Notice of Privacy Practices
This Notice of Privacy Practices (NPP) describes how health
information about you may be used and disclosed and how you can get access
to this information. Please review it carefully. If you have any questions
about this NPP please contact the University Privacy Officer or a Unit
Privacy Officer at one of the University’s Health Care Components (HCC).
This NPP will explain:
-
How a HCC may use and disclose your Protected Health
Information (PHI);
-
Our obligations related to the use and disclosure of
your PHI;
-
Your rights related to any PHI that a HCC has or
retains about you.
This NPP describes how a HCC may use and disclose your PHI
to carry out treatment, payment and/or health care operations and for other
purposes that are permitted or required by law. It also describes your
rights to access and control your PHI. PHI is information about you,
including demographic information, which may identify you and that relates
to your past, present or future physical or mental health or condition and
related health care services.
The University HCC are required to abide by the terms of
this NPP. A copy is available at all HCCs, and at the below stated website.
The University may change the terms of this NPP, at any time. The new NPP
will be effective for all PHI that a HCC maintains at that time. The HCC
will provide you with any revised NPP by posting it on our website:
http://www.missouristate.edu/privacynotice and making it available when you visit
a HCC.
I. Uses and Disclosures of Protected Health Information (PHI)
On your first visit to a HCC, you may be asked to complete a
new patient information form and you will be required to sign an
acknowledgement of NPP. A copy of the NPP will be made available to you. A
HCC may obtain, but is not required to, your consent for the use or
disclosure of your PHI for treatment, payment and/or health care operations.
HCCs are required to obtain your authorization for the use or disclosure of
your information for other specific purposes or reasons. HCCs have listed
some of the types of uses or disclosures below. Not every possible use or
disclosure is covered, but all of the ways that a HCC is allowed to use and
disclose information will fall into one of the categories. Your PHI may be
used and disclosed by your provider, our office staff and others outside of
our office that are involved in your care and treatment for the purpose of
providing health care services to you. Your PHI may also be used and
disclosed to pay your health care bills and to support the operation of a
HCC. Following are examples of the types of uses and disclosures of your PHI
that a HCC is permitted to make.
A. Treatment: A HCC will use and disclose your PHI to
provide, coordinate, or manage your health care and any related services.
This includes the coordination or management of your PHI with a third
party that has already obtained your permission to have access to your
PHI. For example, a HCC would disclose your PHI, as necessary, to a home
health agency that provides care to you. A HCC will also disclose PHI to
other providers or health facilities that may treat you when it has the
necessary permission from you to disclose your PHI. For example, your PHI
may be provided to a health provider to whom you have been referred to
ensure that the provider has the necessary PHI to diagnose or treat you.
In addition, a HCC may disclose your PHI from time-to-time to another
health care provider (e.g., a specialist or laboratory) who, at the
request of your provider, becomes involved in your care by providing
assistance with your health care diagnosis or treatment to your provider.
B. Payment: Your PHI will be used, as needed, to
obtain payment for your health care services. This may include certain
activities that your health insurance plan may undertake before it
approves or pays for the health care services recommended for you such as:
making a determination of eligibility or coverage for insurance benefits,
reviewing services provided to you for medical necessity, and undertaking
utilization review activities. For example, a HCC may need to provide your
insurance plan information about treatment you received, so your insurance
will pay for the services.
C. Healthcare Operations: A HCC may use or disclose,
as needed, your PHI in order to support the business activities of a HCC.
These activities include, but are not limited to: quality assessment
activities, licensing, and employee review activities. In addition, a HCC
may use a sign-in sheet at the registration desk where you will be asked
to sign your name. The staff of a HCC may also call you by name in a lobby
when your provider is ready to see you. A HCC may use or disclose your
PHI, as necessary, to contact you to remind you of your appointment. A HCC
will share your PHI with third party "business associates" that perform
various activities (e.g., billing, reading of x-rays, performing
lab tests, transcription services) for the practice. Whenever an
arrangement between our office and a business associate involves the use
or disclosure of your PHI, the HCC will have a written contract that
contains terms that will protect the privacy of your PHI.
II. Uses and Disclosures of Protected Health Information Based upon Your
Written Authorization
Other uses and disclosures of your PHI will be made only
with your written authorization, unless otherwise permitted or required by
law as described below. You may revoke this authorization, at any time, in
writing, except to the extent that your provider has taken an action in
reliance on the use or disclosure indicated in the authorization.
A. Research : To comply with laws and regulations other
than HIPAA, Taylor Health and Wellness Center, Athletic Training Services,
Speech and Hearing Clinic, and other HCCs will not allow your PHI
collected by their staff, to be used in research projects without your
written consent. Under certain circumstances, the University may use and
disclose PHI about you for research purposes when the Institutional Review
Board has approved a waiver of authorization for the Protection of Human
Subjects. For example, a research project may involve comparing the health
and recovery of all patients who received one medication to those who
received another for the same condition. All research projects, however,
are subject to a special approval process under Missouri law. This process
evaluates a proposed research project and its use of health information,
trying to balance the research needs with patients' need for privacy of
their health information. Before we use or disclose PHI for research, the
project will have been approved through this research approval process.
The University may, however, disclose PHI about you to people preparing
to conduct a research project, for example, to help them look for
patients with specific medical needs, so long as the health information
they review does not leave the facility.
III. Uses and Disclosures of Protected Health Information That Do Not
Require Your Consent or Authorization
A HCC can use or disclose PHI about you
without your consent or authorization when:
-
There is an emergency or when a HCC is
required by law to treat you,
-
When a HCC is required by law to use or
disclose certain information, or
-
When there are substantial communication
barriers to obtaining consent from you.
A HCC can also use or disclose PHI about you
without your consent or authorization for:
A. Appointment Reminders : A HCC may use and disclose PHI to contact you as a reminder
that you have an appointment for treatment or services at a HCC.
B. Treatment Alternatives and
Health-Related Benefits and Services: A HCC may
use and disclose PHI to tell you about or recommend possible treatment
options or alternatives or health-related benefits or services that may be
of interest to you.
C. Individuals Involved in Disaster Relief: Should a disaster occur, a HCC may disclose PHI about you to
any agency assisting in a disaster relief effort so that your family can
be notified about your condition, status and location.
D. As Required By Law: A HCC will disclose PHI about you when required by law.
E. To Avert a Serious Threat to Health or
Safety: A HCC may use and disclose PHI about you
when necessary to prevent a serious threat to the health and safety of
you, the public, or any other person. However, any such disclosure would
only be to someone able to help prevent the threat.
F. Organ and Tissue Donation: If you are an organ donor, a HCC may release PHI to
organizations that handle organ procurement or organ, eye or tissue
transplantation or to an organ donation bank, as necessary to facilitate
organ or tissue donation and transplantation.
G. Military and Veterans: If you are a member of the armed forces, a HCC may release PHI
about you as required by military command authorities. A HCC may also
release PHI about foreign military personnel to the appropriate foreign
military authority.
H. Workers' Compensation: When disclosure is necessary to comply with Workers’
Compensation laws or purposes, a HCC may release PHI about you for
workers' compensation or similar programs. These programs provide benefits
for work-related injuries or illnesses.
I. Public Health Risks: A HCC may disclose PHI about you for public health activities.
These activities generally include the following: to prevent or control
disease, injury or disability; to report births and deaths; to report
child abuse or neglect; to report reactions to medications or problems
with products; to notify people of recalls of products they may be using;
to notify a person who may have been exposed to a disease or may be at
risk for contracting or spreading a disease or condition or to notify the
appropriate government authority if we believe a patient has been the
victim of abuse, neglect or domestic violence. The HCC will only make this
disclosure if you agree or when required or authorized by law.
J. Health Oversight Activities: A HCC may disclose PHI to a health oversight agency for
activities authorized by law. These oversight activities include, for
example, audits, investigations, inspections, and licensure. These
activities are necessary for the government to monitor the health care
system, government programs, and compliance with civil rights laws.
K. Lawsuits and Disputes: If you are involved in a lawsuit or a dispute, a HCC may
disclose PHI about you in response to a court or administrative order as
required by law.
L. Law Enforcement: A HCC may release PHI if asked to do so by a law enforcement
official; however, if the material is protected by 42 CFR Part 2 (a
federal law protecting the confidentiality of drug and alcohol abuse
treatment records), a court order is required. A HCC may also release
limited PHI to law enforcement in the following situations: (1) about a
patient who may be a victim of a crime if, under certain limited
circumstances, the HCC is unable to obtain the patient’s agreement; (2)
about a death a HCC believes may be the result of criminal conduct; (3)
about criminal conduct at the university; (4) about a patient where a
patient commits or threatens to commit a crime on the premises or against
program staff (in which case the HCC may release the patient’s name,
address, and last known whereabouts); (5) in emergency circumstances, to
report a crime, the location of the crime or victims, and the identity,
description and/or location of the person who committed the crime; and (6)
when the patient is a forensic client and the HCC is required to share
with law enforcement by Missouri statute.
M. Coroners, Medical Examiners and Funeral
Directors: A HCC may release PHI to a coroner or
medical examiner. This may be necessary, for example, to identify a
deceased person or determine the cause of death. A HCC may also release
PHI about patients of the university facilities to funeral directors as
necessary to carry out their duties.
N. National Security and Intelligence
Activities: A HCC may release PHI about you to
authorized federal officials for intelligence, counterintelligence, and
other national security activities authorized by law.
O. Protective Services for the President
and Others: A HCC may disclose PHI about you to
authorized federal officials so they may conduct special investigations or
provide protection to the President and other authorized persons or
foreign heads of state.
P. Inmates: If
you are an inmate of a correctional institution or under the custody of a
law enforcement official, PHI may be released about you to the
correctional institution or law enforcement official if the release is
necessary (1) for the institution to provide you with health care; (2) to
protect your health and safety or the health and safety of others; or (3)
for the safety and security of the correctional institution.
IV. Other Uses Or Disclosures Of Protected Health Information
Other uses or disclosures not covered in this NPP will not
be made without your written authorization, unless otherwise permitted or
required by law. If you provide a HCC with written authorization to use or
disclose information, you can change your mind and revoke your authorization
at any time, as long as it is in writing. If you revoke your
authorization, a HCC will no longer use or disclose the information.
However, a HCC will not be able to take back any disclosures that have been
made pursuant to your previous authorization.
V. Your Rights Regarding Health Information About You
You have the following rights regarding PHI a HCC maintains
about you:
A. Right to Inspect and Copy : You have the right to
inspect and receive a copy of your PHI with the exception of
psychotherapy notes and information compiled in anticipation of
litigation. To inspect and receive a copy of your PHI, you must submit
your request in writing to a HCC’s Unit Privacy Officer or designee. If
you request a copy of the information, the HCC may charge a fee for the
costs of copying, mailing or other supplies associated with your request.
A HCC may deny your request to inspect and copy in certain limited
circumstances. If you are denied access to your PHI because of a threat or
harm issue, you may request that the denial be reviewed. Another licensed
health care professional chosen by a HCC will review your request and the
denial. The person conducting the review will not be the person who denied
your request. The HCC will comply with the outcome of the review.
B. Right to Request an Amendment: If you feel your PHI
that a HCC has about you is incorrect or incomplete, you may ask to have
the information amended. You have the right to request an amendment for as
long as the information is kept by or for the HCC. Requests for an
amendment must be made in writing and submitted to the Unit Privacy
Officer or designee. You must provide a reason to support your request for
an amendment. A HCC may deny your request if it is not in writing or if it
does not include a reason supporting the request. In addition, a HCC may
deny your request if you ask us to amend information that:
-
Was not created by a HCC, unless the person or entity
that created the
information is no longer available to make the amendment;
-
Is not part of the PHI kept by or for a HCC;
-
Is not part of the information which you would be
permitted to inspect and copy or;
-
Is accurate and complete.
C. Right to an Accounting of Disclosures: You have the
right to request an "accounting of disclosures", a list of the disclosures
made by a HCC of your PHI. To request an accounting of disclosures, you
must submit your request in writing to the HCC’s Unit Privacy
Officer or designee. Your request must state a time period which may not
go back more than six years and cannot include dates before April 14,
2003. Your request should indicate in what form you want the list (for
example, on paper or electronically). The first list you request within a
twelve-month period will be free. For additional lists in a twelve-month
period, a HCC may charge you for the cost of providing the list. A HCC
will notify you what that cost will be and give you an opportunity to
withdraw or modify your request before you are charged. There are some
disclosures that a HCC does not have to track. For example, when you give
a HCC an authorization to disclose some information, the HCC is not
required to track that disclosure.
D. Right to Request Restrictions: You have the right
to request a restriction or limitation on the PHI a HCC uses or discloses
about you for treatment, payment and/or health care operations. For
example, you could ask that a HCC not use or disclose information about
your family history to a particular community provider. The HCC is not
required to agree to your request. If a HCC does agree, it will comply
with your request unless the information is needed to provide you
emergency treatment. To request restrictions on the use or disclosure of
your PHI for treatment, payment or health care operations, you must make
your request in writing to the HCC’s Unit Privacy Officer or designee. In
your request, you must tell a HCC (1) what information you want to limit;
(2) whether you want to limit our use, disclosure or both; and (3) to whom
you want the limits to apply (for example, disclosures to your spouse).
E. Right to Request Confidential Communications: You
have the right to request that a HCC communicate with you about medical
matters in a certain way or at a certain location. For example, you can
ask that a HCC only contact you at work or by mail. To request
confidential communications, you must make your request in writing
to a HCC’s Unit Privacy Officer or designee. Your request must specify how
or where you wish to be contacted. A HCC will not ask you the reason fior
your request and will accommodate all reasonable requests.
F. Right to a Paper Copy of This Notice: You have the
right to a paper copy of this notice even if you have agreed to receive
the notice electronically. You may ask a HCC to give you a copy of this
notice at any time by contacting the HCC’s Unit Privacy Officer or
designee. You may also obtain a copy of this notice at our website
http://www.missouristate.edu/privacynotice.
VI. Changes To This Notice
The University reserves the right to change this NPP. The
University may make the revised notice effective for PHI a HCC already has
about you as well as any information a HCC receives in the future. The
University will post a copy of the current NPP in all HCCs. The NPP will
contain on the first page, in the top right-hand corner, the effective date.
In addition, each time you register at or are admitted or apply for services
to the HCC for treatment and/or services, you will be offered a copy of the
current NPP in effect. If you want to request any revised NPP, you may
access it at our website,
http://www.missouristate.edu/privacynotice.
VII. Complaints
If you believe your privacy rights have been violated you
may:
A. File a complaint with a HCC by contacting its Unit
Privacy Officer or Designee by dialing the HCC’s main number, or the
University’s Privacy Officer by dialing the University at (417-836-5000),
or by mail: University Privacy Officer, Taylor Health and Wellness Center,
Missouri State University, 901 South National Avenue,
Springfield, MO 65804.
B. File a complaint with the University or a HCC or
the Secretary of the Department of Health and Human Services. You may call
them at 877-696-6775 or write to them at 200 Independence Ave. S.W.,
Washington, DC, 20201.
C. File a grievance with the Office of Civil Rights by
calling 866-OCR-PRIV (866-627-7748), or 886-788-4989 TTY.
All complaints must be submitted in writing. You will
not be penalized for filing a complaint.
HIPAA Procedure 1.005, Form 2
|
