Privacy Policy


1. Introduction

This Joint Notice of Privacy Practices (“Notice”) for Brattleboro Memorial Hospital, its physician practices and its Community Health Team (collectively referred to as “BMH”) describes how your protected health information (“PHI)” may be used and disclosed.

PHI includes your demographic information such as name, address, telephone number, and family; past, present, or future information about your physical or mental health or condition; and information about the medical services provided to you, including payment information, if any of that information may be used to identify you.

2. Organized Health Care Arrangement (OHCA) of BMH

BMH and the members of its organized medical staff have joined together as an Organized Health Care Arrangement to present this Joint Notice of Privacy Practices (NPP) to you as a joint document. Besides the individual members of our organized medical staff, this OHCA specifically includes BMH Physician Practice Group.This NPP will be in effect for all inpatient and outpatient hospital-based services and will allow the sharing of your PHI as appropriate among members of the OHCA for treatment, payment and health care operations. Even though an OHCA has been established, each member is responsible for its own compliance with confidentiality policies and with all federal and state regulations, and no one member is responsible for any violations carried out by another member.

3. Safeguarding PHI Within our Facility

We are required by law to maintain the privacy of your PHI, provide you with notice of our legal duties and privacy practices with respect to PHI and notify you in the event of a breach of unsecured PHI. We are required to abide by the terms of this NPP currently in effect.

BMH uses an electronic record to store and retrieve much of your PHI. One of the advantages of BMH’s electronic health record is the ability to share and exchange PHI among BMH personnel and other community health care providers. We may also share information about you with other health care providers who are involved with your care and to whom you provide consent through the Community Health Team and the Vermont Health Information Exchange (“VHIE”). For more information on VHIE, see

4. Uses and Disclosures of PHI with your Consent or Authorization

Before we provide medical care, except in an emergency or other special circumstances, we will ask you to read and sign a written consent, authorizing us to use and disclose your health information for the following purposes:

  • Treatment. Treatment means the provision, coordination, or management of your health care and related services by BMH and health care providers involved in your care. For example, your PHI may be disclosed to a physician to whom you have been referred to ensure that the physician has the necessary information to diagnose or treat you.
  • Payment. Your PHI will be used and disclosed, as needed, to obtain payment for your health care services. This may include certain activities to obtain reimbursement for the medical services provided to you, including billing, claims management, and collection activities. This may include your insurance carrier’s efforts in determining eligibility, claims processing, assessing medical necessity, and utilization review. Payment may also include activities carried out on our behalf by one or more of our collection agencies or agents in order to secure payment on delinquent bills.
  • Health Care Operations. We may use and disclose your medical information for health care system operations. These activities may include, but are not limited to, quality assessment and improvement activities; fraud & abuse compliance; business planning & development; and business management & general administrative activities. These can also include our telephoning you to remind you of appointments or using a translation service if we need to communicate with you in person, or on the telephone, in a language other than English. When we involve third parties in our business activities, we will have them sign a Business Associate Agreement obligating them to safeguard your PHI according to the same legal standards we follow.
  • Patient Directory. We maintain a patient directory when you are an inpatient that includes your name, a general statement about your condition, your religious affiliation, and your location in the hospital. Such information is disclosed to members of the clergy or (except for religious affiliation) to other persons who ask for you by name. You may choose to have limited or no information about you listed in this directory by contacting the Switchboard Supervisor at (802) 257-0341.

5. Uses and Disclosures of PHI Permitted or Required by Law without Your Authorization

In some circumstances, we may be legally bound by state or federal privacy and security laws to use or disclose your PHI without your consent or authorization, including, but not limited to:

  • Emergencies. If you are incapacitated and require emergency medical treatment, we will use and disclose your PHI to ensure you receive the necessary medical services. We will attempt to obtain your authorization as soon as practical following your treatment.
  • Others Involved in Your Healthcare. Upon your verbal authorization, we may disclose to a family member, close friend or other person you designate only that PHI that directly relates to that individual’s involvement in your healthcare and treatment. We may also need to use PHI to notify a family member, personal representative or someone else responsible for your care of your location and general condition.
  • Communication barriers. If we try but cannot obtain your authorization to use or disclose your PHI because of substantial communication barriers, and your health care provider, using professional judgment, infers that you authorize the use or disclosure or determines that a limited use or disclosure is in your best interests, BMH may permit the use or disclosure.
  • Required by Law. We may disclose your PHI to the extent that its use or disclosure is required by state or federal law and the use or disclosure complies with and is limited to the relevant requirements of such law. For example, this includes but is not limited to required reports to cancer and mammography registries, reports to law enforcement concerning gunshot wounds.
  • Public Health/Regulatory Activities. We may use or disclose your PHI to an authorized public health authority to prevent or control disease, injury, or disability or to comply with state child or adult abuse or neglect law. We are obligated to report suspicion of abuse and neglect to the appropriate regulatory agency.
  • Food and Drug Administration. We may disclose your PHI to a person or company as required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations as well as to track product usage, enable product recalls, make repairs or replacements or to conduct post-marketing surveillance.
  • Health oversight activities. We may disclose your PHI to a health oversight agency for audits, investigations, inspections, and other activities necessary for the appropriate oversight of the health care system and government benefit programs such as Medicare and Medicaid.
  • Judicial and administrative proceedings. We may disclose your PHI in the course of a judicial or administrative proceeding in response to a court order expressly directing disclosure, or in accordance with specific statutory obligations compelling BMH to do so.
  • Law enforcement activities. In accordance with Vermont state law, we may disclose your PHI to a law enforcement officer for law enforcement purposes with a court order, warrant, statutory obligation or patient authorization, or under exceptional circumstances.
  • Coroners, medical examiners, funeral directors and organ donation organizations. We may disclose your PHI to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other lawful duties. We also may disclose your PHI to enable a funeral director to carry out his or her lawful duties. PHI may also be disclosed to organ banks for cadaveric organ, eye, bone, tissue and other donation purposes.
  • Research. We may disclose your PHI for certain medical or scientific research where the researchers have a protocol to ensure the privacy of your PHI.
  • Serious threats to health or safety. We may disclose your PHI to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
  • Military activity & national security. We may disclose the PHI of members of the armed forces for activities deemed necessary by appropriate military command authorities to assure proper execution of the military mission. We also may disclose your PHI to certain federal officials for lawful intelligence and other national security activities.
  • Worker’s Compensation. We may disclose your PHI as authorized to comply with worker’s compensation law.
  • Inmates of a Correctional Facility. We may use or disclose PHI if you are an inmate of a correctional facility and our facility created or received your PHI in the course of providing care to you while in custody.
  • US Department of Health and Human Services. We must disclose your PHI to you upon request and to the Secretary of the United States Department of Health & Human Services to investigate or determine BMH’s compliance with the privacy laws.
  • Disaster Relief Activities. We may disclose your PHI to local, state or federal agencies engaged in disaster relief and to private disaster relief assistance organizations (such as the Red Cross if authorized to assist in disaster relief efforts).
  • Vermont Board of Medical Practice. We may disclose your PHI to the Board required by Vermont law.
  • Fundraising: BMH may contact you for the express purpose of internal fundraising activities. The information disclosed to our fundraising staff shall be limited to contact information and dates of services rendered. You may “opt out” of having such information used for development purposes. To do so, we ask patients to contact our Development Office, (802) 251-8485.

6. Uses and Disclosures Authorized by You

Other uses and disclosures not described in this Notice will be made only with your specific written authorization which you are entitled to revoke (See Paragraph 7). Specifically, we may not use or disclose your PHI for marketing purposes and we may not sell your health information without your written authorization. Additionally, if psychotherapy notes are part of your PHI, they may not be disclosed unless you provided written authorization.

7. Revocation of Authorization

You may revoke authorizations at any time, provided each revocation is in writing. You may not revoke an authorization to the extent that (1) we have relied on that authorization; or (2) if the authorization was obtained as a condition of obtaining insurance coverage, law provides the insurer the right to contest the claim under the policy.

8. Your Rights Regarding PHI

  • Right to request restriction of uses and disclosures. You have the right to request that we not use or disclose any part of your PHI unless it is a use or disclosure required by law. Please advise us of the specific PHI you wish restricted and the individual(s) who should not receive the restricted PHI. We are not required to agree to your restriction request, except as set forth in the paragraph below. If we do agree to a restriction request, we will not use or disclose the restricted PHI unless it is necessary for emergency treatment. In that case, we will ask that the recipient not to further use or disclose the restricted PHI. You may specify the restricted parties in writing to the Director of Medical Information.
  • We must agree to a request to restrict disclosure of PHI to a health plan, if the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law and the PHI pertains solely to an item or service for which BMH has otherwise been in full.
  • Right of access to PHI. You have the right to inspect and obtain a copy of your PHI upon your written request. Your right of access may be limited if providing certain PHI, in the judgment of your physician or some other licensed health care professional, may endanger the health or safety of yourself or others or the PHI makes reference to another person and access is likely to cause substantial harm to you or the other person. To request access to your medical record call the Medical Information Department, (802) 257-8378 or your provider’s office, during business hours. We will respond to your request as soon as possible, but no later than 30 days from the date of your request. If access is denied you will receive a denial letter within 30 days. We may extend the time for responding to such requests by no more than 30 days if we provide you written statement of the reason for the delay and the date by which we will act on the request. There is an appeals process. We have the right to charge a reasonable fee for providing copies of your PHI. If you seek an electronic copy of your electronic phi in a specific electronic form and format that is not readily producible, we with work with you on providing an alternative form and format.
  • Right to confidential communications. You have the right to accommodation of reasonable requests to receive communications of PHI by alternative means or at alternative locations. For example, you may wish your bill to be sent to an address other than your home. Please make your request in writing to the Director of Patient Financial Services, (802) 257-8494 or (802)257-8333 for BMH Physician Group. We will not require an explanation of your reasons for the request and will attempt to comply with reasonable requests, but you will be required to assume any costs associated with forwarding your PHI by alternate means.
  • Right to amend PHI. You have the right to request that we amend your PHI. Your request must be made in writing to the Compliance Officer, (802)257-8360 . We will respond to your request as soon as possible, but no later than 60 days from the date of your request. If we deny your request for amendment, you have the right to submit a written statement disagreeing with the denial; the hospital also has the right to submit a rebuttal statement. A record of any disagreement about amendment will become part of your medical record and may be included in subsequent disclosures of your PHI.
  • Right to accounting of disclosures. Subject to certain limitations, you have the right to a written accounting of disclosures by us of your PHI for not more than 6 years prior to the date of your request. Your right to an accounting applies to disclosures other than those for treatment, payment, or health care operations; to yourself; for a facility directory; to your family or close friends involved in your care; or for notification purposes. Please make your request in writing to the Director of Medical Information. We will respond to your request as soon as possible, but no later than 60 days from the date of your request. We will provide you with one accounting every 12 months free of charge. We will charge a reasonable fee based upon our costs for any subsequent accounting requests.
  • Right to a Copy of our Notice of Privacy Practices. We will ask you to sign a written acknowledgement of receipt of this Notice. We may change the terms of this Notice, at any time. The revised Notice will be in effect for all PHI that we maintain at that time. We will post any revised Notice on our website, Upon your request, we will provide you with the revised Notice or you may obtain a copy by accessing our website at, or by calling any BMH office and requesting that a revised copy be sent to you in the mail, or asking for one at your next appointment.
  • Right to Notification: We will provide you with written notification in the event of a breach of your PHI.

9. Complaint Procedure

  • Within our Facility. If you want further information about your privacy rights, are concerned that we have violated your privacy rights, or disagree with a decision that we have made about your health information, you may contact the BMH Director of Risk Management at (802) 257-8244. We will not retaliate against you for filing a complaint.
  • Outside our Facility. If you believe that BMH is not complying with its legal obligations to protect the privacy of your PHI, you may file a complaint with the Secretary of the U.S. Department of Health & Human Services, Office of Civil Rights. You must make your complaint to the Secretary in writing within 180 days of the act or omission forming the basis of your complaint.

Effective date of this Notice: August 13, 2013
Orig. 03/2003, Rev. 11/2007, 8/2013