Notice of Privacy Practices

WASHINGTON UNIVERSITY
HIPAA Privacy Policy #12

Notice of Privacy Practices

Statement of Policy

Washington University and its member organizations (collectively, “Washington University” or “WU”) are committed to ensuring that Individuals are aware of their rights and responsibilities concerning their Protected Health Information “PHI”). The commitment includes compliance with all applicable laws, regulations and WU policies to protect the privacy of PHI. To help strengthen that commitment, WU has adopted this policy on Notice of Privacy Practices (Notice) in order to clearly define the rights of Individuals and the obligations of WU related to protecting the privacy of Individuals.

Scope of Policy

The Notice applies to all Individuals receiving Health Care services other than inmates. Each Individual has a right to receive the Notice, which contains information concerning the Uses and Disclosures of PHI. WU will provide a Joint Notice of Privacy Practices, along with BJH and SLCH as an Organized Health Care Arrangement (OHCA), when services are provided at BJH and SLCH. A Notice specific to WU is also available for distribution in other settings.

The Notice is available in a summary format and a long format.

Policy

2. Which Notice Should be Provided.

a) For services provided at BJH or SLCH by WU physicians and other WU providers, the Joint Notice of Privacy Practices should be provided.
b) For service provided by WU physicians and other WU providers that do not involve BJH or SLCH, the WU Notice of Privacy Practice should be provided.

3. How must the Notice be Provided to an Individual.

WU will consider the needs of Individuals in providing the Notice and will comply with applicable laws concerning non-English speaking Individuals or Individuals who may not be able to read a written Notice.

a) Electronic Services: If the only service delivered to an Individual is electronic, WU will first deliver the Notice in response to an Individual’s first request for services. An Individual who receives an electronic notice retains the right to obtain a paper copy of the Notice from WU.

b) Web Notice. WU will post a Notice on its Web site and make the Notice available electronically through its Web site. Individuals may still receive a paper copy of the Notice even if he or she has received an electronic Notice.

c) E-Mail Notices. To provide Notices by electronic mail (“E-mail”), an Individual must first agree to accept the Notice electronically. If WU knows that the E-mail transmission failed, a paper copy of the Notice will be provided to the Individual. E-mail notices will comply with the timing of Notices as set forth in paragraph (1)(a)(i) and (ii) above.

4. Content of Notice.

WU will provide a Notice written in plain, understandable language and containing the following:

a) Header. A Header at the top of the Notice that states, in bold type:
“THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.”

b) Uses and Disclosures. Several descriptions of the required and permitted Uses and Disclosures of the PHI including:

i) a description, of sufficient detail, together with at least one example, of the types of Uses and Disclosures permitted for Treatment, Payment, and Health Care Operations;

ii) a description, of sufficient detail, of all the types of Uses and Disclosures, together with each of the purposes, that the WU member organization is permitted or required to make without the Individual’s written consent or authorization;

iii) a description of any more stringent law than the Privacy Regulations governing any particular Use or Disclosure of PHI;

iv) a statement that any other Uses or Disclosures will be made only with the Individual’s written Authorization, and that the Individual may revoke such Authorization in writing (except to the extent the WU member organization has taken action in reliance on the Authorization or if the Authorization was obtained as a condition of obtaining insurance). (See WU HIPAA Policy on Authorization Required to Use or Disclose Protected Health Information.); and

v) a statement that the WU Group Health Plan is permitted to disclose PHI to the plan sponsor without authorization.

c) Contacting Individuals. If WU provides reminders or other Information to Individuals, including fund raising events, a statement that Individuals may be contacted for appointment reminders, for information on other health services, or for raising funds for WU.

d) Individual Rights. A list of an Individual’s rights with respect to PHI (See related policies on requests for amendment of PHI, accounting for Disclosures of PHI, access to one’s own PHI and requests to restrict communication of PHI) and a brief description of how an Individual may exercise such rights including:

e) Washington University Duties.

i) a statement that WU is required by law to protect and maintain the privacy of PHI, to provide Individuals with Notice of its legal duties, and to abide by the terms of such Notice and
ii) a statement that WU reserves the right to change the terms of its Notice and apply the revised privacy practices to PHI previously created or received, and a statement of how it will provide Individuals with a new revised Notice.

f) Complaint.

g) Washington University Contact Person. The name, title and telephone number(s) of the person(s) to contact at WU or its member organizations and/or its OHCA members, BJH and SLCH for further information.

h) Effective Date. The effective date of the Notice.

5. Notice Review and Revisions Procedure.

WU will establish a process to review and revise the Notice if material changes are identified to the Uses or Disclosures of PHI, the Individual rights, WU’s legal duties, or other privacy practices concerning PHI.

6. Joint Notices.

Because WU, BJH and SLCH have designated themselves as an OHCA, the Joint Notice will state that WU, when providing services at BJH or SLCH will abide by the terms of the Joint Notice concerning PHI. The Joint Notice will contain the required elements (above), will list the applicable WU member organizations and service delivery sites to which the Joint Notice applies, and will state that the participating member organizations will share PHI with each other, as necessary, to carry out Treatment, Payment, or Health Care Operations relating to the organized healthcare delivery arrangement.

7. Documentation.

WU will retain a file copy of the Notices issued for at least a six-year period from and after April 14, 2003 to demonstrate compliance with the Notice requirement.

Creation Date: November 22, 2002
Effective Date: April 14, 2003
Last Revision Date: January 9, 2003