HIPAA Privacy Policy

UNIVERSITY OF MIAMI HEALTH SYSTEM NOTICE OF PRIVACY PRACTICES
EFFECTIVE DATE: SEPTEMBER 20, 2013

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN ACCESS THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

WHEN THIS NOTICE APPLIES

This notice summarizes the privacy practices of the University of Miami Health System which includes the University of Miami Hospital and Clinics (UMHC), University of Miami Sylvester Comprehensive Cancer Center, the Anne Bates Leach Eye Hospital, the Bascom Palmer Eye Institute, the University of Miami Hospital (UMH), the University of Miami clinics affiliated with the hospitals, the University of Miami physician practices, their workforce, medical staff, physicians and other health care professionals who provide you with treatment and health care services at such locations (”University”). We may share protected health information (“Health Information”) about you with each other for purposes described in this notice, including for our joint administrative activities.

Your Health Information includes information that the University collects which identifies you and includes information such as your name, date of birth, dates of services, diagnosis, treatments, medications, demographic information (name, address, home/cellular/work telephone numbers, emails, and social security number), photographs, etc.

OUR OBLIGATIONS

We are required by law to:

• Maintain the confidentiality of protected health information;
• Give you this notice of our legal duties and privacy practices regarding health information about you; and
• Follow the terms of our notice that is currently in effect.

HOW WE MAY USE AND DISCLOSE HEALTH INFORMATION

When you receive services or treatment from the University, you will be asked to sign a consent form in which you permit us to use and disclose information about you in ways that are permitted by the federal privacy law, as summarized in this Notice. However, some kinds of health information are subject to separate special privacy protections under the laws of the State of Florida or other federal laws, so that portions of this notice may not apply. If you receive alcohol or substance abuse services or treatment from our substance abuse treatment program, you will receive a separate notice describing how we may use and disclose and protect the privacy of health information regarding your alcohol or substance abuse treatment. In addition, special rules apply to the results of human immunodeficiency virus (“HIV”) tests that identify you or the fact that an HIV test has been performed on you (“HIV test results”). The section below entitled “How We May Use and Disclose HIV Test Results” describes how we may use and disclose this type of health information. Finally, the section below entitled “How We May Use and Disclose Psychotherapy Notes” describes how we may use and disclose notes from psychotherapy counseling sessions in which you participate.

In most circumstances, the following uses and disclosures of your Health Information will require that you sign a written authorization for: (1) uses and disclosures of psychotherapy notes; (2) uses and disclosures of Health Information for marketing purposes; (3) uses and disclosures of Health Information where the University receives remuneration in exchange for disclosing such Health Information; and (4) any other uses and disclosures of Health Information not described in this Notice.

The following categories of activities describe the ways that we may use and disclose your Health Information without obtaining your prior written authorization. Some of the categories include examples, but not every type of use or disclosure included in a category is listed. Except for the categories of activities described below, we will use and disclose Health Information only with written permission from you. If you give us permission to use or disclose Health Information (including HIV test results and psychotherapy notes) for a purpose not listed in this notice, you may revoke that permission at any time by sending a written request to our Privacy Office at the address listed at the end of this notice.

1. For Treatment. We may use Health Information to treat you or provide you with health care services. We may disclose Health Information to doctors, nurses, technicians, or other personnel, including people outside our facilities or clinics who may be involved in your medical care. For example, we may tell your primary physician about the care we provided you or give Health Information to a specialist to provide you with additional services as appropriate for treatment purposes.
2. For Payment. We may use and disclose Health Information so that we, or others may bill or receive payment from you, a government program or an insurance company or other responsible third party for the treatment and services you receive. For example, we may give your health plan information about your treatment so that your health plan will pay for the cost of such treatment. We also may tell your health plan about the services that you are going to receive to obtain prior approval or to determine whether your plan will cover the services.
3. For Health Care Operations. We may use and disclose Health Information for health care operations, which are administrative activities involved in operating the University. These uses and disclosures are necessary to maintain quality care when delivering services to our patients and for our business and management purposes. For example, we may use Health Information to review the adequacy and quality of the care that our patients receive.
4. Appointment Reminders, Treatment Alternatives, and Health-Related Benefits and Services. We may use and disclose Health Information to contact you as a reminder that you have an appointment with us. We also may use and disclose Health Information to tell you about treatment options, alternatives, health-related benefits, or services that may be of interest to you.
5. Fundraising Activities. We may use your demographic information (e.g., name, address, telephone numbers and other contact information), the dates of health care provided to you, your health care status, the department and physician(s) who provided you services, and your treatment outcome information in contacting you in an effort to raise funds in support of the University and other non-profit entities with whom the University is conducting a joint fundraising project. We may also disclose this information to a related foundation or to our business associates so that they may contact you to raise funds for us and other non-profit entities with whom the University is conducting a joint fundraising project. For example, you may get invitations to fundraising events or other types of mailing for University events, affiliated programs, and other joint fundraising programs.
6. Facility Directory. If you are a patient of a University of Miami facility, we may list your name, general condition (e.g., fair, critical), and location in our hospital directory, unless you ask us not to. We may disclose this information to anyone who asks for you by name.
7. Clergy. We may disclose the information in our facility directory and information that you choose to provide us regarding your religious affiliation to members of the clergy for use and disclosure in their religious activities.
8. Individuals Involved in Your Care or Payment for Your Care. We may disclose Health Information to a person, such as a family member or friend, who is involved in your medical care or helps pay for your care, such as a family member or friend. We also may notify such individuals about your location or general condition, or disclose such information to an entity assisting in a disaster relief effort.
9. Research. Under certain circumstances, as an academic medical center, we may use and disclose Health Information for research purposes. For example, a research project may involve comparing the health and recovery of all patients who received one medication or treatment to those who received another, for the same condition. Before we use or disclose Health Information for research, the project will go through a special approval process. This process evaluates a proposed research project and its use of Health Information to balance the benefits of research with the need for privacy of Health Information. We also may permit researchers to look at records to help them identify patients who may be included in their research project or for other similar purposes.

SPECIAL CIRCUMSTANCES

In addition to the above, we may use and disclose Health Information in the following special circumstances:

1. As Required by Law. We will disclose Health Information when required to do so by international, federal, state or local law.
2. To Avert a Serious Threat to Health or Safety. We may use and disclose Health Information when necessary to prevent or lessen a serious threat to your health or safety, or the health or safety of the public or another person. Any disclosure, however, will be to someone who we believe may be able to help prevent the threat.
3. Business Associates. We may disclose Health Information to the business associates that we engage to provide services on our behalf if the information is needed for such services. For example, we may use another company to perform billing services on our behalf. Our business associates are obligated, under contract with us, to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract with them.
4. Organ and Tissue Donation. If you are an organ donor, we may release Health Information to organizations that handle organ procurement or organ, eye, or tissue transplantation or to an organ donation bank, as necessary, to facilitate organ or tissue donation and transplantation.
5. Military and Veterans. If you are a member of the armed forces, we may release Health Information as required by military command authorities. We also may release Health Information to the appropriate foreign military authority if you are a member of a foreign military.
6. Workers’ Compensation. We may disclose Health Information as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.
7. Public Health Risks. We may disclose Health Information for public health activities. These activities generally include disclosures to prevent or control disease, injury or disability; report births and deaths; report child abuse or neglect; report reactions to medications or problems with products; notify people of recalls of products they may be using; track certain products and monitor their use and effectiveness; if authorized by law, notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; and conduct medical surveillance of our facilities in certain limited circumstances concerning workplace illness or injury. We also may release Health Information to an appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence; however, we will only release this information if the patient agrees or when we are required or authorized by law.
8. Health Oversight Activities. We may disclose Health Information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure of our facilities and providers. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
9. Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose Health Information in response to a court or administrative order. We also may disclose Health Information in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.
10. Law Enforcement. We may release Health Information if asked by a law enforcement official as follows: (1) in response to a court order, subpoena, warrant, summons or similar process; (2) limited information to identify or locate a suspect, fugitive, material witness, or missing person; (3) about the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement; (4) about a death we believe may be the result of criminal conduct; (5) about evidence of criminal conduct on our premises; and (6) in emergency circumstances to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime.
11. Coroners, Medical Examiners and Funeral Directors. We may release Health Information to a coroner or medical examiner. In some circumstances this may be necessary, for example, to determine the cause of death. We also may release Health Information to funeral directors as necessary for their duties.
12. National Security and Intelligence Activities. We may release Health Information to authorized federal officials for intelligence, counter-intelligence, and other national security activities authorized by law.
13. Protective Services for the President and Others. We may disclose Health Information to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.
14. Inmates or Individuals in Custody. In the case of inmates of a correctional institution or that are under the custody of a law enforcement official, we may release Health Information to the appropriate correctional institution or law enforcement official. This release would be made only if necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

HOW WE MAY USE AND DISCLOSE HIV TEST RESULTS

We may use and disclose HIV test results for the purposes described above only if you give your permission to use and disclose these HIV test results along with your medical records at the time of testing. If you did not give such permission, we may use and disclose this information only for the following limited purposes without your written authorization:

1. For Treatment. We may use HIV test results to provide you with health care services. We may disclose HIV test results to doctors, nurses, technicians, or other providers who may be involved in your medical care. For example, we may tell a specialist about your HIV status to enable the specialist to provide additional services to you.
2. For Payment. We may use HIV test results when compiling or reviewing records as part of routine billing. For example, we may review your medical record, which contains HIV test results, to enable us to bill properly for your care.
3. For Health Care Operations. We may use HIV test results if necessary to enable us to deliver quality services to our patients. For example, we may use HIV test results to determine whether we are providing appropriate services to you. We also may disclose HIV test results to health facility staff committees to enable them to monitor and evaluate programs.
4. Public Health. We may disclose HIV test results to the Florida department of health for reporting and disease control purposes.
5. Organ and Tissue Donation. We may disclose HIV test results to organizations that procure, process, distribute or use organs, eyes, or tissues for donation purposes.
6. Research. We may disclose HIV test results to authorized medical or epidemiological researchers, as described above.
7. Threats to Safety. We may disclose HIV test results to child-placing or child-caring agencies, family foster homes, residential facilities or community-based care programs that are directly involved in placement, care, control or custody and who have a need to know such information. We also may disclose HIV test results to a sex or needle sharing partner to the extent permitted by the law.
8. Court Order. We may disclose HIV test results in accordance with a court order that specifically requires such disclosure.
9. As Permitted by Law. If an officer, law enforcement personnel, firefighter, ambulance driver, paramedic or emergency medical technician comes into contact with a person in such a way that significant exposure to HIV has occurred, then we may release such HIV test results to a person who was significantly exposed to HIV.

HOW WE MAY USE AND DISCLOSE PSYCHOTHERAPY NOTES

We may use and disclose notes taken during psychotherapy counseling that you received from the University only for the following limited purposes:

1. For Treatment. The physician or therapist that created the psychotherapy notes may use notes that identify you for your treatment or to provide you with health care services. For example, a physician may review his notes prior to your therapy session.
2. Legal Action. We may use and disclose psychotherapy notes that identify you to defend the University of Miami in a legal action or other proceeding. For example, we may provide psychotherapy notes to our lawyers who are defending the University in a legal case.
3. Required by Law. We will disclose psychotherapy notes that identify you when required to do so by international, federal, state or local law.
4. Health Oversight Activities. We may disclose psychotherapy notes that identify you to a health oversight agency for oversight activities involving the creator of the notes. These oversight activities are described above.
5. Coroners and Medical Examiners. We may release psychotherapy notes that identify you to a coroner or medical examiner, as described above.
6. To Avert a Serious Threat to Health or Safety. We may use and disclose psychotherapy notes that identify you when necessary to prevent or lessen a serious threat to health and safety, as described above.

YOUR RIGHTS

You have the following rights, subject to certain limitations, regarding Health Information that we maintain about you:

1. Right to Inspect and Copy. You have the right to inspect and receive a copy of your Health Information that may be used to make decisions about your care or payment for your care, including information kept in an electronic health record, and/or tell us where to send the information.

   Please note that there may be a charge for paper or electronic copies of your records.

2. Right to Amend. If you feel that Health Information that we have is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is maintained by or for us. You must tell us the reason for your request.

   We may deny your request for an amendment to your record. We may do this if your request is not in writing or does not include a reason to support the request. We also may deny your request if you ask us to amend information that:

   • we did not create;
   • is not part of the records used to make decisions about you;
   • is not part of the information which you are permitted to inspect and to receive a copy; or
   • is accurate and complete.
3. Right to an Accounting of Disclosures. You have the right to request an accounting of certain disclosures of Health Information that we made.
4. Right to Request Restrictions. You have the right to request a restriction or limitation on the Health Information that we use or disclose for treatment, payment, or health care operations. You have the right to request a limit on the Health Information that we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not share information about your surgery with your spouse. We are not required to agree to your request. If we agree to your request, we will comply with your request unless we need to use the information in certain emergency treatment situations.

   In addition, you have the right to request that we restrict disclosure of your Health Information to your health plan if the disclosure is for the purpose of carrying out payment or health care operations (and is not for the purpose of carrying out treatment) and the Health Information pertains solely to a health care item or service for which you have paid in full. The University is not required to comply with your request if you do not pay for the service in full.

5. Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we contact you only by mail or at work. Your request must specify how or where you wish to be contacted. We will accommodate reasonable requests. By providing us with certain information, you expressly agree that the University and its business associates can use certain information (such as your home/work/cellular telephone number and your email), to contact you about various matters, such as follow up appointments, collection of amounts owed and other operational matters. You agree you may be contacted through the information you have provided and by use of prerecorded/artificial voice messages and use of an automatic/predictive dialing system.
6. Right to Opt-Out of Fundraising Communications. You have the right to ‘Opt-Out’ of receiving fundraising communications. You may do so by sending an email including your full name, address, and telephone number to medoptout@med.miami.edu. In the alternative, you may send the same information via mail to the address below. Normal processing time may take up to two (2) weeks from the date of receipt. During that processing time, you may continue to receive fundraising communications until our system is updated.
7. Right to a Paper Copy of This Notice.Right to a Paper Copy of This Notice. You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. You may obtain a copy of this notice at any time on the Privacy Office website: http://privacyoffice.med.miami.edu/

Breach Notification

We will keep your Health Information private and secure as required by law. If there is a breach (as defined by law) of any of your Health Information, then we will notify you within 60 days following the discovery of the breach, unless a delay in notification is requested by law enforcement.

Electronic Health Information Exchange

The University participates and in the future may participate in various systems of electronic exchange of health information with other healthcare providers, health information exchange networks and health plans. Your Health Information maintained at the University may be accessed by other providers, health information exchange networks and health plans for the purposes of treatment, payment, or health care operations. In addition, the University may access your Health Information maintained by other providers, health information exchange networks and health plans for treatment, payment or health care operation purposes.

HOW TO EXERCISE YOUR RIGHTS

To exercise any of your rights described in this notice, other than to obtain a paper copy of this notice, you must contact any UM Document/Records Custodian or you may send a written request to:

University of Miami
Office of HIPAA Privacy & Security
P.O. Box 019132 (M-879)
Miami, Florida 33101
305-243-5000
1-866-366-(HUSH)4874

or you may bring your written request personally to the Privacy Office located in the Professional Arts Center, 1150 NW 14th Street, Miami, Florida. For additional information, please visit our website: http://privacyoffice.med.miami.edu.

NO OTHER STAFF MEMBER, PHYSICIAN, NURSE, CLERGY MEMBER, OR ANY OTHER PERSON IS AUTHORIZED TO ACCEPT A REQUEST TO EXERCISE YOUR RIGHTS.

CHANGES TO THIS NOTICE

We reserve the right to change this notice and to make the revised or changed notice effective for Health Information that we already have as well as any information we receive in the future. We will post a copy of the current notice at our hospitals, clinics and physician offices. The notice will contain the effective date on the first page, in the top right-hand corner.

COMPLAINTS AND QUESTIONS

If you believe your privacy rights have been violated, you may file a complaint with us, or the Secretary of the U.S. Department of Health and Human Services. To file a complaint with us, contact our Privacy Office at the address listed above. All complaints must be made in writing. You will not be penalized for filing a complaint.

If you have any questions about this notice, please contact our Privacy Office at 305-243-5000 or 1-866-366-HUSH (4874).