Health Insurance Portability and Accountability Act (HIPAA) Privacy Practices

YOUR INFORMATION, YOUR RIGHTS, OUR RESPONSIBILITIES

Notice of Privacy Practices

Effective date: October 16, 2016

This Notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Our pledge regarding your health information

We understand that medical information about you is personal and private. We are committed to protecting the privacy of your health information by complying with all applicable federal and state privacy and confidentiality laws. We keep a record of the care and services you receive in order to provide you with quality care and to meet legal requirements. This Notice tells you about your rights under the law with respect to your health information. We also want you to know about our responsibilities and how we may use or release your information.

Your health information

In this Notice, the phrase “your health information” or “your information” refers to records that we keep related to your health care. The record may include health information like a diagnosis, a treatment plan, visit notes, test results or payment for those services. It also includes information such as your name, address, phone number and date of birth.

Your rights

This section explains your rights over your health information. If you have a request, we may ask you to submit it in writing. You may ask at one of our care locations how to do this.
You have a right to:

Get a copy of your medical record

You can ask for an electronic or paper copy of your health information.
We will send a copy or a summary as soon as possible. This may take up to 30 days, and we may charge a fee.
If we cannot provide a record, we will explain why.

Ask us to correct your medical record

You can ask us to correct health information that you think is wrong or missing.
We may say “no” to your request, but we will tell you why as soon as possible, usually within 60 days.

Ask for private communications

You can tell us how you would like to be contacted (for example, home or office phone) or to send mail to a different address.
We will do our best to honor all requests within reason.

Ask us to limit what we use or share

You can ask us not to use or share your health information. We will always consider your request, but we are not required to agree to it. We may say “no” if it would affect your care or we cannot do it.
If you pay for a service or health care item in full, out-of-pocket, you can ask us not to share that fact with your health insurer when you check in or register. We will honor your request unless a law requires us to share that information with the health plan.

Get a list of who has your information

You can ask for a list (an “accounting”) of the times we have shared your health information with an outside organization or person. It will show who we shared it with and why.
The list may go back as long as six years from the date you ask.
We would not include the times your information was shared for treatment, payment, or business and other times (such as when you asked us to share information).
You may receive one report per year at no cost. If you ask for another one within 12 months, we will charge a fee.

Get a copy of this Notice

You can ask for a paper copy of this Notice at any time. We will send the Notice right away, even if you have agreed to receive it by email in the past.
This Notice also is on our websites and is posted in all of our care locations.

Choose someone to act for you

You may have given someone medical power of attorney or you may have a legal guardian. They can exercise your rights and make choices about your health information.
We will make sure that the person you chose has this authority and can act for you before we take any action.

File a complaint

You may file a complaint with us if you feel we have violated your privacy rights. Contact Patient Relations using the information at the end of this Notice.
Or you may file a complaint with the US Department of Health and Human Services Office for Civil Rights. Go to: www.hhs.gov/ocr/privacy/hipaa/complaints
We will not penalize you or act against you in any way for filing a complaint.

Your choices

You have choices about how we use and share your health information. Let us know what you want us to do, and we will follow your instructions as best we can.

You may tell us NOT to:

Share your information with your family, close friends or others involved in your care.
Include your information in a patient directory that can be used to locate you.
Share your information in a disaster relief situation.
Contact you to raise money to support our mission.

We need your written permission before:

We use or share your information
- to market another organization’s services or products or
- to market our own services if they are not health related or if another organization pays us to do it.
We sell your information.
We share psychotherapy notes if they were kept for services you have received.
We share substance abuse treatment records.

Our responsibilities

We are required by law to keep your health information private and secure.
We will tell you if there has been a breach of your health information.
We must follow the duties and privacy practices described in this Notice and give you a copy of it.
We will not use or share your information except as described in this Notice unless you give us written permission. You may change your mind at any time by letting us know in writing.
We cannot take back any information we have already shared with your permission.

How do we use your health information?

We use or share your health information in the following ways:

To treat you (treatment)

We use and share your health information to treat you and coordinate your care. When you first become a patient, we ask for your written permission to share your information with health care providers caring for you outside of our facilities. In an emergency, we may have to share your information without your consent.

Example: A doctor treating you for an injury asks another doctor about your overall health.
Example: We use and share your information to remind you of an appointment with us.

We use an Electronic Health Record that allows care providers and other approved users within and outside our facilities, to store, update and use your information. They may do so at the time you are seeking care, even if they work at different clinics and hospitals.

We do this so it is easier for your providers to coordinate and improve the quality of your care. For example, if you are brought to the hospital in an emergency and cannot tell us what is wrong, we will be able to see your health records if your doctor takes part in the shared electronic health record.

If you receive care from more than one provider who uses the electronic health record, your health information will be combined into one record. Once information is combined, it cannot be separated in the future.

For most University of Minnesota Physicians clinics, the electronic health record is maintained by Fairview Health Services. For a list of the health care providers that use this electronic health record, please go to www.fairview.org/medicalrecords. For Broadway Family Medicine Clinic, the electronic health record is maintained by North Memorial Medical Center. This electronic health record system includes Maple Grove Hospital and some non-North Memorial care providers. For University of Minnesota Physicians Dental Clinics, the electronic health record is maintained by the University of Minnesota Department of Dentistry. This electronic health record system includes all University of Minnesota Dental School dental clinics.

To run our organization (operations)

We use and share your health information to manage our operations and to improve the quality of your care.

Example: We use some of your health information to evaluate our services; review and train students, staff and care providers; and assess new treatments.
Example: We share some information with our business partners – those we work with to provide operational services, but who are not our employees or affiliates. The law requires our business partners to safeguard your information the same way we do.

To bill for your services (payment)

We use and share your health information to bill and get payment from health plans and others for care that you receive. When you first become a patient, we will ask you for your written consent to share your information for this purpose.

Example: We give information to your health insurer about the services we gave you so they will pay for those services.

How else can we use or share your health information?

We may share your information in other ways:

For public health and safety

We can share your information with public health or other authorized agencies in order to:

Prevent or control diseases
Help with product recalls
Report bad reactions to medicines
Report births and deaths
Report suspected abuse or neglect of a child or vulnerable adult
Prevent or reduce a serious threat to anyone’s health or safety
Help with health system oversight activities, such as audits, inspections, or investigations
Comply with government functions such as military, national security, correctional facilities, and presidential protective services

For research

We may ask to use or share your information for health research. In order to use your information:
- We must meet the conditions of both state and federal law.
- We must get approval from you or a research review board.
When you first become a patient, we will ask you whether you wish to have your information used for research. You may choose not to allow use of your information in research.

To inform about our services

We can use and share your information to tell you about treatment options and health-related services that may interest you.

For fundraising

We can use and share limited information to contact you about donating to support our mission. This includes supporting University of Minnesota Foundation.
You can tell us not to contact you again by following the “opt-out” instructions given in printed fundraising requests.

For organ and tissue donation

If you are an organ or tissue donor, with your consent, we may use and share your information with organizations that help with organ or tissue donations.

To work with coroner

We can share your information with a coroner or medical examiner.

To handle workers’ compensation claims

We can share your information for your claims for workers’ compensation and similar programs for work-related injuries or illness.

To respond to lawsuits and legal actions

We can share your information for legal actions such as a court order, grand jury subpoena, warrant or other legal process.
We can share your information with law enforcement officials as required by law.

To comply with the law

We can share your information if state or federal laws require it.

Changes to the terms of this Notice

We can change the terms of this notice, and the changes will apply to all information we have about you. You can check our website to see if the date of the Notice has changed.
You may ask for the new notice at our care locations and on our websites.

Who must follow the Terms of this Notice?

All of our employees, medical staff, students, volunteers and agents will comply with the terms of this Notice. If you receive services at one of our locations from a care provider who is not a staff member, they are also required to follow the terms of this Notice.
In addition, University of Minnesota Physicians and Fairview Health Services are part of a health care arrangement and your health information may be shared among our organizations
as needed to carry out treatment, payment or health care operations. We also jointly instruct medical residents and students at the University of Minnesota and engage in joint education and research activities. This means we may share your health information with the University of Minnesota, and it will be subject to the requirements contained in this Notice.

For information or concerns

You may contact us for any questions about this Notice or concerns about the privacy of your patient information.

University of Minnesota Physicians
Patient Relations
720 Washington Avenue SE, Suite 200
Minneapolis, MN 55414
Phone: 612-884-0661
Email: compliance@umphysicians.umn.edu