Privacy Policy

HFH Notice of Privacy Rights and Practices

(Effective October 1, 2024)

This Notice of Privacy Rights and Practices describes how we safeguard and use your Protected Health Information (“PHI”). Your information may be in paper, digital, or electronic record files and may contain health, biometric, or genetic information, images, videos and/or audio recordings. We are providing this Notice to you to help you understand your rights and our responsibilities. We will ask you to read and acknowledge receipt of it.

This notice covers Holy Family Hospital, and the entities described in the Notice Coverage section of this document. We may share your health information with each other for the purposes of treatment, payment, and healthcare operations. If you are a parent or legal guardian receiving this Notice because your child received care at Holy Family Hospital, please understand that when we say “you” in this Notice, we are referring to your child.

You have the right to:
Access and understand this Notice of Privacy Practices
• You may ask for a paper copy of this Notice at any time. If you need help understanding this Notice we will provide language and content support.

Get an electronic or paper copy of your medical record
• You may ask to see or receive an electronic or paper copy of your medical record and other health information.
• Contact the Holy Family Hospital Medical Records Department to request a summary of your record.
• We will provide a copy or a summary of your health information, usually within 10 business days of your request. We may charge a reasonable fee that is based on Massachusetts state-regulated rates.
• We may deny requests that are not legal, not permitted, or are a safety threat or concern.

Ask us to correct your medical record
• You may ask us to correct or amend health information about you that is incorrect or incomplete.
• Contact the Medical Records Department to request a correction to your record.
• We may say “no” to your request, but we will tell you why in writing within 60 days.

Request confidential communications
• You may ask us to contact you in a specific way (for example, home or office phone) or to send mail, or encrypted email, to a different address.
• To request confidential communications, submit your written request to the primary provider who treated you at Holy Family Hospital.
• We will review all reasonable requests that we have the ability to fulfill.

Ask us to limit what we use or share
• You may ask us not to use or share certain health information for treatment, payment, or health care operations (for example, for use in a patient directory, or to your family members and others involved in your care).
• We are not required to agree to requested restrictions except in the case of a disclosure to a health insurer, and we may say “no” if it would affect your care.
• If you pay for a service or health care item out-of-pocket in full, you may ask us not to share information with your health insurer.

Get a list of those with whom we have shared information
• Holy Family Hospital can provide an accounting for who we shared your medical records from May of 2019 to the present.  To request an accounting of disclosures, contact the Holy Family Hospital Medical Records Department.
• We will include all the disclosures, except for those about treatment, payment, and health care operations, which we are allowed to make without your authorization.
• We will provide one accounting a year for free, but will charge a reasonable, cost-based fee if you ask for another one within 12 months.

Choose someone to act for you
• If someone is your designated Health Care Proxy or your legal guardian, that person can exercise your rights and make choices about your health information.
• To let us know that another person may make medical choices for you, inform your health care provider.
• We will make sure the person has been authorized to make medical decisions for you before we take any action.
• My child is younger than 18 years old, what are their rights?

• Patients younger than the age of 18 are considered minors in Massachusetts. Parents with legal custody, a court appointed guardian(s), or a duly authorized delegate named by the parent or guardian, can make decisions about a child’s medical care and have the privacy rights described in this Notice.
• However, there are times a minor may exercise these rights and may even legally keep information confidential from their parents or guardians.  In Massachusetts, a “mature minor” has the right to consent for their own care and maintain such services as confidential from a parent or legal guardian for the following: seeking care for a disease dangerous to the public health; seeking treatment for drug addiction, family planning services, or a sexually transmitted disease; or if they are over 16 and seeking mental health treatment.  In addition, mature minors may also consent for their own care (and maintain confidentiality) for any care if they are married, pregnant or believe themselves to be pregnant, or the parent of a child.
• When minor patients are legally permitted to make decisions about their own medical care, they can usually control the release of their medical information even to their parents or legal guardians.

File a complaint if you feel your rights are violated
• You may complain if you feel we have violated your rights. We will not retaliate against you for filing a complaint.
• To file a concern regarding Holy Family Hospital, contact the Patient Advocate at 978-683-4000, ext. 2273.
• To file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights, send a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, (877) 696-6775, or visit www.hhs.gov/ocr/privacy/hipaa/complaints.
• For more information about the federal rights on the Notice of Privacy Practices please visit:  www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html

What are your choices?
• For certain health information, you may tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions. In these cases, you have both the right and choice to tell us to:
• Share information with your family, close friends, or others involved in your care
• Share information in a disaster relief situation
• Include your information in a hospital directory such as your name, location within the facility, condition described in general terms, and religious affiliation. We may use the hospital directory for purposes to share information with religious leaders or to other persons who ask for you by name
• Locate a family member, personal representative, or others involved in your care
• Share information with family members or others involved in your care or the payment of health care
• If you are not able to tell us your preference, for example, if you are unconscious, we may share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

In these cases, we do not share your information unless you give us valid written permission:
• Marketing campaigns that identify you in images, recordings, and social media.
• Most psychotherapy notes written and kept by your therapist, except for purposes related to treatment, payment, or our operations, to avoid a serious threat to health or safety, or as required by law
• Substance abuse treatment records
• HIV/AIDS testing, diagnosis, or treatment information
• Information about reproductive health issues, such as sexually transmitted diseases or pregnancy.
• We may contact you for charitable fundraising efforts, to assist us in raising funds; however, you may opt out of receiving such communications and tell us not to contact you again.
• You may revoke prior authorizations you have given us, provided the request is in writing; however, previously released information or an authorization granted as a condition of obtaining insurance coverage is not covered by this request.

How do we typically use or share your information?

Treatment
• Without your authorization, we may use your health information and share it with other professionals who treat you. To care for you we may use or disclose your health information to:
• Provide, coordinate, or manage health care and related services. We may share information with other health care providers. For example, we may use and disclose your health information when you need a prescription, lab work, an X-ray, or other services
• Refer you to another health care provider, such as a specialist, home health agency, ambulance or transport company, and/or rehabilitation hospital
• Communicate with clinicians who previously treated or referred you to Holy Family Hospital, including your primary care physician, and to clinicians who will treat you after you leave Holy Family Hospital
• In some cases, providers at other health care organizations may be able to electronically access your health information created or maintained by Holy Family Hospital, either through a secure connection to our systems or through a secure network for the transmission of health information, such as the Massachusetts Health Information Highway. All of these providers are required to take steps to protect the confidentiality of your information.

Payment for your services
• We may use and share your health information to bill and get payment from health plans or other entities. An example is that we give information about your treatment to your health insurance plan so it will pay for your services.

Health Care Operations
• We may use and share your health information to improve your care, run our operations, and contact you when necessary for the purposes of health care fraud and abuse detection or compliance. We share your health information with:

• Suppliers and vendors known as Business Associates
• Joint programs and other affiliated institutions and health care practices

• You may ask us not to use or share certain health information for treatment, payment, or health care operations, and you may revoke prior authorizations you have given us to share your health information. Please submit your request in writing. We will do our best to accommodate your request but may not be able to do so if we have already taken action relying on your authorization, or if the authorization was obtained as a condition of obtaining insurance coverage. For example, we may use your dietary health information to influence our food service options.

  Help with public health and safety issues
  • We may share health information about you for certain situations such as:

• Preventing disease
• Helping with product recalls
• Reporting adverse reactions to medications or products
• Reporting suspected abuse, neglect, or domestic violence
• Preventing or reducing a serious threat to anyone’s health or safety

Organ donation requests and medical examiners
• We may share health information about you with organ procurement organizations.
• We may share health information with a coroner, medical examiner, or funeral director when an individual dies.

Government requests
• We will share information about you if required by law. We will share information with the Department of Health and Human Services, if required to prove that we are complying with federal privacy law. In certain cases, we will share your information but only with your written permission. We may use or share health information about you:

• For workers’ compensation claims
• Workplace compliance and school compliance requirements
• For law enforcement purposes and activities (such as locating a suspect and including certain distinguishing characteristics) or with a law enforcement official and to avert a serious or imminent threat of harm
• With health oversight agencies for activities authorized by law
• For special government functions such as military, prisons, national security, and presidential protective services
• We may share health information about you in response to a court or administrative order, or in response to a subpoena.

How else may we use or share your health information?
• We are allowed and sometimes required to share your information in other ways – usually in ways that contribute to the public good, such as public health and research. We must meet many conditions in the law before we may share your information for these purposes.

What are our responsibilities?
• We are required by law to maintain the privacy and security of your PHI and abide by the terms of this Notice. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your PHI.
• We will follow the legal duties and privacy practices, with respect to your PHI, described in this Notice and give you a copy of it.
• We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you do change your mind.
• We maintain medical records for at least 20 years after the patient’s discharge or after the final treatment, as required by law. Our internal policies govern the safe retention and destruction of any of your information. A copy of our record retention policy is available upon request.

Notice Coverage
• This Notice applies to Holy Family Hospital and its physicians, nurses, and other personnel. It also applies to PHI at all satellite clinical sites owned and operated by Holy Family Hospital.
• Holy Family Hospital may share resources and services with the related entities below for diagnosis, treatment, and education related to specific diseases, therapies, or conditions. Participating providers may share medical, quality assurance, administrative, or fundraising information.

Holy Family Hospital reserves the right to change the terms of this Notice and to make the new Notice provisions effective for all PHI that we maintain. This Privacy Notice is adapted to meet regulatory requirements implementing the Health Insurance Portability and Accountability Act (HIPAA), 45 CFR Parts 160 and 164.

Holy Family Hospital is committed to protecting the PHI of all patients.  Should you have any concerns regarding the use of PHI at Holy Family Hospital, you can contact the Holy Family Hospital Anonymous Compliance and Privacy Hotline – Tel: (877) 886-7565