|
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY
BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW
IT CAREFULLY.
The practice acts to maintain the privacy of protected health information and
provide individuals with notice of the practice’s legal duties and privacy
practices with respect to protected health information as described in this Notice
and abide by the terms of the Notice currently in effect.
Provision of Notice: The practice provides its Notice of Privacy
Practices to every patient with whom it has a direct treatment relationship. The
Notice is provided no later than the date of the first treatment to the patient
after April 13, 2003. The practice makes its Notice available to any member of
the public to enable prospective patients to evaluate the practice’s privacy
practices when making his or her decision regarding whether to seek treatment
from the practice. The practice provides its Notice via e-mail to any patient
or other individual who so requests the Notice.
Documentation of Provision of Notice: When a direct treatment
patient receives the Notice from the practice, the practice asks the patient to
sign its “Receipt of Notice of Privacy Practices” form. The form is
filed with the patient’s medical record. If the patient refuses to sign
the form, it is noted in the medical record that the patient was given the Notice
and refused to sign the form.
Effective Date and Changes to Notice: This Notice is effective
4/14/03. The practice reserves the right to revise this Notice whenever there
is a material change to the uses or disclosures, the individual’s rights,
the covered entity’s legal duties, or other privacy practices stated in
the Notice. Except when required by law, a material change to any term of the
Notice will not be implemented prior to the effective date of the notice in which
such material change is reflected.
If the Notice is revised, the practice makes the revised Notice available upon
request beginning on the revision’s effective date. The revised notice is
posted in the practice’s reception area and made available to all patients,
including those who have received a previous Notice. Upon receipt of a revised
Notice, a patient is asked to acknowledge receipt of the Notice.
Complaints: The practice allows all patients and their agents
to file complaints with the practice and with the Secretary of the federal Department
of Health and Human Services. A patient or his or her agent may file a complaint
with the practice whenever he or she believes that the practice has violated their
rights. Complaints to the practice must be in writing, must describe the acts
or omissions that are the subject of the complaint, and must be filed within 180
days of the time the patient became aware or should have become aware of the violation.
Complaints must be addressed to the attention of the practice’s privacy
officer at the practice’s address. The practice investigates each complaint
and may, at its discretion, reply to the patient or the patient’s agent.
Complaints to the Secretary of the Department of Health and Human Services must
be in writing, must name the practice, must describe the acts or omissions that
are the subject of the complaint, and must be filed within 180 days of the time
the patient became aware or should have become aware of the violation. Complaints
must be addressed to: U. S. Department of Health and Human Services, Office of
Civil Rights, 233 N. Michigan Avenue, Suite 240, Chicago, IL 60601 The practice
does not take any adverse action against any patient who files a complaint (either
directly or through an agent) against the practice.
Contact Person: The practice has a privacy officer that serves as the contact
person for all issues related to the Privacy Rule. The privacy officer is Jean
Lopata. If you have any questions about this Notice, please contact: Jean
Lopata, Privacy Officer, University Surgeons at 312-942-6500 or 1725
W. Harrison, Suite 810, Chicago, IL 60612.
USES AND DISCLOSURES
OF PROTECTED HEALTH INFORMATION
The practice reasonably ensures that the protected health information (PHI)
it requests, uses, and discloses for any purpose is the minimum amount of PHI
necessary for that purpose. The practice treats all qualified individuals as personal
representatives of patients. The practice generally allows individuals to act
as personal representatives of patients. The two general exceptions to allowing
individuals to act as personal representatives relate to unemancipated minors
and abuse, neglect, or endangerment situations. The practice makes reasonable
efforts to ensure that protected health information is only used by and disclosed
to individuals that have a right to the protected health information. Toward that
end, the practice makes reasonable efforts to verify the identity of those using
or receiving protected health information.
Uses and Disclosures – Treatment, Payment, and Health Care Operations
The practice uses and discloses protected health information for payment,
treatment, and health care operations. Treatment includes those activities related
to providing services to the patient, including releasing information to other
health care providers involved in the patient’s care. Payment relates to
all activities associated with getting reimbursed for services provided, including
submission of claims to insurance companies and any additional information requested
by the insurance company so they can determine if they should pay the claim. Health
care operations includes a number of areas, including quality assurance and peer
review activities.
Uses and Disclosures – Not Requiring Authorization
Disclosure to Those Involved in Individual’s Care: The practice
discloses protected health information to those involved in a patient’s
care when the patient approves or, when the patient is not present or not able
to approve, when such disclosure is deemed appropriate in the professional judgment
of the practice. When the patient is not present, the practice determines whether
the disclosure of the patient’s protected health information is authorized
by law and if so, discloses only the information directly relevant to the person’s
involvement with the patient’s health care. The practice does not disclose
protected health information to a suspected abuser, if, in its professional judgment,
there is reason to believe that such a disclosure could cause the patient serious
harm. Further, the practice uses and discloses information as required by law.
Uses and Disclosures Required by Law: The practice uses and
discloses protected health information to appropriate individuals as required
by law. As required by law the practice discloses protected health information
to public health officials. This includes reporting of communicable diseases and
other conditions, sexually transmitted diseases, lead poisoning, Reyes Syndrome,
and mandated reports of injury, medical conditions or procedures, or food-borne
illness including but not limited to adverse reactions to immunizations, cancer,
adverse pregnancy outcomes, death, birth. The practice discloses protected health
information regarding victims of abuse, neglect, or domestic violence. The practice
discloses information about a minor, disabled adult, nursing home resident, or
person over 60 years of age whom the practice reasonably believes to be a victim
of abuse or neglect to the appropriate authorities as required by law or, if not
required by law, if the individual agrees to the disclosure. This includes child
abuse and neglect, elder abuse and exploitation, abused and neglected nursing
home residents, or disabled adults abuse. The practice informs the individual
of the reporting unless the practice, in the exercise of professional judgment,
believes informing the individual would place the individual at risk of serious
harm or the practice would be informing a personal representative, and the practice
believes the personal representative is responsible for the abuse, neglect, or
other injury, and that informing such person would not be in the best interests
of the individual as determined by the professional judgment of the practice.
Uses and Disclosures for Health Oversight Activities: The
practice uses and discloses PHI as required by law for health oversight activities.
The information may be used and released for audits, investigations, licensure
issues, and other health oversight activities, including, but not limited to hospital
peer review, managed care peer review, or Medicaid or Medicare peer review.
Disclosures for Judicial and Administrative Proceedings: In
general, the practice discloses information for judicial and administrative proceedings
in response to an order of a court or an administrative tribunal; or a subpoena,
discovery request or other lawful process, not accompanied by a court order or
an ordered administrative tribunal.
Disclosures for Law Enforcement Purposes: The practice discloses
PHI for law enforcement purposes to law enforcement officials.
Uses and Disclosures Related to Decedents: The practice uses
and discloses PHI as required to a coroner or medical examiner and funeral directors
as required by law. The attending physician is required to sign the death certificate
and provide the coroner with a copy of the decedent’s protected health information.
Uses and Disclosures Related to Cadaveric Organ, Eye or Tissue Donations:
The practice uses and discloses protected health information to facilitate
organ, eye or tissue donations.
Uses and Disclosures to Avert a Serious Threat to Health or Safety:
The practice uses and discloses protected health information to public
health and other authorities as required by law to avert a serious threat to health
or safety.
Uses and Disclosures for Specialized Government Functions: The
practice uses and discloses protected health information for military and veterans
activities, national security and intelligence activities, and other activities
as required by law.
Uses and Disclosures in Emergency Situations: The practice
uses and discloses protected health information as appropriate to provide treatment
in emergency situations. In those instances where the practice has not previously
provided its Notice of Privacy Practices to a patient who receives direct treatment
in an emergency situation, the practice provides the Notice to the individual
as soon as practicable following the provision of the emergency treatment.
Marketing Purposes: The practice does not use or disclose
any protected health information for marketing purposes. The practice does engage
in communications about products and services that encourages recipients of the
communication to purchase or use the product or service for treatment, to direct
or recommend alternative treatments, therapies, health care providers, or settings
of care to the individual. These activities are not considered marketing.
In addition, the practice may contact the individual with appointment reminders
or information about treatment alternatives or other heath-related benefits and
services that may be of interest to the individual.
Uses and Disclosures – Do Not Apply to Practice
Research: The practice does not engage in any research
activities that require it to use or disclose protected health information.
Other Uses and Disclosures: The practice does not use or disclose
protected health information to an employer or health plan sponsor, for underwriting
and related purposes, for facility directories, to brokers and agents, or for
fundraising. If an individual wants the practice to release his or her protected
health information to employers or health plan sponsors, for underwriting and
related purposes, for facility directories, or to brokers and agents, then he
or she can contact the practice and complete an appropriate written authorization.
INDIVIDUAL RIGHTS
Individual Rights – Accounting for Disclosures of Protected Health
Information
The practice tracks all disclosures of a patient’s protected health
information that occur for other than the purposes of treatment, payment, and
health care operations, that are not made to the individual or to a person involved
in the patient’s care, that are not made as a result of a patient authorization,
and that are not made for national security or intelligence purposes or to correctional
institutions or law enforcement officials.
The practice allows an individual to request one accounting within a 12-month
period free of charge. The practice charges a reasonable fee for more frequent
accounting requests. The charge will be $25.00. An individual can request an accounting
of disclosures for a period of up to six years prior to the date of the request.
Requests for shorter accounting periods will be accepted. However, patients may
only request an accounting of disclosures made on or after April 14, 2003. The
practice responds to all requests for an accounting of disclosures within 60 days
of receipt of the request. If the practice intends to provide the accounting for
disclosures and cannot do so within 60 days, the practice informs the requestor
of such and provides a reason for the delay and the date the request is expected
to be fulfilled. Only one 30-day extension is permitted. A request for an accounting
for disclosures must be made in writing and mailed or sent to the practice. It
should be marked “Attention: Privacy Officer.”
Individual Rights – Inspect and Copy Protected Health Information
The practice allows individuals to inspect and copy their protected
health information, documents all requests, responds to those requests in a timely
fashion, informs individuals of their appeal rights when a request is rejected
in whole or in part, and charges a reasonable fee for the copying of records.
The practice reviews the request in a timely fashion and acts on a request for
access generally within 30 days. The practice may have a single extension of 30
days, if needed to act on the request. Each request will be accepted or denied
and the requestor notified in writing. If a request is denied, the requestor is
informed if the denial is “reviewable” or not. The requestor has the
right to have any denial reviewed by a licensed health care professional who is
designated by the practice as a reviewing official and who did not participate
in the original decision to deny. The practice informs the requestor of the decision
of the reviewing official and adheres to the decision. The practice charges reasonable
fees based on actual cost of fulfilling the request. The practice will determine
the appropriate charge for providing the requested records and inform the requestor
in advance of providing the records. If the requestor agrees to pay the fee in
advance, the records will be provided. Otherwise, the records will not be provided,
unless the Privacy Officer determines that the charge is burdensome to the requestor.
Illinois law prohibits charges that exceed the following: $20 handling fee plus
75 cents each for pages 1-25, 50 cents each for pages 26-50, and 25 cents each
for pages 51 to end; plus actual expenses related to the copying of x-rays, CAT
scans, and similar. The practice limits charges for records to the amounts allowed
under Illinois law. Requests for the inspection and copying of records must be
sent to the practice in writing. It should be marked “Attention: Privacy
Officer.”
Individual Rights – Request Amendment to Protected Health Information
The practice allows an individual to request that the practice amend
the protected health information maintained in the patient’s medical record
or the patient’s billing record. The practice documents all requests, responds
to those requests in a timely fashion, and informs individuals of their appeal
rights when a request is denied in whole or in part. Generally the practice will
act on a request for amendment no later than 60 days after receipt of such a request.
If the practice cannot act on the amendment within 60 days, the practice extends
the time for such action by 30 days and, within the 60-day time limit, provides
the requestor with a written statement of the reasons for the delay and the date
by which the practice will complete action on the request. Only one such extension
is allowed. If the practice denies the request, in whole or in part, the practice
provides the requestor with a written denial in a timely fashion. The practice
allows a requestor to submit a written statement disagreeing with the denial of
all or part of the initial request. The statement must include the basis of the
disagreement. The practice limits the length of a statement of disagreement to
one page. The practice accepts requests to amend the PHI maintained by the practice.
The requests must be in writing and should be marked “Attention: Privacy
Officer.”
Individual Rights – Request Confidential Communications
The practice accommodates all reasonable requests to keep communications
confidential. The practice determines the reasonableness based on the administrative
difficulty of complying with the request. A request for confidential communications
must be in writing, must specify an alternative address or other method of contact,
and must provide information about how payment will be handled. The request must
be addressed to the practice’s privacy officer. No reason for the request
needs to be stated. The practice accommodates all reasonable requests. The reasonableness
of a request is determined solely on the basis of the administrative difficulty
of complying with the request. The practice will reject a request due to administrative
difficulty: if no independently verifiable method of communication such as a mailing
address or published telephone number is provided for communications, including
billing; or if the requestor has not provided information as to how payment will
be handled. The practice will not refuse a request: if the requestor indicates
that the communication will cause endangerment; or based on any perception of
the merits of the requestor’s request.
Individual Rights – Request Restriction of Disclosures
The practice accepts all requests for restrictions of disclosures of
protected health information. The practice does not agree to any restrictions
in the use or disclosure of protected health information. All requests for restrictions
of disclosures must be submitted in writing. They must be sent to the attention
of the practice’s privacy officer. The privacy officer notifies the requestor
in writing that the practice does not accept restrictions of disclosure.
Individual Rights – Authorizations
The practice obtains a written authorization from a patient or the patient’s
representative for the use or disclosure of protected health information for other
than treatment, payment, or health care operations; however, the practice will
not get an authorization for the use or disclosure of protected health information
specifically allowed under the Privacy Rule in the absence of an authorization.
The practice will provide a patient upon request a copy of any authorization initiated
by the practice (as opposed to requested by the patient) and signed by the patient.
The practice does not condition treatment of a patient on the signing of an authorization,
except disclosure necessary to determine payment of claim (excluding authorization
for use or disclosure of psychotherapy notes); or provision of health care solely
for purpose of creating protected health information for disclosure to a third
party (e.g., pre-employment or life insurance physicals). In Illinois, a specific
written authorization is required to disclose or release of mental health treatment,
alcoholism treatment, drug abuse treatment or HIV/Acquired Immune Deficiency Syndrome
(AIDS) information. The practice allows an individual to revoke an authorization
at any time. The revocation must be in writing and must be sent to the attention
of the practice’s privacy officer; however, in any case the practice will
be able to use or disclose the protected health information to the extent practice
has taken action in reliance on the authorization.
Individual Rights – Waiver of Rights
The practice never requires an individual to waive any of his or her
individual rights as a condition for the provision of treatment, except under
very limited circumstances allowed under law.
|
