Pullman Regional Hospital Notice of Privacy Practices (NPP)
Effective February 16, 2026
THIS NOTICE DESCRIBES HOW YOUR HEALTH INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
WE HAVE UPDATED OUR PRIVACY PRACTICES TO REFLECT NEW PROTECTIONS. THIS INCLUDES EXPANDED PATIENT RIGHTS, ENHANCED SECURITY MEASURES, NEW INFORMATION ON, AND LANGUAGE THAT ALIGNS 42 CFR PART 2 MORE CLOSELY WITH HIPAA AND THE HITECH ACT.
PLEASE REVIEW CAREFULLY.
The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) is a law requiring Pullman Regional Hospital (PRH) to make sure your personal medical and other treatment information is kept private. PRH is also required to give you this notice, so that if PRH has any of your personal health information, you will know how PRH may use it, or whether and how PRH may give your protected health information (“PHI”) to others.
The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, addresses the privacy and security concerns associated with the electronic transmission of health information, through several provisions that strengthen the civil and criminal enforcement of the HIPAA rules.
PRH programs and services are already keeping your personal medical information private. HIPAA establishes the minimum standards for these protections.
The NPP explains how we may legally use and disclose your PHI, who can access it, where to file a complaint if you think your PHI was mishandled, when a signed authorization is needed for certain disclosures, and other privacy rights you have. We are required to follow all the terms of this notice. We reserve the right to change the provisions of this notice and make it effective for all PHI we maintain.
How We May Use and Disclose Your PHI:
PRH prioritizes the confidentiality of our clients' PHI. Our physicians, clinicians, and employees are mandated to uphold this confidentiality. We have established policies, procedures, and safeguards to protect your PHI from unauthorized use and disclosure. Below is a brief description of the uses and disclosures of your PHI, along with some examples. Please note that not every use or disclosure in a category is listed. The ways we use and disclose substance and alcohol abuse information will be separately described later in this notice.
- Treatment. We may use and disclose your PHI to provide treatment, case management, and care coordination or to direct or recommend health care and any related services such as government services or housing. We may also share your health information with community resources and providers in the county who may be involved in your case or treating you.
- Payment. We may use or disclose your PHI to permit us to bill and collect payment for the treatment and health-related services. For example, we may include information with a bill to Medicare that identifies you, your diagnosis, and services provided to receive payment.
- Health Care Operations. We may use and disclose your PHI to review and evaluate our treatment, or to improve the care and services we offer. In addition, we may disclose your health information to other staff or business associates who perform billing, consulting, behavioral health and health services, auditing, licensing, accreditation, or investigatory services.
- Required by Law. We may use and disclose your PHI when required by federal, state, or local law. For example, the Secretary of the U.S. Department of Health and Human Services (DHHS) may review our compliance efforts, which may include accessing your PHI.
- Business Associates. We sometimes use outside companies, known as “business associates
- Health Oversight Activities. We may disclose your PHI to federal or state agencies that may conduct audits, investigations, oversight activities, and inspect government health benefit programs.
- Public Health Activities. We may use and share your PHI with public health authorities or government agencies to report specific diseases, injuries, conditions, illnesses, and events as mandated by law. For instance, we might share your medical information with a local government agency to aid in a disease outbreak in the area, or to adhere to state laws governing workplace safety.
- Victims of Abuse, Neglect, or Domestic Violence. We may share your PHI information with government agencies to report suspected abuse, neglect, or domestic violence. We will only disclose this information if the law requires us to do so, or when it is necessary to protect someone from serious harm.
- Lawsuits and legal actions. We may use and disclose your PHI in response to a court or administrative order, certain subpoenas, or other legal processes. We may also use and disclose PHI to the extent permitted by law without your authorization, such as in defending against a lawsuit or arbitration.
- Law Enforcement. We may disclose your PHI to help locate or identify a missing person, suspect, or fugitive. This may also occur when there is suspicion that death has occurred because of criminal conduct, to report a crime that happens at our clinics or offices, or to report certain types of wounds, injuries, or deaths that may be the result of a crime. This information may be disclosed to authorized officials such as the police, sheriff, or FBI for law enforcement purposes and in response to legal processes, such as a search warrant or court order.
- Coroners, Medical Examiners, and Funeral Directors. We may share your PHI with funeral directors, coroners, and medical examiners to help identify a body, determine the cause of death, or for official duties.
- Organ, Eye, and Tissue Donation. We may disclose your PHI to organizations responsible for organ, eye, or tissue donations and transplants.
- Research. We may use and share your PHI for research purposes if it is approved by an Institutional Review Board (IRB). An IRB is a committee that is responsible for reviewing and approving research involving human participants to protect their safety and the confidentiality of their PHI by federal law.
- To Stop a Serious Threat to Health or Safety. We may use or disclose your PHI if we believe it is necessary to prevent a serious threat to your health or safety or to someone else’s health or safety.
- Inmates. As an inmate of a correctional institution or in custody of a law enforcement official, you may not receive a notice of privacy practices. We may disclose your PHI to the correctional institution or the law enforcement official for specific purposes, such as protecting your health and safety or that of someone else.
- Military Activity and National Security. We might disclose the PHI of armed forces personnel to the relevant military authorities to carry out military missions. Additionally, we may disclose
- Government Programs for Public Benefits. We may use or disclose your PHI to assist you in qualifying for government benefit programs such as Medicare, Supplemental Security Income, or other available benefits or services. We may also reach out to inform you about potential treatment options, health-related benefits, and services.
- Workers’ Compensation. We may use and share your PHI to comply with workers’ compensation laws or similar programs that provide benefits for work-related injuries or illnesses. For instance, we may disclose your medical information about a work-related injury or illness to claims administrators, insurance carriers, and other parties assessing your claim for workers’ compensation benefits.
- Family and Friends Involved in or Paying for Your Care. We may share your PHI with a friend, family member, or anyone else involved in your care or responsible for payment.
- Disclosures in Case of Disaster Relief. We may share your name, city of residence, age, gender, and overall condition with a public or private disaster relief organization for necessary medical assistance or to aid in reuniting you with family members.
- Disclosures to Parents as Personal Representatives of Minors. In most cases, we may disclose your minor child’s PHI to you. In some situations, however, we are permitted and sometimes required by law to deny you access to your minor child’s PHI. An example of when we must deny such access, based on the type of healthcare, is when a minor who is 12 years old or older seeks care for a communicable disease or condition. Another situation when we must deny access to parents is when minors have adult rights to make their own healthcare decisions. These minors include, for example, married minors or who have a declaration of emancipation from a court.
- Appointment Reminders. We may use the PHI to remind you of your upcoming appointments for treatment or other necessary health care.
- Immunization Records. With written or verbal authorization from a parent, guardian, or other person acting in place of a parent, or from an emancipated minor, we may disclose proof of your child’s immunization to a school and provide information about a child who is or will be a student at the school as required by state or other laws.
- Identity Verification. We may take a photograph of you for identification purposes and store it in your medical record.
- Electronic Health Records (EHR). We may use an electronic health record to store and retrieve your health information. One of the advantages of the EHR is the ability to share and exchange health information among personnel and other community healthcare providers involved in your care. When we enter your information into the EHR, we may share that information by using shared clinical databases or health information exchanges. We may also receive information about you from other healthcare providers involved with your care by using shared databases or health information exchanges. If you have any questions or concerns about the sharing or exchange of your PHI discuss with your provider.
- Communications with Family, Friends, and Others. In situations where you are unable to give consent due to an emergency or lack of capacity, we may need to disclose your PHI to family members or those involved in your care. We will use our professional judgment to determine if it is in your best interest to do so, and we will only disclose the information that is directly relevant to the person’s involvement in your healthcare. For instance, we may share information about potential exposure to an infectious disease if it requires immediate attention.
Uses and Disclosures of Your PHI Requiring Your Written Authorization:
We are required to obtain your written authorization to use or disclose your PHI, with limited exceptions, for the following reasons:
- Sale of PHI. We do not sell patient PHI.
- Marketing. We will request your written approval to use or disclose your PHI for marketing purposes.
- Psychotherapy Notes. We will request your written approval to use or disclose your psychotherapy notes with limited exception. For example, for certain treatment, payment, or healthcare operation functions.
- All other uses and disclosures of your PHI not described in this Notice will be made only with your written approval. You may take back your approval at any time. The request to take back approval must be in writing. Your request to take back approval will go into effect as soon as you request it. There are two cases it won’t take effect as soon as you request it. The first case is when we have already taken actions based on past approval. The second case is before we receive your written request to stop.
Uses and Disclosures of Your Substance and Alcohol Use Disorder Records:
Your records related to substance use disorder (SUD) are protected by federal law under 42 CFR Part 2. This law provides extra confidentiality protections and requires a separate patient consent for the use and disclosure of SUD counseling notes. Each disclosure made with patient consent must include a copy of the consent or a clear explanation of the scope of the consent. 42 CFR Part 2 allows patients to sign a single consent form for all future uses and disclosures for SUD treatment, payment, and other health care operations. Disclosure of these records requires your explicit written consent, except in limited circumstances. You may revoke this consent at any time.
- Medical Emergencies: Only to the extent needed to treat your emergency.
- Reporting Crimes on Program Premises.
- Child Abuse Reporting: In connection with incidents of suspected child abuse or neglect to appropriate state or local authorities.
Prohibitions on Use and Disclosure of Part 2 Records
- The new rule expands prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, or legislative proceedings conducted against a patient unless the patient provides consent, or a court order is issued.
- A separate consent is required and must specifically address the use and disclosure of SUD counseling notes. Consent cannot be combined.
Your Rights Regarding Your PHI:
- Right to Access Health Information. You have the right to access and obtain a copy of your health information held by the covered entity, including electronic records with a few exceptions. This includes any information related to your care, decisions about your care, or payment for your care. You can access your records in any format maintained by PRH and request them to be sent to a third party.
- Right to Request Corrections. You have the right to request corrections to inaccurate or incomplete information. Your request must be in writing, and it should explain the corrections or additions you are requesting, along with the reasons they should be made. We will respond to your request within 60 days and may extend this period once by 30 days if we provide a written explanation for any delay. If your request is approved, we will make the necessary corrections or additions to your PHI.
- We may deny your request if it is not in writing or does not include a reason to support the request. We may also deny your request if:
- The information in your record is correct and accurate.
- The information in your record was not created by HHS, or the person who created it is no longer available to make the amendment, or
- The information is not part of the records you are permitted to view and copy.
- If we deny your request for a change, we will inform you why and explain your right to submit a written statement of disagreement. Your statement should not exceed five pages. Please notify us in writing if you want us to include your statement of disagreement, your original request for a change, and our written denial in future disclosures of that part of your medical records.
- Right to Request Restrictions on Uses and Disclosures of your PHI. You have the right to request restrictions on how your PHI is used or disclosed for treatment, payment, or healthcare operations. We will comply with these requests unless prohibited by law. For example, you can request restrictions on the information you share with someone involved in your care or with your spouse. We may not be obligated to agree to your request, except if you have the right to limit the sharing of information with a health plan or insurer for payment or healthcare operations or with a BA if you pay out of pocket in full for the healthcare item or service at the time of the request for restriction.
- Right to Request Confidential Communications. You have the right to request how we communicate with you about your PHI and where we send communications. For example, you can ask us to only call you at your work number or send mail to a specific address. Your request must be in writing and clearly state your preferred method or location for communication. We will accommodate all reasonable requests. If your PHI is stored electronically, you can request a copy of the records in an electronic format provided by HHS. You can also submit a written request for the electronic copy to be sent to a designated third party. If fulfilling your request costs more than a reasonable amount, we may charge you for the excess costs.
- Right to Revoke an Authorization. You have the right to revoke your written authorization to use and disclose your PHI at any time. You must inform us of the revocation in writing. If you revoke your written authorization, we will stop sharing your PHI. However, any information already used or shared while the authorization was valid cannot be taken back.
- Right to a Paper Copy of this Notice. Unless you are incarcerated, you have the right to request a paper copy of this notice at any time.
- Right to Receive Notifications. You have the right to notifications about how your health information is used and shared.
- Right To Make Decisions on Information Sharing. You have the right to make decisions about specific uses and disclosures of your PHI. You can request restrictions on how your information is used or disclosed, and covered entities must comply with these requests unless prohibited by law.
- Breach Notification. In the event of a breach of your unsecured PHI, you have the right to be notified without unreasonable delay and no later than 60 days following our discovery of the breach.
- Right to File a Complaint. If you have questions about this notice, your privacy rights, or believe your privacy rights have been violated, you may call the PRH HIPAA Privacy Officer at 509-336-7521. You have the right to file a complaint directly with the Office for Civil Rights - U.S. Department of Health and Human Services (DHHS) via the following methods:
- Email: OCRPrivacy@HHS.Gov (for health information privacy or patient safety inquiries)
- OCRMail@HHS.Gov (for non-privacy related inquiries).
- Phone Number: (800) 368-1019 or TDD (800) 537-7697
- Fax Number: (202) 619-3818
- OCR Compliant Portal: OCR Complaint Portal
- Mailing Address:
- Office for Civil Rights – U.S. DHHS
200 Independence Ave., SW Room 509F, HHS Building
Washington, D.C. 20201
The complaint must be submitted in writing and sent by mail, fax, or electronically via email within 180 days of discovering the violation. PRH respects your right to voice concerns about your privacy. You are protected from any form of punishment, threat, or penalty when asking questions or filing a complaint.
Our Responsibilities:
- We are required by law to maintain the privacy and security of your protected health information.
- We will let you know promptly if a breach occurs that may have compromised the privacy and security of your information.
- We must follow the duties and provide a clear and concise explanation of our privacy practices and inform you of any changes to these practices. We must provide you a copy.
- We will not use or share your information other than as described here unless you tell us we can in writing. You may change your mind at any time. Let us know in writing.
- We are obligated to adhere to the terms of this notice while it is in effect. We maintain the right to modify this notice and our privacy practices at any time. Additionally, we will display and provide access to the new notice at HHS Program/Services sites and clinics, in the waiting areas, or at the reception desk.
- PRH complies with applicable federal civil rights laws and does not discriminate based on race, color, national origin, age, disability, or sex. We provide the following services:
- Free aids and services for people with disabilities to help them communicate with us, such as qualified sign language interpreters and written information in alternative formats (such as large print, audio, and accessible electronic formats).
- Free language services for individuals whose primary language is not English, including qualified interpreters and information in other languages.
- Effective May 1, 2024, PRH complies with the Discrimination Based on Disability in Health and Human Service Programs or Activities for people with disabilities under Section 504
- Section 105 of Title 1 of GINA provides enhanced privacy protections for genetic information, ensuring individuals are not disadvantaged based on their genetic predispositions.
Material Changes to the Terms of This Notice
- We are obligated to adhere to the terms of this notice while it is in effect. We maintain the right to modify this notice and our privacy practices at any time. Additionally, we will display and provide access to the new notice at HHS Program/Services sites and clinics, in the waiting areas, or at the reception desk.
Notice of Nondiscrimination [AFFORDABLE CARE ACT (ACA) 45 CFR 92]
- PRH complies with applicable federal civil rights laws and does not discriminate based on race, color, national origin, age, disability, or sex. We provide the following services:
- Free aids and services for people with disabilities to help them communicate with us, such as qualified sign language interpreters and written information in alternative formats (such as large print, audio, and accessible electronic formats).
- Free language services for individuals whose primary language is not English, including qualified interpreters and information in other languages.
Discrimination Based on Disability in HHS Programs or Activities
- Effective May 1, 2024, PRH complies with the Discrimination Based on Disability in Health and Human Service Programs or Activities for people with disabilities under Section 504 of the Rehabilitation Act. The “Rehab Act” protects disabled people from discrimination of all ages.
Genetic Information Nondiscrimination Act (GINA)
- Section 105 of Title 1 of GINA provides enhanced privacy protections for genetic information, ensuring individuals are not disadvantaged based on their genetic predispositions.
- Genetic information must be treated with the same confidentiality as PHI, and only specific entities, such as medical researchers or law enforcement (under limited circumstances), may receive access.
