Search by Specialty
Search by Last Name



Privacy Notice







Heather McAllister, RHIA, CHC
Privacy Office
401 N. Hooper Street, P.O. Box 435
Caro, MI  48723
(989) 672-5799





This Notice of Privacy Practices describes how we may use and disclose your “Protected Health Information” (or “PHI”) to carry out treatment, payment, or health care operations and for other purposes that are permitted or required by law.  PHI is information about you that may identify you and that relates to your past, present, or future physical or mental health or conditions and related health care services.  This Notice also describes your rights in regard to your PHI, including your rights to access and control such information.

This Notice describes our practices and those of:

  • All employees, medical staff, and other personnel of McLaren Caro Region;
  • All departments and units of McLaren Caro Region;
  • Any health care professional authorized to enter information into your hospital chart, including staff physicians who are not our employees;
  • Any member of a volunteer group we allow to help you while you are in the hospital;
  • All fellows, residents, medical students, and other trainees of, or affiliated with, McLaren Caro Region;
  • All affiliates of McLaren Caro Region


  • Make sure that your medical information is protected;
  • Information about you; and
  • Follow the terms of the Notice that is currently in effect.


Following is a description of different types of uses and disclosures of your PHI.  Not every possible use or disclosure will be listed.


We may use and disclose your PHI to provide medical treatment or services.  In the course of providing medical treatment or services, we may use or disclose your PHI to doctors, nurses, technicians, students, or other individuals involved in your care. For example, in preparation for surgery, your doctor may need to tell the anesthetist you are allergic to a particular type of drug.  Your medical information may be shared to coordinate services, such as prescriptions, lab work, x-rays, and dietary needs.  If you require continuing treatment after leaving our facility, your PHI may be provided to home health care personnel or a physician to ensure that these individuals have the necessary information to diagnose or treat you.


We may use and disclose your PHI for billing or collection from you, an insurance company or other third party for treatment and services that we provide to you.  For example, we may provide your insurance carrier with information related to a procedure in order to receive payment for that procedure.  In some instances, your PHI will be disclosed in order to receive pre-approval for a particular course of action. For example, we may need to disclose your PHI to a Health Maintenance Organization (HMO) or other entity in order to receive approval for a hospital stay.

Health Care Operations

We may use and disclose your PHI for health care operations in order to support the business activities of our facility and ensure that our patients receive quality care.  These activities may include, but are not limited to, quality assessment, employee review, service evaluation, training, licensing, marketing, fundraising, and conducting or arranging for other business activities.  For example, we may compare your file with other patient files to evaluate the quality and similarity of treatment. We may also share your PHI with third party “business associates” that perform various activities for us.

Fundraising Activities

We may use or disclose PHI about you to contact you in an effort to raise money for McLaren Caro Region or an institutional foundation related to the facility.  We would only release contact information, such as your name, address, phone number, and the dates you received treatment or services at the Hospital.  If you do not want McLaren Caro Region to contact you for fundraising efforts, you may opt-out by notifying the Hospital Privacy Officer at (989) 673-3141.

Other Uses and Disclosures

As part of treatment, payment, and healthcare operations, we may use and disclose to you PHI for the following purposes:

  • To remind you of an appointment.
  • To inform you of possible treatment options or alternatives.
  • To inform you about health‑related benefits or services that may be of interest to you.

Facility Directory

We may use and disclose certain limited PHI as part of our facility directory. This information includes your name, location in the facility, your general condition, and your religious affiliation. The directory information, except for your religious affiliation, may be released to people who ask for you by name.  You may restrict or prohibit the use or disclosure of this information by contacting our Privacy Officer at (989) 673-3141.

Individuals Involved in Your Care or Payment for Your Care

We may release PHI under the following circumstances:

  • To a friend or family member who is involved in your medical care.
  • To someone who helps pay for your care.
  • To inform your family or friends that you are in our facility and your condition.
  • To an entity assisting in disaster relief efforts so that your family is notified of your condition, status and location.

On admission to the hospital, you may be provided with a four (4) digit PIN number.  You must provide this PIN number to family members, relatives, close personal friends, or any other person that you choose, in order for them to receive information related to your care.  If a request is made without the correct PIN number, the hospital will not provide any information related to your care to the requesting party, other than your general condition.


Required By Law

We will disclose your PHI when required to do so by federal, state, or local law.

Immunizations and Schools

The Hospital may disclose proof of immunization to a school after obtaining a written or verbal authorization of the patient (or his/her parent/legal guardian). This authorization must be documented in the medical record.

Deceased Patients

Your PHI is protected by HIPAA for 50 years after your death.  The final Omnibus Rule allows the Hospital to continue to provide, after your death, PHI about you to those family and friends you have designated.

 Public Health Activities

PHI may be used or disclosed to a public health authority that is authorized by law to collect or receive such information to prevent or control disease, injury or disability, or to report births and deaths.  PHI may be used or disclosed to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition when required or authorized by law.

Abuse, Neglect, and Domestic Violence

We may disclose your PHI to a public health or other appropriate government authority authorized by law to receive reports of child abuse or neglect.  Further, we may disclose PHI about an individual whom we believe to be a victim of abuse, neglect, or domestic violence if you agree or when required or authorized by law.

Food and Drug Administration

We may disclose your PHI when required by the Food and Drug Administration to report adverse events, product defects or problems, or biologic product deviations. Additionally, your health information may be used to track products, enable product recalls, make repairs or replacements, or to conduct post marketing surveillance.

Health Oversight Activities

We may disclose your PHI to a health oversight agency for activities authorized by law and as necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.  These oversight activities may include audits, investigations, inspections, and licensure evaluation.

Lawsuits and Disputes

If you are involved in a lawsuit or a dispute, we may disclose your PHI in response to a court or administrative order such as in response to a subpoena, discovery request, or other lawful process by someone else involved in a lawsuit or dispute.

Law Enforcement

We may release your PHI if asked to do so by a law enforcement official in situations including, but not limited to the following:

  • As required by law for reporting of certain types of wounds or other physical injuries;
  • In response to a court order, subpoena, warrant, summons, or similar process;
  • To identify or locate a suspect, fugitive, material witness, or missing person;
  • To provide information about the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement;
  • To provide information about a death we believe may be the result of criminal conduct;
  • To provide information about criminal conduct at our facility; and
  • Under emergency circumstances to report a crime; the location of the crime or victims; or the identity, description, or location of the person who committed the crime.

Coroners, Medical Examiners, and Funeral Directors

We may release PHI to a coroner or medical examiner for the purpose of identification, determination of a cause of death, or for other legal duties.  We may also release your health information to funeral directors as necessary to carry out their duties.

Organ and Tissue Donation

We may release your PHI to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organ, eye, or tissue for the purpose of facilitating organ, eye, or tissue donation and transplantation.

To Avert a Serious Threat to Health or Safety

We may use and disclose your PHI when necessary to prevent or lessen a serious threat to the health and safety of a person or the public. Any disclosure would only be to someone able to prevent or lessen the threat.

Specialized Government Functions

We may disclose the PHI of Armed Forces personnel, veterans, and foreign military personnel for authorized activities. Further, your health information may be disclosed to authorized federal officials for the conduct of lawful intelligence, counter-intelligence, and other national security activities and special investigations, including the provision of protective services to the President, other authorized persons, or foreign heads of state, as authorized by law.

Workers’ Compensation

We may release PHI about you in connection with workers’ compensation or similar programs.  These programs provide benefits for work-related injuries or illness.


We may release your health information to a correctional institution or law enforcement official if you are an inmate of a correctional institution or under the custody of a law enforcement official if necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.


We may disclose your PHI to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your health information.


Following is an outline of patient rights.  If you have a specific request or question, please contact Heather McAllister, RHIA, CHC, Privacy Officer, 401 N. Hooper Street, P.O. Box 435, Caro, Michigan 48723, (989) 672-5799.

Right to Inspect and Copy

With certain limited exceptions, you have the right to inspect or request either in paper or electronic form, a copy of the designated record sets containing your PHI for as long as we maintain the record. A “designated record set” includes medical, billing, and other records, with the exception of psychotherapy notes, used for making decisions about individuals.  Should your request fall under an exception, you will receive a response explaining the reason for our inability to allow you to inspect and copy the information you requested.  In order to inspect or copy a designated record set, you must submit a written request to our Privacy Officer. If you request a copy of the information, we may charge a fee associated with the costs of your request.  Your request to inspect and copy your PHI may be denied under limited circumstances. If your request is denied, you may request that the denial be reviewed. We will comply with the outcome of the review.

Right to Amend

You may ask us to amend your PHI in a designated record set if you feel that the information is incomplete or inaccurate. You have the right to request an amendment for as long as the information is kept by or for our facility.  To request an amendment, you must submit a written request to our Privacy Officer. You must provide a reason that supports your request.  We may deny your request for an amendment if it is not in writing or does not include a reason to support the request.  If you are denied the ability to amend your health information, you may request a review of the denial.  Possible reasons for denying your request to amend include, but are not limited to:

  • The information was not created by us, unless you provide a reasonable basis to believe that the person or entity that created the information is no longer available to make the amendment;
  • The information is not part of the designated record set maintained by our facility;
  • The information is not part of the designated record set which you would be permitted to inspect; or
  • The request pertains to information that is accurate and complete.

Right to an Accounting of Disclosures

You have the right to request an “accounting of disclosures” listing the disclosures we made of your PHI.  To request an accounting of disclosures, you must submit a written request to our Privacy Officer or Health Information Management Department. Your request must state a time period which may not be longer than six years and may not include dates before April 14, 2003.  Your request should indicate in what form you want the list (ex. Paper or electronic).  The first accounting will be provided without charge.  We may charge you for the costs of providing subsequent accountings within a 12 month period. We will notify you of the costs involved and you may choose to withdraw or modify your request before action is taken.

Right to Request Restrictions

You have the right to request a restriction or limitation on certain parts of the PHI we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the health information we disclose about you for notification purposes or to individuals involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not disclose information about a condition you have to your spouse or children.  We are not required to agree to your request.  Under certain circumstances, we may terminate our agreement to a restriction.  You may also terminate a restriction at a later date.  Make your written request for restrictions to our Privacy Officer.  In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply.  You may contact our Privacy Officer to terminate a restriction.

Right to Request Confidential Communications

You have the right to request that we communicate with you about medical matters in a certain manner or location.  We will accommodate all reasonable requests.  For example, you can ask that we only contact you at home or not to send certain items in the mail.  To request confidential communications, you must make your request in writing to our Privacy Officer. You do not need to include a reason for your request; however, your request must be specific as to your requested accommodations.

Right to Request Restrictions as a Self-Pay Patient

You have the right to restrict certain disclosures of protected health information to a health plan if you pay for a service in full and out of pocket.  If you choose to restrict any information under this circumstance, you must submit your request in writing to the Privacy Officer prior to the service being billed.

Right to an Electronic or Paper Copy of This Notice

You have the right to an electronic or paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. If you have elected to receive this Notice electronically, you must either sign a document we provided agreeing to the receipt of the electronic copy, or send us your own written statement agreeing to the receipt of the electronic copy of the notice.  If you have agreed to receive this notice electronically, you are still entitled to a paper copy of this Notice at your request.  You may obtain a copy of this notice at our web site: www.cch-mi.org or you may obtain a copy of this Notice, electronically or on paper by contacting our Privacy Officer at (989) 673-3141.


Other uses and disclosures of your PHI not covered by this Notice or the laws that apply to us will be made only with your written permission.  If you provide us with permission to use or disclose your PHI, you may revoke that permission in writing at any time.  If you revoke your permission, we will no longer use or disclose health information about you for the reasons covered by your written authorization.  Please understand that we are unable to take back any disclosures we have already made with your permission and that we are required to retain our records of the care that we provided to you.


We may change the terms of this Notice at any time.  Any revised Notice will be effective for all PHI that we maintain at the time the new version is adopted. The effective date of a revised Notice will be noted on its first page.  A copy of the current Notice in effect will be posted.  Each time you receive treatment or health care services you may request a copy of the current Notice.  In addition, you may always request a copy of the current Notice.


If you believe your privacy rights have been violated or that our facility has otherwise not complied with the terms of this Notice, you may file a complaint by contacting our HIPAA Privacy Officer at (989) 673-3141.  All complaints must be submitted in writing. You will not be penalized for filing a complaint.  If you feel uncomfortable filing a complaint with us, you may contact the Secretary of the United States Department of Health and Human Services @ (312) 886-2359 or write to:

U.S. Department of Health and Human Services
233 N. Michigan Ave., Suite 240
Chicago, IL 60601


McLaren Caro Region must notify you following the discovery of a breach of unsecured PHI.  The Hospital will provide this notice in written form by first-class mail, or alternatively, by email if you have agreed to receive such notices electronically.  If the Hospital has insufficient or out-of-date contact information for ten or more individuals involved in the breach, the Hospital must provide substitute notice by either posting the notice on the home page of our web site or by providing the notice in major print or broadcast media where you likely reside.  If the Hospital has insufficient or out-of-date contact information for fewer than ten individuals, the Hospital may provide substitute notice by an alternative form of written, telephone, or other means.  The Hospital will provide these notifications without unreasonable delay and in no case later that 60 days following the discovery of a breach and must include, to the extent possible, a description of the breach, a description of the types of information that were involved in the breach, the steps you should take to protect yourself from potential harm, a brief description of what the Hospital is doing to investigate, mitigate harm and prevent further breaches, as well as contact information for the Hospital.  Additionally, for substitute notice proved via web posting or major print or broadcast media, the notification will include a toll-free number for you to contact the Hospital to determine if your protected PHI was involved in the breach.


Our Notice of Privacy Practices provides information about how we may use and disclose ”Protected Health Information” (or PHI)  to carry out treatment, payment, or health care operations and for other purposes that are permitted or required by law.  As provided in our notice, the terms of our notice may change. If we change our notice, you may obtain a revised copy in an electronic or paper format by contacting Health Information Management Services at (989) 673-3141.

You have the right to request that we restrict how protected health information about you is used or disclosed for treatment, payment, or healthcare operations.  We are not required to agree to the restriction, but if we do, we are bound by our agreement.