The Washington Consumer Health Data Privacy Policy (“Policy”) applies to personal data defined as “Consumer Health Data” by the Washington My Health My Data Act (“MHMD”) that is collected from you by MultiCare Health System. This Policy supplements the MultiCare Health System Website Privacy Policy. In the event of a conflict between any other policy or notice and this Policy, this Policy will prevail as to Consumer Health Data Collected under MHMD. For the purposes of this Policy, unless otherwise noted, all references to MultiCare Health System include MultiCare Health System website, https://updates-www.mccdn.io, and its affiliated entities including but not limited to the following: MultiCare Allenmore Hospital, MultiCare Auburn Medical Center, MultiCare Capital Medical Center, MultiCare Covington Medical Center, MultiCare Deaconess Hospital, MultiCare Good Samaritan Hospital, MultiCare Mary Bridge Children’s Hospital, MultiCare Navos Hospital, MultiCare Tacoma General Hospital, MultiCare Valley Hospital, MultiCare Yakima Memorial Hospital, Behavioral Health Network facilities and all wholly owned and controlled administrative and ambulatory locations and services, applications developed by MultiCare Health System, and other interactions with MultiCare Health System in which Consumer Health Data may be collected.
Consumer Health Data under MHMD means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. This Policy does not apply where an exception or exemption applies such as for Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). As a hospital and research organization, most of the data MultiCare Health System collects and uses is data excluded from MHMD because the data are regulated under HIPAA or other privacy laws. See our Notice of Privacy Practices, and other privacy notices that provide disclosures about personal information that is not Consumer Health Data subject to MHMD.
Consumer Health Data We Collect
As described in the MultiCare Health System’s Website Privacy Policy and Notice of Privacy Practices, the personal data we collect depends on your interactions with MultiCare Health System, the choices you make, the tools and features you use, your location, and applicable law. Consumer Health Data is broadly defined and some of the categories of data we collect would be consumer health data if they were not excluded from MHMD.
We may collect the following categories of personal information, which may be Consumer Health Data if not excluded from MHMD:
- Information about your health-related conditions, symptoms, status, diagnoses, testing, or treatments (including surgeries, procedures, medications, or other interventions);
- Measurements of bodily functions, vital signs, or characteristics, including genetic data and biometric information;
- Use or purchase of prescribed medication;
- Precise location information that could reasonably indicate your attempt to acquire or receive health services or supplies;
- Internet or Network Activity Information essential to running our website such as Internet Protocol (IP) address, Media Access Control (MAC) address, operating system and version, and Internet browser type and version which could identify your attempt to seek health care services or information, including services that allow you to assess, measure, improve, or learn about your or another person’s health; and
- Other information that may be used to infer or derive data related to the above or other health information.
These categories of personal information are specifically excluded from MHMD when collected by MultiCare Health System for medical care, research, or operations. Examples of data we collect that are excluded from MHMD include:
- Personal data defined as Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”);
- Health care information collected, used, or disclosed in medical records (chapter 70.02 RCW);
- Substance Use Disorder Patient Records (42 C.F.R. Part 2);
- Personal data used or shared in research (45 C.F.R. Part 46 and 21 C.F.R. Parts 50 and 56)
- Information and documents created specifically for and collected and maintained for MultiCare Health System’s Quality Improvement;
- Information that is de-identified as defined in HIPAA and information derived from such de-identified data; and
- Information used only for public health activities and purposes and Limited Data Sets as described in HIPAA.
Sources of Consumer Health Data
MultiCare Health System’s does not collect your Consumer Health Data unless you voluntarily provide it to us. We collect personal information, including Consumer Health Data, from the following categories of sources:
- Directly from you when you use our services, participate in a research study or clinical trial, attend MultiCare Health System’s programs or events, engage with customer service, and any other way that you may be able to interact with us. With your permission, we may also collect Consumer Health Data from another source provided by you like your connected device or profile.
- From third-party sources including MultiCare Health System affiliates, other medical providers, contracted service providers, and business associates as defined under HIPAA. We may engage third-party service providers to provide certain interactive features. By using these features, you understand that our vendors may process the information obtained through the feature to provide the Services on our behalf.
- From websites and mobile applications and automatically from devices you use to connect to our Services. For more information about this, please see our Website Privacy Policy, Notice of Privacy Practices, and any Privacy Policies and Terms of Use specific to individual mobile applications.
- We could collect information that includes Consumer Health Data if you voluntarily provided it in an open text field not related to medical care or research, such as the “comment” box on the support.multicare.org donation form.
Use of Your Consumer Health Data
In general, MultiCare Health System does not use Consumer Health Data as defined in MHMD because the personal data we use related to medical care, research, and other MultiCare Health System operations are specifically excluded from MHMD. Those other uses of personal data collected by MultiCare Health System are described where those data are collected, including in our Website Privacy Policy, Notice of Privacy Practices, hospital consent to care forms, and other privacy notices and terms that provide disclosures about personal information.
To the extent we collect personal information, including Consumer Health Data, as described above, we may use it for the following purposes:
- To provide you with the medical or research services you have requested or authorized,
- Delivering the services and their features, including personalization of certain features,
- Ensuring the secure and reliable operation of the services and the systems that support them including troubleshooting and improving the services,
- Essential business operations that support the provision of the services such as analyzing our performance, meeting our legal obligations, developing our workforce, and conducting research and development, and
- Other purposes for which we give you choices or obtain your consent as required by law – for example, for advertising or marketing purposes.
Where we require your consent to collect personal information for a specified purpose, a description of those purposes is provided to you at the time of collection.
MultiCare Health System does not use any Consumer Health Data that may be voluntarily provided through an open text field not related to medical care, research, other MultiCare Health System operations such as the “comment” box on the support.multicare.org donation form with your express consent.
Sharing Consumer Health Data With Third Parties
Most of the data MultiCare Health System shares is excluded from MHMD. Sharing of any data we collect that is excluded from MHMD will be detailed where those data are collected.
MultiCare Health System will only share your Consumer Health Data with employees and trusted partners and only for the services you have consented to or to the extent necessary to provide a product or service that you have requested or comply with applicable law. All such third parties are prohibited from using your Consumer Health Data except to provide these services to MultiCare Health System and they are required to maintain the confidentiality of your Consumer Health Data.
As necessary for the purposes described above, we may share personal information, including Consumer Health Data, with following categories of third parties:
- Affiliates. We enable access to data across our subsidiaries, affiliates, and related companies, for example, where we share common data systems or where access helps us to provide our services and operate our business.
- Service providers. Vendors or agents (“processors”) working on our behalf may access Consumer Health Data for the purposes described above.
- Business partners. We may share Consumer Health Data with other companies, for example, where you use a service that is cobranded and jointly operated with another company, or where you use our services to interact with another company.
- Financial institutions & payment processors. When you make a purchase or enter into a financial transaction, we will disclose payment and transactional data to banks and other entities as necessary for payment processing, fraud prevention, credit risk reduction, analytics, or other related financial services.
- Government agencies. We disclose data to law enforcement or other government agencies when we believe doing so is necessary to comply with applicable law or respond to valid legal process.
- Other third parties. In certain circumstances, it may be necessary to provide data to other third parties, for example, to comply with the law or to protect our rights or those of our customers.
- Other users and individuals. If you use our services to interact with other users of the service or other recipients of communications, we will share data, including Consumer Health Data, as directed by you and your interactions.
- The public. You may select options available through our services to publicly display and disclose certain information, such as an endorsement, demographic data, content and files, or other data, which may include Consumer Health Data.
How to Exercise Your Rights
MHMD provides certain rights with respect to Consumer Health Data, including the right to access, delete, or withdraw consent relating to your consumer health data, subject to certain exceptions. You may exercise any of your rights by contacting us directly using the contact details found in this Policy. The written request should include sufficient information to verify your identity and specify the right you wish to exercise. For any questions or assistance, you may also reach out using the contact information below.
If your request to exercise a right under the MHMD is denied, you may appeal that decision by contacting our legal team. If your appeal is unsuccessful, you can file a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.
Changes to This Policy
MultiCare Health System reserves the right to change this Policy from time to time. For example, when there are changes in our services, changes in our data protection practices, or changes in the law. When changes to this Policy are significant, we will inform you through this policy page.
Contact Information
All notices or requests should be written and delivered via email or mail to:
MultiCare Health System
Web Services Manager
PO Box 5299 – MS: 820-5-MKTG
Tacoma, WA 98415
[email protected]
MultiCare Health System
Privacy and Civil Rights Office
M/S 820-2-CEP
820 A Street
Tacoma, WA 98402
866-264-6121
[email protected]
Updated: April 30, 2024