Privacy Policy

Campus Health Center (“Center”) is committed to compliance with Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations. This Notice of Privacy Practices (“Notice”) has been drafted in accordance with the HIPAA Privacy Rule, contained in the Code of Federal Regulations at 45 CFR Parts 160 and 164, and the final rule issued by the Office of Civil Rights of the U.S. Department of Health and Human Services on January 25, 2013, implementing changes to the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules not defined in this Notice have the same meaning as they have in the HIPAA Privacy Rule. 

Health care you receive at the Center is documented in a medical record, which we use to provide you with quality care and to comply with certain legal requirements. The privacy of your personal medical information is important to us, and we are committed to protecting your privacy and expect our employees, independent contractors, agents, and business associates to do the same. This Notice describes how we may use and disclose your protected health information (“PHI”), your rights to access and control your PHI and our obligations regarding the use and disclosure of your PHI.

OUR DUTIES:

The law requires the Center to:

1. Maintain your PHI private and secure in accordance with this Notice, as long as it remains in effect.
2. Provide you with a paper copy of this Notice describing our legal duties, privacy practices, and your rights concerning your PHI.
3. Abide by the terms of this Notice.
4. Notify you following a Breach of unsecured PHI.

The Center has the right to:

1. Change its privacy practices and the terms of this Notice at any time, as permitted or required by law.
2. Make the changes in its privacy practices and to this Notice and make the new provisions of the Notice retroactive and effective for all PHI that we maintain.

Notice of change to privacy practices:

1. This Notice will be updated and distributed at your visit following a change whenever there is any material change to the uses or disclosures of PHI, your rights, our legal duties, or other privacy practices.

 

USE AND DISCLOSURE OF YOUR PHI:

The following section describes different ways that we may use and disclose your PHI.  Most uses and disclosures of psychotherapy notes (where appropriate and if the Center has any such notes), uses and disclosures of PHI for marketing, and disclosures that constitute a sale of PHI, as well as other uses and disclosure of your PHI that are not described in this Notice will be made only with your written authorization, but we cannot require your authorization as a condition of your treatment. You may revoke authorization in writing at any time, and this revocation will be effective for future uses and disclosures of PHI. However, such a revocation will not be effective for information that the Center has used or disclosed in reliance on the authorization.

Treatment, Payment, and Health Care Operations

Once you sign the Center’s enrollment form, we may use and disclose your PHI for all activities that are included within the definitions of “treatment”, “payment” and “health care operations” as defined in the HIPAA Privacy Rule. 

Examples of uses and disclosures for Treatment - We may use PHI about you to provide you with medical treatment or services. We may disclose your PHI to doctors, nurses, or other health care professionals who are taking care of you. For example:

• If a nurse practitioner at the Center refers you for a cardiac stress test and needs to call the cardiologist for results, the clinician may give your name and reason for ordering the stress test to the cardiologist’s office.
• A nurse practitioner at the Center may call you from time to time at the telephone numbers you provide us to advise you of new alternatives to your treatments that we believe may be of interest to you.  With limited exceptions, where such communications involve receipt of financial remuneration by the Center, the Center must obtain your authorization for any use or disclosure of PHI.

Examples of uses and disclosures for Payment

• The Center’s billing office may submit a claim form, containing your name, address, student or security number, diagnoses and the procedures performed at the Center to your insurance company.

Examples of uses and disclosures for Health Care Operations

• The Center’s nurse practitioners may audit (read and comment upon) your chart to track and improve our performance in assuring that screening tests and immunizations are done on time.
• The Center’s staff may mail you reminders of upcoming appointments and leave messages at the telephone numbers you provide, asking you to return our call.

Business Associates

We contract with service providers, called business associates, to perform various functions on our behalf. For example, the Center may contract with a service provider to perform the administrative functions necessary to pay your medical claims. To perform these functions or to provide the services, business associates will receive, create, maintain, use, or disclose PHI, but only after the Center and the business associate agree in writing to contract terms requiring the business associate to appropriately safeguard your information.

Other Covered Entities

We may use or disclose your PHI to assist health care providers in connection with their treatment or payment activities, or to assist other covered entities in connection with certain health care operations. For example, we may disclose your PHI to a health care provider when needed by the provider to render treatment to you, and we may disclose PHI to another covered entity to conduct health care operations in the areas of quality assurance and improvement activities, or accreditation, certification, licensing, or credentialing. This also means that we may disclose or share your PHI with other health care programs or insurance carriers (such as Blue Cross Blue Shield, etc.) to coordinate benefits, if you or your family members have other health insurance or coverage.

Others Involved in Your Health Care

We may disclose your PHI to a friend or family member that is involved in or responsible for your health care, unless you object or request a restriction (in accordance with the process described below under “Your Rights”). We also may disclose your information to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status, and location. If you are not present or able to agree to these disclosures of your PHI, then, using professional judgment, we may determine whether the disclosure is in your best interest.

Disclosures to You

We are required to disclose to you or your personal representative most of your PHI when you request access to this information. We will disclose your PHI to an individual who has been designated by you as your personal representative and who has qualified for such designation in accordance with relevant law. Prior to such a disclosure, however, we must be given written documentation that supports and establishes the basis for personal representation. We may elect not to treat the person as your personal representative if we have a reasonable belief that you have been, or may be, subjected to domestic violence, abuse, or neglect by such person; that treating such person as your personal representative could endanger you; or if we determine, in the exercise of our professional judgment, that it is not in your best interest to treat the person as your personal representative.

Other uses and disclosures

The Center may use or disclose your PHI for other purposes, without your consent or authorization, if we are required to do so by federal, state, or local law. For example, we may release your PHI when required by privacy laws, public health laws, health oversight activities, court orders, certain subpoenas and discovery requests, or other laws, regulations, or legal processes, and for national security and intelligence activities. Under certain circumstances, we may make limited disclosures of PHI directly to law enforcement officials or correctional institutions if you are an inmate, lawful detainee, suspect, fugitive, material witness, missing person, or a victim or suspected victim of abuse, neglect, domestic violence, or other crimes. We may disclose your PHI to the extent reasonably necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of others. We may disclose your PHI when necessary to assist law enforcement officials capture someone who has admitted to a crime against you or who has escaped from lawful custody, and to coroners or medical examiners when necessary to identify a deceased person or determining a cause of death, and to funeral directors as necessary to carry out their duties. We may disclose proof of immunization to a school where State or other law requires the school to have such information prior to admitting the student, if we obtain an agreement, which may be oral, from a parent, guardian or other person acting in loco parentis for the individual, or from the individual himself or herself, if the individual is an adult or emancipated minor. We may also disclose your PHI to Secretary of the U.S. Department of Health and Human Services when the Secretary is investigating or determining the Center’s compliance with HIPAA.  We may contact you to raise funds for the Center and you have the right to opt out of receiving such communications.

 

YOUR RIGHTS:

1. Right to Request Access. You have a right to review or obtain copies of your PHI. The Center may charge you copying, and postage fees as allowed by law. Note that under federal law, you may not inspect or copy the following records: psychotherapy notes; information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding; and PHI that is subject to law that prohibits access to PHI. In some, but not all, circumstances, you may have a right to have this decision reviewed.
2. Right to Receive an Accounting of Disclosures of PHI. You have a right receive an accounting of certain disclosures of your PHI for purposes other than treatment, payment, or health care operations, pursuant to a signed authorization from you, or certain other disclosures we are permitted to make without your authorization. You can request an accounting of disclosures made up to six years prior to the date of your request. You are entitled to one accounting free of charge during a twelve-month period. There will be a charge to cover our costs for additional requests within that twelve-month period. We will notify you of the cost involved and you may choose to withdraw or modify your request before any costs are incurred.
3. Right to Request a Restriction. You have a right to request that we place additional restrictions on our use or disclosure of your PHI. Your request must include the PHI you wish to limit, whether you want to limit our use, disclosure, or both, and (if applicable), to whom you want the limitations to apply (for example, disclosures to your spouse). We are not required to agree to these additional restrictions, except that we must agree to the request to restrict disclosure of PHI to a health plan if the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law and the PHI pertains solely to a health care item or service for which you, or a person other than the health plan on behalf of the individual, has paid us in full. If we agree to a restriction, we will abide by our agreement (except in the case of an emergency). If restricted PHI is disclosed to a health care provider for emergency treatment, the Center shall request that such health care provider not further use or disclose the information. The Center may terminate its agreement to a restriction if 1) you agree to or request the termination in writing, 2) you orally agree to the termination and the oral agreement is documented; 3) or the Center notifies you that it is terminating its agreement to a restriction, except that such termination is not effective with respect to PHI for which the Center must agree to a restriction as described above and is only effective with respect to PHI created or received after the Center provided such a notice.
4. Right to Request an Amendment. You have a right to request that we amend certain parts of your PHI held by the Center if you believe that information is incorrect or incomplete.   Your request must set forth a reason(s) in support of the proposed amendment. We may deny your request if your PHI is accurate and complete or if we did not create the PHI, you want amended. If we deny your request, we will provide you with a written explanation, and you have the right to file a statement of disagreement. Your statement of disagreement will be linked with the disputed information and all future disclosures of the disputed information will include your statement.
5. Right to Request Confidential Communications.  You have a right to request that we communicate with you about your PHI by different means or to different locations. Your request must specify the alternative means or location for communication with you. The Center will accommodate a request for confidential communications that is reasonable, but may condition it on, when appropriate, information as to how payment, if any, will be handled.
6. Right to a Paper Copy of This Notice.  You have a right to receive a paper copy of this Notice, even if you have agreed to accept this Notice electronically. To obtain a copy of the Notice, please contact the Center using the Contact Information at the end of this Notice.
7. Right to Receive Notifications of Breaches of Unsecured PHI. You have the right to and will receive notifications of breaches of your unsecured PHI.

To exercise any of your rights in items 1 - 5 above, please make a request in writing to the contact information listed at the end of this Notice.

 

COMPLAINTS:

If you believe that your privacy rights have been violated, you may file a complaint with the Center by writing to Privacy Officer, 5285 Anthony Wayne Drive, Detroit, MI  48202 or with the Secretary of the U.S. Department of Health and Human Services. We will not retaliate against you or penalize you for filing a complaint.

 

CONTACT INFORMATION AND QUESTIONS:

For more information about this Notice and to exercise any of the rights described in this Notice, contact Privacy Officer, 5285 Anthony Wayne Drive, Detroit, MI  48202, Telephone: 313-577-5041.

 

Effective Date: 10/03/2007

Revision Effective Date: 02/24/2020