Page title

Effective Date: 09-23-13




This is a Notice of Privacy Practices provided jointly by the Frederick Memorial Hospital, Inc. Employee Health Care Plan, the Frederick Memorial Hospital, Inc. Dental Plan, the Frederick Memorial Hospital, Inc. Health Flexible Spending Account and the Frederick Memorial Hospital, Inc. Employee Assistance Program acting as an organized health care arrangement under the provisions of the federal law known as the Health Insurance Portability and Accountability Act of 1996 (HIPAA).*

HIPAA imposes numerous requirements on group health plans sponsored by employers concerning the use and disclosure of protected health information (PHI). PHI is health information that can be clearly linked to a specific individual. It includes, for example, information about the health care received by an individual and the amounts paid for such care. This Notice will tell you about the ways in which we may use and disclose your PHI, certain obligations we have regarding its use and disclosure, and your rights.

It is important to recognize that health information held by and contained in the employment records of Frederick Memorial Hospital (FMH) is not covered by this Notice and is not subject to HIPAA, but may be subject to other laws. In addition, your health care providers, including FMH in its capacity as a hospital, may have different policies or notices regarding their use and disclosure of your PHI.

Please note that if you participate in any fully insured health plan offered by Frederick Memorial Hospital (including the vision plan), you should have received a separate notice of privacy practices directly from the applicable issuers of that insurance. This Notice only pertains to our uses and disclosures of your PHI under the Plans.

We encourage you to share this Notice with your spouse, your dependents, and any others participating in the Plans through your employment with FMH.

* These Plans are collectively referred to as the “Plans” in this Notice, unless otherwise specified. When this Notice refers to “we” or “us,” it is referring to the “Plans” sponsored by Frederick Memorial Hospital and not Frederick Memorial Hospital in its role as an employer or as a health care provider.

We are required by law to:

  1. Maintain the privacy of your PHI;
  2. Provide you with certain rights with respect to your PHI;
  3. Make this Notice of our legal duties and privacy practices with respect to your PHI available to you;
  4. Follow the terms of the Notice that is currently in effect; and
  5. Follow any more stringent state privacy laws that relate to the use and disclosure of PHI.


We may use and disclose your PHI in any of the ways described below. For each category of uses or disclosures we will explain what we mean and try to provide some examples, but not every use or disclosure in a category will be listed.

For Treatment. We may use your PHI for treatment purposes, such as to conduct case management or coordination. For example, we may disclose your PHI to doctors, nurses, pharmacies, or other medical personnel who are involved in treating you, and they may request your PHI from us to supplement their own treatment records.

For Payment. We will use and disclose your PHI for payment purposes, such as:

  • To review the treatment and services you receive to determine whether and to what extent they are eligible for payment under the terms of the Plans.
  • To inform health care providers and suppliers about your eligibility and that of any other person covered under the Plans by reason of your employment at FMH.
  • To reimburse you or to make payment to health care providers and suppliers for covered services they provided to you.
  • To coordinate benefits when some other plan may be liable for some or all of the costs of your care.
  • For purposes of risk adjustment, collection, or reinsurance (including stop-loss and excess of loss insurance).
  • To review health care service with respect to medical necessity and appropriateness.
  • Or to communicate with you, your health care providers, and others about the status of claims for your care, as well as to track and receive contributions and premiums under the Plans.

For example, we may need to review information about treatment you received from a doctor to determine whether, or how much, to pay the doctor or reimburse you. We may also review information from a doctor about a treatment you have received or are going to receive to decide if the Plans will cover or reimburse the costs of the treatment.

For Health Care Operations. We will use and disclose your PHI for our operations. For example, we may use your PHI for activities such as:

  • To evaluate the utilization and effectiveness of benefits under the Plans.
  • To make underwriting or similar decisions (although we are prohibited from using or disclosing your genetic information for underwriting purposes).
  • To obtain reinsurance (including stop-loss and excess of loss insurance).
  • In the business management and general administration of the Plans.
  • Or for customer service, internal grievance resolution, or appeals of denials of payment or coverage under the Plans.

To the Plans Sponsor. We may disclose your PHI to FMH for plan administration purposes. FMH needs your PHI to administer benefits under the Plans. We may also disclose some of your PHI to FMH to enable it, as the plan sponsor, to enroll and disenroll participants in the Plans and to make decisions about the structures of the Plans. FMH agrees not to use or disclose your PHI other than as permitted or required by the documents governing the Plans and by law. FMH cannot and will not use PHI obtained from the Plans for any employment-related actions.

To, From, and Between Business Associates. We contract with business associates to provide some services, such as the review of certain elements of your care and to administer claims. In performing the jobs we have asked them to do, we may disclose your PHI to our business associates, we may receive your PHI from our business associates, and our business associates may share your PHI between themselves. To protect your PHI, however, we require business associates to sign contracts agreeing to appropriately safeguard your information.

Within the Organized Health Care Arrangement. The Plans may share your PHI with each other as necessary to carry out treatment, payment and health care operations.

To Family and Friends. We may disclose your PHI to a family member or friend, provided the information is directly relevant to that person’s involvement with your health care and payment for that care. You have a right to request us to limit such disclosures.

For Treatment Alternatives, Other Health-Related Benefits and Services, and Treatment Reminders. We may use and disclose your PHI to tell you about or recommend possible treatment alternatives, other health-related benefits or services, or about other Plans or certain value added services, that may be offered by us from time to time. We may also send treatment reminders.

As Required By Law. We will disclose your individual PHI when federal, state, or local law requires us to do so.

In Special Situations. We may also release your PHI as allowed under HIPAA, including under the following circumstances:

  • To facilitate organ and tissue donation and transplant.
  • For specialized governmental functions, including relating to the military and veterans, national security, correctional institutions and public benefit purposes.
  • For workers’ compensation or similar programs, as permitted by law.
  • For public health activities.
  • To prevent and avoid a serious threat to the health or safety of the public or another person.
  • To notify the appropriate government authority, if we believe a patient has been the victim of abuse, neglect, or domestic violence.
  • For health oversight activities including, for example, audits, investigations, actions, inspections, and licensure.
  • For lawsuits and disputes, in response to a valid court or administrative order, subpoena, or other lawful process, or in the course of defending ourselves.
  • For certain law enforcement purposes, including when asked to do so by a law enforcement official or when required.
  • To coroners, medical examiners, and funeral directors as necessary to assist them in their duties.
  • To correctional institutions or law enforcement officials with respect to inmates.
  • Under certain circumstances, for research.
  • Or in response to investigations by Department of Health and Human Services.

By Written Authorization. Except as described above or as permitted by law, we will disclose your PHI only with your prior written permission (called an “authorization” under HIPAA). Most uses of psychotherapy notes, certain uses and disclosures of your health information for marketing purposes, and any sale of your written medical information require your authorization. You may revoke an authorization, in writing, at any time, unless we have taken action relying on the authorization or if you signed the authorization as a condition of obtaining insurance coverage.


You have the following rights regarding the PHI we maintain about you.

Right to Inspect and Copy. With certain exceptions, you have the right to inspect and copy your PHI maintained in the Plans’ “designated record set.” The Plans’ designated record set consists of enrollment, payment, claims processing, and case management records, as well as other records used by us to make health care decisions about individuals. The designated record set does not include psychotherapy notes and information compiled in anticipation of a criminal, civil, or administrative action or proceeding.

We will generally act on your written request within 30 days of receipt. Where appropriate, we may provide you with a summary of your PHI rather than access to, and copies of, it. If the Plans and their business associates do not maintain the PHI, but know where it is maintained, you will be informed where to direct your requests.

You may request an electronic copy of your health information that is maintained by us in electronic designated record sets, and we will provide access in the electronic form and format requested if it is readily reproducible in the requested format. If not, we will discuss the issue with you and provide a copy in a readable electronic form and format upon which we mutually agree, depending on the information and our capabilities at the time of the request.

If you request a copy of the information, we may charge a fee for the cost of labor for copying the information (whether in paper or electronic form), mailing the copy when requested, supplies for creating the paper copy (or electronic media if the request is to provide the information on portable electronic media), and preparing an explanation or summary of the information, if you agree.

You may also request that we send your health information directly to a person you designate if your written request is in writing, signed, and clearly identifies both the person designated and an address to send the requested information.

We may deny your request to inspect and copy your PHI. In certain limited circumstances, our denial will be unreviewable. Ordinarily, however, you may request within a reasonable period of time that the denial be reviewed. Except for unusual circumstances, 90 days will be deemed a reasonable period of time in which to request a review. We will have a person other than the person who initially denied your request review that denial. We will comply with the outcome of the review.

Right to Request Amendment. If you feel that the PHI we have about you in the Plans’ designated record set is incorrect or incomplete, you may ask us in writing to amend the information. You must provide a reason that supports your request.

We will generally act on your request within 60 days. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

  • Was not created by us, unless the person or entity that created the information is no longer available to make the amendment.
  • Is not part of the Plans’ designated record set.
  • Is not part of the information which you would be permitted to inspect and copy.
  • Or is accurate and complete.

If we deny your request, we will keep your request on file. We will distribute it (or a summary) with all future disclosures of the information to which it relates, but only if you ask us to do so. Further, you may submit a written statement disagreeing with the denial and we will keep it on file and distribute it (or a summary) with all future disclosures of the information to which it relates.

Right to an Accounting of Disclosures. You may request in writing an “accounting of disclosures.” This is a list of our disclosures of your PHI, with certain exceptions. These exceptions include:

  • To you or to persons involved in your health care or payment for that care.
  • Pursuant to your written authorization.
  • For the purpose of carrying out treatment, payment or health care operations.
  • That are incidental to another permissible use or disclosure.
  • For disaster relief, national security or intelligence purposes.
  • To correctional institutions or law enforcement officers who have you in custody at the time of the disclosure.
  • Or as part of a limited data set.

The accounting will include the date of each disclosure, the name of the entity or person to whom the disclosure was made and that person’s address (if known), and a brief description of the information disclosed together with the purpose of the disclosure.

Your request for an accounting must state a time period that may not be longer than six years. We will generally act on your request within 60 days. The first list you request within a 12-month period will be free. For additional lists, we may charge you for the costs of providing the accounting. We will notify you of the cost involved, and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to Request Restrictions. You have the right to request a restriction or limitation on the PHI we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a limit on the PHI we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend.

Except as expressly stated below, we are not required to agree to your request. If we do agree, a restriction may later be terminated by your written request, by agreement between you and us (including an oral agreement), or unilaterally by the Plans for PHI created or received after you are notified that the restriction had been removed. We may also disclose PHI about you if you need emergency treatment, even if we have agreed to a restriction.

We are required to agree to your request to restrict certain disclosures of your health information to another health plan, but only if you pay (or someone other than the health plan pays on your behalf) out of pocket in full for the health care item or service about which the restriction is requested.

To request restrictions, you must tell us:

  • What information you want to limit.
  • Whether you want to limit our use, disclosure, or both.
  • And to whom you want the limits to apply.

Right to Confidential Communications. You have the right to file a written request to receive communications from us on a confidential basis by using an alternative means for receipt of information or by receiving the information at an alternative location, but only if you believe and state that the disclosure of all or part of your information could endanger you. All reasonable requests will be granted.

Right to a Paper Copy of this Notice. You also have the right to a paper copy of this Notice, even if you have agreed to receive it electronically.

Right to Notification of a Breach Concerning Your Health Information. You have the right to receive notice, and we will send notice to our last known address for you, of breaches of your health information.

How to Exercise the Above Rights. To exercise the rights described above, you must submit your request in writing to:

Cathleen Casagrande, Privacy Officer
Frederick Memorial Hospital
400 West Seventh Street
Frederick, Maryland 21701

Please note, however, that the Employee Assistance Program is an independent and confidential professional counseling service provided by a contract provider. FMH does not receive any information or reports identifying participating individuals. FMH only receives aggregate statistical information. If you have any questions concerning the privacy of your health information in the hands of Employee Assistance Program, please contact them directly.

Right to File Complaints. You may also file a complaint with us or with the Secretary of the Department of Health and Human Services if you believe your privacy rights have been violated. You may submit your complaint to us by either writing or calling the HIPAA Privacy Officer at:

Cathleen Casagrande, Privacy Officer
Frederick Memorial Hospital
400 West Seventh Street
Frederick, Maryland 21701

If you are not satisfied with the manner in which this office handles a complaint, you may submit a formal complaint to: Office for Civil Rights, U.S. Department of Health and Human Services, 150 S. Independence Mall West, Suite 372, Public Ledger Building, Philadelphia, PA 19106. Or, contact their website at You will not be retaliated against for exercising any right or process described in this Notice, including the filing of a complaint or testifying, assisting, or participating in an investigation, compliance review, or hearing.


We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current notice in the hospital and on the hospital’s intranet website. For a material change, we will also provide the revised notice, or information about the change and how to obtain the revised notice, in our next annual mailing. This notice contains on the first page, in the top right-hand corner, its effective date.


If you have any questions regarding this Notice, please feel free to write or call the HIPAA Privacy Officer at the address listed on this page or by calling 240-566-3877.