Professional Integrity Office
USF Health

Notice of Privacy Practices

USF Logo

 

UNIVERSITY OF SOUTH FLORIDA

COLLEGES OF MEDICINE AND NURSING

NOTICE OF PRIVACY PRACTICES

Effective Date: September 23, 2013

 

NOTICE OF PRIVACY PRACTICES

USF HIPAA COVERED HEALTH CARE COMPONENTS

 

This notice describes how medical (PERSONAL HEALTH) information about you may be used and disclosed, and how you can get access to this information.  IT ALSO DESCRIBES SOME OF THE RIGHTS YOU HAVE REGARDING YOUR PERSONAL HEALTH INFORMATION.  Please review it carefully.

 

USF HIPAA COVERED HEALTH CARE COMPONENTS

The USF HIPAA covered health care components consist of the USF Health Morsani College of Medicine, and its constituent schools and departments (including the USF School of Physical Therapy and Rehabilitation Sciences); the USF College of Pharmacy; the USF Student Health Services; the Johnnie B. Byrd, Sr. Alzheimer’s Center and Research Institute; the USF College of Behavioral Sciences  Department of Communication Sciences and Speech Disorders; the USF Medical Services Support Corporation (MSSC); the University Medical Service Association, Inc. (UMSA); and the USF administrative and operational units that support them.  For purposes of this Notice, these components will be referred to as the “Covered Components” or “we”, “us,” and “our.”

 

As a teaching and research institution, patient care provided by the USF HIPAA Covered Health Care Components is overseen and supervised by physicians and other health care professionals of the USF faculty, and provided by a team of health care professionals.  Health care trainees, including medical residents, fellows, students and other trainees may participate in care of patients of the Covered Components.

 

All physicians, other healthcare professionals, faculty, employees, trainees, students, volunteers and other personnel of the Covered Components (collectively, the “Workforce”) and any USF administrative personnel when they are using and disclosing patients’ health information in support of the Covered Components follow this Notice.

 

This Notice of Privacy Practices (“Notice”) applies to information and records regarding your health care that is created, used and/or maintained by the Covered Components. 

 

Our pledge regarding your health information:

We are committed to treating your health information responsibly.  We promise to treat your information as private and follow all the laws applicable to the privacy of health information used or disclosed in providing your care, in our teaching activities, and in our research studies.  We are required by law to:

·        maintain the privacy of your health information;

·        give you this Notice describing our legal duties and privacy practices with respect to health information about you;

·        notify you following a breach of your unsecured protected health information; and

·        follow the terms of the Notice that is currently in effect.

 

What Does My Personal Health Information Include?

Your personal health information may contain information that identifies you, including your name, address, and other identifying information.  We create a record of your personal health information when providing health care services to you that contains your medical conditions and the care and services we provide to you, including, for instance, the results of diagnostic tests, such as lab work and x-rays. Your personal health information may be kept in various forms; including typed or handwritten entries in the medical record or as an image such as a photograph, x-ray or radiology scan. We also keep information about your insurance status, charges and bills for services we provide to you and about your payment for those services, or payment made on your behalf by your health plan or health insurance company. All of this information is considered personal health information.

 

 

How We May Use and Disclose Your Personal Health Information:

The following categories, with examples provided, describe routine ways that we may use and disclose your health information.   Not every use or disclosure in a category will be listed.  However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

 

When We Can Use or Disclose Your Personal Health Information Without Asking You First:

 

For Treatment. We may use your personal health information to treat you and to coordinate and arrange services for you.  Your personal health information will be shared with doctors, nurses, technicians, medical students and other healthcare trainees, or other personnel who are involved in your care.  For example, a doctor treating you for a broken bone may need to know if you have diabetes because diabetes may slow the healing process.  Different departments of the Covered Components may share medical information about you in order to coordinate the different services you need, such as lab work and x-rays. We also may disclose your information to doctors or other health care providers outside the Covered Components who are involved in your medical care.

 

For Payment. We may use and release your personal health information for the purpose of billing and collecting payment for services we provide to you.  For example, we may need to give your health plan or health insurance company information about surgery we performed so your health plan will pay us or reimburse you for the surgery. We may use your health information to verify your health plan benefits, such as telling your health plan about a treatment you are going to receive in order to obtain prior approval or to determine whether your plan will cover the treatment.

 

For Health Care Operations. We may use and disclose your health information for our business operations and in making sure that all of our patients receive quality care. For example, we may use your health information to review our services and to evaluate the performance of our staff in caring for you. We may also review health information about our patients in order to decide what additional services to offer, what services are not needed, and whether certain new treatments are effective. We may disclose your personal health information to doctors, nurses, technicians, students, and other affiliated personnel to train or educate them. Sometimes, we may compare information from our medical records with information from other medical groups to see how we are doing and where we can make improvements in our care and in the services we offer. We may also share your personal health information with other health care providers and health plans that serve you, if they need your information to conduct their own business operations.

 

Communications, Treatment Alternatives, Benefits and Services.  In the course of providing health care services to you, we may use your personal health information to contact you with a reminder that you have an appointment.  In addition, we may send you other communications such as newsletters or announcements of support group activity or educational services we offer.  We may also communicate with you about a drug you use. In addition, provided we have not received payments for the following communications, we may communicate with you: about products or services related to your treatment; about case management or care coordination; or to recommend   alternative treatments, therapies, health care providers, or care settings.

 

Fundraising.  USF may use, or disclose to its Foundation or a Business Associate, the following information for the purpose of raising funds in support of the University: your demographic information including name, address, other contact information, age, gender and date of birth; dates of health care provided to you; department of service information; treating physician; outcome information; and health insurance status.  However, we must obtain your prior written permission to use any information other than this information for fundraising purposes. For example, we will not use your diagnosis for fundraising purposes without your written authorization. You have the right to “opt out” or decline to receive written communications about fundraising in the future. To opt out or decline future fundraising communications, contact University of South Florida Physician Group (“USFPG”) Clinical Operations Administration listed at the end of the Notice.

 

Individuals Involved in Your Care or Payment for Your Care. We may release your personal health information to a family member, friend, personal representative, or other person who is involved in your medical care or who helps pay for your care if you agree to this release of personal health information or, if when given an opportunity, you do not object.  If you are incapacitated, your health care provider may use his or her professional judgment, and decide that it is in your best interest to disclose your personal health information to a family member, friend or other person who is involved in your care. In any of these cases, your health care provider will discuss only that information that the person involved needs to know about your care or payment for your care. We may also disclose your personal health information to an agency (like the Red Cross) that is assisting in a disaster relief effort so that your family can be notified about your condition, status and location.

 

Research. We use and disclose your personal information for research as allowed by federal and state law.  All research projects and use of your personal health information for research is approved by a qualified and duly constituted Institutional Review Board or approved by a special privacy board.    In some cases, we will get your written permission before using or disclosing your personal health information for research purposes.

  

To Prevent a Serious Threat to Health or Safety. We may use and disclose your personal health information when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.  Any disclosure, however, would only be to someone able to help prevent or lessen the threat.

 

As Required By Law. We will disclose your health information when required to do so by federal, state or local law.

 

SPECIAL SITUATIONS:

 

Organ and Tissue Donation. If you are an organ donor, we may disclose your personal health information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary, to arrange organ or tissue donation and transplantation.

 

Military and Veterans. If you are a member of the United States Armed Forces, we may disclose your personal health information as required by military authorities. We may also disclose personal health information about foreign military personnel to the appropriate foreign military authority.

 

Workers' Compensation. We may release your personal health information for workers' compensation or similar programs. These programs provide benefits for work related injuries or illness.

 

Public Health Activities. We may disclose your personal health information to authorized public health officials (e.g. government officials responsible for controlling disease, injury or disability, such as the Florida Department of Health or the United States Centers for Disease Control and Prevention), or to a foreign government agency collaborating with such officials, so they may carry out their public health activities.  If you have a communicable disease, we may also share your information with others who may have been exposed to your illness, if the law either allows us or directs us to do that to protect other people.

 

Health Oversight, Licensing, Accreditation and Regulatory Activities.  We may disclose your personal health information to health oversight agencies authorized to conduct audits, investigations, and inspections of our facilities or health care practices (e.g., government benefit programs such as Medicare and Medicaid,  the Accreditation Council for Graduate Medical Education,  the Food and Drug Administration (FDA), etc.)

 

Lawsuits and Disputes.  We may disclose your personal health information if we are ordered to do so by a court or an administrative hearing officer that is handling a lawsuit or other dispute or if we receive a valid subpoena, court order, discovery request, warrant, summons or other lawful instructions from a court or other public body that requires us to turn over your records.

 

Law Enforcement. We may disclose your identity and your other personal health information to law enforcement officials for the following purposes:

·         In response to a court order, subpoena, warrant, summons, or similar process or as required by law;

·         To assist law enforcement officers with identifying or locating a suspect, fugitive, material witness, or missing person;

·         If you have been the victim of a crime and we determine that: (1) we have been unable to obtain your agreement because of an emergency or your incapacity; (2) law enforcement officials need this information immediately to carry out their law enforcement duties; and (3) in our professional judgment disclosure to these officers is in your best interest;

·         If we suspect your death may be the result of criminal conduct; or

·         If necessary to report a crime on our property or crimes discovered or witnessed by our staff.

 

Coroners, Medical Examiners and Funeral Directors. In the event of your death, we may disclose your personal health information to a coroner or medical examiner.  This may be necessary, for example, to determine the cause of death.  We may also disclose this information to funeral directors as necessary to carry out their duties.

 

National Security and Intelligence Activities or Protective Services. We may disclose your personal health information to authorized federal officials who are conducting national security and intelligence activities or providing protective services to the President of the United States or other officials.

 

Inmates and Correctional Institutions. If you are an inmate of a correctional institution or in the lawful custody of a law enforcement official, we may disclose your personal health information to the correctional institution or law enforcement official, if necessary to provide you with health care; to protect your health and safety or the health and safety of others; or for the safety and security of the correctional institution.

 

Victims of Abuse, Neglect or Domestic Violence.  We may release your personal health information to a public health authority or agency that receives reports of abuse, neglect or domestic violence. 

 

 

When We Need Your Written Permission to Use or Disclose Your Personal Health Information:

 

All Other Uses & Disclosures.  For uses or disclosures other than those described in the previous sections, we will obtain your written permission before using or disclosing your personal health information or before disclosing it to others outside the Covered Components. You may initiate transfer of your records to another person by filling out and signing a written authorization form. If you provide us with written authorization, you may subsequently revoke (cancel) your permission at any time, except to the extent that we have already relied upon your authorization for some purpose.  To revoke a written authorization, please write to USFPG Clinical Operations Health Information Management at the address listed at the end of this Notice.

 

Special Protections for Mental Health, Substance Abuse, Genetic Testing, Sexually Transmitted Diseases and HIV Information.  Special privacy protections apply to mental health, substance abuse, genetic testing, sexually transmitted diseases and AIDS/HIV related information and to psychotherapy notes.  Some parts of this general Notice may not apply to these types of information.  Unless disclosure of this type of information is permitted by law, we may disclose this information only after obtaining your written authorization.

 

Marketing. We must obtain your written authorization before using or disclosing your personal health information for marketing except if the communication is a face-to-face communication between us and you, or it is in the form of a promotional gift of nominal value we provide to you, such as a note pad containing a health care product name.  Provided that USF has not received payment for making the communication, marketing does not include communications about the following matters: communicating with you about a drug you use, about products or services related to your treatment; about case management or care coordination; or to direct or recommend alternative treatments, therapies, health care providers, or care settings. However, if USF receives payments for these types of communications, we must first obtain your written authorization before communicating with you.

 

Your Rights Regarding Your Personal Health Information:

 

The medical records and health information maintained by USF is the property of USF.  You have the following rights, however, regarding health information we maintain about you:

 

Right to See and Copy. You have the right to see and obtain a copy of your personal health information that is used to make decisions about your care for as long as we maintain this information. If USF has the information you request in an electronic format, you may request that the information be sent directly to you in an electronic format in accordance with USF standards.   To see or obtain a copy of your personal health information, contact USFPG Clinical Operations Health Information Management at the end of this notice.  You must make your request in writing.  We may charge a fee for the costs of copying, mailing or other supplies we use to fulfill your request. We will ordinarily respond to your request within 30 days if the information is located in our facility and within 60 days if it is located off-site.  Should we need additional time to respond, we will notify you to explain the reason for the delay and to provide a time frame for when you can expect an answer to your request. Under certain circumstances, we may deny your request.  If we deny your request, we will provide a written denial notice that identifies our reasons for the denial, explains your rights to have that decision reviewed and how you can exercise those rights.

 

Right to Request an Amendment or Addendum. If you believe that the personal health information we have about you is incorrect or incomplete, you have the right to ask us to amend the information or add an addendum (addition to the record).  You have the right to request an amendment or addendum as long as the information is kept in our records.  To request an amendment, please contact USFPG Clinical Operations Health Information Management listed at the end of this Notice.

 

We may deny your request for an amendment or addendum if it is not in writing or does not include a reason to support the request.  Ordinarily we will respond to your request within 60 days.  If we need additional time to respond, we will notify you in writing to explain the reason for the delay and when you can expect to have a final answer to your request. We may deny your request if you ask us to amend information that was not created by us; is not part of the information kept by us; is not part of the information which you would be permitted to inspect and copy; or is accurate.  Should we deny any part of your request, we will provide a written notice that explains our reasons for doing so.  If you disagree with our decision to deny an amendment, you will have an opportunity to submit a statement explaining your disagreement, and we will include this statement in your records.   

 

Right to an Accounting of Disclosures. You have a right to request and receive a list of certain disclosures we have made of your protected health information.  Your written request must state a time period that may not be longer than the six years prior to the date on which the accounting is requested. The accounting will identify the other persons or entities to which we have disclosed your personal health information.  Any accounting includes only disclosures, and will not include uses of your information.

 

In addition, we are not required to provide an accounting of the following disclosures:

  • Disclosures made to carry out treatment, payment and health care operations;
  • Disclosures we made to you or your personal representative;
  • Disclosures we made after obtaining your written authorization;
  • Disclosures made from the patient directory or to persons involved in your care or other notification purposes as provided for under federal law;
  • Disclosures that were incidental to permissible uses and disclosures of your health information;
  • Disclosures for purposes of research, public health or our business operations where your protected health information has been partially de-identified so that it does not directly identify you;
  • Disclosures for national security or intelligence purposes;
  • Disclosures to correctional institutions or law enforcement officers about individuals in their lawful custody;
  • Disclosures that are part of a limited data set.

 

To request an accounting of disclosures, please submit a written request to USFPG Clinical Operations Health Information Management at the address listed at the end of this Notice.    You have a right to receive one accounting within every 12-month period at no cost.  If you request a second accounting within that 12-month period, we may charge you for the cost of compiling the accounting.  We will notify you of the cost involved, and you may choose to withdraw or modify your request at that time before any costs are incurred. Ordinarily we will respond to your request for an accounting within 60 days.  If we need additional time to prepare the accounting, we will notify you in writing about the reason for the delay and the date when you can expect to receive the accounting.  We may delay providing you with an accounting without notifying you if a law enforcement official or government agency asks us to do so.

 

Right to Request Additional Privacy Protections. You have the right to request that we further restrict the way we use and disclose your health information to treat your condition, collect payment for that treatment, or conduct our or another health care entity’s business operations.  You may also request that we limit how we disclose information about you to persons involved in your care.  To request a restriction, please write to the USFPG Clinical Operations Health Information Management address listed at the end of this Notice.  We are not required to agree to your request for a restriction, and in some cases the restriction you request may not be permitted under law.  Once we have agreed to a restriction, you have the right to revoke the restriction at any time.  Under some circumstances, we will also have the right to revoke the restriction, after notifying you.  If we do agree to your requested restriction, we will comply with your request unless the information is needed to provide you with emergency treatment or we are required or permitted by law to disclose. If you have paid out of pocket and the information pertains solely to a health care item or service, you may request that your personal health information not be disclosed to a health plan for purposes of payment or health care operations.

 

Right to Request Confidential Communications. You have a right to request that we communicate with you about your medical matters in a more confidential way by requesting that we communicate with you by alternative means or at an alternative location.  We will accommodate reasonable requests.  However, if we are unable to contact you using the requested ways or locations, we may contact you using any information we have. It is critical that we have the ability to reach you by telephone.  You may request a confidential communication upon check-in at your next visit, or you may make your request in writing to USFPG Clinical Operations Administration at the address listed at the end of this Notice.  Please specify in your request how or where you wish to be contacted, and how payment for your health care will be handled if we communicate with you through this alternative method or location.

 

Right to Notice in Case of Breach of Your Privacy. You have the right to receive notice if we breach the privacy of your personal health information. A breach means that your personal health information was used or disclosed in a way that is inconsistent with the law.  The notice of breach will tell you what happened, when it happened, and steps you can take to protect yourself from potential harm. The notice will also tell you the steps that we are taking to investigate, mitigate and protect against future breaches as well as how to contact us for additional information.

 

Right to a Paper Copy of This Notice. You have a right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of this Notice.  You can obtain an additional copy by asking for one at the time of your next visit or by accessing our website at www.usfdocs.com, or by writing USFPG Clinical Operations Health Information Management at the address listed at the end of this Notice.

 

Changes to This Notice:

We reserve the right to change this Notice. We reserve the right to make the revised or changed notice effective for personal health information we already have about you as well as any information we receive in the future. We will post a copy of the current notice in our clinic entrance areas. The notice will contain the effective date on the first page. 

 

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the Department of Health and Human Services. To file a complaint with us, write to the USFPG Clinical Operations Administration at the address listed at the end of this Notice.    USF will not be penalize or retaliate against you for filing a complaint.

 

How to contact us:

For questions or issues regarding Medical Records:

USFPG Clinical Operations Health Information Management

Attention:  HIM Administration

Mailing Address:                                                                 

12901 N. Bruce B. Downs Blvd.                                        

MDC 33                                                   

Tampa, Florida 33612                                                        

(813) 974-2201

 

Street Address:

13330 USF Laurel Drive

Carol & Frank Morsani Center for Advanced Healthcare

Tampa, Florida 33612

 

 

For complaints or concerns:

                USFPG Clinical Operations Administration

                Attention:  Patient Advocate

                12901 N. Bruce B. Downs Blvd., MDC 33

                Tampa, Florida  33612

                (813) 974-2201