This notice summarizes the privacy practices of the University of Miami Health System (“UHealth”) which includes the University of Miami Hospital and Clinics (UMHC), the University of Miami physician faculty practice (otherwise known as the University of Miami Medical Group), the healthcare components of the University of Miami Miller School of Medicine, their workforce, medical staff, physicians and other health care professionals who provide you with treatment and health care. We may share protected health information, including electronic protected health information (“Health Information”), about you within UHealth for purposes described in this notice.
Health Information is information that UHealth collects from you when you are a patient that identifies who you are. Health Information includes information such as your name, date of birth, dates of services, diagnosis, treatments, genetic information, financial information, medications, demographic information (name, address, home/cellular/work telephone numbers, email] addresses, and social security number), photographs, etc. This information is important because it allows medical staff to treat you more efficiently and effectively.
When you receive services or treatment from UHealth, you will be asked to sign a consent form in which you allow us to use and disclose Health Information about you in ways that are permitted by the federal privacy law, as summarized in this Notice. However, some kinds of Health Information are subject to separate special privacy protections under the laws of the State of Florida or other federal laws, therefore portions of this notice may not apply. If you receive alcohol or substance abuse services or treatment from our substance abuse treatment program, you will receive a separate notice describing how we may use, disclose and protect the privacy of Health Information regarding your alcohol or substance abuse treatment. In addition, special rules apply to the results of human immunodeficiency virus (“HIV”) tests that identify you or the fact that an HIV test has been performed on you (“HIV test results”). The section below entitled “How We May Use and Disclose HIV Test Results” describes how we may use and disclose this type of Health Information. Finally, the section below entitled “How We May Use and Disclose Psychotherapy Notes” describes how we may use and disclose notes from psychotherapy counseling sessions in which you participate.
In most circumstances, the following uses and disclosures of Health Information will require that you sign a written authorization for: (1) uses and disclosures of psychotherapy notes; (2) uses and disclosures of Health Information for marketing purposes; (3) uses and disclosures of Health Information where UHealth receives payment in exchange for disclosing such Health Information; and (4) any other uses and disclosures of Health Information not described in this Notice
The following categories of activities describe the ways that we may use and disclose Health Information without obtaining your prior written authorization. Some of the categories include examples, but not every type of use or disclosure included in a category is listed. Except for the categories of activities described below, we will use and disclose Health Information only with written permission from you. If you give us permission to use or disclose Health Information (including HIV test results and psychotherapy notes) for a purpose not listed in this notice, you may revoke your permission at any time by sending a written request to our Privacy Office at the address listed at the end of this notice or via email to privacy@med.miami.edu. Once you have revoked your authorization, UHealth will take appropriate action to prevent any further use or disclosure of the Health Information. However, we cannot take back any uses or disclosures already made with your permission.
For Treatment. We may use Health Information to treat you or provide you with health care services. We may disclose Health Information to doctors, nurses, technicians, or other personnel, including people outside our facilities or clinics who, are involved in your medical care. For example, we may tell your primary care physician about your treatment at UHealth, or give Health Information to a specialist to provide you with additional health care services as appropriate for treatment purposes.
For Payment. We may use and disclose Health Information so that we, or others may bill or receive payment from you, a government program, an insurance company or other responsible third party for the treatment and health care services you receive. For example, we may give your health plan information about your treatment so that your health plan is able to pay for the cost of such treatment. We also may tell your health plan about the services that you are going to receive to obtain prior approval or to determine whether your plan will cover the services.
For Health Care Operations. We may use and disclose Health Information for health care operations, which are administrative activities involved in operating UHealth. These uses and disclosures are necessary to maintain quality care when delivering services to our patients and for our business and management purposes. For example, we may use Health Information to review the adequacy and quality of the care that our patients receive.
Appointment Reminders, Treatment Alternatives, and Health-Related Benefits and Services. We may use and disclose Health Information to contact you as a reminder that you have an appointment with us. We also may use and disclose Health Information to tell you about treatment options, alternatives, health-related benefits, or services that may be of interest to you.
Fundraising Activities. We may use your demographic information (e.g., name, address, telephone numbers and other contact information), the dates of health care provided to you, your health care status, the department and physician(s) who provided you services, and your treatment outcome information in contacting you in an effort to raise funds in support of UHealth and other non-profit entities with whom the University is conducting a joint fundraising project. We may also disclose this information to a related foundation or to our business associates so that they may contact you to raise funds for us and other non-profit entities with whom the University is conducting a joint fundraising project. For example, you may get invitations to fundraising events or other types of mailing for University events, affiliated programs, and other joint fundraising programs.
Facility Directory. If you are a patient at a UHealth facility, we may list your name, general condition (e.g., fair, critical), and location in our hospital directory, unless you ask us not to. We may disclose this information to anyone who asks for you by name.
Clergy. We may disclose the information in our facility directory and information that you choose to provide us regarding your religious affiliation to members of the clergy for use and disclosure in their religious activities.
Individuals Involved in Your Care or Payment for Your Care. We may disclose Health Information to a person, such as a family member or friend, who is involved in your medical care or helps pay for your care, such as a family member or friend. We also may notify such individuals about your location or general condition, or disclose such information to an entity assisting in a disaster relief effort.
Research. Under certain circumstances, as an academic medical center, we may use and disclose Health Information for research purposes. For example, a research project may involve comparing the health and recovery of all patients who received one medication or treatment to those who received another, for the same condition. Before we use or disclose Health Information for research, the project will go through a special approval process. This process evaluates a proposed research project and its use of Health Information to balance the benefits of research with the need for privacy of Health Information. We also may permit researchers to look at records to help them identify patients who may be included in their research project or for other similar purposes.
Special Circumstances
In addition to the above, we may use and disclose Health Information in the following special circumstances:
As Required by Law. We will disclose Health Information when required to do so by international, federal, state or local law.
To Avert a Serious Threat to Health or Safety. We may use and disclose Health Information when necessary to prevent or lessen a serious threat to your health or safety, or the health or safety of the public or another person. Any disclosure, however, will be to someone who we believe may be able to help prevent the threat.
Business Associates. We may disclose Health Information to the business associates that we engage to provide services on our behalf if the information is needed for such services. For example, we may use another company to perform billing services on our behalf. Our business associates are obligated by law and under contract with us to protect the privacy of Health Information. Our business associates are not allowed to use or disclose any Health Information other than as specified in our contract with them.
Organ and Tissue Donation. If you are an organ donor, we may release Health Information to organizations that handle organ procurement; organ, eye, or tissue transplantation; or to an organ donation bank, as necessary, to facilitate organ or tissue donation and transplantation.
Military and Veterans. If you are a member of the armed forces, we may release Health Information as required by military command authorities. We also may release Health Information to the appropriate foreign military authority if you are a member of a foreign military.
Workers’ Compensation. We may disclose Health Information as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.
Public Health Risks. We may disclose Health Information for public health activities. These activities generally include disclosures to prevent or control disease, injury or disability; report births and deaths; report child abuse or neglect; report reactions tomedications or problems with products; notify people of recalls of products they may be using; track certain products and monitor their use and effectiveness; if authorized by law, notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; and conduct medical surveillance of our facilities in certain limited circumstances concerning workplace illness or injury. We also may release Health Information to an appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence; however, we will only release this information if the patient agrees or when we are required or authorized by law.
Health Oversight Activities. We may disclose Health Information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure of our facilities and providers. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose Health Information in response to a court or administrative order. We also may disclose Health Information in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.
Law Enforcement. We may release Health Information if asked by a law enforcement official as follows: (1) in response to a court order, subpoena, warrant, summons or similar process; (2) limited information to identify or locate a suspect, fugitive, material witness, or missing person; (3) about the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement; (4) about a death we believe may be the result of criminal conduct; (5) about evidence of criminal conduct on our premises; and (6) in emergency circumstances to report a crime, the location f the crime or victims, or the identity, description, or location of the person who committed the crime.
Coroners, Medical Examiners and Funeral Directors. We may release Health Information to a coroner or medical examiner. In some circumstances this may be necessary, for example, to determine the cause of death. We also may release Health Information to funeral directors as necessary for their duties.
National Security and Intelligence Activities. We may release Health Information to authorized federal officials for intelligence, counter-intelligence, and other national security activities authorized by law.
Protective Services for the President and Others. We may disclose Health Information to authorized federal officials so they may provide protection to the President, other authorized persons, foreign heads of state or to conduct special investigations.
Inmates or Individuals in Custody. In the case of inmates of a correctional institution or that are under the custody of a law enforcement official, we may release Health Information to the appropriate correctional institution or law enforcement official. This release would be made only if necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
We may use and disclose HIV test results for the purposes described above only if you give your permission to use and disclose these HIV test results along with your medical records at the time of testing. If you did not give such permission, we may use and disclose this information only for the following limited purposes without your written authorization: (1) for health care treatment (as described above) and to provide you with health care services, such as informing a specialist about your HIV status to enable the specialist to provide additional services to you; (2) for payment (as described above), such as compiling or reviewing records as part of routine billing; (3) for health care operations (as described above), such as to enable our health facility staff to monitor and evaluate our programs; (4) to child-placing or child-caring agencies, family foster homes, residential facilities or community-based care programs that are directly involved in placement, care, control or custody and who have a need to know such information; (5) to a sex or needle sharing partner in accordance with applicable law; (6) to the Florida Department of Health for public health reporting and disease control purposes, in accordance with applicable law; (6) to organizations that procure, process, distribute or use organs, eyes, or tissues for donation purposes; (7) to authorized medical or epidemiological researchers; (8) in accordance with a valid court order that specifically requires us to release HIV test results; (9) if an officer, law enforcement personnel, firefighter, ambulance driver, paramedic or emergency medical technician comes into contact with a person in such a way that significant exposure to HIV has occurred, then we may release such HIV test results to a person who was significantly exposed to HIV.
Separate authorizations are generally required for most uses and disclosures of psychotherapy notes. We may use and disclose notes taken during psychotherapy counseling that you received from UHealth only for the following limited purposes: (1) for health care treatment (as described above) and to provide you with health care services, such as a physician reviewing his/her notes prior to your therapy session; (2) to defend the University of Miami in a legal action or other proceeding, such as providing psychotherapy notes to our lawyers who are defending the University of Miami in a legal case; (3) when required by law (as described above) under international, federal, state or local law; (4) to a health oversight agency for oversight activities involving the creator of the notes (as described above); (5) to identify you to a coroner or medical examiner (as described above); (6) when necessary to prevent or lessen a serious threat to health and safety (as described above).
You have the following rights, subject to certain limitations, regarding Health Information that we maintain about you:
Right to Inspect and Copy. You have the right to inspect and receive a copy and/or tell us where to send a copy of Health Information that may be used to make decisions about your care or payment for your care, including information kept in an electronic health record.. You can also access your medical records electronically online with MyUHealthChart, available at MyUHealthChart.com.
Please note that there may be a charge for paper or electronic copies of your records.
Right to Amend. If you feel that Health Information that we have is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is maintained by or for us. You must tell us the reason for your request.
We may deny your request for an amendment to your record. We may do this if your request is not in writing or does not include a reason to support the request. We also may deny your request if you ask us to amend information that:
we did not create;
is not part of the records used to make decisions about you;
is not part of the information which you are permitted to inspect and/or receive a copy of; or
is accurate and complete.
Right to an Accounting of Disclosures. You have the right to request, in writing, an accounting of certain disclosures of Health Information that were made for purposes other than treatment, payment for care, or health care operations. You are entitled to one disclosure accounting in any 12-month period at no charge. For any additional accountings requested within the 12-month period, we may charge a reasonable cost-based fee.
Right to Request Restrictions. You have the right to request a restriction or limitation on the Health Information that we use or disclose for treatment, payment, or health care operations. You have the right to request a limit on the Health Information that we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not share information about your surgery with your spouse. We are not required to agree to your request. If we agree to your request, we will comply with your request unless we need to use the information in certain emergency treatment situations.
In addition, you have the right to request that we restrict disclosure of Health Information to your health plan if the disclosure is for the purpose of carrying out payment or health care operations (and is not for the purpose of carrying out treatment) and the Health Information pertains solely to a health care item or service for which you have paid in full, and UHealth must comply with such a request. UHealth is not required to comply with your request if you do not pay for the service in full.
Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we contact you only by mail or at work. Your request must specify how or where you wish to be contacted. We will accommodate reasonable requests.
Right to Opt-Out of Fundraising Communications. You have the right to ‘Opt-Out’ of receiving fundraising communications. You may do so by sending an email including your full name, address, and telephone number to medoptout@med.miami.edu. In the alternative, you may send the same information via mail to the Privacy Office address below. Normal processing time may take up to two (2) weeks from the date of receipt. During that processing time, you may continue to receive fundraising communications until our system is updated.
Right to a Paper Copy of This Notice. You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. You may obtain a copy of this notice at any time on the Privacy Office website: http://privacy.med.miami.edu/
By providing us with certain information, you expressly agree that UHealth and its business associates can use certain information (such as your home/work/cellular telephone number and your email), to contact you about various matters, such as follow up appointments, collection of amounts owed and other health-related services and operational matters. You agree you may be contacted through the information you have provided and by use of pre-recorded/artificial voice messages and use of an automatic/predictive dialing system.
We will keep Health Information private and secure as required by law. If there is a breach (as defined by law) of any of your unsecured Health Information, then we will notify you following the discovery of the breach in accordance with applicable state and federal laws.
UHealth participates and in the future may participate in various systems of electronic exchange of Health Information with other healthcare providers, health information exchange networks and health plans. Health Information maintained at UHealth may be accessed by other providers, health information exchange networks and health plans for the purposes of treatment, payment, or health care operations as described above. In addition, UHealth may access Health Information maintained by other providers, health information exchange networks and health plans for treatment, payment or health care operation purposes.
To exercise any of your rights described in this notice, other than to obtain a paper copy of this notice, you must email Privacy@med.miami.edu or send a request, in writing, to our Chief Privacy and Data Integrity Officer at the following address:
University of Miami Office of Privacy and Data Security
P.O. Box 019132 (M-879)
Miami, Florida 33101
For additional information, please contact the Office of Privacy and Data Security at 305-243-5000 or 1-866-366-HUSH (4874). You can also visit our website at: http://privacy.med.miami.edu.
NO OTHER STAFF MEMBER, PHYSICIAN, NURSE, CLERGY MEMBER, OR ANY OTHER PERSON IS AUTHORIZED TO ACCEPT A REQUEST TO EXERCISE YOUR RIGHTS.
We reserve the right to change this notice and to make the revised or changed notice effective for Health Information that we already have as well as any information we receive in the future. We will post a copy of the current notice at our hospitals, clinics and physician offices as well as on our website at: http://privacy.med.miami.edu/patients/notice-of-privacy-practices. The notice will contain the effective date on the first page, in the top right-hand corner.
If you believe your privacy rights have been violated, you may file a complaint by contacting us at the Privacy Office address listed above. All complaints must be made in writing. You will not be penalized for filing a complaint.
You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling (877) 696-6775, or visiting http://HHS.Gov/OCR/Privacy/HIPAA/Complaints.