member of the armed forces, we may use or disclose your health information as required by military command authorities.

14. National security and intelligence activities. We may use or disclose your health information to authorized federal officials for purposes of intelligence, counterintelligence, and other national security activities, as authorized by law.

15. Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may use or disclose your health information to the correctional institution or to the law enforcement official as may be necessary (a) for the institution to provide you with health care; (b) to protect the health or safety of you or another person; or (c) for the safety and security of the correctional institution.

IV. Uses or disclosures made pursuant to your written authorization.

Except for uses and disclosures for purposes of treatment, payment or health care operations and for purposes which are permitted or required by law as identified above, we may only use or disclose your health information pursuant to your written authorization. Your written authorization is required for any of the following purposes:

• Any use or disclosure involving psychotherapy notes, except to carry out the following limited treatment, payment and health care operations:

1. use by the originator of the notes;
2. use by us for our own mental health training purposes; or
3. to defend ourselves in a lawsuit or other type of proceeding brought by you or on your behalf by your personal representative;

• Any use or disclosure for marketing purposes, except as set forth at Section V(G) of this Notice; and
• Any disclosure which involves a sale of your protected health information (See Section V(H).

You have the right to revoke a written authorization at any time as long as your revocation is provided to us in writing. If you revoke your written authorization, we will no longer use or disclose your health information for the purposes identified in the authorization. You understand that we are unable to retrieve any disclosures which we may have made pursuant to your authorization prior to its revocation.We may not condition the provision to you of treatment on the provision of an authorization.

V. Your rights regarding your health information.

You have the following rights regarding your health information which we create and/or maintain:

A. Right to inspect and copy. You have the right to inspect and/or obtain a copy of your health information that we maintain in a designated record set. Generally, this includes medical and billing records, but does not include psychotherapy notes, information compiled in reasonable anticipation of or for use in a criminal, civil or administrative action or proceeding or if prohibited by law under the clinical laboratory improvement amendments of 1988. We will provide you with access to your health information in the form and format requested, provided that it is readily producible in such form or format or, if not, in a readable hard copy or such other form and format as agreed to by you and us (see below with respect to electronic records maintained by us).

To inspect and/or obtain a copy, including an electronic copy, your health information, you must submit your request in writing to the Medical Records Director, c/o Sitrin Health Care Center. If you request a copy of the information, we may charge a fee for the costs of copying, mailing, if applicable, or other supplies associated with your request.

To the extent that we maintain your personal health information electronically and you request an electronic copy of your health information, we will provide you with access in the electronic form and format requested, provided that it is readily producible in such form or, if not, in a readable electronic form and format that is agreeable to both you and us.

If your request for access directs us to transmit a copy, including an electronic copy, of your health information directly to another individual designated by you, we will provide the copy to the individual designated by you. Your request to transmit a copy of your health information to another individual must be in writing, must be signed by you or your personal representative and must clearly identify the designated individual.

We may deny your request to inspect and copy your health information in certain limited circumstances. If you are denied access to your health information, except in circumstances where the denial is non-reviewable, you may request that the denial be reviewed. Another licensed health care professional selected by our facility will review your request and the denial. The person conducting the review will not be the person who initially denied your request. We will comply with the outcome of this review.

Non-reviewable denials occur when:

1. The protected health information is specifically exempted from access (psychotherapy notes, compiled information for use in a criminal, civil or administrative action or proceedings and prohibited by law under clinical laboratory improvement amendments of 1988);
2. When acting under the direction of a correctional institution, the provider denies an inmate’s request to obtain a copy of protected health information if obtaining such copy would jeopardize the health, safety, security, custody or rehabilitation of the individual or of other inmates, or the safety of any officer, employee or other person at the correctional institution or responsible for the transporting of inmates;
3. During the course of research that includes treatment, a health care provider may temporarily suspend access to protected health information while the research is in progress, provided the individual has agreed to denial of access when consenting to participate in the research that includes the treatment, and the health care provider has informed the individual that the right of access will be reinstated upon completion of the research;
4. Where the protected health information is contained in records that are subject to the Federal Privacy Act; and
5. Where the protected health information was obtained from someone other than the health care provider under a promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information.

B. Right to request an amendment. If you feel that the health information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for our facility. To request an amendment, your request must be made in writing and submitted to the Medical Records Director, c/o Sitrin Health Care Center. In addition, you must provide us with a reason that supports your request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

1. was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
2. s not part of the health information kept by or for our facility;
3. is not part of the information which you would be permitted to inspect and copy; or
4. is accurate and complete.

We will provide you with written notice of either our acceptance of your request for amendment or of our denial of your request for amendment. If we accept the amendment, we will request from you the identification of and your agreement to have us notify relevant persons with which the amended health information needs to be shared. Such relevant persons include persons that you have identified as having received health information about you and needing the amendment and persons, including our business associates, that we know have your health information that is the subject of the amendment and that may have relied or could foreseeably rely on such information to your detriment.

C. Right to an accounting of disclosures. You have the right to request an accounting of the disclosures which we have made of your health information. The accounting will not include disclosures of your health information for treatment, payment and health care operations, except for disclosures through an electronic health record used or maintained by us, or certain other disclosures which the law exempts from the accounting, which include:

1. disclosures to you;
2. incidental disclosures as a by-product of a permitted use or disclosure;
3. pursuant to an authorization;
4. for purposes of the facility’s directory or to persons involved in the individual’s care or other notification purposes (see Section III(B));
5. for national security or intelligence purposes;
6. for correctional institutions or law enforcement officials under certain circumstances set forth at Section 164.5 1(k)(5); or
7. as part of a limited data set.

To request an accounting of disclosures, you must submit your request in writing to the Medical Records Director, c/o Sitrin Health Care Center. Your request must state a time period which may not be longer than six (6) years prior to the date of your request, or three (3) years with respect to disclosures through an electronic health record, and may not include dates before April 14, 2003. Your request should indicate in what form you want to receive the accounting (for example, on paper or via electronic means). The first accounting that you request within a twelve (12)-month period will be free. For additional accountings, we may charge you for the costs of providing the accounting. We will notify you of the cost involved, and you may choose to withdraw or modify your request at that time before any costs are incurred.

D. Right to request restrictions. You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a limit on the health information we disclose about you to someone, such as a family member or friend, who is involved in your care or in the payment of your care or for notification purposes as set forth at Section III(B)(2). For example, you could ask that we not use or disclose information regarding a particular treatment that you received.

We are not required to agree to your requested restriction, except that we are required to comply with the requested restriction if the disclosure is to a health plan for purposes of carrying out payment and health care operations and is not otherwise required by law, and the personal health information pertains solely to a health care item or service for which we have paid in full by you or by someone, other than the health plan, on your behalf.. If we agree to your requested restriction, we will comply with your request unless: (a) the release of the information is needed to provide you emergency treatment and, where such emergency treatment is provided by a health care provider other than us, we will request such other provider not to further use or disclose the information; or (b) the release of the information is required or otherwise permitted by law.

To request a restriction, you may contact Medical Records Director at (315) 737-2252. We will need to know the following: (a) what information you want to restrict; (b) whether you want the restriction to apply to our use, to disclosures or both; and (c) whether the restriction will apply to all disclosures or will be limited to certain disclosures (for example, disclosures to a family member).

We may terminate this agreement with regard to a restriction on the use or disclosures of protected health information. We may terminate this agreement with regard to restrictions if (a) you agree to or request the termination in writing, or (b) you orally agree to the termination and the oral agreement is documented or (c) we inform you that we are terminating the agreement, except that we cannot terminate our agreement to a restriction pertaining to disclosures of your health information to a health plan as described above and that such termination is only effective with respect to protected health information created or received after we inform you.

E. Right to request confidential communications. You have the right to request that we communicate with you about your health care in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail.

To request confidential communications, you must make your request in writing to the Privacy Officer. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

F. Right to a paper copy of this notice. You have the right to receive a paper copy of this notice. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice.

To obtain a paper copy of this notice, contact the Privacy Officer.

G. Marketing. Marketing is a communication about a product or service that encourages the recipient of the communication to purchase or use the product or service. Except where we receive, directly or indirectly, financial remuneration in exchange for making one of the following communications, marketing does not include the following treatment and health care operation communications:

1. for your treatment, including case management or care coordination, or to direct or recommend alternative treatments, therapies, health care providers or health care settings;
2. to describe a health care product or service or the payment for such product or service that is provided by us; or
3. for case management and care coordination, contacting you or your personal representative about treatment alternatives and related functions to the extent such communications are not considered treatment.

We must obtain your written authorization in order to use or disclose your health information to make a marketing communication (including those communications set forth at subsections (1), (2) and (3) above when we receive financial remuneration, directly or indirectly, in exchange for making such communication), except where the communication is in the form of:

1. a face-to-face communication made by us to you or your personal representative; or
2. a promotional gift of a nominal value provided by us.

H. We cannot sell your health information, except pursuant to your written authorization. Certain disclosures are not considered the sale of health information, including but not limited to the following:

1. for permitted public health purposes;
2. for permitted research purposes;
3. for treatment and payment purposes;
4. for permitted due diligence involving the sale, transfer, merger or consolidation of all or part of our business;
5. for disclosures to you; or
6. for disclosures required by law.

VI. Notification of Breach

In the event we discover or we are notified by one of our business associates that there has been a breach involving your personal health information, we will notify you of the breach without unreasonable delay but in no event later than sixty (60) days after the breach has been discovered, except if we are notified by a law enforcement official that such notification would impeded a criminal investigation or cause damage to national security. Unless otherwise required by law, we will notify you in writing by first class mail addressed to your last known address or by electronic mail if you have previously notified us in writing that this is your preferred method of notification. No notice will be provided if the breach involves personal health information which is in a secured format.

VII. Complaints

If you believe that your privacy rights have been violated, you may file a complaint in writing with the facility or with the Office of Civil Rights in the US Department of Health and Human Services. To file a complaint with the facility, contact the facility's Privacy Officer at (315) 737-2710 or the HIPAA facility hotline number at (315) 737-2500.

WE WILL NOT RETALIATE AGAINST YOU IF YOU FILE A COMPLAINT.

VIII. Changes to this Notice

We reserve the right to change this Notice and to make the revised or new Notice provisions effective for all personal health information already received and maintained by the facility as well as for all personal health information we receive in the future. We will post a copy of the current Notice in a prominent location within the facility and on the facility's web site. In addition we will make the revised or new Notice available upon request to existing patients on or after the effective date of the revision.

DOWNLOAD SITRIN PRIVACY NOTICE