FLORIDA INTERNATIONAL UNIVERSITY
HEALTH INFORMATION
NOTICE OF PRIVACY PRACTICES
Effective Date: September 1, 2009
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND
DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.
When this Notice Applies
Florida International University provides health care treatment to patients through its College of Medicine and the Student Health Services. When you seek or receive health care services from the University, your private health information is gathered to create medical records and other records in support of providing health care to you. This health information is protected from certain disclosures and uses by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). In order to comply with HIPAA, the College of Medicine and the Student Health Services are required to protect all of the health information in its possession, regardless of how it is created or received. This Notice of Privacy Practices lets you know how we keep your health information private, and how we may use and disclose your health information to carry out treatment, payment or health care operations, and for other purposes that are permitted or required by law. It also describes your rights to access and to control your protected health information.
Our Commitment to Your Privacy
FIU and the clinical and administrative staff who are directly or indirectly involved in your treatment (collectively referred to as “FIU” or the “University”) are dedicated to maintaining the privacy of your protected health information. “Protected health information” is individually identifiable health information about you that relates to your past, present, or future physical or mental health or condition and/or related health care services.
Your Personal Health Information
We collect personal health information from you in many ways. For example, our physicians, nurses and other clinical staff make entries in your medical records to create a record of your examination and treatment. This information may include: diagnosis and treatment, prescriptions, referrals to other health care organizations and offices, payment, and insurance inquiries.
This Notice of Privacy Practices describes how we will use and disclose your protected health information. We may change the terms of this Notice of Privacy Practices at any time. You may request any revised Notice of Privacy Practices by calling the FIU Privacy Officer and asking that a revised copy be sent to you in the mail, by asking for one at the time of your next appointment, or by accessing our website at http://compliance.fiu.edu. The FIU Privacy Officer may be reached at: University Compliance Officer and Interim Privacy Officer, Florida International University, University Compliance Office, Modesto Maidique Campus, PC 520, 11200 S.W. 8th Street, Miami, FL 33199, Telephone No.: (305) 348-2216; Fax: (305) 348-
7657.
1 Notice to FIU Students: This NOTICE IS NOT APPLICABLE to student education and treatment records maintained at Student Health Services. Such records are confidential and also protected by federal law under the Family Educational Rights and Privacy Act of 1974, as amended, 20 U.S. C. §1232g (“FERPA”).
Uses and Disclosures of Protected Health Information Based Upon Your Written Consent
You will be asked by your health care providers (physicians, nurse practitioners, or nurses) to sign a consent form allowing us to use and disclose protected health information about you in order to treat you, to operate our medical practices, and to seek payment for our services. You consent to the use and disclosure of your protected health information for treatment, payment and health care operations by signing the appropriate consent form. Once signed, your physician, nurse or other clinical or administrative staff member and others outside of the University who are involved in your care and treatment will use and disclose your health information in order to provide health care services to you and to obtain payment for those services. The following are examples of the types of uses and disclosures of your protected health information that the University is permitted to make once you have signed our consent form. These examples are only illustrations and not all of the ways that we may use or disclose your health information.
a. Treatment. Your protected health information will be used and shared with others involved in your treatment. We will also disclose protected health information to individuals who are involved in coordinating or managing your health care provided you have agreed to provide access to your protected health information for that purpose. In each case these disclosures are to assist with your treatment.
b. Payment. Your protected health information will be used, as needed, to obtain payment for your health care services. This may include obtaining verification that your care is covered under your insurance policy.
c. Health Care Operations. We may use or disclose your protected health information in order to support the operation of our health care practices. Examples of the types of operations are patient registration and follow up, clinical and operational performance improvement, employee review activities, education and training of medical students, risk management, peer review, and conducting or arranging for other business activities.
d. Business Associates. We will share your protected health information with third parties that perform various activities (e.g., billing, financial services) for the University. Our business associates are those people and organizations that are not part of our workforce but provide services to the University to support our clinical practices. For example, we may retain a billing company to bill and collect for the health care services we provide.
e. Health Related Services. We may use or disclose your protected health information, as necessary, to provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you. For example, we may send you a newsletter or an email about the services we offer.
f. Individuals Involved in Your Care or Payment for Your Care. We may disclose your protected health information to a person, such as a family member or friend, who is involved in your medical care or helps to pay for your care. We also may notify your family about your location or general condition or disclose such information to an entity assisting in a disaster relief effort.
g. Research. If research is being conducted and is approved by an institutional review board, your protected health information may be disclosed to researchers. In such event, we will establish protocols to protect the privacy of your protected health information.
h. Fundraising Activities. We may use demographic information (name and address) and dates of service to contact you about contributing to the University. We also may provide this limited information to our foundation, for the same purpose. If we contact you for fundraising purposes, we will let you know how you can opt out of receiving such fundraising communications.
Your Rights with Respect to Your Personal Health Information
These are your rights with respect to your protected health information.
a. Right to Inspect and Copy Your Protected Health Information. You have the right to inspect and copy your protected health information. This means you may inspect and obtain a copy of your “designated record set” which is medical and billing records and any other records that your health care provider and the University use for making decisions about you. If you request a copy of your protected health information, we will charge a fee for the cost of copying, mailing or other supplies associated with your request as permitted by applicable law. Please note that federal law provides that you cannot inspect or copy psychotherapy notes, information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding, and protected health information that is subject to any law that prohibits access to protected health information. In some circumstances, you may have a right to have this decision reviewed.
b. Right to Request Restrictions on Use or Disclosure. You have the right to ask us not to use or disclose any part of your protected health information; even for the purposes of treatment, payment or healthcare operations. Your request must be in writing and state the specific restriction requested and to whom you want the restriction to apply. We are not required to agree to a restriction that you request. If your health care provider believes it is in your best interest to permit the use and disclosure of your protected health information, the information will be disclosed despite your request. Even if we have agreed to a restriction of the disclosure or use of your health information, we will use or disclose it if necessary to care for you in an emergency treatment situation.
c. Right to Receive Confidential Communications. You have the right to ask us to communicate with you in a way that protects your confidentiality. We will accommodate reasonable requests except in the case of an emergency.
d. Right to Amend Your Personal Health Information. This means you may ask us to change protected health information in your medical records and other records used in your treatment. We may deny your request for an amendment if we do not believe it is accurate or appropriate. If we deny your request for amendment, you have the right to file a statement of disagreement with us and we may prepare a rebuttal to your statement and will provide you with a copy of any such rebuttal. You are not entitled to the amendment if we object.
e. Right to Receive an Accounting of Disclosures of Your Personal Health Information. You have the right to receive an accounting of disclosures we have made (if any) of your protected health information to third parties for reasons other than treatment, payment or healthcare operations as described in this Notice of Privacy Practices. The right to receive this information is subject to certain exceptions, restrictions and limitations. It excludes disclosures we may have made to you or for notification purposes. You have the right to receive specific information regarding the disclosures that occurred after the effective date of this Notice.
f. Right to obtain a paper copy of this notice. You have the right to obtain a paper copy of this notice from us, upon request, even if you have agreed to accept this notice electronically.
Mandatory Disclosures Without Consent
Attached to this Notice of Privacy Practices you will find a description of disclosures that we are permitted or required to make without your consent. This includes disclosures to state and federal public health agencies and law enforcement.
Exercising your Rights
In order to exercise any of the rights listed above in paragraphs a through f, you must write to the University Compliance Officer and Interim Privacy Officer at: Florida International University, University Compliance Office, Modesto Maidique Campus, PC 520, 11200 S.W. 8th Street, Miami, FL 33199, Telephone No: (305) 348-2216; Fax: (305) 348-7657.
NO OTHER PERSON, INCLUDING STUDENT HEALTH SERVICES OR COLLEGE OF MEDICINE STAFF MEMBER, PERSONNEL, PHYSICIAN OR NURSE IS AUTHORIZED TO ACCEPT A REQUEST TO EXERCISE YOUR RIGHTS.
Complaints
If you have any complaints regarding our privacy practices, or if you believe your privacy rights have been violated, you may file a written complaint directly with the University Compliance Officer and Interim
Privacy Officer at: Florida International University, University Compliance Office, Modesto Maidique Campus, PC 520, 11200 S.W. 8th Street, Miami, FL 33199, Telephone No.: (305) 348-2216; Fax: (305) 348-
7657. We will take your complaint seriously and respond appropriately. We will not act against you in any way for filing a complaint. For further information about the complaint process, you may also contact the Student Health Services Medical Records Manager at: Florida International University, University Health Services Complex, Modesto Maidique Campus, Miami, FL 33199, Telephone No.: (305) 348-7364; Fax: (305) 348-0336. Additionally, you may file a complaint with the Secretary of the U.S. Department of Health and Human Services. This notice becomes effective on September 1, 2009.
Other Permitted and Required Uses and Disclosures Without Your Consent,
Authorization or Opportunity to Object
We may use or disclose your protected health information in the following situations without your consent or authorization. These situations include:
a. Required By Law. We may use or disclose your protected health information to the extent required by law. The use or disclosure will be made in compliance with the applicable law and will be limited to the requirements of the law.
b. Public Health. We may disclose your protected health information to a public health authority that is permitted by law to collect or receive the information. The disclosure will be made for the purpose of controlling disease, injury or disability. We may also disclose your protected health information, if directed by the public health authority, to a foreign government agency that is collaborating with the public health authority. Public health activities may include the following:
(i) reporting matters related to the quality, safety, or effectiveness of a product or service regulated by the Food and Drug Administration
(ii) preventing or controlling disease, injury, or disability
(iii) reporting disease or injury
(iv) reporting births and deaths
(v) reporting child abuse or neglect
(vi) reporting reactions to medications and food or problems with products
(vii) notifying people of recalls or replacements of products they may be using
(viii) notifying the appropriate government authority if we believe a person has been the victim of abuse, neglect or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.
(ix) If authorized by law, we may disclose your protected health information to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.
c. Emergencies. We will, as necessary and appropriate, use or disclose your protected health information to treat you in an emergency treatment situation. We will try to obtain your consent as soon as reasonably practicable after the delivery of emergency treatment.
d. Health Oversight. We may disclose protected health information to a health oversight agency for activities authorized by law, such as audits, investigations and inspections. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, other government regulatory programs and civil rights laws.
e. Food and Drug Administration. We may disclose your protected health information to a person or company as required by the Food and Drug Administration to report adverse clinical events, product defects or problems, or biologic product deviations; to track products; to enable product recalls; to make repairs or replacements; or to conduct post marketing surveillance.
f. Legal Proceedings. We may disclose protected health information in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), and in response to a subpoena, discovery request or other lawful process.
g. Law Enforcement. We may also disclose protected health information for law enforcement purposes so long as applicable legal requirements are met. These law enforcement purposes include, without limitation: (a) legal processes required by law, (b) limited information requests for identification and location purposes, (c) requests pertaining to victims of a crime, (d) suspicion that death has occurred as a result of criminal conduct, (e) in the event that a crime occurs on the premises of the health care facilities or the University, and (f) medical emergency (not on health care facilities or University premises) where it is likely that a crime has occurred.
h. In Legal Custody. If you are an inmate of a correctional institution or under custody of a law enforcement official, we may disclose protected health information about you to the correctional institution or law enforcement official.
i. Criminal Activity. Consistent with applicable federal and state laws, we may disclose your protected health information if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose certain limited protected health information if it is necessary for law enforcement authorities to identify or apprehend an individual.
j. Organ and Tissue Donation. We may disclose protected health information to authorized organizations relating to organ, eye, or tissue donations or transplants.
k. HIV Test Results. If you received an HIV test and did not give us permission to use and disclose the results with your medical record, we will use and disclose the results of HIV tests that identify you only: (1) to provide you with healthcare services (for example, we may tell a specialist about your HIV status so the specialist can treat you); (2) when compiling or reviewing your records as part of routine billing; (3) if necessary, to enable us to protect the quality of our services (for example, we may disclose the test results to our committees to monitor and evaluate our programs); (4) to child-placing or child-care agencies, family foster homes, residential facilities or community-based care programs that are directly involved in placement, care, control or custody and that have a need to know such information; (5) to a sex or needle-sharing partner in accordance with the law; (6) in accordance with a court order that specifically requires us to release HIV test results; and (7) in connection with organ donation.
l. Military and Veterans. When the appropriate conditions apply, we may use or disclose protected health information of individuals who are Armed Forces personnel (a) for activities deemed necessary by appropriate military command authorities; (b) for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits; or (c) to foreign military authority if you are a member of that foreign military service.
m. National Security and Intelligence Activities. We may also disclose your protected health information to authorized federal officials for conducting national security and intelligence activities, including for the provision of protective services to the President or others legally authorized.
n. Workers’ Compensation. Your protected health information may be disclosed by us as authorized to comply with workers’ compensation laws and other similar legally-established programs that provide benefits for work-related injuries or illnesses.
o. Coroners, Medical Examiners, and Funeral Directors. We may disclose protected health information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also disclose protected health information to funeral directors so they can carry out their duties.