Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Understanding Your Health Record/Information

Each time you visit a hospital, physician, or other health care provider, a record of your visit is made. Typically, this record contains your symptoms, examinations, test results, diagnoses, treatment, and a plan for future care or treatment. This information, often referred to as your health or medical record, is used in many ways to contribute to your individual health and the overall health of the University and community as a whole.

When viewed as an individual, the information contributes to individual health in the following ways:

• A basis for planning your care and treatment
• A means of communication among the many health professionals who contribute to your care
• A legal document describing the care you received
• A means by which you or a third-party payer can verify that services billed were actually provided

The same information can be aggregated or compiled to find the overall health of the University, to identify trends and needs for the University community, and to help improve the care provided to our student patients. All personally identifiable information is removed during the aggregation process to ensure confidentiality is maintained.

When the aggregate data is viewed, this information is used in the following manner:

• As a tool in educating health professionals
• As a source of data for medical research
• As a source of information for public health officials charged with improving the health of the nation
• As a source of data for facility planning
• As a tool we can use to assess and improve the care we render and the outcomes we achieve

An understanding to what is in your record and how your health information is used helps you to:

• Ensure its accuracy
• Better understand who may access your health information and under what circumstances they may access your information
• Make informed decisions when authorizing disclosure of Personally Identifiable Medical Records to others

Our Responsibilities

• Maintain the privacy of your health information as required by law
• Provide you with a notice as to our legal duties and privacy practice with respect to information we collect and maintain about you
• Abide by the terms of this notice
• Notify you if we are unable to agree to a requested restriction
• Accommodate reasonable requests you may have to communicate health information by alternative means or at alternative locations

We reserve the right to change our practices and to make the new provisions effective for all protected health information we maintain. Should our information practices change, we will post a new revision on the University Health Services Web Site. We will not use or disclose your health information without your written authorization, except as described in this notice.

Although your health record is the physical property of the healthcare practitioner or facility that compiled it, the information belongs to you. Federal Law provides you the right to:

• Request a restriction on certain uses and disclosures of your information. GSHS is not required to agree to a restriction, except in limited circumstances, such as for psychotherapy notes or information gathered for judicial proceedings
• Upon your request, you may at any time receive a paper copy of this notice, even if you earlier agreed to receive this notice electronically
• Inspect and obtain a copy of your health records
• Amend your health record if you believe it is incorrect or incomplete. However, GSHS is not required to amend your health information, and if your request is denied, GSHS will provide you with information about our denial and how you can disagree with our denial.
• Obtain an accounting of disclosures of your health information. In some limited instances, you have the right to ask for a list of the disclosures of your health information we have made during the previous six years, but the request cannot include dates before April 14, 2003. This list must include the date of each disclosure, who received the disclosed health information, a brief description of the health information disclosed, and why the disclosure was made. The list will not include disclosures made for the purposes of treatment, payment, healthcare operations, our directory, national security, law enforcement/corrections, and certain health oversight activities. We must comply with your request for a list within 60 days, unless you agree to a 30-day extension. The first accounting in any 12 month period is provided without charge. We may charge you for subsequent requests.
• Receive communications of protected health information from GSHS by alternative means or at alternative locations
• GSHS must accommodate reasonable requests
• Authorize use or disclosure of any of your protected health information by using the Authorization to Use or Disclose Health Information Form
• Revoke your authorization to use or disclose health information except to the extent that action has already been taken.

The following areas describe the ways GSHS may use or disclose your health information without written consent. For each area, an example will be given. Not every use or disclosure in the respective areas will be listed. However, all the ways GSHS is permitted to use and disclose information will fall within one of these areas.

For Treatment

For example: Information obtained by a nurse, physician, or other member of your health care team will be recorded in your record and used to determine the course of treatment that should work best for you. Your physician will document in your record his or her expectations of the members of your health care team. Members of your health care team will then record the actions they took and their observations. This will assist the physician determine how you are responding to treatment. We will also provide your physician or subsequent health care provider with copies of various reports that should assist him or her in treating you once you are discharged from this facility.

For Collection of Payment

For example: A bill may be sent to you or a third-party payer (i.e. an insurance company). The information on or accompanying the bill may include information that identifies you, as well as your diagnosis, procedures, and the supplies used.

For Regular Health Care Operations

For example: Members of the Medical Staff, the Risk or Quality Improvement Manager, or members of the Quality Improvement team may use information in your health record to assess the care and outcomes in your case and others like it. This information will then be used in an effort to continually improve the quality and effectiveness of the health care and service we provide.

Business Associates

Some of the services provided by our facility require interaction with a contracted Business Partner. Examples include radiology, certain laboratory tests, software vendors, and the Accreditation Association for Ambulatory Health Care (AAAHC). When these services are contracted, we may disclose your health information to our business associate so that they can perform the job they have been entrusted to fulfill and bill you or your third-party payer for services rendered. To protect your health information, however, we require the business associate to appropriately safeguard your information, and all are bound by a confidentiality agreement.

To Those Involved with Your Care or Payment of Your Care

If people such as family members, relatives, or close personal friends are helping care for you or helping you pay your medical bills, we may release important health information about you to those people. The information released to these people may include your location within our facility, your general condition, or death. You have a right to object to such disclosures, unless you are unable to function or there is an emergency. In addition, we may release your health information to organizations authorized to handle disaster relief efforts so those who care for you can receive information about your location or health status. We may allow you to agree or disagree orally to such release, unless there is an emergency.

Research

We may disclose information to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your health information. This includes removing any Personally Identifiable Medical Records.

Marketing

We may contact you to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you.

Food and Drug Administration (FDA)

We may disclose to the FDA health information relative to adverse events with respect to food, supplements, product and product defects, or post marketing surveillance information to enable product recalls, repairs, or replacement.

Workers Compensation

We may disclose health information to the extent authorized by and to the extent necessary to comply with laws relating to workers compensation or other similar programs established by law.

Public Health

As required by law, we may disclose your health information to public health or legal authorities charged with preventing or controlling disease, injury, or disability. GSHS may also disclose your health information to appropriate persons in order to prevent or lessen a serious and imminent threat to the health or safety of a particular person or the general public.

Correctional Institution

Should you be an inmate of a correctional institution, we may disclose to the institution or agents thereof health information necessary for your health and the health and safety of other individuals.

Required by Law

We may disclose health information for law enforcement purposes, as required by law, or in response to a valid subpoena. Federal law makes provision for your health information to be released to an appropriate health oversight agency, public health authority or attorney, provided that a work force member or business associate believes in good faith that we have engaged in unlawful conduct, or have otherwise violated professional or clinical standards, and are potentially endangering one or more patients, workers, or the public.