Notice of Privacy Practices

Printable version

This notice describes your rights regarding your medical information and informs you of how medical information about you may be used. Please review it carefully. This notice applies to Oklahoma State University Health Services (UHS) facilities and clinics.

• University Health Services Duties

  By law, Oklahoma State University Health Services must keep protected health information (PHI) private. PHI is any information, including verbal, electronic and on paper that is created or received by UHS for purposes of providing health care to patients and for purposes of billing and payment for those services. PHI includes but is not necessarily limited to test results, notes written by doctors, nurses and other clinical staff, and general information such as your name, address and telephone number that is included in your health care records and your billing records.
  University Health Services is required by law to give you this notice and to follow the notice that is currently in effect.

• The Health Care Providers Covered by This Notice

  This notice covers UHS and UHS co-workers, volunteers, students, and trainees. The notice also covers other health care providers that come to UHS facilities and clinics to care for patients (such as physicians, physician assistants, therapists and other health care providers not employed by University Health Services), unless these other health care providers give you their own notice of privacy practices.

• Use & Disclosure of PHI Without Your Permission

  Below is a list of ways in which University Health Services may use or share your PHI without your advance permission:
  For Treatment: We may share PHI about you with people involved in your care. For example, a doctor may need to look at your medical history before treating you. To the extent allowed by law, we may also participate with digital health information exchanges (HIEs) and their members, in which we send patient data to a network system committed to securing the information and allowing your data to be available to other members who are providing treatment to you. If you do not want your information in the HIE, you must make a written restriction request through your provider.
  For Payment: We may use and disclose your PHI for billing purposes. For example, we may share your PHI with your insurance company to receive payment for services UHS provides to you, and we may share information with an ambulance company so that it may bill for services provided to bring you to UHS for treatment.
  For Health Care Operations: We may use and disclose PHI about you for our operations and to contact you when necessary. For example, we may share PHI about you to evaluate our doctors’ and nurses’ performance in caring for you. We are not allowed to use genetic information to decide whether we will give you treatment or determine the price of such treatment.
  For Research: We may share your PHI with researchers when their research has been approved by an institutional review board (IRB) and found by the IRB not to require patient permission. Your permission is required for other types of research.
  Health Information Exchange: Health Information Exchanges (HIE) are networks of electronic health information contributed by various providers. By seeing records of past care received at other locations in an HIE, providers can make more informed decisions about care plans and avoid duplicative or unnecessary treatment. As a healthcare provider in Oklahoma, we are required by state law to participate in the State-Designated HIE, MyHealth Access Network.

  MyHealth complies with all State and Federal laws (like HIPAA) to protect your information. Only the health industry professionals involved in your care (and their approved staff members) can access your information, and only as their jobs require it. You may opt-out of having your information shared by going to www.myhealthaccess.net/opt-out or ask our front desk for the opt-out form.

• Other Uses & Disclosures of PHI Without Your Permission

  University Health Services may also use or share PHI without your permission for the following purposes:

  • Public health activities such as to report the occurrence of communicable diseases
  • To report information about suspected victims of abuse, neglect, or domestic violence
  • Health oversight activities, such as Medicare and Medicaid program activities
  • Legal proceedings, such as in response to a subpoena or court order
  • Law enforcement purposes, such as with the police or other law enforcement officials who are pursuing a criminal suspect
  • With medical examiners, coroners, and funeral directors
  • For organ and tissue donation purposes
  • To avert a serious health or safety threat
  • To comply with workers’ compensation laws
  • With an entity legally authorized to assist in disaster relief efforts such as the American Red Cross
  • Helping with product recalls
  • Reporting adverse reactions to medications
  • For other purposes as required by law
• Permissive Uses or Disclosures

  Oklahoma State University Health Services may use or share your PHI for any of the purposes described in this section unless you specifically request in writing that we do not. Your written request must be given to your care provider or to the Oklahoma State University-Center for Health Sciences Compliance Office listed at the end of this notice.

  • We may contact you by mail, email or telephone at the addresses and numbers provided by you to remind you of an appointment, and we may leave voice messages at the telephone number you provide us with and respond directly to your emails.
  • We may contact you by mail, email or telephone at the addresses and numbers provided by you to tell you about or recommend possible treatment options or alternatives that may be of interest to you.
  • We may share patient directory information including your name, room location, and general condition (for example, fair, or stable) with people who ask for you by name.
  • We may contact you about UHS-sponsored activities including fundraising programs and events. If you do not want your information to be used for fundraising purposes, please contact the OSU-CHS Compliance Office listed at the end of this notice. We will care for you regardless of your decision to participate in fundraising activities.
  • We may share PHI about you with a friend, family member, personal representative, or any individual you identify who is involved in your care or is paying for some or all of your care.
• Uses & Disclosures Requiring Your Written Permission

  For any purpose other than the ones listed earlier in this notice, we may use or share your PHI only when you give us written permission.
  Psychotherapy Notes. We must obtain your written permission for most uses and disclosures of psychotherapy notes.
  Marketing. Before we receive financial payment for marketing activities using your PHI, we must obtain your written permission. We may, however, communicate with you about products or services related to your treatment, case management, care coordination, or alternative treatments, therapies, health care providers or care settings without your permission. Your permission is also not needed for small promotional items and face-to-face communications.
  Sale of PHI. We may not sell your PHI without your written permission, except that we may be paid our cost to provide PHI for certain permitted purposes such as public health purposes and other purposes permitted by law.

• Revoking Your Authorization

  If you give us written permission to use and share your PHI, you can take back your permission at any time, as long as you tell us in writing. If you take back your permission, we will stop using or sharing your information, but we will not be able to take back any information that we have already shared.
  You have the following rights:
  Right to Request Restrictions: You have the right to request any restrictions on uses or disclosures of your PHI. University Health Services is not required to accommodate all such requests but will make a good faith attempt to accommodate the requested restriction. UHS reserves the right to review and deny such requests as allowed by law. UHS also reserves the right to terminate agreed-upon restrictions if we deem it appropriate. We will notify you of such termination. If you pay cash for your health care item or service in full before or at the time the service or item is provided, and request that UHS not share the PHI about that service with your health plan, we will not disclose the PHI about that service to the health plan unless we are required to do so by law.
  Right to Request Confidential Communication: You have the right to request PHI in a certain form or at a specific location. Your request must be in writing. For example, you can request that we not contact you at work, and you can tell us how and/or where you want to receive PHI. We will agree to reasonable requests. If we agree to your request, we will honor your request until you tell us in writing that you have changed your mind and no longer want confidential communication.
  Right to Inspect and Receive a Copy of Your PHI: You have the right to review your PHI and to receive a paper or electronic copy of your PHI. Your request must be in writing. We may charge a fee for the cost of providing you with copies. We may deny your request to access and receive a copy of your PHI in rare situations when doing so is determined by a licensed health care professional to pose a serious risk of harm.

  Right to Request a Change to Your PHI: You have a right to request that your PHI be corrected if you believe that it contains a mistake or is missing information. You must tell us the reasons for the change in writing using the request form you can get from the OSU-CHS Compliance Office listed at the end of this notice. UHS will respond to your request, but can deny your request if: (1) it is not in writing or does not include a reason for the change; (2) the information you want to change was not created by UHS; (3) the information is not part of the medical record kept by UHS; (4) the information is not part of the information that you are permitted to inspect or copy; or (5) the information contained in the record is accurate and complete.
  Right to Notice of a Breach: We are required by law to tell you if there is a breach of your PHI. A breach can occur when safeguards to protect your PHI fail.
  Right to an Accounting of Disclosures: You have the right to request an accounting of disclosures of your PHI that we have made, with some exceptions. Your request must be in writing and must state the time period for the requested information. UHS will not provide this information for a time period greater than six (6) years from the date of your request. You have the right to receive one (1) free accounting every twelve (12) months. If you request more than one (1) accounting in any twelve (12) month period, we may charge you a reasonable fee for the costs of providing that list.
  Right to Receive a Copy of this Notice: You have the right to a copy of this Notice. You may view and print a copy of this notice from our website at uhs.okstate.edu/who-we-are/privacy. If you want a paper copy of this notice mailed to you, or to exercise any of your rights outlined above, please send a written request to the Privacy Officer at OSU-CHS Compliance Office listed at the end of this notice.
  Right to Choose Someone to Act for You: If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person you designate has the authority to act on your behalf before we take any action.

• Privacy Complaints

  If you have any questions about this Notice, or any concern about the privacy of your PHI, please contact the Privacy Officer for OSU-CHS Compliance Office listed at the end of this notice.
  We hope you will tell us if you have a concern so we can try to fix it, but you also have the right to file a complaint with the Office for Civil Rights (OCR) by sending a letter to 200 Independence Ave., S.W., Washington, D.C. 20201 or by visiting www.hhs.gov/ocr/privacy/hipaa/complaints/. If you decide to report a complaint to OSU Medicine or to the OCR, we will not retaliate against you and your complaint will not affect your ability to obtain care and treatment at OSU Medicine.

• Changes to this Notice

  We have the right to change this notice at any time. If we change this notice, we may make the new terms effective for all PHI that we maintain. Any changes that we make will comply with federal, state, and other laws. The most recent copy of this notice will be on our website and posted conspicuously in all University Health Services facilities and clinics. You can also call or write to the Privacy Officer at OSU-CHS Compliance Office listed at the end of this notice to obtain the most recent version of this notice.
  OSU-CHS Compliance Office

  ATTN: Privacy Officer

  2345 Southwest Blvd, Suite 250

  Tulsa, OK 74107

   

  (918) 586-4540

   

  chs.privacy@okstate.edu