Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

The BYU–Idaho Student Health Center (SHC) is a health care component of BYU–Idaho. As such, it is subject to a variety of laws and regulations that govern the use and disclosure of personal information and records. Generally, BYU-Idaho is required by law to maintain the privacy of your records and protected health information (PHI), notify you of any breach of unsecured PHI that affects you, and provide you with this notice, which describes our legal duties and privacy practices relating to your PHI. The SHC is required to abide by the terms of the notice that is currently in effect; however, we reserve the right to change the privacy practices described in this notice, in accordance with the law. Any change to our privacy practices applies to all of the PHI that we maintain. If we change our privacy practices, you may request the revised paper copy at the SHC or access the revised electronic copy on our website at www.byui.edu/health-center/privacy-practices.

USE AND DISCLOSURE OF PHI REGARDLESS OF STUDENT STATUS

In general, when we use or disclose your PHI, we must release only the information needed to achieve the purpose of the use or disclosure. However, if you request the information for yourself, for a provider regarding your treatment, or to meet a legal requirement, you can indicate which protected health may be made available by completing an authorization form.

Without your written authorization, we can use your PHI for the following purposes (except with respect to uses or disclosures that require an authorization or are prohibited by law):

• Treatment. BYU–Idaho may use or disclose PHI for the treatment activities of a health care provider. For example, a provider may use the information in your medical record to determine which treatment option, such as a drug or surgery, best addresses your health needs. The treatment selected will be documented in your medical record so that other health care professionals can make informed decisions about your care.
• Payment. In order for an insurance company to pay for your treatment, we must submit a bill that identifies you, your diagnosis, and the treatment provided to you.  As a result, we will pass such health information onto you or your insurer in order to help receive payment for your medical bills.
• Health Care Operations. We may use your personal information to improve the quality or cost of care we deliver.  These quality and cost improvement activities may include examining the effectiveness of the treatment provided to you when compared to patients in similar situations or sending you appointment reminders.
• As Required by Law. Sometime we must disclose some of your personal health information if it is required by federal, state, or local law. 
• Public Health Activities. We may be required to report your personal health information to authorities to help prevent or control disease, injury, or disability.  This may include using your medial record to report certain diseases, injuries, birth or death information, information concern to Food and Drug Administration, or information related to child abuse or neglect.  We may also have to report to your employer certain work-related illnesses and injuries so that your workplace can be monitored for safety. 
• Health Oversight Activities. We may disclose your personal health information to authorities so they can monitor and regulate those who work in the health care system or for government benefit programs. 
• Judicial and Administrative Proceedings. Under certain circumstances, we may disclose your personal health information in the course of a lawsuit or court proceeding, including in response to a court order, subpoena, discovery request, or other lawful process. 
• Law enforcement. If requested, we may disclose your personal health information to a law enforcement official to provide information about a crime or suspected crime or to help identify missing persons.
• Activities Related to Death. We may disclose your personal health information to coroners, medical examiners, and funeral directors so they can carry out their duties related to your death, such as identifying the body, determining cause of death, or in the case of funeral directors, to carry out funeral preparation activities. 
• Organ, Eye or Tissue Donation. We may release your personal health information to organizations that handle organ procurement or organ, eye, or tissue transplantation, or to an organ donation bank, as necessary to facilitate a donation and transplantation. 
• Research. We may disclose our personal health information for research if the research has been approved by an official research board, which is required to evaluate the research proposal and establish standards to protect the privacy of your health information. 
• To Avoid a Serious Threat to Health or Safety. We may release your personal health information to proper authorities if we believe, in good faith, that such release is necessary to prevent or minimize a serious and approaching threat to you or the public’s health or safety.
• Victims of Abuse, Neglect, or Domestic Violence. We may disclose your personal health information to a government authority if we reasonably believe you are a victim of abuse, neglect, or domestic violence. 
• Specialized Government Functions. If you are involved with the military, national security, or intelligence activities, or if you an inmate in a correctional institution or in the custody of law enforcement officials, we may release your personal health information to the proper authorities so they may carry out their duties under the law. 
• Workers’ Compensation. We may disclose your personal health information to the appropriate persons in order to comply with the law related to workers’ compensation or other similar programs.
• Health Center Directory. Unless you object, we may use your personal health information-such as your name, location in our facility, general health condition (e.g. “stable” or “unstable” and religious affiliation-for our directory. The information about you contained in our directory will be released to people who ask for you by name. However, the information about your religious affiliation will only be disclosed to clergy.
• Emergency situations/disaster relief. If you are unable to consent or in the case of an emergency, we may disclose limited portions of your health information if we deem it to be in your best interest and the disclosure is not contrary to your prior expressed preference. In addition, we may release your personal health information to organizations authorized to handle disaster relief efforts so those who care for you can receive information about your location or health status. Even so, we will inform you and provide an opportunity for you to object once it becomes possible to do so.
• To Those Involved with Your Care, Payment, or Notification. If people such as family members, relatives, or close personal friends are involved in your care or help pay your medical bills, we may disclose certain PHI to them. The information disclosed may include your location within our facility, your general condition, or your death. You have the right to object to such a disclosure unless your condition renders you unable to object or there is an emergency, and we may allow you to agree or disagree orally. It is our duty to give you enough information so you can decide whether to object to the disclosure of your information to those involved with your care or payment. This type of use or disclosure may also include giving information to entity that is authorized to assist in disaster relief efforts.
• More Restrictive Law. Certain State laws are more restrictive than Federal law regarding disclosures of your PHI. When such laws apply, we will not disclose your PHI without your authorization except upon request of the Idaho Board of Pharmacy, or its representatives, acting in their official capacity; the practitioner (or the practitioner’s designee) who issues a prescription of yours; other licensed health care professionals responsible for your care; agents of the Idaho Department of Health and Welfare when acting in their official capacity with reference to issues related to the practice of the SHC pharmacy, provided such request is in writing; agents of any board whose practitioners have prescriptive authority, when the board is enforcing laws governing that practitioner; a government agency charged with responsibility for providing medical care for you, provided such request is in writing; the Food and Drug Administration (FDA), for purposes relating to monitoring of adverse drug events in compliance with requirements of Federal law, rules, or regulations adopted by the FDA; the authorized insurance benefit provider or health plan that provides your health care coverage or pharmacy benefits; or the order of a court of competent jurisdiction.

ADDITIONAL Disclosures of Student Information Expressly Permitted by Law.

 If you are a BYU-Idaho Student at the time you receive services from the SHC, we may also disclose your information, including PHI, as permitted by the Family Educational Rights and Privacy Act (FERPA). One notable example of this is the SHC’s ability to disclose your information without your consent to school officials with a legitimate educational interest.

• A school official is a person employed by the University in an administrative, supervisory, academic or research, or support staff position (including law enforcement unit personnel and health staff); a person or company with whom the University has contracted (such as an attorney, auditor, or collection agent); a person serving on the Board of Trustees; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks.
• A school official has a legitimate educational interest if the official is performing a task that is (1) specified by his or her position description or by contract agreement, or (2) related to a student’s education, or (3) related to the discipline or continuing ecclesiastical endorsement of a student, or (4) is a service or benefit relating to the student or student’s family, such as health care, counseling, job placement, or financial aid.
• You may find a complete list of how your information may be shared and used, and your rights under FERPA, in the university’s Access to Student Records Policy, available at https://web.byui.edu/policylibrary/.

NOTE: For all patients, student or otherwise, we must obtain your written authorization for any use or disclosure of your PHI that does not fit with at least one of the situations listed above. Additionally, a written authorization is required for the use and disclosure of psychotherapy notes (except for certain treatment, payment, or health care operations), use and disclosure of PHI for marketing purposes, and sale of PHI. You may, at any time, withdraw any authorization form that you completed previously, but the withdrawal must be requested in writing. Please note that you may not withdraw an authorization if the SHC has taken action by relying on the authorization, and if the authorization was obtained as a condition of obtaining insurance coverage, other law provides the insurer with the right to contest a claim under the policy or the policy itself. If you wish to withdraw an authorization, please submit your request in writing to the medical records staff at the SHC (100 Student Health and Counseling Center, Rexburg, ID 83460-2010).

Your Rights

You have several rights with respect to your PHI. Please note that, except for certain individual rights under FERPA, your personal representative, if you have one, may exercise your rights in your place. If you wish to exercise any of the following rights, please visit the medical records staff at the SHC (100 Student Health and Counseling Center, Rexburg, ID 83460-2010) or call us 208-496-9330.

Specifically, you have the right to:

Inspect and copy your PHI

Patients who were students at BYU-Idaho at the time they received services from the SHC have the right review and inspect their education records, including PHI and other records subject to FERPA, within 45 days of the day the University receives a request for access. Students should submit to the SHC, registrar, dean, head of the academic department, or other appropriate official, a written request that identifies the record(s) they wish to inspect. The University official will make arrangements for access and notify the student of the time and place where the records may be inspected. If the records are not maintained by the University official to whom the request was submitted, that official shall advise the student of the correct official to whom the request should be addressed.

Patients who were not students at BYU-Idaho at the time they received services from the SHC have the right to inspect and obtain a copy of their PHI in an appropriate and readily producible format. However, this right does not apply to psychotherapy notes or information gathered for a civil, criminal, or administrative action or proceeding. These patients may obtain a copy of their information by completing an “Authorization for Use and Disclosure of PHI” (which can be obtained by visiting our website or the SHC) and mailing or faxing the form to our medical records staff. If the form is completed correctly and if we are permitted to grant the request, the copy of the records will be mailed to the address indicated on the form. We may charge a reasonable, cost-based fee that covers labor, supplies, and postage.

Request a correction to your PHI

Regardless of whether you are a BYU-Idaho student or not, if you believe your PHI is incorrect, you may submit a written request for an amendment of records. Although the process is slightly different for students and non-students, the university will act on your request no later than 60 days after we receive it; however, we may deny your request if we did not create the information, the information is not part of your designated medical record, or we determine that the information is accurate and complete. You have the right to submit a written disagreement with the denial.

Request restrictions on certain uses and disclosures

You have the right to request restrictions on how your PHI is used or to whom your information is disclosed, even if the restriction affects your treatment or our payment or health care operations activities. For example, you may wish to limit the PHI provided to family or friends involved in your care or payment of medical bills. We are not required to agree to all requested restrictions, and the university expressly reserves the right to make any disclosure of student information permitted by law as described in the Access to Student Records Policy; however, we generally must agree to requests to limit information disclosed to your health plan if the information relates to a specific health care item or service only, if you or someone else besides the health plan pays for that item or service in full, if the disclosure is for purposes of payment or health care operations, and if the disclosure is not required by law. You may request a restriction by submitting the request in writing to our medical records staff.

Receive confidential communications of PHI

Except as otherwise permitted by FERPA and described in the Access to Student Records Policy, you have the right to request that we communicate your PHI to you confidentially and by alternative means or at alternative places. For example, you may wish to receive information about your health status in a private room or in a written letter sent to a private address. We must accommodate reasonable requests if you clearly state that the disclosure of all or part of the information could endanger you, and we may not require an explanation from you about the basis of the request. You may request confidential communications by submitting the request in writing to our medical records staff.

Receive an accounting of disclosures of your PHI

For non-student records and student records not governed by FERPA, you have the right to receive a list of certain disclosures of your PHI that we have made during the six years before the date of your request. The list will include the date of each disclosure, to whom each disclosure was made, a brief description of the information disclosed, and why each disclosure was made. We will not include certain disclosures, including those made to you; for treatment, payment, and health care operations purposes; allowed by a valid authorization; incident to a permitted or required use or disclosure; for our directory; to the people involved in your care; or for national security or law enforcement. You may request this list by submitting a written request to our medical records staff. We must comply with your request within 60 days unless you agree to a 30-day extension, and we must not charge you for the first list that you request in a given year.

Obtain a paper copy of this notice

You may request a paper copy of this notice at any time, even if you agreed previously to receive the notice electronically. You can also find this notice on our website at www.byui.edu/health-center/privacy-practices.

Complain

If you believe your privacy rights have been violated, you may file a complaint with us, with the Department of Education at https://studentprivacy.ed.gov/file-a-complaint (for student records), or with the Secretary of the Department of Health and Human Services at www.hhs.gov (for non-student records). We will not retaliate against you for filing such a complaint. If you wish to file a complaint with us, have questions about this notice, or need any other assistance related to this notice, please contact the Health Services Director at the SHC (100 Student Health and Counseling Center, Rexburg, ID 83460-2010) or at 208-496-9330.

Effective Date: August 22, 2024