Privacy
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Our Commitment to Privacy
The privacy of your medical information is a priority at McKenzie Health
System (MHS) and we are committed to protecting medical information about
you. This Notice describes how we protect your privacy as we provide services
to you. It describes the medical information we collect about you, how
we use it, and with whom we share it. This Notice also explains your rights
and certain obligations we have regarding the use and disclosure of your
medical information.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA)
is a federal law that provides protection for the privacy and security
of medical information also known as protected health information (PHI).
There are also other federal and state of Michigan laws and regulations
that require medical information to be kept private and secure.
HIPAA requires us to make sure that medical information that identifies
you is kept private, that we give you this Notice explaining your rights
and our privacy obligations and privacy practices concerning your medical
information, and to follow the terms of the Notice that is currently in effect.
Who Will Follow This Notice
McKenzie Health System and all of its sites and locations will follow the terms of this Notice which includes members of the medical staff and all workforce members (employees, contractors, volunteers, and other authorized personnel).
Changes To Our Notice
We reserve the right to change the terms of this notice and our privacy practices at any time as allowed by law. The changes will apply to all PHI about you that we have at the time of the change, and to all PHI about you that we keep in the future. A copy of our current Notice will be posted in our facilities, on our website and will be available to any person upon request.
How We May Use and Disclose Your Health Information
Our use and disclosure of your PHI must comply with both Michigan and federal privacy laws and regulations. Certain types of PHI have additional restrictions on the use and disclosure. In many situations, we can use and disclose your PHI without your written permission; however, there are some situations where your written authorization is required.
General Use and Disclosures That Do Not Require Written Consent
As permitted by HIPAA, we may generally use or disclose your PHI without
obtaining prior written consent from you to carry out the activities detailed below:
Treatment: We may use and disclose your PHI to provide you with medical care and any
related services. We may also share your PHI with others who provide care
to you such as hospitals, hospices, nursing homes, doctors, nurses, physician
assistants, medical and nursing students, therapists, technicians, spiritual
care providers, nutrition staff, volunteers, emergency service and transportation
providers, medical equipment providers, pharmacies, and others involved
in your care at MHS.
We may use and disclose your PHI with health care providers and their staff
outside of MHS for continuation of care. We may use your PHI to contact
you to provide appointment reminders or to give you information about
treatment options or other health-related benefits and services that may
interest you.
For example, if you are treated for a knee injury, we may disclose your
PHI to the physical therapy provider to coordinate your care.
Payment: We may use and disclose your PHI to bill and collect payment for health
care services provided to you. Some providers who deliver care at MHS
bill separately and we may provide payment-related information to them
to coordinate the billing and payment process. We may contact you in writing
or by telephone to discuss your account or to verify or gather more information
about your insurance coverage.
For example, we may share your PHI with your health insurance plan so it
will pay for your health care or services. We may share your information
about treatment you are going to receive to obtain prior authorization
or to determine whether your plan will cover the treatment. You do have
the right to request information to be withheld from your insurance company
or third part payor if you make a request in writing about a specific
treatment or service in advance, and you pay for the services in full
before we provide the specific treatment or service to you.
Health Care Operations: We may use or disclose your PHI as necessary to support the day-to-day
activities and management of MHS. For example, information on services
you receive may be used to support budgeting and financial reporting,
and activities to evaluate and promote quality. We may use or disclose
PHI to get accreditation, legal, auditing, accounting and other services
for business management, quality assessment and planning purposes. We
may use or disclose your medical information in combination with other
patients’ medical information to compare our efforts and to learn
where we can improve our care and services. We may disclose your medical
information to businesses and individuals who perform services for us
if they agree to protect the privacy of that information.
Other Use and Disclosures That Do Not Require Written Consent
As permitted by HIPAA, we may generally use or disclose your PHI without obtaining prior written consent from you to carry out the activities detailed below:
Appointment Reminders: We may use your medical information to contact you about upcoming appointments.
Health-Related Benefits or Services: We may use or disclose your PHI to inform you about health-related benefits
and services that may be of interest to you and your treatment, case management
or care coordination, or to communicate alternative treatments, therapies,
providers, or settings of care.
Research: Under certain circumstances, we may use and disclose PHI about you for
research purposes. For example, a research project may involve evaluating
the health and recovery of all patients who received one medication compared
with those who received another for the same condition. All research projects
are subject to a special approval process. This process evaluates a proposed
research project and its use of health information. This process also
ensures that the research needs are balanced with our patients’
needs for privacy of their health information. Before we use or disclose
health information for research, the project will have been reviewed through
this research approval process. We may, however, disclose health information
about you to people preparing to conduct a research project. For example,
we may disclose information to researchers to help them look for patients
with specific medical needs, so long as the medical information they review
does not leave MHS. We may need to ask for your specific permission if
the researcher will have access to your name, address, or other personal
information.
How We May Use and Disclose Your Health Information – Special Situations
In many cases, we can use and disclose your PHI without your written permission.
The following outlines how we can use or disclose your PHI in a special
situation.
Required by Law: We will disclose health information about you when required by federal,
state or local law or regulation. For example, we are required to report
certain injuries or illnesses for public health purposes.
Artificial Intelligence (AI) Technologies: Your medical information may be used with AI technologies to support various
functions, such as treatment, payment and health care operations. AI tools
may assist in analyzing health data, streamlining administrative workflows
and supporting clinical decisions. For example, we may use AI solutions
to assist with tasks such as medical transcription and summary services
to improve the quality of care our patients receiving or to provider your
doctor with evidence-based insights to support treatment decisions.
Avert a Serious Threat to Health and Safety: We may use and disclose your PHI when necessary to prevent a serious threat
to your health and safety or the health and safety of the public or another
person. We would only disclose the necessary information to someone able
to help prevent the threat such as law enforcement, family, or caregivers.
Coroners, Medical Examiners and Funeral Directors: We may disclose medical information to a coroner or medical examiner. This
may be necessary to identify a deceased person or determine the cause
of death. We may also disclose medical information about patients to funeral
directors, as necessary, to carry out their duties.
Data Breach Notification Purposes: We may use or disclose your PHI to provide legally required notices of
unauthorized access to or disclosure of your medical information.
De-Identified Information: We may use or disclose de-identified PHI for purposes like research, public
health or healthcare operations.
Health Oversight Activities: We may disclose your PHI to a health oversight agency for activities authorized
by law. These oversight activities include audits, investigations, inspections,
and licensure.
These activities are necessary for the government to monitor the health
care system, government programs, and compliance with civil rights laws.
Inmates: If you are an inmate of a correctional institution or under custody of
a law enforcement office, we may disclose your health information to the
correctional institution or law enforcement official. This disclosure
would be necessary for the institution to provide you with health care,
protect your health and safety or the health and safety of others, or
for the safety and security of the correctional institution.
Judicial and Administrative Proceedings: We may disclose your PHI in response to a court or administrative tribunal
order, a subpoena, a discovery request, or other lawful process but only
when we have followed procedures required by law.
Law Enforcement: We may disclose PHI about you to law enforcement officials, as allowed
by law, if the information is: (1) to comply with a court order, subpoena,
warrant, summons or similar process; (2) limited information to identify
or locate a suspect, fugitive, material witness or missing person; (3)
about the victim of a crime even if, under certain limited circumstances,
we are unable to obtain the person’s agreement to the disclosure;
(4) about a death we believe may be the result of criminal conduct; (5)
about criminal conduct on our premises; and (6) in an emergency to report
a crime, the location of the crime or victims, or the identity, description
or location of the person who committed the crime.
Military and Veterans: If you are a member of the armed forces, we may disclose PHI about you
as required by military command authorities. We may also disclose PHI
to the appropriate foreign military authority if you are a member of the
foreign military.
National Security and Intelligence Activities: We may disclose your PHI to an authorized federal official for purposes
of intelligence, counterintelligence and other national security activities
that may be authorized by law.
Organ and Tissue Donation: We may disclosure your PHI to organizations that handle organ procurement
or organ, eye and tissue transplantation or to an organ donation bank,
to facilitate donation and transplantation, as required by law, to help
with the donation process.
Protective Services for the President and Others: We may disclose medical information about you to authorized federal officials
so they can protect the president, authorized people, or foreign heads
of state or conduct special investigations.
Public Health Activities: We may disclose your PHI to legal authorities for public health activities
to prevent or control disease, injury or disability; to report births,
deaths and disease registries; to report child abuse or neglect; to report
reactions to medications or problems with products; to notify people of
recalls for products they may be using; to notify a person who may have
been exposed to a disease or may be at risk for contracting or spreading
a disease or condition.
Secretary of Health and Human Services: We are required to disclose your information to the Secretary of the U.S.
Department of Health and Human Services when the Secretary is investigating
or determining our compliance with the HIPAA Privacy Rules.
Third Parties and/or Business Associates: We may disclose your PHI to third parties with whom we contract to perform
services on behalf of MHS. We will have written assurances from the third
party that your information will be protected.
Victim of Abuse, Neglect, or Domestic Violence: We may use or disclose your PHI to an authorized government authority,
including a social service or protective service agency if we reasonably
believe you to be a victim of abuse, neglect, or domestic violence.
Workers’ Compensation: We may disclose PHI about you for workers’ compensation or similar
programs. These programs provide benefits for work-related injuries and
illnesses.
Use and Disclosure to Which You Have the Opportunity to Object
As permitted by HIPAA, you may object to the following use or disclosures
of your medical information:
Individuals Involved in Your Care or Payment of Your Care: Unless you object, we may disclose medical information about you to a friend
or family member who is involved in your medical care or is responsible
for paying for your care or if we believe the disclosure is in your best
interest. We may tell your family and friends about your general condition.
In addition, we may disclose medical information about you to an entity
assisting in a disaster relief effort like the Red Cross or the Federal
Emergency Management Agency (FEMA), so your family can be notified about
your condition, status, and location. If you have any objection to sharing
your medical information in this way, please contact the HIPAA Privacy
Officer listed at the end of this Notice.
Patient directories: Unless you object, we may include certain limited information about you
in the patient directory while you are a patient here. Patient directory
information may include your name, location in the hospital, and general
condition (good, fair, poor) and may be released to people who ask for
you by name. If you provide a religious affiliation, it may be provided
only to members of the clergy.
Your Right to Opt-Out of Certain Activities
Fundraising Activities: We may use certain non-clinical information including, but not limited
to your name, address, telephone number, dates and department of service,
age and gender to contact you to raise funds for our organization. You
have the right to opt out of fundraising communications.
Health Information Exchange: We may participate in health information networks and exchanges (HINs/HIEs)
that securely share your electronic health information with others for
treatment, payment, health care operations, public health, and other purposes
allowed by law. You may opt out of the health information exchange and
prevent providers from being able to search for your information through
the exchange. If you choose to opt out, we may still use and share your
information as required or permitted by law.
Marketing Activities: Most uses and disclosures of your medical information for marketing purposes
or any sale of your medical information will require your written permission.
We may communicate with you about our own products or services. You have
the right to opt out of marketing communications.
Highly Confidential Information
Certain health information receives special privacy protections, such as
psychotherapy notes, services for mental health and developmental disabilities,
alcohol and drug abuse treatment and prevention services, and certain
diseases. We will use or disclose your highly confidential information
only as permitted or required by law or with your written permission.
Psychotherapy Notes: HIPAA provides additional protection of psychotherapy notes, which are
the personal notes of a mental health professional about a private or
group counseling session. Most uses or disclosures of psychotherapy notes
require your written permission.
Part 2 Records: Part 2 protections apply to records from certain federally assisted programs
often referred to as “Part 2 Programs” that contain substance
use disorder (SUD) and/or medication assisted treatment (MAT) information
that offer strict confidentiality to encourage people to seek help. We
may receive Part 2 Records about you in accordance with a TPO consent.
We may redisclose the records in accordance with HIPAA, except for uses
and disclosures for civil, criminal, administrative, and legislative proceedings
(legal proceedings) against you. Any use in legal proceedings requires
a Part 2 compliant court order or that the patient signs a separate Part
2 consent, which cannot be combined with a consent to use or disclose
the records for any other purpose.
Other Sensitive Information: Other types of information may have greater protection under state law,
such as certain drug and alcohol information, HIV/AIDS and other communicable
disease information, genetic information, mental health information, or
information about developmental disabilities. For this type of information,
we may be required to get your written permission before disclosing it
to others. If you have any questions about this, contact the HIPAA Privacy
Officer at the end of this notice.
All Other Uses and Disclosures Require Your Prior Written Authorization
If a use or disclosure is prohibited or materially limited by other applicable
law, including psychotherapy notes, the more stringent law will be followed
and an authorization will be required.
Other uses and disclosures of PHI not covered by this Notice or the laws
that apply to MHS will only be made with your written permission. If you
provide us with permission to use or disclosure your PHI, you may revoke
that permission in writing at any time. If you revoke your permission,
we will no longer use or disclose PHI about you for the reasons covered
by your written authorization, unless we have already acted in reliance
upon it. You can revoke your permission, by submitting a written request
to the HIPAA Privacy Officer listed at the end of this Notice.
Notice of Redisclosure
Medical information that is disclosed pursuant to this Notice may be subject to redisclosure by the recipient and no longer protected by HIPAA. Federal or state law applicable to the recipient may limit their ability to use or disclose the medical information received, such as if they are another health care provider subject to HIPAA or a program or entity subject to Part 2.
Your Rights Regarding Your Medical Information
You have specific rights, subject to certain limitations, related to your
medical information, including any Part 2 Records. If someone has authority
to act as your personal representative (medical power of attorney or legal
guardian), that person may exercise your rights and make choices about
your health information. We will make sure the person has this authority
and can act for you before we take any action. Information about these
rights and how you can exercise your rights are below:
Right to Request Restrictions: You have the right to submit a written request to restrict how we use and
disclose your PHI for treatment, payment and health care operations. Your
request must state, in writing, what restriction is requested and to whom
you want the restriction applied. We will consider your request but are
generally not legally required to agree to them except when you pay out-of-pocket
for a service in full (prior to the service being performed) or if the
restriction is required by law. If professional judgement determines that
it is not in your best interest to restrict use and disclosure of PHI
about you, the request may be denied. If we agree to the requested restriction,
we will make reasonable efforts to comply with your request unless the
information is needed for emergency treatment. You may submit your written
request for restriction to the HIPAA Privacy Officer.
Right to Confidential Communications: You have the right to request that we communicate with you about health
care manners in a certain way or at a certain location. For example, you
can ask that we only contact you at work or by mail. We will make reasonable
efforts to accommodate your request. A request must be in writing, specify
how or where you wish to be contacted and submitted to the HIPAA Privacy Officer.
Right to Inspect and Copy: You have the right to review, inspect or receive a copy of the PHI that
we keep about you or anyone that you have legal authorization to access
PHI about. We may charge a reasonable fee for the cost of copying, mailing
or other supplies associated with your request. In limited circumstances,
we may deny your request. For example, your request may be denied if a
licensed health professional determines, in their best professional judgment,
that access to the requested information is reasonably likely to cause
harm to you or another person or is reasonably likely to endanger the
life or physical safety of the individual or another person. If you receive
a denial, you may request the denial to be reviewed.
Right to Amend: If you feel that the medical information we have about you is incorrect
or incomplete, you have the right to submit a written request to amend
your medical information. To make an amendment request, contact the Health
Information Management Department to complete an Amendment Request form.
Please be specific about the information that you believe is incorrect
or incomplete. We may deny the request if it is not in writing or if it
does not include a reason to support the request. In addition, your request
may be denied if our information is complete and accurate, if the medical
information was not created by us, if the information is not part of the
medical information kept by us, or is not part of the information that
you would be permitted to inspect and copy under certain circumstances.
We cannot remove or change the information in the record; however, if
your request is granted, we will add supplemental information by an addendum.
Right to an Accounting of Disclosures: You have a right to request a list of the disclosures we made of your
medical information, except for disclosures related to treatment, payment
and health care operations that do not require your consent. You may submit
a written request for a period of up to six years from the date of disclosure
to the HIPAA Privacy Officer. Your first request in a 12-month period
is free. For additional requests within the same 12-month period, we may
charge you for the costs of providing the list. We will notify you in
advance if there is a cost associated so you can choose whether to get the list.
Right to Be Notified of a Breach: You have a right to be notified in writing if there is a breach of privacy
or security affecting your medical information.
Right to a Copy of our Notice: You have a right to a paper or electronic copy of this Notice. You may
ask us to give you a copy at any time. This Notice is also available on
our website at www.mckenziehealth.org.
Who You Can Contact for Information About This Notice or Our Privacy Practices
If you have questions about this Notice or complaints about our privacy practices, or if you would like to know how to file a complaint with the Office of Civil Rights of the U.S. Department of Health and Human Services, you can contact our HIPAA Privacy Officer at (810) 648-6157. If you believe your privacy rights have been violated, you may file a complaint with MHS, or with the U.S. Department of Health and Human Services Office for Civil Rights without fear of retaliation.
If you believe your privacy rights have been violated, you may file complaint with MHS, or with the secretary of health and human services without fear of retaliation.
To file a complaint with McKenzie Health System, contact the HIPAA Privacy
Officer at
810-648-6157 or submit a written complaint to:
McKenzie Health System
Attn: HIPAA Privacy Officer
120 Delaware Street
Sandusky, MI 48471
To file a complaint with the U.S. Department of Health and Human Services
Office for Civil Rights, send a letter to:
200 Independence Avenue S.W.,
Washington, D.C., 20201
Phone:
(877) 696-6775
Visit: https://www.hhs.gov/hipaa/filing-a-complaint/index.html
F-20713/26 Effective date is February 16, 2026