THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT
YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Effective Date: 7/18/2024

The Purpose of this notice is to describe the uses and disclosures of protected health information (PHI) that Mahoning Valley Nursing and Rehabilitation Center (MVNRC) is permitted to make, MVNRC’s legal duties and privacy practices with respect to PHI, and the Resident’s rights concerning PHI.
MVNRC is committed to preserving the privacy and confidentiality of your protected health information created and/or maintained at our organization. This Notice describes the ways in which MVNRC may use or disclose your protected health information and also describes your rights and MVNRC’s obligations regarding any such uses or disclosures. We will abide by the terms of this notice, including any revisions that are made as required or authorized by law. Modifications to this notice will be communicated with the monthly billing statements and a copy of the current Notice will be posted in each facility with copies made available to Residents and Responsible Parties upon request.
The individuals listed below will abide by the terms of this Notice and may share PHI with each other for purposes of treatment, payment, or health care operations, as further described in this notice.
• Any health care professional authorized to enter information into your medical record created and/or maintained at MVNRC.
• Any volunteer permitted to assist you while receiving services at MVNRC. • All team members of MVNRC.
We may use or disclose your PHI in the following manners:
• For purposes of treatment, payment, or health care operations.
• Pursuant to your written authorization
• Pursuant to your verbal agreement
• As permitted by law • As required by law

Listed below are different ways that we may use or disclose your PHI. Other uses or disclosures not described in the Notice will only be made with your authorization.
Treatment:
• We may use your PHI to provide you with health care treatment and services and disclose PHI to Team Members and other persons who are involved with your care.
• We may use or disclose your PHI for purpose of contacting you to inform you of treatment alternatives or health-related benefits and services that may be of interest to you.

Payment:
• We may use or disclose your PHI so that we may bill and collect payment from you, an insurance company, or another third party for health care services you receive at MVNRC.
• We may tell your health plan about a treatment you are going to receive in order to obtain prior authorization for the services or to determine if your health plan will cover the treatment or service.
Health Care Operations:
• We may use or disclose your PHI to perform certain functions within MVNRC that are necessary to operate the facility and to assure a quality standard of resident care.
• We may use your PHI to review our treatment and services and to evaluate the performance of our Team Members in caring for you.
• We may use your PHI to determine whether certain services are effective or whether additional services should be provided.
• We may disclose your PHI to Team Members and other persons caring for you for review and learning purposes.
• We may use your PHI to compare with other facility standards to determine potential improvements for care and services at MVNRC and so that others may use the information to study health care and health care delivery. In this circumstance, identifiers may be removed to provide for anonymity of our residents.
• Examples where PHI may be used or disclosed: Death Notices (date of birth and date of death will be shared at the facility), Birthday Observances (date of birth will be used to determine month of celebration events), Medical Appointments (PHI may be used to communicate appointment reminders and transportation arrangements).

Pursuant to Written Authorization:
• We must obtain your written authorization for any use or disclosure of PHI that is not for treatment, payment or health care operations or otherwise permitted or required by the Privacy Rule. MVNRC may not condition treatment, payment, enrollment, or benefits eligibility on an individual granting an authorization, except in limited circumstances.
• An authorization must be written in specific terms. It may allow use and disclosure of PHI by the covered entity seeking the authorization, or by a third party. Examples of disclosures that would require an individual’s authorization include disclosures to a life insurer for coverage purposes or disclosures to a pharmaceutical firm for their own marketing purposes.
• All authorizations must be in plain language, and contain specific information regarding the information to be disclosed or used, the person(s) disclosing and receiving the information, expiration, right to revoke in writing, and other data.
• Psychotherapy Notes. We must obtain your authorization to use or disclose psychotherapy notes with the following exceptions:
o The covered entity who originated the notes may use them for treatment.
o A covered entity may use or disclose, without an individual’s authorization, the psychotherapy notes, for its own training, and to defend itself in legal proceedings brought by the individual, for HHS to investigate or determine the covered entity’s compliance with the Privacy Rules, to avert a serious and imminent threat to public health or safety, to a health oversight agency for lawful oversight of the originator of the psychotherapy notes, for the lawful activities of a coroner or medical examiner or as required by law.
• Marketing. Marketing is any communication about a product or service that encourages recipients to purchase or use the product or service. The Privacy Rule carves out the following health-related activities from this definition of marketing:
o Communications to describe health-related products or services, or payment for them, provided by or included in a benefit plan of the covered entity making the communication;
o Communications about participating providers in a provider or health plan network, replacement of or enhancements to a health plan, and health- related products or services available only to a health plan’s enrollees that add value to, but are not part of, the benefits plan;
o Communications for treatment of the individual; and
o Communications for case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or care settings to the individual.
Marketing also is an arrangement between MVNRC and any other entity whereby MVNRC discloses PHI, in exchange for direct or indirect remuneration, for the other entity to communicate about its own products or services encouraging the use or purchase of those products or services. MVNRC must obtain an authorization to use or disclose PHI for marketing, except for face-to-face marketing communications between MVNRC and an individual, and for MVNRC’s provision of promotional gifts of nominal value. No authorization is needed, however, to make a communication that falls within one of the exceptions to the marketing definition. An authorization for marketing that involves MVNRC’s receipt of direct or indirect remuneration from a third party must reveal that fact.
Pursuant to Verbal Authorization:
• Informal permission may be obtained by asking you outright, or by circumstances that clearly give you the opportunity to agree, acquiesce, or object. Where you are incapacitated, in an emergency situation, or not available, MVNRC generally may make such uses and disclosures, if in the exercise of our professional judgment, the use or disclosure is determined to be in your best interests.
• Facility Directories. It is a common practice in many health care facilities, to maintain a directory of resident contact information. MVNRC may rely on your informal permission to list in its facility directory your name, general condition, religious affiliation, and location in the facility. MVNRC may then disclose your condition and location in the facility to anyone asking for you by name, and also may disclose religious affiliation to clergy. Members of the clergy are not required to ask for you by name when inquiring about resident religious affiliation.
• For Notification and Other Purposes. MVNRC also may rely on your informal permission to disclose to your family, relatives, or friends, or to other persons whom you identify, PHI directly relevant to that person’s involvement in your care or payment for care. This provision, for example, allows a pharmacist to dispense filled prescriptions to a person acting on your behalf. Similarly, MVNRC may rely on your informal permission to use or disclose PHI for the purpose of notifying (including identifying or locating) family members, personal representatives, or others responsible for your care of your location, general condition, or death. In addition, PHI may be disclosed for notification purposes to public or private entities authorized by law or charter to assist in disaster relief efforts.

Uses or Disclosures Required by Law:
• Public Health Activities. MVNRC may disclose PHI to: (1) public health authorities authorized by law to collect or receive such information for preventing or controlling disease, injury, or disability and to public health or other government authorities authorized to receive reports of child abuse and neglect; (2) entities subject to FDA regulation regarding FDA regulated products or activities for purposes such as adverse event reporting, tracking of products, product recalls, and post-marketing surveillance; (3) individuals who may have contracted or been exposed to a communicable disease when notification is authorized by law; and (4) employers, regarding employees, when requested by employers, for information concerning a work-related illness or injury or workplace related medical surveillance, because such information is needed by the employer to comply with the Occupational Safety and Health Administration (OSHA) or similar state law.
• Judicial and Administrative Proceedings. MVNRC may disclose PHI in a judicial or administrative proceeding if the request for the information is through an order from a court or administrative tribunal. Such information may also be disclosed in response to a subpoena or other lawful process if certain assurances regarding notice to the individual or a protective order are provided.
• Law Enforcement Purposes. MVNRC may disclose PHI to law enforcement officials for law enforcement purposes under the following six circumstances, and subject to specified conditions: (1) as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; (2) to identify or locate a suspect, fugitive, material witness, or missing person; (3) in response to a law enforcement official’s request for information about a victim or suspected victim of a crime; (4) to alert law enforcement of a person’s death, if MVNRC suspects that criminal activity caused the death; (5) when MVNRC believes that PHI is evidence of a crime that occurred on its premises; and (6) by a covered health care provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime.
• Essential Government Functions. An authorization is not required to use or disclose PHI for certain essential government functions. Such functions include: assuring proper execution of a military mission, conducting intelligence and national security activities that are authorized by law, providing protective services to the President, making medical suitability determinations for U.S. State Department employees, and determining eligibility for or conducting enrollment in certain government benefit programs.

Uses or Disclosures Permitted by Law:
• Victims of Abuse, Neglect or Domestic Violence. In certain circumstances, MVNRC may disclose PHI to appropriate government authorities regarding victims of abuse, neglect, or domestic violence.
• Health Oversight Activities. MVNRC may disclose PHI to health oversight agencies for purposes of legally authorized health oversight activities, such as audits and investigations necessary for oversight of the health care system and government benefit programs.
• Decedents. MVNRC may disclose PHI to funeral directors as needed, and to coroners or medical examiners to identify a deceased person, determine the cause of death, and perform other functions authorized by law.
• Cadaveric Organ, Eye, or Tissue Donation. MVNRC may use or disclose PHI to facilitate the donation and transplantation of cadaveric organs, eyes, and tissue.
• Research. “Research” is any systematic investigation designed to develop or contribute to generalizable knowledge. The Privacy Rule permits MVNRC to use and disclose PHI for research purposes, without an individual’s authorization, provided MVNRC obtains either: (1) documentation that an alteration or waiver of your authorization for the use or disclosure of PHI about you for research purposes has been approved by an Institutional Review Board or Privacy Board;
(2) representations from the researcher that the use or disclosure of the PHI is solely to prepare a research protocol or for similar purpose preparatory to research, that the researcher will not remove any PHI from MVNRC, and that PHI for which access is sought is necessary for the research; or (3) representations from the researcher that the use or disclosure sought is solely for research on the PHI of decedents, that the PHI sought is necessary for the research, and, at the request of MVNRC, documentation of the death of the individuals about whom information is sought. MVNRC also may use or disclose, without your authorization, a limited data set of PHI for research purposes.
• Serious Threat to Health or Safety. MVNRC may disclose PHI that we believe is necessary to prevent or lessen a serious and imminent threat to a person or the public, when such disclosure is made to someone we believe can prevent or lessen the threat (including the target of the threat). MVNRC may also disclose to law enforcement if the information is needed to identify or apprehend an escapee or violent criminal.
• Workers’ Compensation. MVNRC may disclose PHI as authorized by, and to comply with, workers’ compensation laws and other similar programs providing benefits for work-related injuries or illnesses.

The following are your rights regarding your PHI:
• Access. Except in certain circumstances, you have the right to review and obtain a copy of your PHI in MVNRC’s designated record set. The “designated record set” is that group of records maintained by or for MVNRC that is used, in whole or part, to make decisions about you, or that is a provider’s medical and billing records about you or a health plan’s enrollment, payment, claims adjudication, and case or medical management record systems. The Privacy Rule excepts from the right of access the following PHI: psychotherapy notes, information compiled for legal proceedings, laboratory results to which the Clinical Laboratory Improvement Act (CLIA) prohibits access, or information held by certain research laboratories. For information included within the right of access, MVNRC may deny you access in certain specified situations, such as when a health care professional believes access could cause harm to you or another. In such situations, you must be given the right to have such denials reviewed by a licensed health care professional for a second opinion. MVNRC may impose reasonable, cost-based fees for the cost of copying and postage when records are requested by an authorized person, other than the resident, following submission of an authorization form.
• Amendment. The Privacy Rule gives you the right to have MVNRC amend your PHI in a designated record set when that information is inaccurate or incomplete. If MVNRC accepts an amendment request, we must make reasonable efforts to provide the amendment to persons that you have identified as needing it and to persons that MVNRC knows might rely on the information to your detriment. If the request is denied, MVNRC must provide you with a written denial and allow you to submit a statement of disagreement for inclusion in the record. The Privacy Rule specifies processes for requesting and responding to a request for amendment. MVNRC must amend PHI in our designated record set upon receipt of notice to amend from another covered entity.
• Disclosure Accounting. You have a right to an accounting of the disclosures of your PHI by MVNRC or MVNRC’s business associates. The maximum disclosure accounting period is the six years immediately preceding the accounting request. There is no fee for an accounting requested in the first twelve-month period, however, you may be charged for the cost of providing additional accounting (we will notify you of the cost and give you the opportunity to withdraw or modify your request prior to the cost incurrence).
The Privacy Rule does not require accounting for disclosures: (a) for treatment, payment, or health care operations; (b) to you or your personal representative; (c) for notification of or to persons involved in your health care or payment for health care, for disaster relief, or for facility directories; (d) pursuant to an authorization; (e) of a limited data set; (f) for national security or intelligence purposes; or (g) incident to otherwise permitted or required uses or disclosures. Accounting for disclosures to health oversight agencies and law enforcement officials must be temporarily suspended on their written representation that an accounting would likely impede their activities.
• Restriction Request. You have the right to request that MVNRC restrict use or disclosure of PHI for treatment, payment or health care operations, disclosure to persons involved in your health care or payment for health care, or disclosure to notify family members or others about your general condition, location, or death. MVNRC is under no obligation to agree to requests for restrictions. If MVNRC does agree, then we must comply with the agreed restrictions, except for purposes of treating you in a medical emergency.
We are required to agree to your request to restrict disclosure of PHI to a health plan if the disclosure is for payment or health care operations and pertains to a health care item or service for which you have paid out of pocket in full.
• Confidential Communications Requirements. Health plans and covered health care providers must permit you to request an alternative means or location for receiving communications of PHI by means other than those that MVNRC typically employs. For example, you may request that the provider communicate with you through a designated address or phone number. Similarly, you may request that MVNRC send communications in a closed envelope rather than a postcard.
Health plans must accommodate reasonable requests if you indicate that the disclosure of all or part of the PHI could endanger you. The health plan may not question your statement of endangerment. MVNRC may condition compliance with a confidential communication request on you specifying an alternative address or method of contact and explaining how any payment will be handled.
• Genetic Information. For health plans that underwrite, there is a prohibition against health plans using or disclosing PHI that is genetic information about you for underwriting purposes.
• Information Breach. Regulations requires MVNRC to notify you of a breach without unreasonable delay but in no case later than 60 calendar days from the discovery of the breach, except in certain circumstances where law enforcement has requested a delay.
• Fund Raising. The Privacy Rule requires MVNRC when planning to use or disclose PHI for fundraising to inform you in our Notice of Privacy Practices that we may contact you to raise funds for MVNRC (as with the Benevolent Care Program). The following PHI about you may be used for MVNRC’s fundraising without your authorization: (1) demographic information relating to you; and (2) the dates of health care provided to you. In addition, MVNRC is required to include in any fundraising materials it sends to you a description of how you may opt out of receiving future fundraising communications and that MVNRC must make reasonable efforts to ensure that individuals who do opt out are not sent future fundraising communications.
• Complaint Submission. You have the right to submit a written complaint if you:
o Believe that MVNRC has improperly used or disclosed your PHI
o Have concerns about MVNRC’s HIPAA privacy policies
o Have concerns about MVNRC’s compliance of its privacy policies
You may file the complaint with either MVNRC’s Health Information Manager or the Compliance Officer, 397 Hemlock Drive, Lehighton, PA 18235; 570-386-5522 or the Office for Civil Rights (DHHS, 150 S. Independence Mall West – Suite 372, Public Ledger Building, Philadelphia, PA 19106-9111; 1-800-368-1019; (215) 861-4440 (TDD); (215) 861-4431 FAX). There will be no retaliation against an individual for filing a complaint.
• Electronic Notice. You have the right to request the NPP be emailed to you, however, if MVNRC is aware the email transmission has failed, then a paper copy of the NPP must be provided to you.

For further information regarding MVNRC’s privacy practices, contact the Privacy Officer or the Compliance Officer at 570-386-5522.