Reviewed: May 27, 2021
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
The BYU–Idaho Student Health Center (SHC), a health care component of BYU–Idaho, is required by law to maintain the privacy of your protected health information (PHI), notify you of any breach of unsecured PHI that affects you, and provide you with this notice, which describes our legal duties and privacy practices relating to your PHI. The SHC is required to abide by the terms of the notice that is currently in effect; however, we reserve the right to change the privacy practices described in this notice, in accordance with the law. Any change to our privacy practices applies to all of the PHI that we maintain. If we change our privacy practices, you may request the revised paper copy at the SHC or access the revised electronic copy on our website at www.byui.edu/health-center/privacy-practices.
In general, when we use or disclose your PHI, we must release only the information needed to achieve the purpose of the use or disclosure. However, if you request the information for yourself, for a provider regarding your treatment, or to meet a legal requirement, you can indicate which protected health may be made available by completing an authorization form.
Without your written authorization, we can use your PHI for the following purposes (except with respect to uses or disclosures that require an authorization or are prohibited by law):
- Treatment. BYU–Idaho may use or disclose PHI for the treatment activities of a health care provider. For example, a provider may use the information in your medical record to determine which treatment option, such as a drug or surgery, best addresses your health needs. The treatment selected will be documented in your medical record so that other health care professionals can make informed decisions about your care.
- Payment. BYU–Idaho may use or disclose PHI for the payment activities of a health care provider or another covered entity. For example, the SHC will supply verbal or written clarification about your claim for reimbursement when it is requested by your insurance provider in order to expedite payment. The SHC does not submit requests to private insurance providers for reimbursement of health care services provided to you, but you can request a Health Insurance Claim Form (HCFA 1500) from us that identifies you, your diagnosis, and the treatment provided to you. You can then submit your own requests for reimbursement.
- Health Care Operations. BYU–Idaho may use or disclose PHI for the health care operations activities of another covered entity if both BYU–Idaho and the covered entity has or had a relationship with you, the PHI relates to that relationship, and the disclosure is for an appropriate purpose, such as quality assessment, patient safety activities, review of health care professional competence, certain training programs, licensing, or health care fraud and abuse detection or compliance. For example, we may need your diagnosis, treatment, and outcome information in order to improve the quality or cost of care we deliver. These quality and cost improvement activities may include evaluating the performance of your doctors, nurses, and other health care professionals, or examining the effectiveness of the treatment provided to you when compared to patients in similar situations. In addition, we may use your PHI for appointment reminders; we may look at your medical record to determine the date and time of your next appointment with us and then send you a reminder to help you remember the appointment. A third way we may use your medical information is to determine whether or not another treatment or a new service we offer may interest you; we may contact a cancer patient to notify him or her that we have a new cancer research facility that offers life-saving treatments.
- As Required by Law. We may use or disclose your PHI to legal authorities, such as law enforcement officials, court officials, or government agencies, as required by law. For example, we may be required to respond to a court order or report certain physical injuries.
- Law Enforcement. We may use or disclose your PHI for law enforcement purposes. Such purposes may include reporting certain types of wounds, providing information to assist in the identification and location of a crime suspect, turning in evidence of crime on the premises, and other uses and disclosures involving law enforcement.
- Public Health Activities. We may use or disclose your PHI for public health activities and purposes. For example, we may be required to report information to authorities in order to help prevent or control disease.
- Injury, or disability. This may include using your medical record to report certain diseases, injuries, birth or death information, information of concern to the Food and Drug Administration, or information related to child abuse or neglect. Additionally, we may have to report certain work-related illnesses and injuries to your employer so that your workplace can be monitored for safety.
- Health Oversight Activities. We may use or disclose your PHI to a health oversight agency for oversight activities authorized by law. These activities may include audits; investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions; or other necessary activities.
- Judicial and Administrative Proceedings. We may use or disclose your PHI in the course of any judicial or administrative proceeding. For example, we may be required to disclose your information in response to a subpoena or other lawful process.
- Activities Related to Death. We may use or disclose your PHI for purposes related to your death. For example, we may disclose information to coroners, medical examiners, or funeral directors, as permitted or required by law, for duties related to your death (such as identification, determination of cause of death, or funeral preparation activities).
- Organ, Eye or Tissue Donation. We may use or disclose your PHI for cadaveric organ, eye, or tissue donation purposes. For example, we may disclose information to an organ procurement organization that facilitates organ, eye, or tissue donation or transplantation.
- Research. Under certain circumstances and only after a specific approval process, we may use or disclose your PHI for research purposes. For example, we may disclose information for research if an authorized board approves a waiver of authorization.
- To Avoid a Serious Threat to Health or Safety. We may use or disclose your PHI to the proper authorities as required by law and standards of ethical conduct if we believe, in good faith, that such release is necessary for law enforcement authorities to identify or apprehend an individual or to prevent or minimize a serious and imminent threat to the health or safety of you or the public.
- Victims of Abuse, Neglect, or Domestic Violence. We may use or disclose your PHI if we reasonably believe that you are a victim of abuse, neglect, or domestic violence. For example, we may report this information to a government authority that is authorized by law to receive such reports.
- Specialized Government Functions. We may use or disclose your PHI for military and veterans activities, national security and intelligence activities, protective services for certain individuals, or for other specialized government functions. For example, if you are involved with the Armed Forces, we may disclose your information to appropriate military authorities to assure proper execution of a military mission.
- Workers’ Compensation. We may disclose your PHI in order to comply with workers’ compensation laws. For example, we may disclose your information to appropriate persons for your work-related injuries.
- To Those Involved With Your Care, Payment, or Notification. If people such as family members, relatives, or close personal friends are involved in your care or help pay your medical bills, we may disclose certain PHI to them. The information disclosed may include your location within our facility, your general condition, or your death. You have the right to object to such a disclosure unless your condition renders you unable to object or there is an emergency, and we may allow you to agree or disagree orally. It is our duty to give you enough information so you can decide whether or not to object to the disclosure of your information to those involved with your care or payment. This type of use or disclosure may also include giving information to entity that is authorized to assist in disaster relief efforts.
- More Restrictive Law. Certain State laws are more restrictive than Federal law regarding disclosures of your PHI. In accordance with such laws, we will not disclose your PHI without your authorization except upon request of the Idaho Board of Pharmacy, or its representatives, acting in their official capacity; the practitioner (or the practitioner’s designee) who issues a prescription of yours; other licensed health care professionals responsible for your care; agents of the Idaho Department of Health and Welfare when acting in their official capacity with reference to issues related to the practice of the SHC pharmacy, provided such request is in writing; agents of any board whose practitioners have prescriptive authority, when the board is enforcing laws governing that practitioner; a government agency charged with responsibility for providing medical care for you, provided such request is in writing; the Food and Drug Administration (FDA), for purposes relating to monitoring of adverse drug events in compliance with requirements of Federal law, rules, or regulations adopted by the FDA; the authorized insurance benefit provider or health plan that provides your health care coverage or pharmacy benefits; or the order of a court of competent jurisdiction.
NOTE: We must obtain your written authorization for any use or disclosure of your PHI that does not fit with at least one of the situations listed above. Additionally, a written authorization is required for the use and disclosure of psychotherapy notes (except for certain treatment, payment, or health care operations), use and disclosure of PHI for marketing purposes, and sale of PHI. You may, at any time, withdraw any authorization form that you completed previously, but the withdrawal must be requested in writing. Please note that you may not withdraw an authorization if the SHC has taken action by relying on the authorization, and if the authorization was obtained as a condition of obtaining insurance coverage, other law provides the insurer with the right to contest a claim under the policy or the policy itself. If you wish to withdraw an authorization, please submit your request in writing to the medical records staff at the SHC (100 Student Health and Counseling Center, Rexburg, ID 83460-2010).You have several rights with respect to your PHI. Please note that your personal representative, if you have one, may exercise your rights in your place. If you wish to exercise any of the following rights, please visit the medical records staff at the SHC (100 Student Health and Counseling Center, Rexburg, ID 83460-2010) or call us at (208) 496-9331.
Specifically, you have the right to:
You have the right to inspect and obtain a copy of your PHI in any appropriate and readily producible format. However, this right does not apply to psychotherapy notes or information gathered for a civil, criminal, or administrative action or proceeding. You may obtain a copy of your information by completing an “Authorization for Use and Disclosure of PHI” (which can be obtained by visiting our website or the SHC) and mailing or faxing the form to our medical records staff. If the form is completed correctly and if we are permitted to grant your request, the copy of your records will be mailed to the address that you indicate on the form. We may charge a reasonable, cost-based fee that covers labor, supplies, and postage.
If you believe your PHI is incorrect, you may submit a written request for an amendment of your medical record. We will act on your request no later than 60 days after we receive it; however, we may deny your request if we did not create the information, the information is not part of your designated medical record, or we determine that the information is accurate and complete. You have the right to submit a written disagreement with the denial.
You have the right to request restrictions on how your PHI is used or to whom your information is disclosed, even if the restriction affects your treatment or our payment or health care operations activities. For example, you may wish to limit the PHI provided to family or friends involved in your care or payment of medical bills. We are not required to agree to all requested restrictions; however, we must agree to requests to limit information disclosed to your health plan if the information relates to a specific health care item or service only, if you or someone else besides the health plan pays for that item or service in full, if the disclosure is for purposes of payment or health care operations, and if the disclosure is not required by law. You may request a restriction by submitting the request in writing to our medical records staff.
You have the right to request that we communicate your PHI to you confidentially and by alternative means or at alternative places. For example, you may wish to receive information about your health status in a private room or in a written letter sent to a private address. We must accommodate reasonable requests if you clearly state that the disclosure of all or part of the information could endanger you, and we may not require an explanation from you about the basis of the request. You may request confidential communications by submitting the request in writing to our medical records staff.
You have the right to receive a list of certain disclosures of your PHI that we have made during the six years before the date of your request. The list will include the date of each disclosure, to whom each disclosure was made, a brief description of the information disclosed, and why each disclosure was made. We will not include certain disclosures, including those made to you; for treatment, payment, and health care operations purposes; allowed by a valid authorization; incident to a permitted or required use or disclosure; for our directory; to the people involved in your care; or for national security or law enforcement. You may request this list by submitting a written request to our medical records staff. We must comply with your request within 60 days unless you agree to a 30-day extension, and we must not charge you for the first list that you request in a given year.
You may request a paper copy of this notice at any time, even if you agreed previously to receive the notice electronically. You can also find this notice on our website at www.byui.edu/health-center/privacy-practices.
If you believe your privacy rights have been violated, you may file a complaint with us and with the Secretary of the Department of Health and Human Services at www.hhs.gov. We will not retaliate against you for filing such a complaint. If you wish to file a complaint with us, have questions about this notice, or need any other assistance related to this notice, please contact the Health Services Director at the SHC (100 Student Health and Counseling Center, Rexburg, ID 83460-2010) or at (208) 496-9340.
Effective Date: September 17, 2013