Privacy Practices

Below is a general notice of privacy practices. Click here for more information about general website privacy policy. 

Rev 5, Effective Oct 1, 2024

Health Insurance Portability and Accountability Act (HIPAA)

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW CAREFULLY!

Twelve Clans Unity Hospital (TCUH) and Winnebago Public Health Department (WPHD) are separate divisions of the Winnebago Comprehensive Healthcare System (WCHS) operated by the Winnebago Tribe of Nebraska. Because these separate entities are under common ownership and control, TCUH and WPHD have organized as a single Affiliated Covered Entity for the purposes of the HIPAA Privacy Rule. This status permits TCUH and WPHD to maintain a single Notice of Privacy Practices ("Notice"). This Notice describes the health information practices of both TCUH and WPHD. All entities, sites and locations (called "our practice") will follow the terms of this Notice. The Notice describes how you can get access to this information. In addition, the Notice describes how these entities, sites and locations may share medical information with each other for treatment, payment and healthcare operations as described in this Notice.

OUR COMMITMENT TO YOUR PRIVACY:

Each time you visit our practice, a record of your visit is made. Typically, this medical record contains your symptoms, examination and test results, diagnoses, treatment, a plan for future care or treatment, and billing-related information. This Notice applies to all individually identifiable protected health information (PHI) in the medical records of your care generated or maintained by our practice. PHI includes data consisting of identifiers including, but not limited to, your name, address, social security number, date-of-birth and others that could be used to identify you as the individual patient who is associated with that health information. WCHS is dedicated to maintaining the privacy of your PHI. We are required by law to maintain the confidentiality of PHI that identifies you. We also are required by law to provide you with this Notice of our legal duties and the privacy practices that we maintain in our practice concerning your PHI. By federal, tribal and applicable state law, we must follow the terms of the Notice that we have in effect at the time.

We realize that these laws are complicated, and to help you understand them we are providing you with the following important information:

  1. How we may collect and maintain records of your PHI;
  2. Your privacy rights regarding your PHI; and
  3. Our obligations concerning the use and disclosure of your PHI

The terms of this Notice apply to all records containing your PHI that are created or maintained by our practice. We reserve the right to revise or amend this Notice. Any revision or amendment to this Notice will be effective for all your records that our practice has created or maintained in the past, and for any of your records that we may create or maintain in the future. Our practice will always post a copy of our current Notice in our offices in a visible location, and you may request a copy of our most current Notice at any time.

WE COLLECT YOUR PHI IN THE FOLLOWING WAYS:

We collect PHI about you through treatment, payment and related healthcare operations, application and enrollment processes, receiving PHI from your other healthcare providers or health plans, or through other means, as allowed by law. Your PHI broadly includes any past, present and future healthcare information, and may have been communicated orally, in written form or by electronic communications from you, our healthcare providers and associated members of your healthcare team, other healthcare providers such as physicians and hospitals, as well as health insurance companies or plans.

USES OR DISCLOSURES OF YOUR PROTECTED HEALTH INFORMATION:

The following are examples of different ways in which we may use and disclose your PHI.

  1. Treatment. We may use your PHI to provide healthcare services to you. For example, we may ask you to have laboratory tests (such as blood or urine tests), and we may use the results to help us reach a diagnosis. We might use your PHI to write a prescription for you, or we might disclose your PHI to a pharmacy when we order a prescription for you.
  2. Payment. Our practice may use and disclose your PHI to bill and collect payment for the services and items you may receive from us. For example, we may contact your health insurer to certify that you are eligible for benefits (and for what range of benefits), and we may provide your insurer with details regarding your treatment to determine if your insurer will cover, or pay for, your specific treatment. We also may use and disclose your PHI to obtain payment from third parties that may be responsible for such costs, such as Veterans benefits. Also, we may use your PHI to bill you directly for services and items that are not otherwise covered.
  3. Health Care Operations. Our practice may use and disclose your PHI to perform typical business functions. For example, our practice may use your PHI to evaluate the quality of care you received from us, or to conduct cost-management and business planning activities for us.
  4. Release of Information to Family/Friends. Our practice may release your PHI to a friend or family member who is involved in your care, or who assists in taking care of you, but generally, you have the opportunity to object to such disclosures. For example, a relative might be involved in caring for you and help assure you get your medications. In this example, we may share PHI with this relative, limited to the extent to which the relative needs information to continue to assist in caring for you. You would be given an opportunity to object to sharing of your PHI, and in certain circumstances might need to provide us authorization in writing to share more comprehensive PHI.
  5. Facility Directory. The facility directory (that is, a roster available only internally to staff indicating who is currently receiving care in the facility) is accessible to certain staff so that your family, friends, and clergy can visit you and generally know how you are doing. We may include your name, location in the facility, your general condition (for example, fair or stable), and your religious affiliation in the facility directory. The directory information, except for your religious affiliation, may be released to people who specifically ask for you by name. Your name and religious affiliation may be given to a member of the clergy of your specific faith congregation, even if they don't ask for you by name. You must notify the personnel registering you or a member of your hospital care team if you do not want us to release information about you from the facility directory. If you do not want information released from the facility directory, we cannot tell friends and family that you are here or about your general condition. Additionally, we cannot share with or confirm for others, such as flower or other delivery services, that you are here.
  6. Disclosures Required by Law. Our practice may use and disclose your PHI when we are required to do so by federal, tribal, or any other applicable law not already referred to in this Notice. For example, dog bites and certain injuries potentially resulting from a crime of violence are required to be reported to Tribal authorities.
  7. Treatment Alternatives. We may use and disclose your PHI to manage and coordinate your healthcare and inform you of treatment alternatives that may be of interest of you. This may include telling you about treatments, services, products and/or other healthcare providers associated with your diagnosis or clinical condition.
  8. Appointment Reminders. We may use and disclose your PHI to provide a reminder to you about an appointment you have for treatment or care at WCHS.
  9. Business Associates. There are some services provided at WCHS through contracts with business associates. When these third parties are contracted to perform services for WCHS, we may disclose your PHI to these companies so that they can perform the job we have asked them to do. For example, we use third parties to send patient satisfaction surveys to our patients to assess how our patients feel we are doing. However, to protect your PHI, we require these third-party business associates to appropriately safeguard your PHI through a very detailed Business Associates Agreement.
  10. All Other Situations, With Your Specific Authorization. Except as otherwise permitted by law or as described above, we may not use or disclose your PHI without your written authorization. Further, we are required to use or disclose your PHI consistent with the terms of your authorization. You may revoke, in writing, your authorization to use or disclose any PHI at any time, except to the extent that we have taken action in reliance on such authorization, or, if you provided the authorization as a condition of obtaining insurance coverage and the law provides the insurer with the right to contest a claim under the policy. Further, we will be unable to take back any disclosures we have previously made based upon your written authorization.

USE AND DISCLOSURE OF YOUR PROTECTED HEALTH INFORMATION IN CERTAIN SPECIAL CIRCUMSTANCES:

The following categories describe unique scenarios in which we may use or disclose your PHI:

1) Public Health Risks. Our practice may disclose your PHI to public health authorities that are authorized by law to collect information for the purpose of:

  • Maintaining vital records, such as births and deaths;
  • Reporting child abuse or neglect;
  • Preventing or controlling disease, injury or disability;
  • Notifying a person regarding potential exposure to a communicable disease;
  • Notifying a person regarding a potential risk for spreading or contracting a disease or condition;
  • Reporting reactions to drugs or problems with products or devices;
  • Notifying individuals if a product or device they may be using has been recalled;
  • Notifying appropriate government agencies and authorities regarding the potential abuse or neglect of an adult patient (including domestic violence); however, we will only disclose this information if the patient agrees, or we are required or authorized by law to disclose this information; or
  • Notifying your employer under limited circumstances related primarily to workplace injury or illness or medical surveillance.

2) Health Oversight Activities. Our practice may disclose your PHI to a health oversight agency for activities authorized by law. Oversight activities can include, for example, investigations, inspections, audits, surveys, licensure and disciplinary actions; civil, administrative, and criminal procedures or actions; or other activities necessary for the government to monitor government programs, compliance with civil rights laws and the health care system in general.

3.) Lawsuits and Similar Proceedings. Our practice may use and disclose your PHI in response to a court or administrative order, if you are involved in a lawsuit or similar proceeding. We also may disclose your PHI in response to a discovery request, subpoena, or other lawful process by another party involved in the dispute, but only if we have made an effort to inform you of the request or to obtain an order protecting the information the party has requested.

4) Law Enforcement. We may release PHI if asked to do so by a law enforcement official:

  • Concerning a crime victim in certain situations, if we are unable to obtain the person's agreement;
  • Concerning a death we believe has resulted from criminal conduct;
  • Regarding criminal conduct at our offices;
  • In response to a warrant, summons, court order, subpoena or similar legal process;
  • To identify/locate a suspect, material witness, fugitive or missing person; or in an emergency, to report a crime (including the location or victim(s) of the crime, or the description, identity or location of the perpetrator).

5) Deceased Patients. Our practice may release PHI to a medical examiner or coroner to identify a deceased individual or to identify the cause of death. If necessary, we also may release information for funeral directors to perform their jobs.

6) Organ and Tissue Donation. Our practice may release your PHI to organizations that handle organ, eye or tissue procurement or transplantation, including organ donation banks, as necessary to facilitate organ or tissue donation and transplantation if you are an organ donor.

7) Research. Our practice may use and disclose your PHI for research purposes in certain limited circumstances. We will obtain your written authorization to use your PHI for research purposes except when:

  • Our use or disclosure was approved by an Institutional Review Board or a Privacy Board;
  • We obtain the oral or written agreement of a researcher that:
  • The information being sought is necessary for the research study; - The use or disclosure of your PHI is being used only for the research; and
  • The researcher will not remove any of your PHI from our practice; or
  • The PHI sought by the researcher only relates to decedents and the researcher agrees either orally or in writing that the use or disclosure is necessary for the research and, if we request it, to provide us with proof of death prior to access to the PHI of the decedents.

8) Serious Threats to Health or Safety. Our practice may use and disclose your PHI when necessary to reduce or prevent a serious threat to your health and safety or the health and safety of another individual or the public. Under these circumstances, we will only make disclosures to a person or organization able to help prevent the threat.

9) Military. Our practice may disclose your protected health information if you are a member of U.S. or foreign military forces (including veterans) and if required by the appropriate authorities.

10) National Security. Our practice may disclose your PHI to federal officials for intelligence and national security activities authorized by law. We also may disclose your PHI to federal officials to protect the President, other government officials or foreign heads of state, or to conduct investigations.

11) Inmates. Our practice may disclose your PHI to correctional institutions or law enforcement officials if you are an inmate or under the custody of a law enforcement official. Disclosure for these purposes would be necessary:

  • For the institution to provide health care services to you,
  • For the safety and security of the institution; and/or
  • To protect your health and safety or the health and safety of other individuals.

12) Workers' Compensation. Our practice may release your PHI for workers' compensation and similar programs.

13) Data Breach Notification Purposes. Our practice may use or disclose your PHI to provide legally required notices of unauthorized access to or disclosure of your PHI.  

YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION:

You have the following rights regarding the PHI that we maintain about you:

1) Requesting Restrictions. You have the right to request a restriction in our use or disclosure of your PHI treatment, payment or health care operations. Additionally, you have the right to request that we restrict our disclosure of your PHI to only certain individuals involved in your care or the payment for your care, such as family members and friends. We are not required to agree to your request; however, if we do agree, we are bound by our agreement except when otherwise required by law, in emergencies, or when the information is necessary to treat you. To request a restriction, you must make your request in writing and your request must describe in a clear and concise fashion:

  • The information you wish restricted
  • Whether you are requesting to limit our practice's use, disclosure or both
  • To whom you want the limits to apply.

2.) Right to Request Restriction on Disclosures to Health Plans for Services Paid for In Full at Time of Service. You have the right under the American Recovery and Reinvestment Act, Section 13405(a) to request WCHS to restrict disclosures of PHI to a health plan for purposes of carrying out payment or healthcare operations if the PHI pertains solely to a healthcare item or service for which WCHS has been paid out of pocket in full at time of service.

3) Confidential Communications. You have the right to request that our practice communicate with you about your health and related issues in a particular manner or at a certain location. For instance, you may ask that we contact you at home, rather than work. To request a type of confidential communication, you must make a written request to WCHS specifying the requested method of contact, or the location where you wish to be contacted. Our practice will accommodate reasonable requests.

4) Inspection and Copies. You have the right to inspect and obtain a copy of the PHI that may be used to make decisions about you, including patient medical records and billing records, but not including psychotherapy notes. You must submit your request in writing to WCHS to inspect and/or obtain a copy of your protected health information. We do not charge a fee for the costs of copying, mailing, labor and supplies associated with your request. We may deny your request to inspect and/or copy in certain limited circumstances. If so, we will provide you with a written denial specifying the legal basis for denial, a statement of your rights, and a description of how you may file a complaint with us. You may request a review of our denial. Another licensed health care professional chosen by us will conduct reviews. We must provide you with access to your protected health information in the form or format requested by you, if it is readily producible in such form or format, or, if not, in a readable hard copy form or such other form or format. We will provide you with access as requested in a timely manner, including arranging with you a convenient time and place to inspect or obtain copies of your protected health information or mailing a copy to you at your request. We will discuss the scope, format, and other aspects of your request for access as necessary to facilitate timely access. If we do not maintain the information that is the subject of your request for access but we know where the requested information is maintained, we will inform you of where to direct your request for access. If your protected health information is maintained in an electronic format (known as an electronic medical record or an electronic health record), you have the right to request that an electronic copy of your record be given to you or transmitted to another individual or entity.

5) Amendment. You have the right to request that we amend your PHI or a record about you contained in your designated record set, for as long as the designated record set is maintained by us. To request an amendment, your request must be made in writing and submitted to WCHS. You must provide us with a reason that supports your request for amendment. Our practice will deny your request if you fail to submit your request (and the reason supporting your request) in writing. We have the right to deny your request for amendment, if:

We determine that the information or record that is the subject of the request was not created by us, unless you provide a reasonable basis to believe that the originator of the information is no longer available to act on the requested amendment;

  • the information is not part of your designated record set maintained by us;
  • the information is prohibited from inspection by law; or
  • the information is accurate and complete.

We may require that you submit written requests and provide a reason to support the requested amendment. If we deny your request, we will provide you with a written denial stating the basis of the denial, your right to submit a written statement disagreeing with the denial, and a description of how you may file a complaint with us. This denial will also include a notice that if you do not submit a statement of disagreement, you may request that we include your request for amendment and the denial with any future disclosures of your protected health information that is the subject of the requested amendment. Copies of all requests, denials, and statements of disagreement will be included in your designated record set. If we accept your request for amendment, we will make reasonable efforts to inform and provide the amendment within a reasonable time to persons identified by you as having received PHI of yours prior to amendment and persons that we know have the PHI that is the subject of the amendment and that may have relied, or could foreseeably rely, on such information to your detriment. All requests for amendment shall be sent to WCHS.

6) Accounting of Disclosures. All our patients have the right to request an "accounting of disclosures." An "accounting of disclosures" is a list of certain nonroutine disclosures our practice has made of your PHI for non-treatment or operations purposes. Use of your PHI as part of the routine patient care in our practice is not required to be documented. We are not required to provide accountings of disclosures for the following purposes:

  • Treatment, payment, and healthcare operations;
  • Disclosures pursuant to your authorization;
  • Disclosures to you;
  • Disclosures to a facility directory or to persons involved in your care
  • Disclosures for national security or intelligence purposes; and
  • Disclosures to correctional institutions.

We reserve our right to temporarily suspend your right to receive an accounting of disclosures to health oversight agencies or law enforcement officials, as required by law. To obtain an accounting of disclosures, you must submit your request in writing to WCHS. All requests for an "accounting of disclosures" must state a time period, which may not be longer than six (6) years from the date of disclosure.

7) Right to a Paper Copy of This Notice. You are entitled to receive a paper copy of our Notice of Privacy Practices. You may ask us to give you a copy of this Notice at any time. To obtain a paper copy of this Notice, please request it from the front desk or call 402-745-3950.

8) Right to File a Complaint. If you believe your privacy rights have been violated, you may file a complaint with our practice. To file a complaint with our practice, contact the WCHS Privacy Officer at 402-745-3950. You may also contact the Office of Civil Rights, U.S. Department of Health & Human Services at: Centralized Case Management Operations U.S. Department of Health and Human Services 200 Independence Avenue, S.W. Room 509 F HHH Bldg. Washington, D.C. 20201 Email to OCRComplaint@hhs.gov Complaints must be submitted in writing. A complaint must name the entity that is the subject of the complaint and describe the acts or omissions believed to be in violation of the applicable requirements of HIPAA or this Privacy Policy. A complaint must be received within 180 days of when you knew or should have known that the act or omission complained of occurred. You will not be penalized for filing any complaint. As required by law, we will notify you if a breach of your PHI occurs.

9) Right to Provide an Authorization for Other Uses and Disclosures. WCHS will obtain your written authorization for uses and disclosures that are not identified by this Notice or permitted by applicable law. We will require your specific authorization for most uses and disclosures of psychotherapy notes, uses and disclosures of your PHI for marketing purposes, and any disclosures of your PHI that constitute a sale of your information. Additionally, should we use your information for any fundraising purposes, you have the right to opt out of such communication and the communications will specify how to do so. Any authorization you provide to us regarding the use and disclosure of your PHI may be revoked at any time in writing. After you revoke your authorization, we will no longer use or disclose your PHI for the reasons described in the authorization. Please note that we are required to retain records of your care.

10) Right to Breach Notification. You have a right to and will receive notification of a breach of your PHI in appropriate circumstances and in appropriate timeframes, as defined and described in federal and other laws.

2024 REVISIONS/ UPDATES to the WCHS GENERAL NOTICE OF PRIVACY PRACTICES

Notwithstanding the above privacy practices and Notice provisions, the following additional provisions also apply:

1) If you have PHI created or maintained by a WCHS Substance Use Disorder program covered by 42 CFR Part 2, there are additional confidentiality protections and processes that apply to you. Please see the "WCHS Notice of Confidentiality of Substance Use Disorder Records, Addendum to the General WCHS HIPAA Notice of Privacy Practices."

2) When WCHS or a WCHS business associate receives a request from, e.g., a health oversight agency, law enforcement, judicial or administrative process, coroner or medical examiner, for PHI potentially related to reproductive health care provided to you, WCHS will obtain a signed attestation from the requestor that clearly states the requested use or disclosure is not for one of the prohibited purposes described below:

  • To conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care;
  • To impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care; and/or
  • To identify any person for any purpose described in (1) or (2)

The prohibition applies when the reproductive health care at issue:

  • Is lawful under the law of the jurisdiction in which such health care is provided under the circumstances in which it is provided;
  • Is protected, required, or authorized by Federal law, including the United States Constitution, under the circumstances in which such health care is provided, regardless of the jurisdiction in which it is provided; or
  • Is provided by another person and presumed lawful.

3) Be aware that while WCHS strives to uphold all the above regulatory requirements to protect your PHI, there is a potential for information legally disclosed as described in this Notice to be redisclosed by the recipient and no longer protected by law.

Notice of Confidentiality of Substance Use Disorder Records 

ADDENDUM TO THE GENERAL WINNEBAGO COMPREHENSIVE HEALTHCARE SYSTEM (“WCHS”) HIPAA NOTICE OF PRIVACY PRACTICES FOR PATIENTS/CLIENTS WHO MAY HAVE HEALTH INFORMATION FROM A WCHS SUBSTANCE USE DISORDER (“SUD”) PROGRAM COVERED BY 42 CFR PART 2

THIS ADDENDUM DESCRIBES:

  • HOW HEALTH INFORMATION ABOUT YOU FROM A WCHS SUD PROGRAM COVERED BY 42 CFR PART 2 MAY BE USED AND DISCLOSED
  • YOUR RIGHTS WITH RESPECT TO YOUR SUD HEALTH INFORMATION
  • HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR SUD HEALTH INFORMATION, OR A VIOLATION OF YOUR RIGHTS CONCERNING YOUR SUD INFORMATION

The confidentiality of substance use disorder (“SUD”) records maintained by the Winnebago Comprehensive Healthcare System (“WCHS”) is protected by Federal and Tribal laws.  Generally, the SUD programs run by WCHS may not say to a person outside of the program that a patient/client attends the program or disclose any information identifying a patient/client as someone who has an SUD or share any SUD health information about the patient/client, unless:

  • The patient/client consents in writing,
  • The disclosure is mandated by law or allowed by a court order requested by an accompanying subpoena, or
  • The disclosure is made to medical personnel in a medical emergency or to qualified person for research, audit and payment activities, or program evaluation.

Records, or testimony relaying the content of such records, shall not be used or disclosed in any civil, administrative, criminal, or legislative proceedings against a patient/client in an SUD program unless based on specific written consent or a court order after notice and an opportunity to be heard is provided to the patient/client or the holder of the records.  These protections apply to minor patients/clients in a program as well as adults. 

Federal and Tribal law do NOT protect any information about a crime committed by a patient/client at the program, against any person who works for the program, or about any threat to commit such a crime.

Additionally, Federal and Tribal laws do NOT protect any information about suspected child abuse or neglect from being reported under Tribal law to appropriate authorities.

There are significant therapeutic and safety advantages for having all of your health information, including SUD records, available to your physicians, advanced practice providers, nurses, therapists and other members of the care team.  Providing consent to combine your SUD records and the rest of your health information will assure that your healthcare team is fully aware of your treatment plans, medications and medical history.  You may provide a single consent (a separate document) for all future uses or disclosures for treatment, payment and healthcare operations for this purpose.  You may revoke this consent at any time as described in the consent document.

In general, except as modified by this ADDENDUM, all provisions and patient rights set out in the WCHS – HIPAA Notice of Privacy Practices apply to your SUD records.   WCHS reserves the right to change the terms of the notice and this ADDENDUM and make the new notice provisions effective for all records that it maintains.

Violation of Federal law and regulations by a program may have legal consequences.  Suspected violations may be reported to appropriate authorities in accordance with Federal and Tribal law, including calling WCHS Quality Management Department at 402745-3950 or toll free 888-575-9244, email qualityassurance@wchs.health, or using the U.S. Department of Health and Human Services, Office for Civil Rights, Complaint Portal Assistant at https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf . 

If you have any questions or concerns about the confidentiality of Substance Use Disorder patient/client records, please contact program personnel.   For further details, see Federal law and regulations 42 U.S.C. 290dd-2, and 42 CFR Part 2. 

ONGOING ACCESS TO PRIVACY POLICY:

We will provide you with a copy of the most recent version of this Notice at any time upon your written request sent to the address listed below. For any other requests or for further information regarding the privacy of your PHI, and for information regarding the filing of a complaint with us, please contact the WCHS Privacy Officer at 402-745-3950 or write:

Winnebago Comprehensive Healthcare System

Attn: Privacy Officer

225 S. Bluff Street

Winnebago, NE 68071

Read Website Privacy Policy

Back to View All Policies