Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW YOUR HEALTH INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Pledge Regarding Health Information

We are committed to protecting your health information. We are required by law to 1) make sure that your health information is protected; 2) give you this notice of our legal duties and privacy practices with respect to your medical information; and 3) to follow the terms of this notice.

We reserve the right to change this notice. Any revision will affect how your current health information is treated as well as any information we receive in the future. We will post a copy of the current notice in various locations throughout Concord Hospital Health System and in our medical offices.

Who Will Follow This Notice

Our healthcare team covered by this notice includes healthcare providers and the staff at Concord Hospital, Concord Hospital – Laconia, Concord Hospital – Franklin, Concord Hospital Medical Group and other providers who are involved in your care. This includes primary care providers, specialty care providers, consulting providers, and on-call providers. Also covered by this notice are all other non-clinical employees including managerial, administrative, billing, and support staff employed by Concord Hospital Health System.

How We Protect Your Information

We use a shared electronic medical record (EMR) to manage your care. Our EMR is shared with other healthcare partners and providers such as The Orthopedic Surgery Center, Concord Imaging Center and other local and regional care providers. Our EMR has built-in safeguards to protect information contained in it. Additionally, we have policies that limit who can access the EMR and train all staff and users about using the EMR and protecting your privacy.

How We May Use and Disclose Your Health Information

The following are a few examples of how we may use and disclose health information without your written permission.

Treatment

We may use your health information to provide you with medical treatment or services. We may share medical information about you with the providers, nurses, and other staff involved in your care. We may also disclose your health information to other healthcare providers and healthcare facilities that may be involved in your care. Examples include:

• prescriptions, test results, and discharge instructions
• appointment reminders
• follow-up calls after your visit to see how you are feeling and answer any questions you may have
• information about possible treatment options or alternatives
• Providers may use documentation tools that utilize secure advanced technology to generate a draft of treatment notes and summaries that will be reviewed and authenticated by your Provider.

Health Information Collaborations or Exchanges (HIE)

Concord Hospital Health System providers believe that having timely access to your medical information is important to providing quality medical care. We also recognize that you may receive healthcare from non-Concord Hospital Health System providers. As part of your care and treatment while at a Concord Hospital Health System facility, we may request or share medical information with those other providers, as permitted by law (excluding Substance Use Services and Behavioral Health Services information). Concord Hospital Health System participates in joint arrangements with other healthcare providers and entities whereby we may use or disclose your health information for: continuity of care, improving the accuracy of your health records, decreasing the time needed to access your information, evaluating and comparing your information for quality improvement purposes, and such other purposes as may be permitted by law. The sharing of information may be through a direct exchange or through a third party.

Examples may include:

• Accountable Care Organization (ACO): ACOs are groups of healthcare providers who work together to provide coordinated, high quality care to their Medicare patients to ensure that their patients receive the care needed without duplication of services.
• Clinical Data Registry: Registries collect information about individuals usually with a focus on a diagnosis (e.g. COPD, breast cancer, asthma) or a medical procedure they have undergone (e.g. valve replacement, transplant, joint replacement). The purpose of such registries is to improve the quality of care provided to those patients with these diagnoses or procedures.
• National Health Information Exchange: We may electronically transmit your health information (excluding Substance Use Services and Behavioral Health Services information) in a secure and confidential manner to other health care providers involved in your care through a national health information exchange, such as CommonWell. If you wish to opt out of this exchange, please send a request in writing including your full name (printed and signed) and date of birth to the Health Information Management Services Department, 250 Pleasant Street, Concord, NH 03301.

Billing and Payment

We may use and share your information so that we, and others who have provided services to you, can bill and collect payment for these services from your insurance company or a third party. The information sent with the bill may include information that identifies you, as well as your diagnosis, procedures and supplies used. Examples include:

• Requests for payment for the care you received
• Requests for approval before doing a procedure

Healthcare Operations

We may use medical information about you for administrative, educational, quality improvement and other business operations. We do this so that we can continue to improve the quality and effectiveness of the care we provide. When possible, we take out information that identifies who you are before sharing your information. Examples include:

• evaluating the performance of our staff in caring for you
• improving our care and the services we offer
• deciding if we should offer more services
• budgeting and planning
• auditing and evaluation

Required by Law

We disclose your health information when required to do so by federal, state, or local law. Additionally, we will share your information when we receive a court order or other legal document requiring that medical information be released.

Law Enforcement

We may respond to a court order, subpoena, warrant, or similar process. We may also disclose limited information in response to a law enforcement official’s request for identification and location purposes. In certain cases, we may disclose your health information to a law enforcement official when it is related to the investigation of a crime.

Public Health and Safety

We may share your medical information for public health or public safety reasons. Examples include:

• When it is necessary to prevent a serious health or safety threat to you, another person, or the public.
• In the event of a disaster, to organizations assisting in disaster-relief efforts so that your family can be notified about your condition and location.
• To report child abuse or neglect to authorized government authorities. Additionally, we may report other cases of neglect, abuse, or domestic violence to the extent allowed by law.
• For public health purposes.
• For specialized government functions such as protection of public officials including the President and foreign heads of state.
• Reporting births and deaths.
• Reporting reactions to medications or problems with products.
• Notification of recalls of products.

Military Authorities

If you are active duty or a veteran of the armed forces, we may share your medical information with the military as allowed, or required, by law.

Health Oversight Activities

We may disclose health information to a health oversight agency for activities required by law. These oversight activities include audits, investigations, inspections, and licensure.

Research

Under certain circumstances, we may use and disclose your medical information for research purposes. All research projects must be approved through a special approval process that balances the research needs with the patient’s need for privacy. Whenever possible, we will remove information such as your name, address, and other personal identifiers not needed for the research project.

Deceased Individuals

We may release health information to a coroner or medical examiner. This may be necessary to identify a deceased person or determine the cause of death. We may also release health information to funeral directors as necessary to carry out their duties.

Organ, Eye, and Tissue Donations

If you are an organ donor, we may release health information to organizations to facilitate organ, eye, or tissue donation, and transplantation.

Business Associates

We may release health information to businesses that use your health information to assist us in performing essential healthcare operations, payments, and other functions. Contracts with these businesses must include specific provisions governing the use and protection of your information as required by federal law.

Workers’ Compensation

We may disclose your health information that is reasonably related to a worker’s compensation illness or injury following written request by your employer, worker’s compensation insurer, or their representative.

Prison Inmates

If you are an inmate or under the custody of a law enforcement official, we may release your health information to the correctional institution or a law enforcement official. Instances when release could be necessary include (1) for the institution to provide you with healthcare; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

Proof of Immunizations

We may disclose proof of a child’s immunization to a school, regarding a child who is a student or prospective student of a school, as required by State or other law if authorized by a parent, guardian, or other person acting in loco parentis. Written authorization is not required.

Incidental Disclosures

While we take reasonable steps to safeguard the privacy of your health information, certain disclosures of your health information may occur during or as an unavoidable result of otherwise permissible uses or disclosures of your health information. For example, during the course of a treatment session, other patients in that treatment area may see, or overheard discussion of your health information.

Situations Where You Have the Right to Limit the Release of Your Medical Information

Hospital Directory

If you are hospitalized, we may include your name and location in the Hospital’s electronic patient directory. This information, along with your general medical condition (for example, good, fair, serious), may be released to people who ask for you by name. If you do not want your name and condition released in this way, you must tell the staff member who registers you as a patient or tell your caregiver once you are admitted to a patient care unit. If you opt out, we will not confirm that you are being treated at the Hospital and we will not release your name, location, or condition to anyone, even if they ask for you by name. Patients who are being treated on the Behavioral Health Patient Care Units are automatically excluded from the directory.

Clergy

We may release your name, religious affiliation, and location in the Hospital to clergy, if you have given consent upon admission or during your stay. The exception is patients who are on one of our Behavioral Health Patient Care Units. Any questions concerning clergy visits can be answered by calling the Spiritual Care Office at (603) 227-7000.

Family or Friends Involved in Your Care

We may share information about you with family members and friends who are involved in your care or paying for your care. Whenever possible, we will allow you to tell us who you would like to be involved in your care. However, in emergencies, or situations where you are unable to tell us who we can share information with, we will use our best judgment about who to share your information with.

Fundraising

We may use your name, address, telephone number, date(s) of service, age, date of birth, gender, the department from which you received service, and your treating physician, to contact you for a contribution for Concord Hospital Trust. We may share this information with Concord Hospital Trust, our Hospital’s fundraising entity to work on our behalf. Any funds raised are used to expand and improve the services and programs we provide to the community and support care for the uninsured. If you do not wish to receive fundraising requests, you may opt out by calling Concord Hospital Trust at (603) 227-7000, or e-mail chtrust@crhc.org. In the event that you opt out, you will not receive any fundraising communications from us in the future unless you notify us that you wish to begin receiving this information.

Behavioral Health Notes

Most uses and disclosures of Behavioral Health notes require your written permission.

Substance Use Treatment Records

Special privacy protections apply to drug and alcohol treatment records. Records of substance use treatment that you received from a Concord Hospital Health System substance use provider will be kept in our EMR. These records have restricted access based on the role of the employee and are not available in our patient portal or any Health Information Exchanges. Substance Use Treatment records shall only be shared upon your written consent, except as outlined here and in emergency situations such as situations where there is a serious threat to your health or safety or when required by law. Please ask your substance use treatment provider about these records and the limited ways they are shared.

Other Uses

Uses and disclosures of medical information for marketing purposes, and disclosures that constitute the sale of protected medical information require your written authorization. If you provide us authorization to use or disclose your health information, you may revoke that authorization, in writing, at any time. We are unable to take back any disclosures we have already made with your authorization, and that we are required to retain our records of the care that we provided to you.

Your Rights Regarding Your Health Information

The records we create and maintain using your medical information belong to Concord Hospital Health System. However, the information belongs to you. As a result, you have a number for rights that include:

Right to Get a Paper Copy of This Notice

You have the right to have a paper copy of this Notice.

Right to Review and Copy

You have the right to look at and get copies of your medical record, including billing records. To request a copy of your record, you must send your request in writing by completing an Authorization to Disclose PHI Form to Health Information Management Services, Release of Information. We may charge a fee to cover the copying, mailing, and other costs and supplies. If you are currently a patient in the Hospital and would like to look at a copy of your records you must complete a Request to Inspect PHI Form and give it to the Patient Relations Department. We may deny your request to inspect and copy records in certain, very limited circumstances. If you are denied access to health information, you may request that the denial be reviewed.

Right to Ask for an Amendment to Your Medical Information

If you think that information about you is not correct or is incomplete; you may ask us to correct your record. Your request must be made in writing and sent to the Health Information Management Services Department at 250 Pleasant Street, Concord, NH 03301. You must provide a reason that supports your request. We may deny your request for a change if it is not in writing or does not include a reason to support the request. We may deny your request if you ask us to change information that:

• Was not created by us, unless the person or entity that created the information is no longer available to make the change
• Is not part of the health information kept by us to be used in providing healthcare services to you
• Is not part of the information which you would be permitted by law to inspect and copy
• Is accurate and complete

Right to an Accounting of Disclosures

You have the right to ask for a list of when your medical information was shared without your written consent. This list will not include uses or sharing:

• For treatment, payment or other business operations
• With you or someone representing you
• With you or your representative or family/friends involved in your care
• With those who have requested your information through the patient directory
• When all personal identifiers were de-identified and then shared
• In those few situations where the law does not require or allow it

Your request must be made in writing and sent to the Health Information Management Services Department at 250 Pleasant Street, Concord, NH 03301. Your request must state the time period for which you want the list. However, the time period cannot be longer than 6 years from the date of your request.

Right to Ask for Restrictions on the Use and Sharing of Your Medical Information

You may request restrictions on certain uses and disclosures of your health information. You have the right to request a restriction on the health information we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend. We are not required to agree to your request in most cases. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment. If we do not agree, we will notify you of the denial in writing.

We will agree to restrict disclosure of medical information about an individual to a health plan if the reason for sharing the information would have been to obtain payment and the medical information pertains solely to a service for which you, or a person other than the health plan, have paid in full.

For patients receiving Substance Use Services, you have the right to restrict access to your information for purposes normally allowed under the HIPAA regulations, specifically, you have the right to request a restriction of you information for Treatment, Payment or Healthcare operations as defined herein. Concord Hospital will endeavor to accommodate these restrictions to the extent possible within our system’s constraints.

To request restrictions, you must submit your request in writing to Health Information Management Services Department at 250 Pleasant Street, Concord, NH 03301 or through your Patient Portal; “MyPatient Connect”. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply, for example, disclosures to your spouse.

We cannot restrict information from healthcare providers involved in your care.

Right to be Notified of a Breach

You have the right to know if your information has been breached (released in violation of the rules).

Confidential Communications

You have the right to request communications of your information by alternate means or alternate locations. For example, you can request that appointment reminders are sent to your cell phone and not your home phone.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with the Health System.

You also have the right to file a complaint at the regional Office of Civil Rights. All complaints must be submitted in writing. You will not be penalized for filing a complaint.

If you have any questions or would like more information about this, please contact Patient Relations Monday through Friday, 8 am to 4 pm at (603) 230-1902, via email at ptrelations@crhc.org or in writing, at Concord Hospital Health System Patient Relations, 250 Pleasant Street, Concord, NH 03301.

Revised 2/1/2026