Patient, financial and other business-related information whether in writing, electronic or any other form, is generally considered confidential and may be legally protected. Employees, providers, providers’ office staff, independent contractors, consultants, Non Mercy Employed Health Care Individuals, students, residents, volunteers and vendors may have access to confidential information in the performance of their duties for Mercycare Service Corporation (Mercy). The following agreement stipulations are placed upon all users at the time of acceptance of their user password, entry of their login into a Mercy Information System or upon granting physical access to locations where Information System hardware systems are operated or stored.
Policies. I will not use or disclose protected health information except as the HIPAA Privacy Rule permits or requires or as authorized by the individual who is the subject of the information. I agree to adhere to Mercy’s confidential information and disclosure policies. I further agree to immediately report to my supervisor, to the HIPAA Privacy Officer or HIPAA Security Officer, or via the Compliance Hotline, (319-369-4586), activity which is contrary to Mercy’s policies or the terms of this agreement.
Password. My user password is equivalent to my legal signature. It is given to me for my use only. I agree to maintain my password to computer systems and equipment in strictest confidence, not to reveal or disclose my password to anyone at any time for any reason. I further agree to contact the Information Services Help Desk immediately and request a password reset if mine is revealed or has been potentially compromised. I understand that I may change my password at any time.
Access to Information. I will access only that information, perform only those computer functions and use only that information as is required for the performance of my duties and responsibilities. I will not operate or attempt to operate computer equipment without specific authorization and will not attempt to access data or modules or perform computer functions that do not directly pertain to my work. I understand that accessing the patient records of family members is only appropriate to do via the Patient Portal or through the Release of Medical Information process. I agree that I will not use my access granted to me for my job role to look at the records of my family members or others, unless it is in accordance with my professional job duties and responsibilities. I understand that Mercy has the capability to electronically monitor system transactions and may periodically review such information to assure appropriate access of users.
Disclosure. I agree not to demonstrate the operation of computer equipment or applications to anyone without specific authorization. I further agree that I will not disclose any portion of the computerized systems (including but not limited to the design, programming techniques, flow charts, source code, screens and documentation created by employees, outside resources or third parties). I also agree not to disclose any protected health information or confidential business information without specific authorization or only in accordance with applicable policy.
Liability. I recognize that any improper access, disclosure, or violation of policy could result in legal liability and I agree to defend, indemnify and hold Mercy and any of its agents, employees or representatives harmless from any claim, demand or suit arising from my acts in relation to improper access or disclosure of confidential information. I understand that I may be charged with civil monetary or criminal penalties for improper use or disclosure under HIPAA regulations.
Corrective Action. I recognize that any improper access or disclosure could result in corrective action, which may include but will not be limited to discharge in the case of employees, termination of agreements in the case of contractors, consultants, and vendors; termination of access in the case of Non Mercy Employed Health Care Individuals, students or volunteers; or revocation of medical staff membership and/or clinical privileges in the case of medical staff members, taken in accordance with applicable medical staff bylaws, rules and regulations.
Termination. I acknowledge that upon termination of my relationship with Mercy, I will cease access to Mercy systems and my accounts will be disabled or deleted from the system. Should I reenter into a relationship with Mercy; a new user account will be issued.
Reptrax (Applicable to Vendor/Contractors). I acknowledge that Reptrax is the approved Vendor/Contractor credentialing application used by Mercy. I understand my responsibilities around the use of Reptrax as outlined in the Mercy Vendor policy.
I have read the above user agreement and agree to abide by the stipulations set forth therein.