University of Louisville / James Graham Brown Cancer Center
Notice of Privacy Practices
Click
here for a printable PDF version
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT
YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE
REVIEW IT CAREFULLY.
PURPOSE
University of Louisville Hospital/James Graham Brown Cancer Center (“Hospital”)
values the privacy of your health information. In accordance with
the Health Insurance Portability and Accountability Act of 1996 (HIPAA),
our Notice of Privacy Practices (“Notice”) describes and
gives examples of your rights and our obligations regarding the use and
disclosure of your protected health information. The examples are
not exhaustive. We may share your information in any manner that
is consistent with the concepts described in this Notice or as otherwise
permitted by federal, state or local health information privacy laws. This
Notice is effective April 14, 2003.
JOINT NOTICE
The Hospital and certain independent health care providers who use the
Hospital to treat their patients have adopted this Notice as a common
statement of privacy practices. Generally, these providers are
Hospital medical staff members and persons who work with them. A
detailed list of entities and persons who participate in this arrangement
is maintained in the Hospital’s medical staff office.
This Notice applies only to services performed in Hospital departments,
such as mobile services or outpatient services located in buildings on
the Hospital’s campus. This Notice does not apply to services
that providers perform at their private physician clinics on the Hospital’s
campus or at other locations. Each health care provider is separately
responsible for its conduct and the services that it offers.
PERSONAL HEALTH INFORMATION WE MAY COLLECT
We may collect information about you from different sources, such as
you, your family or designated representative, insurance companies, employers
or other health care providers. The following are examples of information
we may collect:
- Registration information, such as your name, address, birth date,
social security number, medical and mental health history, payment
sources, physicians’ names or how to contact your family
or other persons involved in your care.
- Medical information, such as test results or health records of your
treatment and diagnosis by physicians, nurses, therapists, mental health
professionals or other health care providers.
USES AND DISCLOSURES REQUIRED BY HIPAA
Treatment, Payment and Health Care Operations: We may use and
disclose your health and financial information to deliver treatment,
obtain payment and conduct health care operations.
The following are examples of uses and disclosures for treatment:
- We may share your information with health care providers involved
in your treatment, such as physicians, hospital staff or outside consultants
(e.g. pathologists or radiologists).
- We may share your information with our departments to coordinate
the different health care services that you may need, such as prescriptions,
lab work or x-rays.
- We may share your information with other health care facilities to
which you are transferred.
The following are examples of uses and disclosures for payment:
- We may share your information with your health plan as it relates
to verifying your eligibility, reviewing services for medical necessity
or other payment decisions.
Note: We submit claims to health plans based on information provided
by patients or their representatives. Health plan statements are
often sent to the policyholder, who may or may not be the patient.
- We may share your information with our business office to ensure
costs were appropriate to the care or treatment that you received at
our facility.
- We may share your information for the payment activities of another
health care provider, such as an ambulance company that transports
you to and from our facility.
The following are examples of uses and disclosures for health care operations:
- We may share your information to conduct our Academic Medical Center
training programs, such as for physicians who are pursuing advanced
training or faculty and students of the University of Louisville or
other academic health affiliates.
- We may share your information to compile patient census data, conduct
quality improvement programs or review the qualifications of health
care professionals.
- We may share your information with manufacturer representatives. For
example, technical advisors on new devices may be present during surgery
to answer questions from the operating team.
- We may contact you as a reminder of an appointment you have for care
or treatment at our facility.
Business Associates: We may share your information with our business
associates who perform services on our behalf. We require our business
associates to protect the privacy of your information.
Research: We may share your information for medical research
when approved by an Institutional Review Board (IRB) or a Privacy Board. For
example, we may compile research databases or create limited data sets
permitted by federal regulations.
Health-Related Benefits and Services: We may contact you about
treatment options, health-related benefits or other products or services
that may be of interest to you. We may also contact you to conduct
case management or care coordination.
Fundraising: We may contact you for fundraising efforts to support
our educational and medical research mission.
Public Health: We may share your information with public health
or other legal authorities charged with preventing or controlling disease,
injury or disability. For example, we may notify the Kentucky Department
for Public Health about certain diseases, such as active tuberculosis.
Food and Drug Administration: We may share your information with
the Food and Drug Administration (FDA) to support activities related
to the quality, safety or effectiveness of a product or activity.
Communicable Diseases: We may share your information with a person
who may have been exposed to a communicable disease or may otherwise
be at risk for contracting or spreading a disease or condition when permitted
by law.
Health Oversight: We may share your information with a health
oversight agency for activities authorized by law, such as audits, investigations
or inspections. For example, we may share information with the
state agency that issues our hospital license.
Coroners, Medical Examiners and Funeral Directors: We may share
your information with coroners or medical examiners so they may perform
their legal duties, such as making identifications or determining cause
of death. We may also share your information with funeral directors
so they may perform their duties.
Organ Donation: We may share your information with organ procurement
organizations or other entities engaged in the procurement, banking or
transplantation of organs to facilitate organ, eye or tissue donation
and transplantation if you are an organ donor.
Workers Compensation: We may share your information as authorized
under workers compensation laws or other similar programs established
by law.
Inmates: We may share your information with an institution or
law enforcement official as necessary for your health and the health
and safety of other individuals if you are an inmate of a correctional
institution or under the custody of a law enforcement official.
Required By Law: The following are examples of information we
may share as required by law:
- Abuse or Neglect: We may share your information to report suspected
abuse, neglect or domestic violence to public officials.
- Law Enforcement: We may share your information to respond to
a warrant, subpoena or summons, to report certain types of wounds or
to identify or locate suspects, witnesses or missing persons. We
may also share your information if you are, or are suspected of being,
a victim of a crime or to alert law enforcement officials when we believe
a death may have resulted from criminal conduct, a crime occurred on
our property or a medical emergency exists off our property and it
is likely that a crime occurred.
- Legal Proceedings: We may share your information under a judicial
or administrative proceeding and in response to a court order, subpoena,
discovery request or other lawful process.
Threatening Activities: We may share your information if we believe
it is necessary to prevent or lessen a serious or present threat to the
health or safety of a person or the public. We may also share your
information with law enforcement authorities to identify or apprehend
an individual.
Military, National Security and Intelligence Activities: We may
share your information as required by military command authorities if
you are a member of the Armed Forces. We may also share your information
with authorized federal officials to conduct intelligence, counter-intelligence
or other national security activities, protect the President or other
authorized persons or conduct special investigations.
USES AND DISCLOSURES TO WHICH YOU MAY AGREE OR OBJECT
You have the right to agree or object to the following uses and disclosures
of your information. If you are not able to agree or object due
to incapacity or an emergency treatment circumstance, we may share your
information according to your prior expressed preference or if we determine
it is in your best interest.
Facility Directories: We may share your name, your location in
our facility and a general description of your condition. We may
also share your religious affiliation with the clergy.
Individuals Involved In Your Health Care: We may share your information
with your family, friends or other persons you identify. We may
also share your information to notify or assist in notifying your family
or other persons responsible for your care about your location, general
condition or death.
Disaster Relief: We may disclose your information to a public
or private entity authorized to assist in disaster relief efforts or
to coordinate with your family or other persons involved in your care.
USES AND DISCLOSURES REQUIRING YOUR AUTHORIZATION
Except as described above, we will not use or disclose your information
without authorization from you or your representative unless otherwise
permitted or required by law. You may revoke an authorization
at any time. The revocation will not apply to disclosures already
made in reliance on your authorization. Your request for revocation
must be made in writing to our Privacy Officer.*
YOUR RIGHTS
Right to Restrictions: You may ask us to restrict how we use and
disclose your information to carry out treatment, payment and health
care operations to your family, friends or other persons you identify. We
may agree to or deny your request. Your request for restrictions
must be made in writing to our Privacy Officer.*
Right to Confidential Communications: You may receive confidential
communications by different means and at different locations. We
will make every attempt to accommodate reasonable requests. Your
request for confidential communications must be made in writing to our
Privacy Officer.*
Right to Amendment: You may ask that we amend your health information
in a designated record set for as long as the information is maintained. We
may agree to or deny your request. If we deny your request, you
may submit a written statement of disagreement and we may prepare a written
rebuttal. If you do not submit a statement of disagreement, you
may ask us to include your request for amendment and our denial with
future disclosures. Your request for amendment must be made in
writing to our Privacy Officer.*
Right to an Accounting of Disclosures: You may receive an accounting
of disclosures of your information made by us in the six (6) years prior
to the date that you request the accounting. Among other exceptions,
this right does not apply to treatment, payment and health care operations,
persons involved in your care, national security or intelligence purposes,
correctional institutions or law enforcement officials or disclosures
that occurred before April 14, 2003. Your request for an accounting
of disclosures must be made in writing to our Privacy Officer.*
Right to Inspect and Copy: You may inspect and obtain a copy of
your protected health information contained in a designated record set
for as long as the information is maintained. We may deny your
request in certain circumstances and you may request a review of the
denial. Your request to inspect and copy must be made in writing
to our Medical Records Department.
Right to a Copy of this Notice: You have the right to a paper
copy of this Notice at any time. You may obtain a copy of this
Notice by making a written or verbal request to our Admissions Department.
* Please direct correspondence to our Privacy Officer at the address
listed below.
OUR DUTIES
We are required by law to maintain the privacy of your protected health
information and to provide you with notice of our legal duties and privacy
practices that affect your information. We are also required by
law to abide by the terms of this Notice.
CHANGES TO THIS NOTICE
We reserve the right to change the terms of this Notice at any time
and to make the new Notice provisions effective for all PHI that we maintain. You
may obtain a copy of the new Notice by making a written or verbal request,
by accessing our website at www.uoflhealthcare.org or
at the time of your next visit.
COMPLAINTS
If you believe your privacy rights have been violated, you may file
a written complaint with our Privacy Officer at the address listed below
or the Secretary of the U.S. Department of Health and Human Services. We
will not retaliate against you for filing a complaint.
CONTACT INFORMATION
Please direct correspondence or questions to:
Privacy Officer
University of Louisville Hospital
530 South Jackson Street
Louisville, KY 40202-1675
(502) 562-3551