Modified From:
HIPPA Policy of:
UNIVERSITY OPTOMETRIC CENTER
State University of New York College of Optometry
33 West 42nd Street, New York, NY 10036-8003

VERSION 1.0  April 14, 2003

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.  We are required by law to protect the privacy of health information that may reveal your identity, and to provide you with a copy  of this notice which describes the health information privacy practices of our center, its optometric medical staff, and affiliated health care providers that jointly perform treatment, payment activities and business operations with our center.  A copy  of our current notice will always be posted here.

WHEN WE MAY NEED YOUR AUTHORIZATION TO USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION

We will generally obtain your written authorization before we use or share with others your protected health information that would specifically identify you except for treatment, payment and health care operations.  You may also initiate the transfer of your records to another person by completing an authorization form.  If you provide us with a written authorization, you may revoke that authorization at any time, except to the extent that we have already relied upon it.  To revoke an authorization, please write to the Medical Records department.

WHAT HEALTH INFORMATION IS PROTECTED
We are committed to protecting the privacy of information we gather about you while providing health-related services.  Some examples of protected health information are:

·    information about your health condition (such as a disease you may have);
·    information about health care services you have received or may receive in the future (such as an operation);
·    information about your health care benefits under an insurance plan (such as whether a prescription is covered);
·    geographic information (such as where you live or work);
·    demographic information (such as your race, gender, ethnicity, or marital status);
·    unique numbers that may identify you (such as your social security number, or your phone number); and
·    other types of information that may identify who you are.

WHEN WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION WITH YOUR CONSENT

During your intake, prior to receiving any health care services, we will ask you to sign a one time HIPAA consent permitting University Optometric Center, its faculty providers and other healthcare professionals to use and disclose your health information for the purposes of Treatment, Payment, and Health Care Operations.  A description of these uses are described
below.  We are allowed by law to refuse to treat you if you do not sign the consent form.

Treatment, Payment And University Optometric Center Business Operations

We share and use your health information with doctors, residents, students, and other healthcare professionals at the center who are involved in taking care of you, and they may in turn use that information for diagnosis management or treatment.  We may disclose your health information to another health care provider to whom you have been referred for further health care, or to a provider to whom you have disclosed as participating in your care.  We may also disclose your health information to manufacturers when we order eyeglasses, contact lens, or low vision devices for you.  Sometimes we may ask for copies of your health information from another professional that you may have seen before us for diagnosis management or treatment.

We use your health information for payment purposes when, for example, our staff asks you about health insurance or about other sources of payment for our services, when we prepare bills to send to you or your health or vision care plan, when we process payment by credit card, and when we try to collect unpaid amounts due.  We may disclose your health information outside of our office for payment purposes when, for example, bills or claims for payment are mailed, faxed, or sent by computer to you or your health insurance, or when we occasionally have to ask a collection agency or attorney to help us with unpaid amounts due.
We use and disclose your health information for health care operations in a number of ways.  Health care operations means those administrative and managerial functions that we have to do in order to run our business.  We may use or disclose your health information, for example, to evaluate the performance of our staff in caring for you, or to educate our staff on how to improve the care they provide for you.  We may also share your information for financial or billing audits, for internal quality assurance, for the defense of legal matters, and to develop marketing and business plans.

We may use your health information when we contact you with a reminder that you have an appointment for treatment or services at our facility.  We may also use your health information in order to recommend possible treatment alternatives or health-related benefits and services that may be of interest to you.  If you do not object, we may share your health information with a family member, relative, or close personal friend who is involved in your care or payment for that care.

WHEN WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION WITHOUT CONSENT OR AUTHORIZATION
In some limited situations, the law allows or requires us to use or disclose your health information without your permission.  Such uses or disclosures are:

·    when a state or federal law mandates that certain health information be  reported for a specific purpose;
·    for public health activities, we may report information about various diseases to governmental agencies collecting that information;
·    for public health purposes, such as contagious disease reporting, investigation or surveillance; and notices to and from the Food and Drug Administration regarding drugs or medical devices;
·    disclosures to governmental authorities about victims of suspected  abuse, neglect or domestic violence;
·    in emergency situations, we may use or disclose your information if you  need emergency treatment, if this happens, we will try to obtain your consent as soon as possible;
·    use and disclosure if substantial communication barriers exists and we believe you would want us to treat you if we could  communicate with you;
·    uses and disclosures for health oversight activities, such as for the licensing of doctors; for audits by Medicare or Medicaid; or for investigation of possible violations of health care laws;
·    disclosures for judicial and administrative proceedings, such as in response to subpoenas or orders of courts or  administrative agencies;
·    disclosures for law enforcement purposes, such as to provide information about someone who is or is suspected to be a victim of a crime; to  provide information about a crime at our center; or to report a crime that happened somewhere else;
·    disclosure to a medical examiner to identify a dead person or to determine the cause of death; or to funeral directors to aid in burial; or to organ procurement organizations that handle organ, eye or tissue donations;
·    disclosures for law enforcement purposes, if you are an inmate or you are detained by a law enforcement officer, we may disclose your information to the prison officers or law enforcement officers if necessary to provide you with health care;
·    uses or disclosures for health related research;
·    uses and disclosures to prevent a serious threat to health or safety;
·    uses or disclosures for specialized government functions, such as for the protection of the president or high ranking government officials; for lawful national intelligence activities; for military purposes; or for the evaluation and health of members of the foreign service;
·    disclosures relating to worker’s compensation programs;
·    disclosures to business associates who perform health care operations for us and who agree to keep your health information private.
·    incidental disclosures, while we take reasonable steps to safeguard the privacy of your information, certain disclosures of your information may occur during, or as an unavoidable result of our otherwise permissible uses or disclosures.  For example, during the course of a treatment session, other patients in the treatment area may see, or overhear discussion of, your protected health information;
·    uses and disclosures of deidentified information, we may use or disclose your information if it has been deidentified where it cannot be used to identify you.  This might occur if you are participating in a research project;

Research.  In most cases, we will ask for your written authorization before using your health information or sharing it with others in order to conduct research that would specifically identify you.  However, under some circumstances, we may use and disclose your health information without your authorization if we obtain approval through a special process to ensure that research without your authorization poses minimal risk to your privacy.  Under no circumstances, however, would we allow researchers to use your name or identity publicly.  We may also release your health information without your authorization to people who are preparing a future research project, so long as any information identifying you does not leave our facility.  In the unfortunate event of your death, we may share your health information with people who are conducting research using the information of deceased persons, as long as they agree not to remove from our facility any information that identifies you.

Fundraising.  We will never use or disclose your information for fundraising activities without your authorization.

YOUR RIGHTS TO ACCESS AND CONTROL YOUR HEALTH INFORMATION

We want you to know that you have the following rights to access and control your health information.  These rights are important because they will help you make sure that the health information we have about you is accurate.  They may also help you control the way we use your information and share it with others, or the way we communicate with you about your medical matters.

Right To Inspect And Copy Records
You have the right to inspect and obtain a copy of any of your health information that may be used to make decisions about you and your treatment for as long as we maintain this information in our records.  This includes medical and billing records.  To inspect or obtain a copy of your health information, please submit your request in writing to the Medical Records department.  If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies we use to fulfill your request.  The standard fee is $0.75 per page and must generally be paid before or at the time we give the copies to you.

We will respond to your request for inspection of records within 14 days.  We ordinarily will respond to requests for copies within 30 days, if we need additional time to respond to a request for copies, we will notify you in writing within the time frame above to explain the reason for the delay and when you can expect to have a final answer to your request.

Right To Amend Records
If you believe that the health information we have about you is incorrect or incomplete, you may ask us to amend the information.  You have the right to request an amendment for as long as the information is kept in our records.  To request an amendment, please write to the Director of Medical Records.  Your request should include the reasons why you think we should make the amendment.  Ordinarily we will respond to your request within 60 days.  If we need additional time to respond, we will notify you in writing within 60 days to explain the reason for the delay and when you can expect to have a final answer to your request.

If we deny part or all of your request, we will provide a written notice that explains our reasons for doing so.  You will have the right to have certain information related to your requested amendment included in your records.  For example, if you disagree with our decision, you will have an opportunity to submit a statement explaining your disagreement which we will include in your records.  We will also include information on how to file a complaint with us or with the Secretary of the Department of Health and Human Services.  These procedures will be explained in more detail in any written denial notice we send you.

Right To An Accounting Of Disclosures
After April 14, 2003, you have a right to request an “accounting of disclosures” which is a list with information about how we have shared your information with others.  An accounting list, however, will not include:
·    Disclosures we made to you;
·    Disclosures we made in order to provide you with treatment, obtain payment for that treatment, or conduct our normal business operations;
·    Disclosures made to your friends and family involved in your care;
·    Disclosures made to federal officials for national security and intelligence activities;
·    Disclosures to correctional institutions or law enforcement officers; or
·    Disclosures made before April 14, 2003.

To request this list, please write to the Medical Records department.  Your request must state a time period for the disclosures you want us to include.  For example, you may request a list of the disclosures that we made between January 1, 2004 and January 1, 2005.  You have a right to one list within every 12 month period for free.  However, we may charge you for the cost of providing any additional lists in that same 12 month period.  We will always notify you of any cost involved so that you may choose to withdraw or modify your request before any costs are incurred.

Ordinarily we will respond to your request for an accounting list within 60 days.  If we need additional time to prepare the accounting list you have requested, we will notify you in writing about the reason for the delay and the date when you can expect to receive the accounting list.  In rare cases, we may have to delay providing you with the accounting list without notifying you because a law enforcement official or government agency has asked us to do so.

Right To Request Additional Privacy Protections
You have the right to request that we further restrict the way we use and disclose your health information to treat your condition, collect payment for that treatment, or run our Center's normal business operations.  You may also request that we limit how we disclose information about you to family or friends involved in your care.  For example, you could request that we not disclose information about a surgery you had.  To request restrictions, please write to Medical Records department.  Your request should include (1) what information you want to limit; (2) whether you want to limit how we use the information, how we share it with others, or both; and (3) to whom you want the limits to apply.

We are not required to agree to your request for a restriction, and in some cases the restriction you request may not be permitted under law.  However, if we do agree, we will be bound by our agreement unless the information is needed to provide you with emergency treatment or comply with the law.  Once we have agreed to a restriction, you have the right to revoke the restriction at any time.  Under some circumstances, we will also have the right to revoke the restriction as long as we notify you before doing so; in other cases, we will need your permission before we can revoke the restriction.

Right To Request Confidential Communications
You have the right to request that we communicate with you about your medical matters in a more confidential way.  For example, you may ask that we contact you at work instead of at home.  To request more confidential communications, please write to the Medical Records department.  We will not ask you the reason for your request, and we will try to accommodate all reasonable requests.  Please specify in your request how or where you wish to be contacted, and how payment for your health care will be handled if we communicate with you through this alternative method or location.

Right To Request Someone Act On Your Behalf
You have the right to name a personal representative who may act on your behalf to control the privacy of your health information.  Parents and guardians will generally have the right to control the privacy of health information about minors unless the minors are permitted by law to act on their own behalf.

How To Obtain A Copy Of This Notice.
You have the right to a paper copy of this notice.  You may print a paper copy at any time.

How To Obtain A Copy Of Revised Notices.
We may change our privacy practices from time to time.  If we do, we will revise this notice so you will have an accurate summary of our practices.  The revised notice will apply to all of your health information, and we will be required by law to abide by its terms.  We will post any revised notice in our  reception area.  You will also be able to obtain your own copy of the revised notice by accessing our website or asking for one at the time of your next visit.  The effective date of the notice will always be located in the top right corner of the first page.

How To File A Complaint.
If you believe your privacy rights have been violated, you may file a complaint with us or with the  Department of Health and Human Services. No one will retaliate or take action against you for filing a complaint.
To file a complaint with us, please contact us at the listed e-mail address.  To file a complaint with the DHHS, you must file in writing (electronic or paper), within 180 days of when you knew, or should have known of the problem. Send your complaint to DHHS Regional Manager, Office for Civil Rights, U.S. Department of Health and Human Services Government Center.