BYU Student Health Center Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

BYU Student Health Center must maintain the privacy of your personal health information and give you this notice that describes our legal duties and privacy practices concerning your personal health information. In general, when we release your personal health information, we must release only the information we need to achieve the purpose of the use or disclosure. However, all of the personal health information that you designate will be available for release when you sign an authorization form. You can request the information for yourself or for a provider regarding your treatment. We must follow the privacy practices described in this notice.

However, we reserve the right to change the privacy practices described in this notice, in accordance with the law. Changes to our privacy practices would apply to all personal health information we maintain. If we change our privacy practices, the revised Notice of Privacy Practices will be available on our website at http://health.byu.edu .

Without your written authorization , we CAN use your personal health information for the following purposes:

1. Treatment. For example, a doctor may use the information in your medical record to determine which treatment option, such as a drug or surgery, best addresses your health needs. The treatment selected will be documented in your medical record so that other health care professionals can make informed decisions about your care.

2. Payment. In order for an insurance company to pay for your treatment, we must submit a bill that identifies you, your diagnosis, and the treatment provided to you. As a result, we will pass such health information onto you or your insurer in order to help receive payment for your medical bills. Billing information will be mailed to the most current address we have on file for you.

• Health Care Operations . We may need your diagnosis, treatment and outcome information in order to improve the quality or cost of care we deliver. These quality and cost improvement activities may include evaluating the performance of your doctors, nurses and other health care professionals, or examining the effectiveness of the treatment provided to you when compared to patients in similar situations.

In addition, we may want to use your personal health information for appointment reminders. For example, we may look at your medical record to determine the date and time of your next appointment with us, and then send you a reminder letter or email to help you remember the appointment. We may look at your personal medical information and decide that another treatment or a new service we offer may interest you; for example, new radiology procedures. Or, we may use your health information to assist you with pharmaceutical Patient Assistance programs.

4. As required or permitted by law . Sometimes we must report some of your personal health information to legal authorities, such as law enforcement officials, court officials, or government agencies. For example, we may have to report abuse, neglect, domestic violence or certain physical injuries, or to respond to a court order.

5. For public health activities . We may be required to report your personal health information to authorities to help prevent or control disease, injury, or disability. This may include using your medical record to report certain diseases, injuries, birth or death information, information of concern to the Food and Drug Administration, or information related to child abuse or neglect. We may also have to report to your employer certain work-related illnesses and injuries so that your workplace can be monitored for safety.

6. For health oversight activities . We may disclose your personal health information to authorities so they can monitor, investigate, inspect, discipline or license those who work in the health care system or for government benefit programs.

7. For activities related to death . We may disclose your personal health information to coroners, medical examiners and funeral directors so they can carry out their duties related to your death, such as identifying the body, determining cause of death, or in the case of funeral directors, to carry out funeral preparation activities.

8. To avoid a serious threat to health or safety . As required by law and standards of ethical conduct, we may release your personal health information to the proper authorities if we believe, in good faith, that such release is necessary to prevent or minimize a serious and approaching threat to you or the public's health or safety.

9. For military, national security, or incarceration/law enforcement custody . If you are involved with the military, national security or intelligence activities, or you are in the custody of law enforcement officials or an inmate in a correctional institution, we may release your personal health information to the proper authorities so they may carry out their duties under the law.

10. For workers' compensation . We may disclose your personal health information to the appropriate persons in order to comply with the laws related to workers' compensation or other similar programs. These programs may provide benefits for work-related injuries or illness.

11. BYU Student Health Center Scheduling/Billing System . Unless you object, we may use your personal health information, such as your name, location in our facility, your general health condition (e.g., “stable,” or “unstable”), and your religious affiliation for our directory. It is our duty to give you enough information so you can decide whether or not to object to release of this information for our directory. The information about you contained in our directory will be released to people who ask for you by name. However, the information about your religious affiliation will only be disclosed to clergy. We may allow you to agree or disagree orally regarding the use of your personal health information for directory purposes.

12. To those involved with your care or payment of your care . If people such as family members, relatives, or close personal friends are helping care for you or helping you pay your medical bills, we may release important personal health information about you to those people. The information released to these people may include your location within our facility, your general condition, or death. You have the right to object to such disclosure, unless you are unable to function or there is an emergency. In addition, we may release your personal health information to organizations authorized to handle disaster relief efforts so those

who care for you can receive information about your location or health status. You can disagree orally to such release unless there is an emergency. It is our duty to give you enough information so you can decide whether or not to object to release of your personal health information to others involved with your care.

NOTE: Except for the situations listed above, we must obtain your specific written authorization for any other release of your personal health information.

If you sign an authorization form, you may withdraw your authorization at any time, as long as your withdrawal is in writing. If you wish to withdraw your authorization, please submit your written withdrawal request to BYU Student Health Center, Medical Records, 2102 SHC, (801)422-5134 .

Your Personal Health Information Rights

You have several rights with regard to your personal health information. If you wish to exercise any of the following rights, please contact BYU Student Health Center, Medical Records, 2102 SHC, (801)422-5134 . Specifically, you have the right to:

1. Inspect and have a copy of your personal health information . With a few exceptions, you have the right to inspect and obtain a copy of your health information. Under limited circumstances, we may deny you access to a portion of your health information, and you may request a review of the denial.

2. Request to correct your personal health information . If you believe your health information is incorrect, you may ask us to correct the information. You will be asked to make such requests in writing and to give a reason as to why your personal health information should be changed. However, if we did not create the health information that you believe is incorrect, or if we disagree with you and believe your health information is correct, we may deny your request. Your request will be reviewed by the Privacy Official, Medical Director and Administrative Director of the Student Health Center. If a correction is warranted, it will be made in the manner of an addendum to the appropriate document and you will be notified by mail.

3. Request restrictions on certain uses and disclosures . You have the right to ask for restrictions on how your personal health information is used or to whom your information is disclosed, even if the restriction affects your treatment or our payment or health care operation activities. Or, you may want to limit the personal health information provided to family or friends involved in your care or payment of medical bills. You may also want to limit the personal health information provided to authorities involved with disaster relief efforts. However, we are not required to agree in all circumstances to your requested restriction.

4. As applicable, receive confidential communication of health information . You have the right to ask that we communicate your health information to you in different ways or places. For example, you may wish to receive information about your health status in a private room or through a written letter sent to a private address. We must accommodate reasonable requests.

5. Receive a record of disclosures of your health information . In some limited instances, you have the right to ask for a list of the disclosures of your personal health information we have made during the previous six years, but the request cannot include dates before April 14, 2003. This list must include the date of each disclosure, who received the disclosed personal health information, a brief description of the

personal health information disclosed, and why the disclosure was made. We must comply with your request for a list within 60 days, unless you agree to a 30-day extension, and we may not charge you for the list, unless you request such list more than once per year. In addition, we will not include in the list disclosures made to you, or for purposes of treatment, payment, health care operations, our directory, national security, law enforcement/corrections, and certain health oversight activities.

6. Obtain a paper copy of this notice . The BYU Student Health Center Notice of Privacy Practices is available at any time at the Reception desk. A complete copy of the Notice is posted on our Web site at http://health.byu.edu .

7. Complain . If you believe your privacy rights have been violated, you may file a complaint with us and with the federal Department of Health and Human Services at http://www.hhs.gov/ocr/hipaa . We will not retaliate against you for filing such a complaint. To file a complaint with either entity, please contact BYU Student Health Center, Administration, 2300 SHC, (801)422-7443, who will provide you with the necessary assistance and paperwork.

Again, if you have any questions or concerns regarding your privacy rights or the information in this notice, please contact BYU Student Health Center, Medical Records, 2102 SHC, (801)422-5134 .

This Notice of Medical Information Privacy is Effective APRIL 14, 2003.