HIPAA NOTICE OF PRIVACY PRACTICES

XAVIER UNIVERSITY

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Uses and Disclosures  Under the Health Insurance Portability and Accountability Act of 1996, Xavier University (the “University”) must adopt additional policies and procedures to protect the confidentially of your personal health information. In general, the University will not discuss your personal health information with others without your knowledge or consent. However, you should be aware that there are certain exceptions to confidentiality in order to provide you with comprehensive and adequate health care. Members of our staff are permitted to use and disclose your personal health information, without your authorization, for each of the following purposes:  

1.         Treatment: “Treatment” is when our staff provides, coordinates, or manages your health care and    other services related to your health care. An example of this is when a member of our staff consults with another health care provider, such as your family physician.  However, in regard to psychological services, our staff will not disclose your confidential health information for treatment purposes without your informed consent.

2.       Payment: “Payment” is when our staff obtains reimbursement for your healthcare. Examples of payment are when a member of our staff shares your personal health information with your insurance plan to obtain reimbursement for the health care services you receive.  However, in regard to psychological services, our staff will not disclose your confidential health information for payment purposes without your informed consent.

3.       Health Care Operations: “Health care operations” are activities that are related to the performance and operation of our practice.  Examples include quality assessment and improvement activities, business-related matters such as audits and administrative services, and case management and care coordination.  For example, our staff is permitted to share your personal health information with supervised students and trainees for training purposes.  However, in regard to psychological services, our staff will not disclose your confidential health information for operational purposes without your informed consent.  When any confidential psychological information is used as a basis of teaching, we shall exercise reasonable care to ensure that the reported material is appropriately disguised to prevent client identification.

4.                Required by Law: “Required by law” refers to any and all uses and disclosures that are required by local, state, or federal regulations. Examples include regulations regarding disclosures to health oversight agencies, judicial or administrative agencies, and law enforcement authorities.  However, your physical and mental health information is protected and privileged information through your relationship with your physician or psychologist.  Our staff must limit the use and disclosure of your personal health information to that which is expressly required by law.  For example, if our staff receives a request for personal health information pursuant to a court order, our staff will only share those portions of your health information that are expressly authorized by such order.

5.                Public Health Activities: “Public health activities” refer to activities performed by certain public health authorities and government agencies as required by law. Examples include collection of information for purposes of preventing or controlling disease, injury, or disability.  However, your physical and mental health information is protected and privileged information through your relationship with your physician or psychologist.  For example, if our staff receives a request for personal health information from a public health authority in order to prevent disease, our staff will only share those portions of your health information that are expressly required by law.

6.               Child Abuse:    If, in our professional capacity, we know or suspect that a child under 18 years of age or a mentally retarded, developmentally disabled, or physically impaired child under twenty-one years of age has suffered or faces a threat of suffering any physical or mental would, injury, disability , or condition of a nature that reasonably indicates abuse or neglect of the child, we are required to report that knowledge or suspicion to the Ohio Public Children Services Agency, or a municipal or county peace officer.

7.               Adult and Domestic Abuse: If we have reasonable cause to believe that an adult is being abused, neglected, or exploited, or is in a condition that is the result of abuse, neglect, or exploitation, we are required by law to immediately report such belief to the County Department of Job and Family Services.

8.               Serious Threat to Health or Safety:  If we have actual knowledge, or have knowledge based on a credible representation by a person with apparent knowledge or authority, that you pose a risk of serious and imminent threat to the health or safety of a person or the public, we may use or disclose protected health information to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat. We may also disclose protected health information to law enforcement authorities as specified under federal and state laws.

If you communicate to one of our mental health staff an explicit threat of inflicting imminent and serious physical harm or causing the death of one or more clearly identifiable victims, and that staff member believes you have the intent and ability to carry out the threat, then the staff member is required by law to take one or more of the following actions in a timely manner: 1) take steps to hospitalize you on an emergency basis, 2) establish and undertake a treatment plan calculated to eliminate the possibility that you will carry out the threat, and initiate arrangements for a second opinion risk assessment with another mental health professional, 3) communicate to a law enforcement agency and, if feasible, to the potential victim(s), or victim’s parent or guardian if a minor, all of the following information: (a) the nature of the threat, b) your identity, and c) the identity of the potential victim(s).

All other uses and disclosures of your personal health information will be made pursuant to your written authorization and you may revoke such authorization at any time.  An “authorization” is written permission from you granting our staff permission to disclose specific personal health information to a specified party and for a particular purpose. For example, we will need to obtain an authorization from you before releasing your psychotherapy notes. Psychotherapy notes are notes we have made about our conversation during a private, group, joint, or family counseling session, which we have kept separate from the rest of your medical file.

Additional Uses and Disclosures

The University staff is also permitted to use or disclose your personal health information without your authorization for the following additional activities:

1.       Appointment Reminders: The University staff is permitted to contact you to provide appointment reminders.

2.       Treatment Alternatives: The University staff is permitted to contact you about treatment alternatives or other health-related benefits and services that may be of interest to you.

Individual Rights

You have the following rights under the Health Insurance Portability and Accountability Act of 1996:

1.               Right to Request Restrictions – You have the right to request restrictions on certain uses and disclosures of protected health information as provided by law; however, the University is not required to agree to your requested restrictions.

2.               Right to Receive Confidential Communications by Alternative Means and at Alternative Locations – You have the right to receive confidential communications of protected health information by alternative means and at alternative locations. (For example, you may not want a family member to know that you are receiving services from our staff. Upon your request, we will send your bills to another address.)

3.               Right to Inspect and Copy – You have the right to inspect and copy protected health information as well as psychotherapy notes as provided by law.

4.               Right to Amend – You have the right to amend protected health information as provided by law.

5.               Right to an Accounting – You have the right to receive an accounting of disclosures of protected heath information as provided by law.

6.               Right to a Paper Copy of Notice – You have the right to obtain a paper copy of this notice.

Duties of Xavier University

The University is required by law to maintain the privacy of protected health information and provide individuals with notice of its legal duties and privacy practices with respect to protected health information.

The University is also required to abide by the terms of this Notice currently in effect.

Right to Revise Privacy Practices

The University reserves the right to change the terms of its Notice and to make the new notice provisions effective for all protected health information that it maintains. Upon request, we will provide you with the most recently revised Notice.

Complaints

You may issue a complaint to our staff, the University, or to the Secretary of the Department of Health and Human Services if you believe that your privacy rights have been violated. A complaint may be filed with the University by writing a letter to:  Dr. J. Richard Hirté, Ph.D., Privacy Officer , Xavier University, 3800 Victory Parkway, Cincinnati, Ohio 45207

Filing of a complaint will not result in any form of retaliation.

Contact Person

You may contact Dr. Karl W. Stukenberg, Director  of the University’s Psychological Services Center or the Privacy Officer for the University for further information concerning the University’s privacy practices.

Effective Date:   EFFECTIVE 4/14/2003 – REVISED 9/2003