Notice of Privacy Practices

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW PROTECTED HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice describes the practices of the Oakland University Graham Health Center and the Oakland University Counseling Center as of January 1, 2014 (called the “Health Center” in this Notice) with regard to the health care information and records and Protected Health Information the Health Center has about you that relates to the health care services provided by the Health Center, and how the Health Center may use and disclose this information. This Notice also describes your rights in your Protected Health Information and how you can exercise those rights. Your rights, and the Health Center’s responsibilities, apply only to the Protected Health Information created, received, maintained or transmitted by the Health Center.

Oakland University Students

If you are attending Oakland University as a student when the Health Center creates or receives health care information or records about you, your information and records are protected by the Family Educational Rights and Privacy Act and its implementing regulations (“FERPA”). Please see Oakland University’s Family Educational Rights and Privacy Act policy and supplemental information located, under the heading FERPA.

Non-Oakland University Students

If you are not attending Oakland University as a student when the Health Center creates or receives Protected Health Information about you (e.g., students enrolled at other colleges or universities, faculty, staff, visitors, etc.), your Protected Health Information is protected by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”) as described below.

Protected Health Information (“PHI”) includes individually identifiable information that relates to your past, present or future health condition, treatment or payment for health care services, and includes information such as your name, social security number, address and date of birth.

The Health Center is required by law to keep PHI that identifies you private, to give you this Notice of the Health Center’s legal duties and privacy practices with respect to your PHI, notify you following a breach of unsecured PHI that affects you, and to follow the terms of the Notice that is currently in effect. This Notice of Privacy Practices became effective August 2, 2010, which is the date on which the Health Center began to transmit health information in electronic form and has been amended as of September 23, 2013.

PHI use and disclosure by the Health Center is regulated by HIPAA as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), except to the extent such use and disclosure of student health records is governed by FERPA. This Notice attempts to summarize the HIPAA privacy regulations, but the regulations will supersede any discrepancy between the information in this Notice and the regulations.

A. Uses and Disclosure of PHI Without Your Permission. The Health Center primarily uses and discloses your PHI to provide you with medical care and treatment, obtain payment for treatment and conduct our operations. The following describes these and other uses and disclosures which may be made without your written authorization, together with some examples:

1. Treatment. The Health Center may use or disclose your PHI to provide, coordinate, facilitate or manage your medical treatment and related services. For example, the Health Center might disclose your PHI to another physician or health care provider not affiliated with the Health Center who, at your request or the request of the Health Center, becomes involved in your care.
2.  Payment. The Health Center may use and disclose your PHI to obtain payment for medical treatment and related services provided by the Health Center. For example, the Health Center may need to disclose your PHI related to your visit to the Health Center to your health insurance plan to receive payment. Similarly, the Health Center may disclose your PHI to your health insurance plan to obtain approval for a hospital stay or referral to a specialist.
3. Health Care Operations. The Health Center may use and disclose your PHI for other Health Center operations. These uses and disclosures are necessary to administer the Health Center. For example, the Health Center may use or disclose your PHI (1) to conduct quality assessment and improvement activities, (2) for employee review activities, (3) for licensing, accreditation or certification purposes; business planning and development such as cost management, (4) for business management and general Health Center administrative activities.
4.  Communications. The Health Center may use your PHI when we contact you to provide appointment reminders or to follow up on the care that you have received, discuss test results or make referrals to other health care providers.
5. As Required by Law. The Health Center will disclose your PHI when required to do so by law. For example, the Health Center must allow the U.S. Department of Health and Human Services to audit Health Center records. The Health Center may also disclose PHI when required by a court or administrative order or subpoena.
6. Health Oversight. The Health Center may disclose your PHI to agencies that monitor our compliance with state and federal laws.
7. Public Health Activities. The Health Center may disclose your PHI to authorized public health officials and agencies for the purpose of public health activities. These activities may include controlling or preventing disease, injury, or disability, reporting of births and deaths, reporting reactions to medications, products or medical devices, or communicable disease reporting.
8. Victims of Abuse, Neglect or Domestic Violence. The Health Center may disclose your PHI to a public health authority that is authorized by law to receive reports of child abuse or neglect. In addition, we may disclose your PHI if we believe that you have been a victim of abuse, neglect or domestic violence to a governmental entity or agency authorized to receive such information. In such circumstances, the disclosure will be made consistent with the requirements of applicable federal and state laws.
9. Serious Threat to Health or Safety. The Health Center may use and disclose your PHI when necessary to prevent a serious threat to your health and safety or the health and safety of others.
10. National Security and Intelligence Activities or Protective Services. The Health Center may disclose your PHI to authorized federal officials for intelligence or national security activities, to conduct special investigations, or to provide protective services to the President or other government officials.
11.  Coroners, Medical Examiners and Funeral Directors. The Health Center may disclose your PHI to a coroner or medical examiner to determine a cause of death or to identify a deceased person. The Health Center may also disclose your PHI to a funeral director as necessary to carry out the funeral director’s duties.
12. Workers’ Compensation. The Health Center may disclose your PHI as authorized by, and to the extent necessary to comply with, workers’ compensation or other similar laws.

B. Uses and Disclosures of PHI Without Objection. The Health Center may disclose your PHI to family members, other relatives or your friends if they are involved in your care or payment for that care, and provided you do not object. For example, your medical condition and treatment plan may be discussed with you in the presence of a relative or friend unless you object. Unless you object, the Health Center may disclose your PHI to notify, or assist in notifying your family members, other relatives or your friends, if they are involved in your care, about your condition, location or death. Other than in an emergency or when it is not practical because you are incapacitated, we will provide you with the opportunity to object before such a disclosure is made.

C. Uses and Disclosures of PHI With Your Permission. The Health Center will not use or disclose your PHI for any purpose not identified above unless you give the Health Center your written authorization to do so. For example, the following uses and disclosures generally require your authorization: (1) uses and disclosures for marketing purposes; (2) uses and disclosures which are a sale of Protected Health Information; and (3) uses and disclosures of psychotherapy notes. If you give the Health Center written authorization to use or disclose your PHI for a specific purpose that is not described in this notice, then, in most cases, you may revoke it in writing at any time. Your revocation will be effective for all of your PHI the Health Center maintains, unless the Health Center has taken action in reliance on your authorization.

D. Your Rights. You may make a written request to the Health Center to do one or more of the following concerning your PHI:

1. Request Restrictions. To put additional restrictions on the Health Center’s use and disclosure of your PHI. Also, you may request restrictions of the disclosure of your PHI to family members, other relatives or friends involved in your care. The Health Center does not have to agree to your request. The Health Center will comply with your request that your PHI not be disclosed if the disclosure is to a health for payment or health care operations and the PHI pertains solely to an item for which you have paid the health care provider out of pocket in full.
2. Request Confidential Communications. To communicate with you in confidence about your PHI by a different means or at a different location than is currently used by the Health Center. The Health Center will accommodate reasonable requests. Your request should be made in writing and specify the alternative means or location to communicate with you in confidence.
3. Inspect and Copy. To see and get copies of your PHI kept in a “Designated Record Set.” A Designated Record Set includes medical records and billing records about you maintained by or for the Health Center or that is used by the Health Center to make decisions about you. In limited cases, the Health Center does not have to agree to your request. For example, this right does not apply to psychotherapy notes which the Health Center maintains or information which the Health Center compiles in reasonable anticipation of, or for use in, civil, criminal or administrative actions or proceedings. If the Health Center uses or maintains an electronic health record containing your PHI, you may obtain a copy of your electronic PHI in an electronic format and, if you choose, direct the Health Center to transmit the electronic copy directly to a person designated by you. The Health Center will not provide electronic PHI in a manner or format that the University determines is not secure unless authorized in writing by you.
4. Amend. To correct your PHI. A request to correct your PHI must be in writing and you must provide reasons and support for the correction. In some cases, the Health Center does not have to agree to your request, in which case you may submit a written response that will be included in future disclosures of your PHI.
5. Accounting of Disclosures. To receive a list of disclosures of your PHI that the Health Center and its business associates made for certain purposes for the last 6 years (but not for disclosures before August 2, 2010). This accounting will not include disclosures made for treatment, payment, or health care operations; made to law enforcement personnel; made pursuant to your authorization; or made directly to you.
6. This Notice. To send you a paper copy of this notice if you received this notice by e-mail or on the internet.

NOTE: To exercise your rights, you must submit your request in writing and on the Health Center’s forms. You may contact the Health Center (contact information is given below) for a copy of any such forms you may need. In some cases, the Health Center may charge you a reasonable, cost-based fee to carry out your request.

E. Personal Representative. You may exercise your rights through a personal representative appointed by you or designated by applicable law. The parent of a minor is usually considered that child’s personal representative.

F. Changes to This Notice. The Health Center must comply with the provisions of this Notice, although the Health Center reserves the right to change the terms of this Notice from time to time and to make the revised Notice effective for all PHI the   Health Center maintains. The Health Center will notify you within sixty days of any material changes to this Notice.

G. Questions and Complaints. If you have questions about this Notice or want to file a complaint because you believe the Health Center has violated your privacy rights or this Notice, please contact the Health Center at:

Graham Health Center
2200 North Squirrel Road
Rochester, MI 48309
(2348) 370-2341
Fax: (248) 370-2691

You also have the right to complain to the U.S. Department of Health and Human Services. We will not retaliate against you if you choose to file a complaint with the Health Center or with the U.S. Department of Health and Human Services.