Great River Health Systems

Notice of Privacy Practices

Download as PDF

The Notice of Privacy Practices describes how Great River Health Systems may use and disclose health information about you and how you can get access to this information. Please review the notice carefully. If you have any questions, please call Great River Health Systems’ privacy officer at 319-768-1960. 

Protected health information (PHI) is medical and demographic information that may identify you. It includes past, present or future physical or mental-health conditions and related health care services. Great River Health Systems and independent providers of diagnostic-imaging services may use and disclose your PHI to carry out treatment, seek payment or conduct health care operations, and for other purposes permitted or required by law.

Great River Health Systems includes:

  • Burlington Area Family Practice Center
  • Great River Klein Center
  • Great River Medical Center departments
  • Great River Physicians and Clinics
  • Heritage Family Pharmacy
  • Heritage Medical Equipment and Supplies
  • Heritage Park Pharmacy
  • Heritage Partners Pharmacy
  • Home Health and Hospice

Our promise to you
Great River Health Systems is committed to providing you with high-quality care and to complying with legal requirements. We understand that your PHI is private, and we are committed to protecting it.

Who must follow this notice?

  • Business associates, such as people and businesses that create, maintain, receive or send your PHI to provide services to Great River Health Systems
  • Great River Health Systems employees, health care providers and volunteers

We are required by law to:

  • Follow the terms of the Notice of Privacy Practices 
  • Give you this notice of our legal obligation and privacy practices with your PHI 
  • Keep private and confidential PHI that identifies you unless otherwise permitted or required by law 
  • Notify you, according to regulations, if there has been a breach of your PHI that resulted in that information being compromised

We may change the terms of our notice anytime, and a new notice will be effective for the PHI we maintain. On request, we will provide you with a revised Notice of Privacy Practices in paper form. You also may get a copy by calling the Health Information Management Department at 319-768-1900, or asking for one when you register for your next appointment. In addition, we will post the Notice of Privacy Practices on our website,


How we may use and disclose your medical information
The following categories describe ways we may use and disclose your PHI without your written approval. For categories not listed, Great River Health Systems will ask for your approval. 

For treatment. We will use your PHI to provide, coordinate and manage your medical treatment or services. We may disclose information to providers, nurses and other health care providers who are or will be involved in your care, whether they are affiliated with Great River Health Systems or not.

Examples: You may need surgery, and the surgeon may need a medical provider’s recent history and physical before he or she can perform the procedure. If you have diabetes, the provider may need to tell a dietitian so appropriate meals are ordered. Other hospital departments also may share medical information about you to coordinate the care you need. This information may include medicines, and laboratory and diagnostic-imaging tests. In addition, your health information may be shared with a provider to whom you have been referred to ensure that the provider has the necessary information to continue care, diagnose or treat you.

For payment. We will use and disclose relevant PHI so treatment and services you receive at our facility can be billed to and payment may be collected from you, an insurance company or a third party. Information also may be used for case-management activities.

Example: We may tell your health-insurance plan about a scheduled procedure or test to have it pre-certified and determine whether the treatment or hospital stay will be covered.

For health care operations. We may use and disclose medical information about you for our health care operations. These uses and disclosures are necessary to operate Great River Health Systems and ensure our patients receive high-quality care.

Example: We may use medical or mental-health treatment information to review our treatment and services and to evaluate the performance of our staff in caring for you. We also may disclose your PHI to physicians, nurses, medical students, and other Great River Health Systems employees or consultants for review and learning purposes.

To the extent permitted by law, we also may disclose your PHI to another health care entity for use in some health care operations if that entity and Great River Health Systems have a relation to you, the information is about this relation, the disclosure is for a quality-related health care activity and for fraud detection.

For appointment reminders. Unless you tell us otherwise in writing, we may use or disclose your PHI, as necessary, to remind you of an appointment.

For the hospital directory. Unless you object, we may include limited information about you in the hospital directory while you are an inpatient. This information may include your name and location in the hospital. Directory information will be released only to people who ask for you by name, which shows they already know you are a patient. We may disclose directory information to a member of the clergy if you do not object. In addition, if you do not object, we may disclose one-word descriptions of you condition:

  • Undetermined
  • Good
  • Fair
  • Serious
  • Critical

For treatment alternatives and health-related benefits and services. We may use or disclose your PHI, as necessary, to provide you with information about treatment alternatives or other health-related benefits and services that may interest you.

Example: We may send you a newsletter about services we offer. If you do not want this information, call the Privacy Officer to have your name removed from the mailing list. 

To people involved in your care or payment for your care. We may release medical and mental-health information about you to a family member involved in your medical care if this person’s involvement is related to such information. We will only provide this information if you agree, are given the opportunity to object and do not or if, in our professional judgment, it would be in your best interest to allow the person to receive the information or act on your behalf.

Example: We may give medical information, including prescription information or information about your appointments, to a friend or family member involved in your care. We also may give such information to someone who helps pay for your care. In addition, we may disclose medical information about you to an entity helping in a disaster relief effort so your family can be told about your condition, status and location.

As required by law. We will disclose medical information about you when required by federal, state or local law without your consent or approval, such as information to report child or dependent-adult abuse.

To avert a serious threat to health or safety. We may disclose medical information about you to prevent a serious threat to your health and safety or the health and safety of the public or someone else. But any disclosure would be only to someone who can help prevent the threat.

To business associates. Great River Health Systems identifies and enters into an agreement with business associates who provide services to Great River Health Systems that may use minimally necessary PHI. We may disclose your medical information to such business associates without your consent. Business associates must maintain and comply with the privacy requirements of state and federal law and keep your medical information confidential. Examples of business associates are accounting firms hired to audit billing and payment information, and software vendors who help Great River Health Systems maintain and process medical information.

For research. Great River Health Systems sometimes participates in research studies with entities such as drug companies. We will disclose your PHI as permitted by federal law. In appropriate cases, we will seek your approval to use and disclose such information. We may disclose your information to researchers when their research has been approved by a special committee that has reviewed the research proposal and established protocols to ensure the privacy of your health information.

Military and veterans. If you are a member of the armed forces, we may release medical information about you as required by military command authorities. We also may release medical information about foreign military employees to the appropriate foreign military authority.

Workers’ compensation. We may release medical information about you for workers’ compensation or similar programs without consent. These programs provide benefits for work-related injuries or illnesses. For example, if you are injured on the job, we may release applicable information about that injury to your employer or its workers’ compensation insurer.

Public-health activities. We may disclose medical information about you for public-health activities without your consent. These activities generally include:

  • Notifying someone who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition
  • Notifying the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence
  • Preventing or controlling disease, injury or disability
  • Reporting products regulated by the Federal Drug Administration to carry out functions, such as collecting data about the safety of a product and notifying people about recalls of products they may be using
  • Reporting reactions to medicines or problems with products

Health oversight activities. We may disclose medical information to a health oversight agency, such as the Department of Health and Human Services, for activities allowed by law. These oversight activities include audits, investigations, inspections and licensing procedures. These activities are necessary for the government to monitor the health care system, government programs and compliance with civil rights laws.

Lawsuits and administrative proceedings. If you are involved in a lawsuit or dispute as a party, we may disclose medical information about you for a court or administrative order. We also may disclose medical information about you for a subpoena, discovery request or other lawful process by someone involved in the dispute. Any disclosure of mental-health information, drug treatment, or HIV or AIDS-related information must comply with applicable state and federal law. In addition, we may disclose medical information to the opposing party in any lawsuit or administrative proceeding – including mental-health, drug treatment, or HIV or AIDS-related information – in which your physical or mental condition is an issue after you have signed a written approval to release the information.

Similarly, we may disclose medical information about you in proceedings in which you are not a party, but only if efforts have been made to tell you or your attorney about the request or to obtain an order protecting the information requested.

Law enforcement. We may release medical information, excluding mental-health information, if asked to do so by law enforcement to:

  • Identify or locate a suspect, fugitive, material witness or missing person
  • Investigate a death we believe may be the result of criminal conduct
  • Investigate criminal conduct at Great River Health Systems
  • Learn more about the victim of a crime if, under limited circumstances, we cannot obtain the person’s agreement
  • Report a crime in emergency circumstances. This information can include the location of the crime or victims, and the identity, description or location of the person who committed the crime.
  • Respond to a court order, subpoena, warrant, summons or similar process

Coroners, medical examiners and funeral directors. We may release medical information, including mental-health information, to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death.

National-security and intelligence activities. We may release medical information about you to federal officials for intelligence, counterintelligence and other national-security activities allowed by law.

Protective services for the president and others. We may disclose medical information about you to federal officials so they may provide protection to the President, other sanctioned people or foreign heads of state, or to conduct special investigations.

Inmates. If you are an inmate of a correctional institution or under law-enforcement custody, we may release medical information about you to the correctional institution or law enforcement. This release would be necessary:

  • For the institution to provide you with health care
  • For the security of the correctional institution
  • To protect your health and safety, or the health and safety of others

Uses and disclosures with your written approval 
Some uses and disclosures of your PHI can be made only with your written approval, unless otherwise permitted or required by law (described in the next section). You may revoke this approval in writing anytime, unless the health system relies on the disclosure shown in the approval. 

Examples of uses and disclosures that may only be made with your written approval are:

  • AIDS- or HIV-related information, mental-health or substance-abuse treatment information only with written approval as required by applicable state law or federal regulations unless the law permits or limits otherwise
  • Marketing purposes and if we will receive any financial payment from a third party for marketing. We will tell you that in the approval form.
  • Psychotherapy notes only with a specific approval signed by you or your legal representatives, following applicable state law or federal regulations
  • Those uses and disclosures not described in the notice above

Great River Health Systems may contact you to raise funds but you have a right to opt out of receiving such communications by calling Great River Health Systems’ Public Relations Department at 319-768-3300. We will promptly honor your request unless we have already sent a communication to you. If you provide approval for the disclosure of your health information, you may revoke it anytime by giving us notice according to our approval policy. Your revocation will not be effective for uses and disclosures made in reliance on your prior approval.

Your rights concerning medical information about you
You have the following rights about medical information we maintain about you:

Right to inspect and request a copy. You have the right to inspect and request a copy of your medical information that may be used in making decisions about your care. This medical information is contained in a designated record set by Great River Health Systems. This usually includes medical and billing records, but does not include psychotherapy notes. 

If we maintain the information electronically and you ask for an electronic copy, we will provide the information to you in the format you requested, assuming it is readily producible. If we cannot readily produce the record in the format you request, we will produce it in another readable electronic form we agree to.

If you request a copy of the information, we may charge a fee for the costs of copying, mailing and other supplies associated with your request. The cost of providing an electronic copy of information from your electronic medical record will be limited to the labor cost and cost of supplies to prepare the electronic copy. If you want to inspect your records, we may charge a fee for the inspection that reflects staff time in pulling the records and participating in the inspection.

We may deny your request to inspect or obtain a copy in limited circumstances. If you are denied access to medical information, you may request that the denial be reviewed. Another licensed health care professional chosen by Great River Health Systems will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.

Right to request amendment. If you think medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for Great River Health Systems and is contained in Great River Health Systems’ designated record set.

To request an amendment, you must contact the Privacy Officer so a Health Information Request for Amendment form can be mailed to you. The form must be filled out and returned to the Privacy Officer. You must provide a reason that supports your request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

  • Is accurate and complete
  • Is not part of the information that you would be permitted to inspect and copy
  • Is not part of the medical information kept by Great River Health Systems
  • Was not created by us, unless the person or entity that created the information is no longer available to make that amendment

Right to an accounting of disclosures. You have the right to request an accounting of disclosures. This accounting is a list of the disclosures we or one of our business associates have made about your medical information. An accounting from paper records will not include disclosures for treatment, payment and health care operations. An accounting from your electronic medical record will include disclosures for treatment, payment and health care operations for three years before the request.

The first accounting of disclosures you request in a 12-month period will be free. For additional lists, we may charge you for the costs of providing the list. We will tell you the cost involved and you may choose to withdraw or modify your request before any costs are incurred.

Right to request restrictions. You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the medical information we disclose about you to someone involved in your care or in the payment for your care, like a family member or friend. For example, you may request that your spouse or child involved in your care not receive some information about your condition.

We are not required to agree to your request, unless the disclosure is to a health plan or other payer to carrying out payment or health care operations and you have paid for the services in full. For other requests for restrictions, if we agree, we will comply with your request unless the information is needed to provide emergency treatment to you.

To request restrictions, you may call the Health Information Management Director at 319-768-1960, and request a form or send a written request that includes:

  • To whom you want the limits to apply (for example, disclosures to your spouse)
  • What information you want limited
  • Whether you want to limit routine access, use or disclosures for treatment, payment or operations

Requests should be sent to the Health Information Management Director at Great River Health Systems, 1221 S. Gear Ave., West Burlington, IA 52655.

Right to request confidential communications. You have the right to request how and where we communicate with you about medical matters. For example, you can ask that we only contact you at work or by mail.

To request confidential communications, you must make your request in writing to the Privacy Officer, Great River Health Systems, 1221 S. Gear Ave., West Burlington, IA 52655. We will not ask the reason for your request. We will accommodate requests that Great River Health Systems determines to be reasonable. Your request must specify how or where you want to be contacted.

Right to request a copy of this notice. You have the right to request a paper copy of this notice. This notice is also available for download.

If you believe your privacy has been violated by Great River Health Systems, please call the health systems’ Privacy Officer at 319-768-1960, or contact the U.S. Secretary of Health and Human Services. Great River Health Systems will not seek retaliation for filing a complaint.

Original: April 14, 2003      Revised: Sept. 20, 2013