Privacy Practices

Revised and Effective July 2023

PLEASE REVIEW IT CAREFULLY.

If you have any questions about this Notice, please contact the El Camino Health Compliance/Privacy Officer, or designee, by dialing the main El Camino Health number at 650-940-7300 or by leaving a message on the Corporate Compliance Hotline at 650-988-7733.

At El Camino Health, we believe your health information is personal. We are committed to keeping the records of the care and services that you receive at our facilities private, and we are required by law to respect your confidentiality.

This Notice describes the privacy practices of El Camino Health and its affiliates, and applies to all of the health information that identifies you and the care you receive at El Camino Health.

Your health information may consist of paper, digital or electronic records, but could also include photographs, videos, and other electronic transmissions or recordings that are created during your care and treatment. Each time you visit a hospital, physician or other healthcare provider, a record of your visit is made. This record may be shared with various members of your care team who are not always employed by El Camino Health, but who may be affiliated. Typically, this record contains your symptoms, examination and test results, diagnoses, treatment, a plan for future care or treatment, status as client research trial participant, and billing-related information ("protected health information"). This Notice applies to all of the records of your care generated by El Camino Health, whether made by our personnel, contractors or your doctor. Members of your care team who are not employed by El Camino Health may give you different policies or notices to describe their own office practice.

El Camino Health and Affiliates

El Camino Health locations and facilities include but are not limited to the following:

A complete list of El Camino Health facilities and locations is provided on our website at locations.elcaminohealth.org.

All of these hospitals, doctors, entities, foundations, facilities and services may share your health information with each other for reasons of treatment, payment and healthcare operations as described below.

Our Responsibilities

We are required by law to maintain the privacy of your health information, to provide you with a description of our privacy practices and legal duties with respect to your health information, and to notify affected individuals following a breach of unsecured health information.

Whenever we use or disclose your health information, we are required to abide by the terms of this Notice of Privacy Practices.

How We May Use and Disclose Health Information About You

We typically use or share your health information in the following ways:

For Treatment: We can use your health information and share it with other professionals who are treating you, and for purposes of recommending treatment alternatives, care coordination and alternative settings of care.

We may also share protected health information with your designated primary care physician ("PCP") or other subsequent healthcare provider in order for them to effectively treat you once you are discharged from the hospital. This information may be shared electronically, in a restricted, secure format.

For Payment: We may use and disclose medical information about your treatment and services to bill and collect payment from you, your insurance company, health plan or another third party payer ("Plan"). For example, we may need to give your Plan information about your surgery so they will pay us or reimburse you for the treatment. We may also inform your Plan about the treatment you are going to receive to determine whether your Plan will cover it.

For Healthcare Operations: We will also use and share your health information to assist in running our operations and to improve patient care. We may use and share your health information, including but not limited to, in the following ways:

To our business associates with whom we contract to perform services;
To assess your satisfaction with our services;
For population-based activities relating to improving health or reducing healthcare costs;
To contact you to inform of possible relevant clinical research trials available; and
For conducting training programs or reviewing the competence of healthcare professionals.

Under Organized Healthcare Arrangements: We may participate in joint arrangements with other healthcare providers or healthcare entities whereby we may use or disclose your health information, as permitted by law, to participate in joint activities involving treatment; review of healthcare decisions, quality assessment or improvement activities; or payment activities.

Health Information Exchanges: We may participate in one or more health information exchanges ("HIEs") whereby we may disclose your health information, as permitted by law, to other healthcare providers or entities for the purposes described in this Notice. You are not required to participate in any HIEs in order to receive care. You may opt out of participating in the HIEs by providing a written request to the El Camino Health Privacy Officer. If you opt out, others may still request your information through the HIEs, but your information will not be viewable through the HIEs. You may opt back in to the HIEs at any time.

Your Choices

For certain health information, you may tell us your choices about what we share.

For Fundraising Activities (except Mental Health Patients): We may disclose limited information about you (such as your name, address, telephone number and the dates you received services at El Camino Health) to raise money on behalf of El Camino Health. This limited disclosure permits contact with you in an effort to expand and support the healthcare services we offer, the educational programs we provide to the community and the research we conduct to find cures for life-threatening diseases. If you are contacted by the El Camino Health Foundation, you have the right to be excluded from further contact by making a written request to the El Camino Health Foundation.

For Hospital Patient Directory (except Mental Health Patients): We may include certain limited information about you in the hospital patient directory while you are a patient at the hospital. The information may include your name, location in the hospital, your general condition (e.g., good, fair, etc.) and your religious affiliation. This information may be provided to members of the clergy even if they do not ask for you by name and, except for religious affiliation, to other people who ask for you by name. If you would prefer not to be listed in the hospital patient directory, please request the "Request to Withhold Public Release of Information" form, or request it at the time of registration from admission staff. If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest.

To Individuals Involved in Your Care or Payment for Your Care: Unless you instruct us otherwise, we may, in our professional judgment, use or disclose your health information to a family member, other relative, a friend or any other person identified by you who is involved in your medical care or who helps pay for your care (including your Plan). In an emergency situation or in the event of your incapacity, we may exercise our professional judgment to determine whether a disclosure to a particular person is in your best interest. We will disclose only the information that we believe is directly relevant to the person's involvement with your healthcare or payment for your care. In addition, we may disclose your health information to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.

How Else Can We Use or Share Your Health Information?

We are allowed or required to share your information in other ways — usually in ways that contribute to the public good, such as the ways mentioned below. We must meet certain conditions in the law before we can share your information for these purposes. For more related information, click Your Rights under HIPAA.

Public Health Activities: We may disclose your health information for authorized public health activities: to public health officials to prevent or control disease, injury or disability; to the U.S. Food and Drug Administration ("FDA") as required or permitted by the FDA; and to report to your employer as required under laws addressing work-related illnesses and injuries or workplace medical surveillance.
Research: We may use or disclose your information for health research under certain circumstances.
Victims of Abuse, Neglect or Domestic Violence: If we reasonably believe you are a victim of abuse, neglect or domestic violence, we may disclose your health information to a governmental authority, including a social services or protective services agency, authorized by law to receive reports of such abuse, neglect or domestic violence.
For Health Oversight Activities: We may disclose your health information to a health oversight agency that oversees the healthcare system and is charged with responsibility for ensuring compliance with the rules of government health programs such as Medicare or Medicaid, or licensing and similar authorities.
To Law Enforcement Officials: We may disclose your health information to the police or other law enforcement officials in certain limited, allowable circumstances or in compliance with a warrant, a court order, or a grand jury or an administrative subpoena.
For Legal Proceedings: We may disclose your health information in the course of a judicial or administrative proceeding in response to: (1) a court order; (2) a legally valid order or warrant issued by a state or federal authority, administrative agency or licensing board; and (3) a subpoena, discovery request or other lawful process in a third party action, but only after efforts have been made to notify you that your health information is being sought so that you can obtain an order protecting the information requested.
Decedents: We may disclose your health information to a coroner, a medical examiner or a funeral director.
Organ and Tissue Procurement: We may disclose your health information to entities engaged in procurement, banking or transplantation of cadaveric organs, eyes or tissue for purposes of facilitating donation and transplantation.
Health or Safety: We may use or disclose your health information to prevent or lessen a serious and imminent threat to your health or safety, or the health or safety of others.
Specialized Government Functions: We may use and disclose your health information to units of the government with special functions, such as the U.S. military, the U.S. Department of State, under certain circumstances, and correctional institutions.
Worker's Compensation: We may disclose your health information as authorized by and to the extent necessary to comply with laws and legal actions relating to workers' compensation or other similar programs.
Business Associates: We can share health information about you with service providers (known as business associates) that assist us. For example, we may disclose your protected health information to a copy service we use when making copies of your health record or to a consultant who performs utilization reviews. We require our business associates to appropriately safeguard your health information in accordance with current legal requirements.

Uses and Disclosures Requiring Your Written Authorization

Marketing Activities: We must also obtain your written authorization prior to using your health information for marketing purposes.

However, no Marketing Authorization is required for the following informational communications (except Mental Health Patients): (1) information about health-related products or services we provide; (2) information about services or products relating to your treatment; (3) information about services or products for purposes of case management or care coordination, or to recommend alternative treatments, therapies, providers or care settings; (4) to provide you with marketing materials in a face-to-face encounter; and (5) to give you a promotional gift of nominal value.

If authorized, marketing informational communications may be sent to you by email, text or regular mail using information you provide us at registration.

Highly Confidential Information: Federal and state laws require special privacy protections for certain highly sensitive information about you ("Highly Confidential Information"), including the subset of your health information that: (1) is maintained in psychotherapy notes; (2) relates to alcohol and drug abuse prevention, treatment and referral; (3) relates to treatment or testing for HIV/AIDS or sexually transmitted infections; (4) relates to mental or behavioral health treatment; and (5) contains genetic information, including genetic testing results. For purposes other than those permitted or required by law, we must obtain your written authorization in order for us to disclose your Highly Confidential Information.

Other Uses of Protected Health Information

Other uses and disclosures of health information not covered by this Notice or the laws that apply to us will be made only with your written authorization. If you authorized us to use or disclose your protected health information, you may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose your protected health information for the reasons covered by your written authorization. You understand that we are unable to take back any uses or disclosures we have already made in reliance on the authorization, and that we are required to retain our records of the care that we provided to you.

Your Rights Regarding Your Health Information

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

Inspect and Copy: You can ask to see or obtain an electronic or paper copy of your medical records and other health information we have about you. If you wish to make a request, you may obtain a request form from, or submit your detailed request in writing to, the Health Information Management Services Department, including the protected health information you are requesting access to and the relevant dates. We will provide a copy or a summary of your health information in accordance with applicable state and federal requirements. We may charge a reasonable, cost-based fee for copying, mailing or other supplies associated with your request. We may deny your request in certain limited circumstances; however, you may request that the denial be reviewed in some situations. We will comply with the outcome of the review.

Amendment: You can ask us to correct health information about you that you think is incorrect or incomplete. We may deny your request for an amendment and, if this occurs, you will be notified of the reason for the denial within 60 days. If you wish to make a request, you may obtain a request form from, or submit your detailed request in writing to, the Health Information Management Services department. You must include your reasons for the request.

Accounting of Disclosures: You may ask for a list (accounting) of the times we've shared your health information for six years prior to the date you ask, with whom we shared it and why. If you wish to make a request, you may obtain a request form from, or submit your detailed request in writing to, the Health Information Management Services department.

In this list, we will include all the health information disclosures we have made except for those about treatment, payment, healthcare operations and certain other disclosures (such as any you asked us to make). We'll provide one accounting of disclosures a year for free, but will charge a reasonable, cost-based fee if you ask for another one within 12 months.

Request Additional Restrictions: You can ask us not to use or share certain health information for treatment, payment or our operations. We are not required to agree to your request. For example, we may say "no" if it would affect your care. If you wish to make a request, you must submit your detailed request in writing to your care provider or to the Privacy Officer, or designee, using the "Request to Restrict Use or Disclosure of Protected Health Information" form available at the Health Information Management Services department. If you pay for a service or healthcare item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say "yes" unless a law requires us to share that information.

Request Confidential Communications: You may request that we communicate with you about medical matters in a certain way or at a certain location. For example, you may ask that we contact you at work or by U.S. Mail. To request confidential communications, you must make your request in writing to the El Camino Health Privacy Office at the address provided below. We will work to accommodate all reasonable requests.

A Paper Copy of This Notice: You may obtain a paper copy of this Notice, even if you have agreed to receive this Notice electronically. You may request a copy of this Notice at any time. You may also obtain a copy of this Notice at our website elcaminohealth.org.

File a Complaint: If you believe your privacy rights have been violated, you may file a complaint with the El Camino Health Privacy Officer. To obtain information or be contacted by the Privacy Officer, or designee, you may leave a message on the Corporate Compliance Hotline, or you may call Administration at 650-940-7300. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 877-696-6775 or visiting the Filing a HIPAA Complaint website. All complaints should be submitted in writing. We will not retaliate against you for filing a complaint.

Changes to This Notice

We reserve the right to change this Notice at any time, and the revised Notice will be effective for all of the health information we already have about you as well as any information we receive in the future. The revised Notice will be effective for all health information that we maintain as of the effective date of such revised Notice, even if we collected or received the health information prior to the revised Notice's effective date. The most current Notice will be posted in El Camino Health's care facilities and will include the date of adoption. In addition, each time you register at or are admitted to El Camino Health for treatment or healthcare services as an inpatient or outpatient, we will offer you a copy of the current Notice in effect. We will also post a copy of the current Notice at our website elcaminohealth.org.

State Specific Requirements

When federal and California privacy laws are different and conflict, and California law is more protective of your health information or provides you with greater access to your health information, then we will follow California law.

Privacy Officer

The El Camino Health Privacy Officer, or designee, may be reached by dialing the main El Camino Health number at 650-940-7300. You may also leave a message on the Corporate Compliance Hotline 650-988-7733 for a return call from the Privacy Officer, or designee.

Share this page: