Effective September 23, 2013

THE UNIVERSITY OF TENNESSEE HEALTH SCIENCE CENTER HIPAA NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Understanding Your Health Information

Each time you receive health care services from The University of Tennessee Health Science Center (“UT Health Science Center” or “UTHSC”), a record of your treatment is made. This record contains information about your symptoms, examinations, test results, medications you take, your allergies and the plan for your care. We refer to this information as your health or medical record. It is an essential part of the healthcare we provide for you. Your health record contains personal health information and there are state and federal laws to protect the privacy of your health information. This notice is required by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

Uses and Disclosures of Your Health Information

We will use your information for treatment purposes

The UTHSC staff involved in your care will document information in your record about your examination, the care that you receive, the results of that care, and the care planned for you. If you were referred to us from another health care provider, we may send copies of your medical record to the provider who referred you to us so your provider will have updated treatment information about your care.

We will provide your doctors and other healthcare providers who are treating you with copies of various reports that should assist them in treating you.

We may also use health information about you to call you and/or send you a letter to follow up with diagnostic test results and to survey your satisfaction with the services provided.

We will use your health information for payment purposes

A bill will be sent to you or your insurance company. We may include information that identifies you, as well as your diagnoses, procedures, healthcare providers and supplies used. We also may contact your insurance company to determine if they will pay for your health care as part of their certification process.

We will use your health information for regular healthcare operations purposes

UTHSC staff may look at your health information to assess the care and results in your case and others like yours. The UT Health Science Center is a teaching institution, so we may use your health information in the process of educating and training students and resident physicians.

Your right to request restrictions on use and disclosure of your health information

You have the right to request in writing a restriction on the above uses and disclosures of your protected health information for treatment, payment, and health care operations; however, we are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment. We may, however, also end the agreement at any time after notifying you in writing of such.

Other Disclosures

Business Associates

There are some services provided in our organization through contracts with business associates and in some instances, their subcontractors. We require the business associate, and any subcontractors they utilize, to protect your health information.

Communication with others involved with your care

We may give to a family member, or other relative, close personal friend or any other person you identify, certain parts of your health information that is directly relevant to that person’s involvement in your care or payment related to your care.

Your health information will only be shared if you agree, or are silent when given the opportunity to disagree, or we believe, based on the circumstances and our professional judgment that you do not object.

If you are incapacitated or in an emergency circumstance, we may provide to a family member, or other relative, close personal friend, or any other person accompanying you, certain parts of your health information that is directly relevant to that person’s involvement in your care or payment related to your care.

Research

Under certain circumstances, we may use and disclose health information about you from your medical record for research purposes. All such research projects, however, will be subject to a special approval process designed to protect the privacy of your health information.

Required by law

We may disclose health information required by law to the following entities or type of entities that includes, but is not limited to:

• Food and Drug Administration
• Public Health or legal authorities charged with disease prevention
• Correctional institutions
• Workers compensation agents
• Organ and tissue donation organizations
• Military command authorities
• Health oversight agencies
• Medicare or Medicaid if requested for an audit or investigation
• Funeral directors, coroners, and medical examiners
• National security and intelligence agencies
• Protective services for the president and others
• Law enforcement as required by law or in accordance with a valid subpoena
• Licensing boards
• To avoid a serious threat to the health and safety of a person or the public

Marketing

The UT Health Science Center will not use health information in your records for marketing purposes without your written authorization or approval.

Other uses and provided information from your medical record will be made only with your written authorization or approval.

Patient rights

You have the right to:

• Inspect and obtain a copy of your health record within sixty days of request. There may be a charge to cover the cost of producing your record in hard copy or electronic form.
• Request an amendment of your health records;
• Obtain an accounting of disclosures of your protected health information made after April 14, 2003, for purposes other than treatment, payment, and healthcare operations;
• Request communication of your health information in a certain way or at a certain location. For example, you can ask that we contact you by mail and not by telephone, or that we contact you at a specific telephone number, or that we use an alternative address for billing purposes, or that we not leave messages on certain answering machines. Email communication will be provided only at your written request indicating you understand that email can be an unsecure communication method;
• Revoke your authorization to use or disclose health information except to the extent that action has already been taken; and
• Restrict disclosures to a health plan for services when those services have been paid out- of-pocket in full by the patient, a family member, or another individual.

Our duties

We are obligated to:

• Maintain the privacy of your health information;
• Obtain an authorization for the use and disclosures of psychotherapy notes, marketing, and the sale of protected health information;
• Refrain from selling your protected health information without your individual written authorization;
• Notify you if there has been a breach of your unsecured protected health information;
• Provide you with a notice as to our legal duties and privacy practices with respect to information we collect about you through this notice;
• Abide by the terms of the notice currently in effect;
• Notify you in writing if we are unable to agree to a requested restriction;
• Follow reasonable requests you make to communicate with you as you instruct, for example, to contact you at a certain telephone number or address;
• Provide you a paper copy of this notice of privacy practices upon request; and
• With written request, to provide you with a copy of your electronic health record in electronic form and to transmit the copy directly to another person designated by you. An electronic copy may be attached to an email that does not require encryption as long as you have been advised of the risk of transmission of an unencrypted document.

To exercise any of the above rights or to make any of the above requests, your request must be in writing.

The University of Tennessee Health Science Center is not required to act immediately except for a request for a copy of your health record and will investigate our abilities to comply with all requests prior to agreeing to the request.

The University of Tennessee Health Science Center reserves the right to change this Notice of Privacy Practices and its policies and procedures for privacy practices at any time and to make the changes effective for all protected health information created or received prior to the new effective date and then currently maintained by the UTHSC. Any revised Notice will be posted in the waiting rooms or patient lobbies of our clinical practices and reasonable efforts will be made to advise you of the change(s) in the Notice, policies and procedures at your next service visit. You may also obtain a copy of the revised Notice upon request.

For More Information or to Report a Problem

If you have any questions about your rights or duties or the UTHSC practices and procedures regarding protected health information, please contact the appropriate office of the facility where you received services.

If you believe your privacy rights have been or are being violated, you may file a complaint by calling the UTHSC HIPAA Privacy Officer at (901) 448-8469 or the UT compliance hotline at (855) 461-2771.

You may file a complaint with the Secretary of the Department of Health and Human Services. Complaints to the Secretary must be filed in writing on paper or electronically and must be made within 180 days of when you became aware of, or should have been aware of, the incident giving rise to your complaints. By law, you cannot be penalized for filing a complaint.

Revision 1: Revised Date—September 22, 2013 | Revision 2: Revised Date—April 1, 2019 [Updated Privacy Officer and UT compliance hotline phone numbers]