Affiliates of Hawaii Pacific Health

Notice of Privacy Practices



If you have any questions about this Notice, please contact our Privacy Officer listed below.

  1. Introduction:

    This joint Notice of Privacy Practices (this “Notice”) describes how we may use and disclose your protected health information (“PHI”) to carry out treatment, payment, and/or health care operations and for other purposes that are permitted or required by law. It also describes your rights concerning your PHI. PHI is information about you, including information that may identify who you are or where you live, that relates to your past, present, or future physical or mental health or condition, related health care services, and payment for such services.

    To promote continuity and consistency of care, we have an integrated electronic medical record at all our facilities. This means information created in the course of our caring for you will reside in the integrated record and may be available to others involved with your care.

  2. Who Will Follow This Notice:

    This Notice describes the privacy practices of our facilities that make up the Hawaii Pacific Health Affiliated Covered Entity and of members of each facility’s “organized health care arrangement’, as follows:

    • Kapiolani Medical Center for Women and Children;
    • Pali Momi Medical Center;
    • Kapiolani Medical Specialists;
    • Straub Clinic and Hospital;
    • Kauai Medical Clinic;
    • Wilcox Memorial Hospital;
    • All departments, units, and clinics of each of the above-named facilities;
    • Any health care professional authorized to enter information into your medical or billing records at our facilities;
    • All employees, medical staff members, allied health professionals, and other authorized workforce who may need access to your information;
    • Volunteers we allow to help you at our facilities; and
    • All residents, postgraduate fellows, medical students, and students of other health care professions or educational programs at our facilities.

    For purposes of complying with federal privacy and security requirements, the above-described Hawaii Pacific Health facilities have designated themselves as an Affiliated Covered Entity. These are facilities under common ownership and control that have agreed to treat themselves as a single “covered entity” under these federal laws. Hawaii Pacific Health, as the member of these affiliated facilities, will coordinate privacy practices among these facilities and, from time to time, will have access to some PHI as a business associate of these facilities. Additionally, the independent providers who are providing health care services at or through our facilities, or who share electronic medical records with Hawaii Pacific Health’s Health Advantage Connect partners, have agreed to follow this Notice when providing services at or through that facility. These independent providers, however, are legally separate and responsible for their own acts.

  3. Our Legal Duty

    We are required by law to:

    • Keep records of the care that we provided to you;
    • Keep your PHI private;
    • Notify you, under certain circumstances, of breaches affecting your PHI;
    • Abide by the terms of the Notice that is currently in effect; and
    • Give you this Notice of our duties and privacy practices with respect to your PHI.

    We may change our Notice at any time. We reserve the right to revise or amend this Notice. Any revision or amendment to this Notice will apply to all of your records that any of our facilities have created or maintained in the past and for any of your records that we may create or maintain in the future. We will visibly post a copy of our current Notice in our admitting and business offices. You may request a copy of the Notice from these locations. The Notice also will be posted on our website. Your personal doctor may have separate policies or notices regarding the use and disclosure of PHI that is created in his/her private practice.

  4. We May Use and Disclose Medical Information About You

    The following categories describe different ways we may use and disclose PHI. Not every use or disclosure in a category will be listed.

    a. Treatment: We may use and disclose your PHI to provide you with medical treatment or services.  For example, we may disclose your PHI to doctors, nurses, and other health care personnel or providers to coordinate the different things you need, such as prescriptions, lab work, and X-rays. We may also permit disclosure of your electronic health record via electronic transfer to other facilities and providers for treatment purposes. We also may disclose your PHI to other people who provide services that are part of your care, such as a hospice or home care agency.

    We participate in one or more Health Information Exchanges (“HIE”). Your health information and identifying information regarding your visits to our facilities may be shared with the HIEs for the purposes of diagnosis and treatment. Other providers participating in these HIEs may access this information as part of your treatment.

    b. Payment: We may use and disclose your PHI to bill and collect payment for your health care services. We may disclose your PHI to other health care providers and organizations involved in your care to assist in their billing and collection efforts.  This may include, for example, disclosures to your health insurance plan about services we recommend for you so your plan can determine eligibility, coverage, or medical necessity or for utilization review activities. We also may disclose your PHI to third parties for collection of payment.

    c. Healthcare Operations: We may use your PHI or share it with others in the course of operating our facilities. For example, we may use your information to evaluate: the performance of our staff in caring for you; the quality of our services; and effectiveness of various treatments. This includes combining information we have with information from other health care providers to compare our services and outcomes so we can see where we can make improvements in our care and services. We may remove information that identifies you from this set of medical information so others may use it to study health care and health care delivery without learning who the specific patients are. We also may call you by name in the waiting areas. We also may disclose your PHI to third parties who perform various activities on our behalf, such as accounting, transcription services, data analysis, and risk management.

    In addition, we may disclose your PHI for payment activities and certain business operations of another health care provider or health plan as long as they have or had a relationship with you; the information disclosed pertains to that relationship; and the information is used for one of the following health care operations: quality assessment and improvement; case management and care coordination.

    We coordinate with an “accountable care organization” called Hawaii Health Partners and other health care providers in the community to better coordinate care, improve the quality of your health care services, and reduce health care costs. We may share your PHI with Hawaii Health Partners and other health care providers in the accountable care network for these purposes

    d. Education and Training: We may disclose information to doctors, nurses, technicians, training doctors, medical students, postgraduate fellows and other hospital personnel for review and learning purposes. These same classes of individuals and other health care professional students may participate in examinations or procedures and in your care as part of our educational programs.

    e. Health Related Benefits and Services: We may use and disclose your PHI to tell you about health-related benefits or services that may be of interest to you.

    f. Research: Under certain circumstances, we may use and disclose your PHI for research purposes but only as allowed by law or with your permission. For example, a research project may involve comparing the health and recovery of all patients who received one medication to those who received another, for the same condition. We may use or allow other researchers to review your PHI for the purpose of preparing a plan for a specific research project but, in that event, none of your identifiable information will be allowed to leave our facilities. We may use your PHI to contact you with information about a research study in which you might be interested in participating. If you choose to participate in a research study, you will be asked to sign a written form authorizing the use and disclosure of your PHI for that study. All research studies must be reviewed and approved by a committee, called an Institutional Review Board (IRB), before subjects may be enrolled. This process evaluates a proposed research project and its use of medical information, trying to balance the research needs with patients’ need for privacy of their medical information.

    g. For Fundraising: We may use or disclose certain PHI to an institutionally affiliated foundation to contact you to raise money for our facilities and their operations. If you do not want to be contacted in this way, please notify the Privacy Officer.

    h. Personal Representatives: We may disclose your PHI to a personal representative who has authority under applicable law to make health care decisions on your behalf.

  5. You Will Have the Opportunity to Agree or Object to These Uses and Disclosures:

    Provided you do not object, we may disclose your PHI in the following situations after we discuss it with you. If, however, you are not able to object, we may disclose your PHI if it is consistent with your known prior expressed wishes and is determined to be in your best interests. As soon as you are able, we will give you the opportunity to object to any further disclosures.

    • Facility Directory: Unless you object, we will include certain limited information about you in the facility directory while you are a patient at one of our facilities.  This information may include your name, location in the facility, your general condition (fair, stable, etc.), and your religious affiliation. With the exception of your religious affiliation, the directory information may be released to people who ask for you by name. Your religious affiliation may be given to a member of the clergy, such as a priest or rabbi, even if they don’t ask for you by name. We provide this information so your family, friends, and clergy can visit you and know, generally, how you are doing. If you do not want this information listed in the directory, you must notify the admissions office or fill out a Directory Restriction Form.
    • Individuals Involved in Your Care or Payment for Your Care and Notification: Unless you object, we may disclose to a member of your family, a relative, a close friend, or any other person you identify information that directly relates to that person’s involvement in your health care.  We also may give information to someone who helps pay for your care. We may share PHI with these people to notify them about your location and general condition. Finally, we may disclose PHI about you to disaster relief agencies, such as the Red Cross, so that your family can be notified about your condition, status, and location.
    • When Required By Law:We will use and disclose your PHI when we are required to do so by federal, state, or local law.
    • To Avert a Serious Threat to Health or Safety:  We may use and disclose your PHI to prevent a serious threat to your health and safety or the health and safety of others.
    • For Organ and Tissue Donation: We may disclose your PHI to a designated organ donor program as required or permitted by law.
    • For Specific Government Functions: We may release medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law, as well as to others so they may provide protection to the President and other authorized persons or foreign heads of state. If you are a member of the armed forces, we may release your information as required to your military command authorities.
    • For Legal Proceedings: We may disclose your PHI in response to a subpoena, discovery request, or other lawful process by someone involved in a dispute, but only after efforts have been made to tell you about the request or to obtain an order protecting the PHI requested.
    • For Law Enforcement: We may use or disclose your PHI for law enforcement purposes, such as legal processes, limited information requests for identification and location purposes, information pertaining to victims of a crime, suspicion that death has occurred as a result of criminal conduct, a crime occurring on our premises, and  certain medical emergencies (not on the premises).
    • For Health Oversight: We may disclose PHI about you to a state or federal health oversight agency that is authorized by law to oversee our operations. These activities are necessary for the government to monitor our health care system, government programs, and compliance with civil rights laws.
    • To Coroners, Medical Examiners, and Funeral Directors: We may disclose your PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or to determine the cause of death. We also may release PHI to funeral directors as necessary for them to carry out their duties.
    • For Workers’ Compensation: We may disclose your PHI as permitted by workers’ compensation laws and other similar programs.
    • For Public Health: We will disclose PHI to public health authorities for public health activities, investigations, or interventions as required by law. Public health activities generally include:We May Make the Following Uses and Disclosures Without Your Authorization:
      • Reporting births and deaths, birth defects, children at risk, and child abuse or neglect;
      • Preventing or controlling disease, injury, or disability;
      • Notifying people of recalls of medical products they may be using;
      • Notifying a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
      • Reporting reactions to medications or problems with products; and
      • Notifying the appropriate government authority if we believe a patient has been the victim of abuse or neglect.
    • Regarding Inmates or Individuals in Custody: If you are in legal custody, we may disclose your PHI to a correctional institution or law enforcement official. PHI may be disclosed to provide you health care, to protect your health and safety or the health and safety of others, or for the safety and security of the correctional institution.
  6. Other Uses and Disclosures of Your PHI:

    Other uses and disclosures of your PHI not covered by this Notice or the laws that apply to us will be made only with your written authorization.  If you provide us permission to use or disclose your PHI, you may revoke that permission, in writing, at any time.If you revoke your permission, we will stop any use or disclosure of PHI previously permitted by your written authorization.  We are unable to “take back” any disclosures we have already made with your permission. We generally will not sell your PHI, use or disclose your PHI for marketing, or use or disclose any PHI contained in psychotherapy notes without your authorization.

  7. Your Rights Regarding Your PHI:

    a. You have the right to request restrictions on how we use and disclose your PHI for treatment, payment, or health care operations. We, however, are not required to agree to your request except as indicated below.  If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment.   To request a restriction, your request must be in writing to our Privacy Officer and must describe:

    • The information you wish restricted;
    • Whether you are requesting to limit our use, disclosures, or both; and
    • To whom you want the limitation to apply.

    You have a right to request, and we are required to agree to, a restriction on the information disclosed to your health plan if you make arrangements to pay for the related services in full.

    b. You have the right to request confidential communications from us by alternative means or at an alternative location. We will accommodate reasonable requests. We may ask you for information as to how payment will be handled or to specify an alternative address or other method of contact. We will not request an explanation from you as to the basis for the request. Please notify our Admissions/Registration staff.

    c. You have the right to inspect and obtain a paper or electronic copy of your PHI that our facilities use to make decisions about you for as long as we maintain the PHI. There are a few exceptions. If we deny your request to inspect your PHI, we will give you reasons in writing for the denial and explain any right to have the denial reviewed. If you want copies of your PHI, a charge for copying may be imposed.   You may direct that the copy be transmitted directly to an entity or person designated by you, provided that any such designation is clear, conspicuous, and specific with complete name and mailing address or other identifying information. Please contact our Health Information Management Department if you have questions about access to your health information.

    d. You have the right to request an amendment if you feel the PHI we have about you is incorrect or incomplete.  In certain cases, we may deny your request for an amendment. If we deny your request, you have the right to file a statement of disagreement with us. We may prepare a rebuttal and will provide you with a copy of such rebuttal. Please contact our Health Information Department if you have questions about the process.

    e. You have the right to find out what disclosures we have made about you to whom, and why. This applies to disclosures made for reasons other than treatment, payment, or our health care operations. It also excludes disclosures we made to you or as authorized by you, for a facility directory, to family members or friends involved in your care, for notification purposes, or as required by law. The right to receive this information is subject to certain exceptions, restrictions, and limitations. Please contact our Health Information Department for further information.

    f. You have the right to a paper copy of this Notice. You are entitled to receive a paper copy of our Notice even if you have agreed to accept this Notice electronically. You may ask us to give you a copy of this Notice at any time. To obtain a paper copy of this Notice, contact our Privacy Officer.

    g. You have the right to file a complaint. If you believe your privacy rights regarding your PHI may have been violated, you may file a complaint to our Privacy Officer at the address below or the Secretary of the Department of Health and Human Services.  You will not be penalized for filing a complaint.

    For additional information about our privacy practices, please contact our Privacy Officer at 55 Merchant St., 26th Floor, Honolulu, HI 96813; (808) 535-7310, 535-7148 or via e-mail at

Information We Collect Through This Web Site Regarding Web Technologies

Here is how and why we use some common Web technologies to help manage our websites:

Cookies: A “cookie” is a small piece of information that our website may provide to your browser while you are at our sites. The website supplies your browser with cookies that contain a unique identifier used to better understand website usage in the aggregate and on an individual level so we know what areas of our site users prefer (e.g., based on the number of visits to those areas). This is done through a tracking utility that allows us, for example, to reconstruct activity from a session or by a user, for troubleshooting and issue resolution purposes. We may also employ service providers to help us collect and understand our website usage data.

When periodic surveys are presented to website visitors, cookies are used to prevent issuing multiple invitations to the same individual.

Additionally, our service providers that serve ads on affiliate and/or advertiser websites may assign different cookies and small graphical images, called single-pixel GIFs or web beacons, to your browser to track the effectiveness of our advertising on other websites and your involvement with Hawaii Pacific Health. For example, as part of our affiliate programs, our service providers use cookies and web beacons to determine when affiliate program members have referred a customer to Hawaii Pacific Health via a link on their website. The Hawaii Pacific Health website also sets a temporary cookie that contains a unique, anonymous identifier that is provided to the service provider to ensure that each referral is only counted once. This cookie is not linked to a customer’s personal information.

Once you close your browser, or once you are logged off the Site, the cookie simply terminates. By accepting cookies from the Site, you would not have to log in with a password more than once during a session. You can configure your browser not to accept cookies. If you reject the cookie, you can still use the Site, although your use may be limited.

Behavioral Advertising: Please be aware that we use third party advertising companies to collect non-personally identifiable information for online behavioral advertising to provide targeted display advertisements, likely to be of greater interest to you, through participating publishers and advertisers. Such information may include non-personally identifiable information (e.g., click stream information, browser type, time and date, subject of advertisements clicked or scrolled over) through the use of Cookies and other technology. To learn more about online behavioral advertising or to opt-out of this type of advertising, please click on the following link: