Hennepin Health is committed to protecting the privacy of your health information. The notice of privacy practices describes how your medical information may be used and disclosed, and how you can get access to this information. It only applies to your relationship with Hennepin Health.
The notice of privacy practices satisfies privacy requirements under the Health Insurance Portability and Accountability Act (HIPAA), and Minnesota state law. It was first effective April 14, 2003 with a material update effective September 23, 2013.
Hennepin Health collects information about its members from several places such as on applications and forms, via the phone, providers, state and federal health care programs, and counties that provide social services to you. This information is considered to be “protected health information” because it can be used to identify you, and relates to your physical or mental health.
Information we receive from members may include:
In addition to the information Hennepin Health receives from members, information may come from other sources such as:
Your information may be used by Hennepin Health staff for payment and health care operations. Your information may also be disclosed to organizations outside of Hennepin Health for these reasons under certain circumstances. In addition, Hennepin Health may disclose your information for the purposes of treatment by a provider, as long as certain requirements are met. Hennepin Health will not ask your consent to use or disclose your information in these ways. Examples of payment include claims payment, eligibility and premiums collected from individuals. Examples of health care operations include quality improvement, care coordination, fraud and abuse issues, and complaint resolution. Examples of treatment include the provision of health care services in an emergency room or by your doctor and the referral of health care services from one provider to another.
In addition, this notice allows Hennepin Health to share your information in a way that is consistent with your application to enroll in Minnesota Health Care Programs (MHCP) and/or your application to enroll in Hennepin Health. For example, your application to enroll in MHCP allows the sharing of your records without additional consent from you if the records are being shared with county human services offices. This would allow Hennepin Health to share your records with certain county agencies if needed to provide, manage or coordinate health care services. This notice also extends restrictions required by the Minnesota Government Data Practices Act to Hennepin Health-contracted vendors when your information is being shared for health care operations.
Your information may be given to certain entities without your written consent for the following reasons:
In certain situations, you have the option of telling Hennepin Health what your preferences are when it comes to sharing your information, and Hennepin Health will follow your instructions. For example, in some instances, you have the right to direct Hennepin Health to:
If you are not able to tell us your preferences – for example, if you are unconscious – Hennepin Health may decide to share your information if it is believed to be in your best interest. Your information may also be shared if needed to lessen a serious and imminent threat to health or safety.
Hennepin Health must get your consent for any use or disclosure:
In all other circumstances not described in this notice, uses and disclosures of your data will only be made with your written consent. You may revoke your consent at any time.
Access to your data is restricted to Hennepin Health staff that uses the data to provide services to you. All Hennepin Health staff has been trained to protect privacy. Staff that violates these policies is subject to disciplinary action.
Current law allows Hennepin Health to share data about you with organizations and departments such as:
Non-affiliated organizations include:
You have the right to request that Hennepin Health restrict uses and disclosures of your health data for activities related to payment and operations. You also have the right to request a limit on the health data Hennepin Health discloses to someone involved in your care or the payment for your care such as a family member or friend. Hennepin Health will evaluate all requests. Hennepin Health may not agree to the restriction; however, Hennepin Health must agree to your request if the information is related to health care services for which you have paid in full on your own. If Hennepin Health agrees to a restriction, it will be abided by except in emergencies. Hennepin Health will end its agreement to a restriction if you agree to or request the end of the restriction. If Hennepin Health decided to end its agreement to the restriction, you will be informed.
You may ask Hennepin Health to contact you by another means or at another location. For example, you may wish to be contacted at work rather than at home. Hennepin Health must agree to your request if you clearly state that the disclosure of all or part of your health data could endanger you. Private data is available to a minor, or parent or guardian of a minor, unless the minor requests data not be shared with the parent:
To inspect your health information or request a copy of it, call Hennepin Health Member Services at 612-596-1036. You have a right to inspect and copy your health data for as long as we keep it; however, you do not have an automatic right to access psychotherapy notes, or information in a criminal, civil or administrative action or proceedings. Hennepin Health will act upon an access request immediately, but has up to 30 days of receiving your request to do so (with a possible 30-day extension). Hennepin Health may provide you with a summary of the health data you asked for if you agree in advance to the summary and fees Hennepin Health charges.
If your health data is in an electronic format (known as an electronic medical record or an electronic health record), you have the right to request that an electronic copy of your record be given to you, or transmitted to another individual or entity. Hennepin Health will make every effort to provide access to your protected health information in the form or format you request, if it is readily producible in such form or format. If the data is not readily producible in the form or format you request, your record will be provided in either a standard electronic format or readable hard-copy form.
Hennepin Health may deny your request for access to your health data in certain cases – for example, when access endangers your or others’ life or safety. If your request is denied, Hennepin Health will send you a written denial that explains why. Your review rights (if any) and instructions for how to file a complaint with Hennepin Health or the Minnesota Department Health and Human Services will be included with the denial. In certain cases when a request for access is denied, Hennepin Health will give you a chance to review it. The review decision must be made in a reasonable period of time. Hennepin Health will provide you with a written review decision.
Hennepin Health charges a fee to access your health data unless prohibited by state law. This fee is based on copying, mailing and summary preparation costs.
You have the right to receive a paper copy of this notice upon request, even if you agreed to receive the notice electronically.
You have the right to ask for a change to be made to your health data if you think it is wrong or inaccurate. Hennepin Health may deny your request to change your health data if the data:
To ask for a change to be made, you must mail a written request to Hennepin Health explaining why you are requesting an amendment to your health information. Hennepin Health will respond to your written request within 30 days of the request (with up to a 30-day extension). If Hennepin Health agrees to change your record, you will be informed the change was accepted. Hennepin Health also will ask you to identify any relevant persons who should be notified of the change. Hennepin Health will then make reasonable efforts to inform and provide the amendment to the persons both you and Hennepin Health has identified (such as Hennepin Health business partners).
If Hennepin Health does not agree to amend your record, you will receive a timely written notice that explains the reason for the denial. The denial includes your right to submit a written statement of disagreement or have the change request included with future disclosures. You also have the right to complain to Hennepin Health or the Secretary of the U.S. Health and Human Services. Hennepin Health may prepare a rebuttal statement to your statement of disagreement, which you would receive a copy of. Any future disclosures of your health data will include the statement of disagreement or request for amendment, denial notice and rebuttal or summary of this information.
You have the right to receive a list or accounting of the disclosures of your health data made to Hennepin Health during the six years prior to the request. Hennepin Health will act on your request for a list of disclosures within 60 days (with a possible 30-day extension). This list will not include the following disclosures:
Hennepin Health will give you one free list each year. For more requests, Hennepin Health will charge for copying and postage. The written list will include the following data for each disclosure:
Hennepin Health does not sell or rent your data to anyone. Hennepin Health does not disclose your data to any third party with which it does not have an agreement. If Hennepin Health were to do so, Hennepin Health would first request your written consent.
If you are no longer a member of Hennepin Health, your health data will still be handled according to this notice. Hennepin Health will not share your data without your consent unless legally required to do so. Future members will have the same privacy protections as former and current members.
If you believe your privacy rights have been violated, you may file a complaint with Hennepin Health or the Secretary of the U.S. Health and Human Services.
To file a complaint with Hennepin Health, call 1-800-657-3778 or write to:
Minneapolis Grain Exchange Building
400 South Fourth Street, Suite 201
Minneapolis, MN 55415
To file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights, call 1-877-696-6775 or write to:
U.S. Department of Health and Human Services
200 Independence Ave. SW
Washington, D.C. 20201
Hennepin Health will not intimidate, discriminate against or retaliate against you if you exercise any right or process described in this notice. This includes the filing of a complaint, or testifying, assisting or participating in an investigation, compliance review or hearing.
Hennepin Health is required by HIPAA and other federal law, and Minnesota state law to maintain the privacy of your health data and give you this notice of privacy practices, which describes Hennepin Health’s legal duties with respect to protected health information. Hennepin Health will let you know promptly if a breach occurs that may have compromised the privacy or security of your information. Hennepin Health will abide by the terms of this Notice of Privacy Practices.
Hennepin Health will notify members prior to making any significant changes to its privacy practices. Hennepin Health will send members a written notice, as well as post an update on the website.