NOTICE OF PRIVACY PRACTICES               

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

HIPAA PRIVACY RULES REQUIRE THAT WE FURNISH YOU WITH THIS NOTICE.

Overview

It is the policy of SMU Dr. Bob Smith Health Center at Southern Methodist University (the “Health Center”) to comply with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health (“HITECH”) Act of 2009, and implementing regulations.

The Health Center is required by law to maintain the privacy of your protected health information (“PHI”) and to provide you with a notice of its legal duties and privacy practices with respect to your protected health information. Accordingly, this Notice of Privacy Practices (“Notice”) is intended to inform you of the Health Center’s privacy practices and legal obligations regarding your protected health information, as regulated under HIPAA and related privacy regulations. This Notice also explains your rights with regard to your protected health information. The Health Center will only use your health information for intended patient/client care and other purposes described in this Notice.

The effective date of this Notice is October 1, 2013.

THE FOLLOWING IS A SUMMARY OF THE CIRCUMSTANCES UNDER WHICH AND PURPOSES FOR WHICH YOUR PHI MAY BE USED AND DISCLOSED.

Uses and Disclosures of Protected Health Information for TPO

The Health Center is permitted to use, access, maintain, and disclose your protected health information for purposes of treatment, payment, and operations ("TPO") in accordance with state and federal law. Use and disclosure of your protected health information for purposes of TPO do not require your authorization. We typically use or share your protected health information in the following ways:

Using and disclosing information for treatment purposes.To maintain quality healthcare, it will be necessary to share protected health information with all members of your treatment team. This may include employees in the Health Center as well as other health care providers. For example, a physician treating you for an injury may ask another doctor about your overall health condition or disclose your treatment records to other health care providers who are providing health care treatment to you.

Using and disclosing information for payment purposes. The Health Center can use and share your protected health information to bill for and receive payment from health plans and other entities. Necessary information will be shared with appropriate payer sources and their representatives for payment purposes including, but not limited to eligibility, benefit determination, and utilization review. It will also be necessary for our internal billing personnel to have access to protected health information to carry out their job functions.

Using and disclosing information for operations purposes. Necessary information will be shared for conducting business operations of the Health Center. Some examples of such business operations include, but are not limited to peer review, accreditation, quality assessment activities, training of staff, licensing, and conducting or arranging for other business activities.

We may enter into contracts with entities known as Business Associates that provide services to or perform functions on behalf of the Health Center. We may disclose protected health information to Business Associates once they have agreed in writing to safeguard the protected health information. For example, we may disclose your protected health information to a Business Associate to handle billing or to provide legal, accounting, auditing, and information technology services. Business Associates are also required by law to protect protected health information.

Other uses and disclosures without your consent

The following are additional situations where the law permits or requires the Health Center to use or disclose your protected health information without your authorization:

As permitted or required by law. The Health Center may also use or disclose your protected health information without your written authorization for other reasons as permitted by federal, state, or local law.

Disclosures for Public Health Activities. The Health Center can share protected health information about you for certain public health and safety situations.

Public Health Authorities. The Health Center may disclose your protected health information to public health authorities who need the information to prevent or control disease, injury, or disability or handle situations where children are abused or neglected.

Food and Drug Administration (FDA). The Health Center may disclose protected health information when there are problems with a product that is regulated by the FDA. For instance, when the product has harmed someone, is defective, or needs to be recalled.

Communicable Diseases. The Health Center may disclose protected health information to a person who has been exposed to a communicable disease or may be at risk of spreading or contracting a disease or condition.

Employment-Related Situations. The Health Center may disclose protected health information to an employer when the employer is allowed by law to have that information for work-related reasons. The Health Center may also disclose protected health information for workers' compensation programs.

Disclosures about Victims of Abuse, Neglect, or Domestic Violence. The Health Center may disclose protected health information to appropriate authorities if we have reason to believe that a person has been a victim of abuse, neglect, or domestic violence.

Disclosures for Health Care Oversight. The Health Center may disclose protected health information so that government agencies can monitor or oversee the health care system and government benefit programs and be sure that certain health care entities are following regulatory programs or civil rights laws like they should.

Disclosures for Judicial or Administrative Proceedings. The Health Center may disclose protected health information in a court or other type of legal proceeding if it is requested through a legal process, such as a court order or a subpoena.

Disclosures for Law Enforcement Purposes. As permitted or required by State law, the Health Center may disclose your protected health information to a law enforcement official for certain law enforcement purposes as follows: (1) as required by law for reporting of certain types of wounds or other physical injuries pursuant to the court order, warrant, subpoena or summons or similar process; (2) for the purpose of identifying or locating a suspect, fugitive, material witness or missing person; (3) under certain limited circumstances, when you are the victim of a crime; (4) to a law enforcement official if the Health Center has a suspicion that your death was the result of criminal conduct including criminal conduct at SMU; and (5) in an emergency in order to report a crime.

Uses or Disclosures in Situations Involving Decedents.The Health Center may use or disclose protected health information to coroners, medical examiners, or funeral directors so that they can carry out their responsibilities.

Uses or Disclosures Relating to Organ Donation.The Health Center may use or disclose protected health information to organizations involved in organ donation or organ transplants.

Uses or Disclosures Relating to Research.The Health Center may use or disclose protected health information for research purposes if the privacy of the information will be protected in the research.

Uses or Disclosures to Avert Serious Threat to Health or Safety.The Health Center may use or disclose your protected health information to appropriate persons or authorities if there is reason to believe it is needed to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

Uses or Disclosures Related to Specialized Government Functions.The Health Center may use or disclose protected health information to the federal government for military purposes and activities, national security and intelligence, or so it can provide protective services to the U.S. President or other official persons.

Specific Consent required for other uses and disclosures

Except for situations described above, the Health Center will not use or disclose your protected health information without your written authorization. This authorization will only allow the use or disclosure of the specific information detailed on the authorization form. The Health Center must obtain your authorization for any use or disclosure of your protected health information for release of psychotherapy notes, use of PHI for certain marketing or research purposes, and sale of protected health information.

If you give the Health Center authorization to disclose your protected health information to someone, you have the right to revoke that authorization so that the Health Center will not disclose the information to that person or organization in the future. However, the revocation will not affect any uses or disclosures that have been made with your authorization before it was revoked.

Patient Privacy Rights

Federal law provides you with certain rights with respect to your protected health information. You may exercise these rights as follows. To make these requests, contact the Executive Director of Health Services listed at the end of this Notice.

Right to Access, Inspect, and Copy Your Health Information. In most cases, you will have the right to review and obtain copies of your protected health information or request a summary or explanation of your health information. We may charge you a reasonable fee to cover the costs of copying, mailing, or other expenses associated with your request. To the extent your information is held in an electronic health record, you may be able to receive the information in electronic format. There are some exceptions to the right of access of health information. These include, but are not limited to: psychotherapy notes and information compiled for use in a civil, criminal, or administrative proceeding.

Right to Amend You have a right to ask the Health Center to make corrections or changes to your protected health information when you think this information is incorrect or incomplete. In some circumstances, we may deny your request to amend your protected health information. If we deny your request, you may file a statement of disagreement with us.

Right to an Accounting of Disclosures You have a right to get a list (an "accounting") of those with whom we've shared your protected health information. You have the right to request an accounting of the disclosures made of your protected health information by the Health Center dating back six years. This only applies to disclosures made for purposes other than treatment, payment, operations, and certain other discloses (such as those you asked us to make).

Right to Request Restrictions You have a right to ask us to limit how we use or share your protected health information when carrying out payment and health care operations and how we disclose health information to those involved in paying for your care, such as relatives or close friends. The Health Center does not have to agree to your requested restriction but has to follow the restriction if we agree to it. Even if the Health Center agrees to follow a restriction, we may still use or disclose the restricted information to appropriate persons if you need emergency care. Although in most circumstances, the Health Center is not obligated to agree to a requested restriction, if you pay for a service or health care item out-of-pocket in full and ask us not to share that information for the purposes of payment or our operations with your health insurer, we are required to comply with that request.

Right to request Confidential Communications You have the right to ask us to communicate with you in a specific way. For example, you may ask us to call you at your place of employment or send communications regarding treatment to an alternate address. We will make every effort to accommodate reasonable requests. We may also condition this accommodation by asking you for information as to how payment will be handled or specification of an alternative address or other method of contact. We will not request an explanation from you as to the basis for the request.

Our Legal Responsibilities

In addition to maintaining the privacy of your protected health information and providing you with this Notice, the Health Center is obligated to notify you upon discovery of a breach that compromises the privacy and security of your protected health information.

We are required to follow the duties and privacy practices described in this Notice and give you a copy. We may change the terms of this Notice and reserve the right to make the changes effective for all protected health information that we maintain about you. This Notice, and any revisions, will be available to you upon request and posted in our office.

Complaints