Privacy Practices: Treatment, Payment & Business Operations

We may use your health information or share it with others in order to treat your condition, obtain payment for that treatment, and run our business operations.  In some cases, we may also disclose your health information for payment activities and certain business operations of another health care provider or payor.  We can do all of these things without obtaining your authorization.  Below are further examples of how your information may be used and disclosed for these purposes. 

Treatment

We may share your health information with doctors, nurses or other staff at any of our locations who are involved in taking care of you, and they may in turn use that information to diagnose or treat you.  An MSKCC doctor may share your health information with another MSKCC doctor, or with a non-MSKCC doctor, to determine how to diagnose or treat you.  Your MSKCC doctor may also share your health information with another doctor to whom you have been referred for further health care.  If you are a bone marrow/peripheral blood stem cell donor or recipient, your information may also become part of your recipient/donor’s medical record.

Payment

We may use your health information or share it with others to obtain payment for your health care services.  For example, we may share information about you with your health insurance company in order to obtain reimbursement after we have treated you, or to determine whether it will cover your treatment.  We might also need to inform your health insurance company about your health condition in order to obtain pre-approval for your treatment, such as admitting you to the hospital for a particular type of surgery.  We also may share your information with other health care providers and payors for their payment activities.

Business Operations

We may use your health information or share it with others in order to conduct our business operations.  For example, we may use your health information to evaluate the performance of our staff in caring for you, or to educate our staff on how to improve the care they provide to you.  We also may share your health information with other health care providers and payors for certain of their business operations if the information is related to a relationship the provider or payor currently has or previously had with you, and if the provider or payor is required by federal law to protect the privacy of your health information.

Appointment Reminders, Treatment Alternatives, Benefits and Services

In the course of providing treatment to you, we may use your health information to contact you with a reminder that you have an appointment for treatment or services at our facility.  We may also use your health information in order to recommend possible treatment alternatives or health-related benefits and services that may be of interest to you.

Fundraising

To support our business operations, we may use demographic and other information about you, including your name, where you live or work, your health insurance status, your age and gender, the dates that you received treatment, the name of your treating physician and department, and certain information about the outcome of your treatment, in order to contact you to raise money to help us operate.  We may also share this information with an MSKCC-related charitable foundation or with our business associates (described further below) who may contact you to raise money on our behalf.  You have the right to opt-out of receiving these fundraising communications at any time.  You may exercise your opt-out right by contacting the Privacy Office at 646-227-2056 or by e-mail at privacy@mskcc.org.

Business Associates

We may disclose your health information to contractors, agents and other business associates who need the information in order to assist us with obtaining payment or carrying out our business operations.  For example, we may share your health information with a billing company that helps us to obtain payment from your insurance company.  Another example is that we may share your health information with an accounting firm or law firm that provides professional advice to us about how to improve our health care services and comply with the law.  If we do disclose your health information to a business associate, we will have a written contract to ensure that our business associate also protects the privacy of your health information.

Partially De-identified Information – Limited Data Set

We are also permitted to use and disclose “partially de-identified” health information about you (known as a “Limited Data Set”) if the person who will receive the information signs an agreement to protect the privacy of the information as required by federal and state law.  Partially de-identified health information will not contain any information that would directly identify you (such as your name, street address, social security number, phone number, fax number, electronic mail address, website address, or license number).

Research

All research projects conducted by MSKCC are approved through a special review process to protect patient safety, welfare and confidentiality.  In most cases, we will ask for your written authorization before using your health information or sharing it with others in order to conduct research.  However, under some circumstances, we are permitted to use your medical information for research without your authorization, if we get approval from a special review board.  These studies will not affect your treatment or welfare, and your medical information will continue to be protected.  For example, the research project may involve comparing the health and recovery of patients with the same type of disease who received one medication to those who received another.  In those instances, there will be no disclosure of your protected health information to outside parties, unless required by law, subject to a Limited Data Set (described above), or if we have obtained your permission.  In addition, because a major part of our mission is research, we may use your protected health information for creating databanks, outcome reviews and screening for eligibility for participation in clinical trials.  In these instances, there will be no disclosure of your identified protected health information to outside parties except as a Limited Data Set (described above) or if required by law.