CNHSA Notice of Privacy Practices

This notice describes how Tribal Health Information (THI) about you may be used and disclosed, what your patient rights are, and how you may gain access to this information if you desire. Please review it carefully.

Our Legal Duty: We are required by applicable law to maintain the privacy and security of your health information. We are also required to give you this notice about our privacy practices, our legal duties, your rights concerning your health information and notify you following a breach of unsecured THI. We must abide by the terms of this notice while it is in effect. This notice takes effect on March 1, 2022.

Changes to this Notice: We reserve the right to change our privacy practices and the terms of this notice at any time. We reserve the right to make the changes in our privacy practices and the new terms of our notice effective for all health information that we maintain, including health information we created or received before we made the changes. When we make a significant change in privacy practices, we will change this notice and make it available upon request and at the original initial posting sites.

You may request a paper copy of our notice at any time. For more information about our privacy practices or for additional copies of this notice, please contact us using the information listed at the end of this notice.

Uses and Disclosures of Health Information: We use and disclose health information about you for treatment, payment, and healthcare operations. For example:

Treatment: We may use or disclose your health information to a physician or other healthcare provider who is providing treatment to you.
Payment: We may use and disclose your health information to obtain payment for services we provide to you (i.e. insurance companies).
Healthcare Operations: We may use and disclose your health information in connection with our healthcare operations. Healthcare operations include daily activities, quality assessment and improvement activities, reviewing the competence or qualifications of healthcare professionals, evaluating practitioner and provider performance, conducting training programs, accreditation, and certification, licensing, or credentialing activities.

Your Authorization: In addition to our use of your health information for treatment, payment, or healthcare operations, you may give us written authorization to use your health information or to disclose it. If you give us an authorization, you may revoke it in writing at any time. Your revocation will not affect any use or disclosure permitted by your authorization while it was in effect. Unless you give a written authorization, we cannot use or disclose your health information for any reason except those described in this notice.

To Your Family and Friends: We must disclose your health information to you, as described in the Patient rights section of this Notice. We may disclose your health information to a family member, friend, or other person to the extent necessary to help with your healthcare or with payment for your healthcare, but only if you agree that we may do so.

Persons Involved in Care: We may use or disclose health information to notify or assist in the notification of (included identifying or locating) a family member, your personal representative, or another person responsible for your care, of your location, your general condition or death. If you are present, then prior to use or disclosure of your health information, we will provide you with an opportunity to object to such uses of disclosures. In the event of your incapacity or emergency circumstances, we will disclose health information based on a determination using our professional judgment disclosing only health information that is directly relevant to that person’s involvement in your healthcare. We will also use our professional judgment and our experience with common practice to make reasonable inferences of your best interest in allowing a person to pick up filled prescriptions, medical supplies, x-rays, or other similar forms of health information.

Individuals Involved in Your Care or Payment for Your Care: We may release medical information about you to a friend or family member who is involved in your medical care or who helps pay for your care. In addition, we may disclose medical information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition.

Research: We may disclose information to researchers when an institutional review board has reviewed the research proposal and established protocols to ensure the privacy of your health information.

Required by Law: We may use or disclose your health information when it is required by applicable law to do so, i.e. infectious disease reporting, gunshot reporting, child abuse, missing person, etc.

Abuse or Neglect: We may disclose your health information to appropriate authorities if we reasonably believe that you are a possible victim of abuse, neglect, or domestic violence or the possible victim of other crimes. We may disclose your health information to the extent necessary to avert a serious threat to your health or safety or the health or safety of others.

National Security: We may disclose to military authorities the health information of Armed Forces personnel under certain circumstances. We may disclose to lawfully authorized federal officials health information required by lawful intelligence, counterintelligence, and other national security activities authorized by applicable law, and to authorized federal officials where required to provide protection to the President of the United States, other authorized persons or foreign heads of state or conduct special investigations.

Future Communications: We may communicate to you via newsletters, mail outs or other means regarding treatment options, health related information, disease-management programs, wellness programs, or other community-based initiatives or activities our facility is participating in.

Organized Health Care Arrangement: This facility and its medical staff members have organized and are presenting you with a joint notice. Information will be shared as necessary to carry out treatment, payment, and health care operations. Physicians and caregivers within our health system may have access to protected health information to assist in reviewing past treatment as it may affect treatment at the time.

Affiliated Covered Entity: Protected health information will be made available to personnel at affiliated clinics as necessary to carry out treatment, payment and health care operations. Caregivers at other facilities may have access to health information at their locations to assist in reviewing past treatment information as it may affect treatment at this time. Please contact the CNHSA Privacy Officer for further information on the specific sites included in this affiliated covered entity.

Health Information Exchange: Your health information may be used and disclosed and received from other health care providers for treatment purposes thru the Indian Health Services (IHS) Health information Exchange (HIE). Your health information may be used and disclosed by IHS to perform functions allowed in the Multi-Purpose Agreement executed between IHS and CNHSA regarding Health Information Exchange.

State-Specific Requirements: Many states have requirements for reporting including population-based activities relating to improving health or reducing health care costs. Your health information will be shared with the state following applicable Tribal Law.

Tribal Health Contractors: We may disclose your tribal health information to Tribal Health Contractors independent of the CNHSA with whom we contract to provide services on our behalf.

Fundraising Activities: We may use medical information about you to contact you in an effort to raise money for the hospital and its operations. You may opt out of this communication at any time by contacting the CNHSA Privacy Official.

Hospital Directory: We routinely include certain limited information about you in the hospital directory while you are a patient at the hospital. This may include your name, your location in the hospital, your general condition (such as “fair” or “critical”) and your religious affiliation.

We are not required to obtain your consent to include you in the hospital directory. However, you may (if you choose) object, and instruct us not to disclose, or to limit disclosure of, your directory information, in the manner described under “Right to Request Restrictions” below.

Special Situations: We may also use and disclose medical information about you in the situations described under “SPECIAL SITUATIONS” below, without your consent or authorization. In addition to the permitted uses and disclosures described above, we are permitted and/or required to make certain disclosures of your medical information without your specific consent or authorization, as described below.

Organ and Tissue Donation: If you are an organ donor, we may release medical information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

Worker’s Compensation: We may release medical information about you for worker’s compensation or similar programs established by applicable law. These programs provide benefits for work-related injuries or illness.

Military and Veterans: If you are a member of the armed forces, we may release medical information about you as required by military command authorities or, some cases if needed to determine benefits, to the Department of Veterans Affairs. We may also release medical information about foreign military personnel to the appropriate foreign military authority.

Public Health Risks: We may disclose medical information about you for public health activities. These activities generally include the following:

  • to prevent or control disease, injury or disability;
  • to report births and deaths;
  • to report child abuse or neglect;
  • to report reactions to medications or problems with products;
  • to notify people of recalls of products that they may be using;
  • to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.
  • to notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence. We will only make this disclosure if you agree or when required by applicable law.

Health Oversight Activities: We may disclose medical information to a health oversight agency for activities authorized by applicable law. These oversight activities include, for example, audits, investigations, inspections, and licensure. We may disclose tribal health information with Choctaw Nation of Oklahoma Legal and Compliance Division as necessary for Health Services Privacy and Security Code compliance and enforcement purposes.

Lawsuits and Disputes: We may release medical information if asked to do so by a tribal law enforcement official:

  • In response to a court order, subpoena, warrant, summons or similar process;
  • To identify or locate a suspect, fugitive, material witness, or missing person;
  • About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement;
  • About a death we believe may be the result of criminal conduct;
  • About criminal conduct at the hospital; and
  • In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.

Coroners, Medical Examiners and Funeral Directors: We may release medical information to a coroner or medical examiner. We may also release medical information about patients of the hospital to funeral directors as necessary to carry out their duties.

Inmates: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release medical information about you to the correctional institution or law enforcement official where necessary for the institution to provide you with health care; to protect your health and safety or the health and safety of others; or for the safety and security of the correctional institution.

Your Health Information Rights: Although your health record is the physical property of the healthcare practitioner or facility that compiled it, you have the right to:

  • Right to Inspect and Copy: You have the right to inspect and copy medical information in a timely manner that may be used to make decisions about your care. Usually, this includes medical and billing records, but does not include psychotherapy notes. We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to medical information, you may request that the denial be reviewed. Another licensed health care professional chosen by the hospital will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.
  • Right to Amend: If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for CNHSA. We may deny your request for an amendment and if this occurs, you will be notified of the reason for the denial.
  • Right to An Accounting of Disclosures: You have the right to request an accounting of disclosures. This is a list of certain disclosures we make of your medical information about you.
  • Right to Request Restrictions: You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask we not use or disclose information about a surgery.
  • We are not required to agree to your request with the exception to request for restrictions on disclosures regarding payment or health care operations, not otherwise required by applicable law, to your health plan for services that have been paid in full by someone other than your health plan. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment.
  • Right to Request Confidential Communications: You have the right to request that we communicate with you about medical matters in a certain way or a certain location. We will agree to the request to the extent it is reasonable for us to do so. For example, you can ask we only contact you at work or by email.
  • Note: You may exercise the health information rights listed above by contacting the CNHSA Health Information Management Department and following the proper procedures defined by CNHSA.

Questions and Complaints: If you 1) are concerned that your privacy rights may have been violated, 2) disagree with a decision we made about access to your health information, 3) would like to speak with someone in response to a request you made to amend or restrict the use or disclosure of your health information, 4) would like to have us communicate with you by alternative means or at alternative locations or 5) have questions and desire further information about our privacy practices, please contact the CNHSA Privacy Officer.

You may file a complaint with the hospital by contacting 1-800-349-7026 and asking the operator for the CNHSA Privacy Officer. You may also file a complaint with the Choctaw Nation of Oklahoma Legal and Compliance Division. All complaints must be submitted in writing. You will not be penalized or retaliated against for filing a complaint and we encourage you to first attempt resolution of your problem with the CNHSA Privacy Officer or Administration. To file a complaint with the Choctaw Nation of Oklahoma Legal and Compliance Division, contact:

Choctaw Nation of Oklahoma
Legal and Compliance Division
CNO Privacy Officer
PO Box 1210
Durant, OK. 74702
[email protected]

Other uses and disclosures of medical information not covered by this notice or the laws that apply to us will be made only with your written authorization. If you provide us permission to use or disclose medical information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose medical information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided to you.

We support your right to the privacy of your health information.

Contact Telephone: 1-800-349-7026. Ask For CNHSA Privacy Officer

Privacy Notice Definitions

Tribal Health Information or THI. information that is a subset of health information, including demographic information collected from an individual, and: (1) is created or received by CNHSA and (2) relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (i) that identifies the individual; or (ii) with respect to which there is a reasonable basis to believe the information can be used to identify the individual.

Tribal Health Contractor. a third-party contractor who, on behalf of CNHSA, creates, receives, maintains, or transmits THI for business purposes. This may include: a Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to THI to CNHSA and that requires access on a routine basis to such THI, a person that offers a personal health record to one or more individuals on behalf of CNHSA, a subcontractor that creates, receives, maintains, or transmits THI on behalf of the Tribal Health Contractor. Tribal Health Contractor does not include a health care provider, with respect to disclosures by CNHSA to the health care provider concerning the treatment of the individual.

Family Member. With respect to an individual:

  1. A dependent (as defined by Tribal Law) of the individual; or
  2. Any other person who is a first-degree, second-degree, third-degree, or fourth-degree relative of the individual or of a dependent of the individual.

Health Oversight Agency. An agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or people or entities to whom it has granted authority, that is authorized by applicable law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance.

Unsecured Tribal Health Information or Unsecured THI. Tribal health information that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals.