Notice of Privacy Practices for Covered Entities

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY. 

Certain covered components within Wichita State University must maintain the privacy of your personal health information.  These covered components include Student Health Services, the Evelyn Hendren Cassat Speech-Language-Hearing Clinic, the Advance Education in General Dentistry (AEGD) Clinic, and Counseling and Psychological Services (CAPS) (collectively, “Covered Components”). This Notice of Privacy Practices (“Notice”) summarizes the privacy practices of the Covered Components and their workforce, medical staff, physicians and other health care professionals who provide you with treatment and health care. We may share protected health information, including electronic protected health information (“PHI”), about you within and outside WSU for purposes described in this Notice.  

PHI is information that WSU collects from you when you are a patient that identifies who you are. PHI includes information such as your name, date of birth, dates of services, diagnosis, treatments, genetic information, financial information, medications, demographic information (name, address, home/cellular/work telephone numbers, email addresses, and social security number), photographs, etc. This information is important because it allows medical staff to treat you more efficiently and effectively.  

All employees, medical staff, trainees, students, volunteers, and agents of the Covered Components are required to follow this Notice. 

We are required by law to: 

• Maintain the confidentiality of PHI;
• Give you this Notice of our legal duties and privacy practices regarding PHI;
• Notify affected individuals following a breach of unsecured PHI under federal law; and 
• Follow the terms of our Notice currently in effect. 

When you receive services or treatment from any of the Covered Components, you will be asked to sign a consent form in which you allow us to use and disclose PHI about you in ways that are permitted by the federal privacy law, as summarized in this Notice. However, some kinds of PHI are subject to separate special privacy protections under the laws of the State of Kansas or other federal laws, therefore portions of this Notice may not apply. If you receive alcohol or substance abuse services or treatment, you will receive a separate notice of privacy practices describing how we may use, disclose and protect the privacy of PHI regarding your alcohol or substance abuse treatment. In addition, special rules apply to the results of human immunodeficiency virus (“HIV”) tests that identify you or the fact that an HIV test has been performed on you (“HIV test results”). The section below entitled “How We May Use and Disclose HIV Test Results” describes how we may use and disclose this type of PHI. Also, the section below entitled “How We May Use and Disclose Psychotherapy Notes” describes how we may use and disclose notes from psychotherapy counseling sessions in which you participate. Finally, the section below entitled “How We May Use and Disclose Reproductive Health Care Information” describes how we may use and disclose this type of PHI. 

In most circumstances, the following uses and disclosures of PHI will require that you sign a written authorization for: (1) uses and disclosures of psychotherapy notes; (2) uses and disclosures of PHI for marketing purposes; (3) uses and disclosures of PHI where WSU receives payment in exchange for disclosing such PHI; and (4) any other uses and disclosures of PHI not described in this Notice.  
 
If you provide us with written authorization to use or disclose your PHI for such other purposes, you may revoke your authorization at any time by sending a written request to our Privacy Office at the address listed at the end of this Notice or via email to hipaaprivacy@wichita.edu. Once you have revoked your authorization, WSU will take appropriate action to prevent any further use or disclosure of the PHI. However, we cannot take back any uses or disclosures already made with your permission. 

The following categories of activities describe the ways that we may use and disclose PHI without obtaining your prior written authorization. Some of the categories include examples, but not every type of use or disclosure included in a category is listed. Except for the categories of activities described below, we will use and disclose PHI only with written permission from you.  

1. For Treatment. We may use PHI to treat you or provide you with health care services. We may disclose PHI to doctors, nurses, technicians, or other personnel, including people outside our facilities or clinics who are involved in your medical care. For example, we may tell your primary care physician about your treatment at WSU or give PHI to a specialist to provide you with additional health care services as appropriate for treatment purposes.  
2. For Payment. We may use and disclose PHI so that we, or others, may bill or receive payment from you, a government program, an insurance company or other responsible third party for the treatment and health care services you receive. For example, we may give your health plan information about your treatment so that your health plan is able to pay for the cost of such treatment. We also may tell your health plan about the services that you are going to receive to obtain prior approval or to determine whether your plan will cover the services.  
3. For Health Care Operations. We may use and disclose PHI for health care operations, which are administrative activities involved in operating the Covered Components. These uses and disclosures are necessary to maintain quality care when delivering services to our patients and for our business and management purposes. For example, we may use PHI to review the adequacy and quality of the care that our patients receive.  
4. For Educational Purposes. Wichita State University is an academic environment, so we may use your information in the process of educating and training students and students may also use or disclose your PHI.  
5. Appointment Reminders, Treatment Alternatives, and Health-Related Benefits and Services. We may use and disclose PHI to contact you as a reminder that you have an appointment with us. We also may use and disclose PHI to tell you about treatment options, alternatives, health-related benefits, or services that may be of interest to you.  
6. Fundraising Activities. We may use your demographic information (e.g., name, address, telephone numbers and other contact information), the dates of health care provided to you, your health care status, the department and physician(s) who provided you services, and your treatment outcome information in contacting you in an effort to raise funds in support of WSU and other non-profit entities with whom the University is conducting a joint fundraising project. We may also disclose this information to a related foundation or to our business associates so that they may contact you to raise funds for us and other non-profit entities with whom the University is conducting a joint fundraising project. For example, you may get invitations to fundraising events or other types of mailing for University events, affiliated programs, and other joint fundraising programs.  
7. Facility Directory. If you are a patient at a WSU facility, we may list your name, general condition (e.g., fair, critical), and location in our directory, unless you ask us not to. We may disclose this information to anyone who asks for you by name.  
8. Clergy. We may disclose the information in our facility directory and information that you choose to provide us regarding your religious affiliation to members of the clergy for use and disclosure in their religious activities.  
9. Individuals Involved in Your Care or Payment for Your Care. We may disclose PHI to a person, such as a family member or friend, who is involved in your medical care or helps pay for your care, such as a family member or friend but we will do so only as allowed by state or federal law (with an opportunity for you to agree or object when required under the law), or in accordance with your prior authorization. We also may notify such individuals about your location or general condition or disclose such information to an entity assisting in a disaster relief effort.  
10. Research. Under certain circumstances, as an academic institution, we may use and disclose PHI for research purposes. For example, a research project may involve comparing the health and recovery of all patients who received one medication or treatment to those who received another, for the same condition. Before we use or disclose PHI for research, the project will go through a special approval process in conjunction with the WSU Institutional Review Board or other authorized privacy board to obtain a waiver of authorization under HIPAA. This process evaluates a proposed research project and its use of PHI to balance the benefits of research with the need for privacy of PHI. Additionally, WSU may disclose PHI for purposes preparatory to research such as permitting researchers to look at records to help them identify patients who may be included in their research project or for other similar purposes if (i) WSU receives certain required representations from the researcher, and (ii) the researcher does not remove any PHI from WSU during the course of the review. We may also use or disclose your PHI for research purposes if your authorization has been obtained when required by law, or if the information we provide to researchers is “de-identified.” 

In addition to the above, we may use and disclose PHI in the following special circumstances:  

1. As Required by Law. We will disclose PHI when required to do so by international, federal, state or local law, except in the case that the individual or entity requesting it is using it for the purposes of conducting criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care. 
2. To Avert a Serious Threat to Health or Safety. We may use and disclose PHI when necessary to prevent or lessen a serious threat to your health or safety, or the health or safety of the public or another person. Any disclosure, however, will be to someone who we believe may be able to help prevent the threat.  
3. Business Associates. We may disclose PHI to the business associates that we engage to provide services on our behalf if the information is needed for such services. For example, we may use another company to perform billing services on our behalf. Our business associates are obligated by law and under contract with us to protect the privacy of PHI. Our business associates are not allowed to use or disclose any PHI other than as specified in our contract with them.  
4. Organ and Tissue Donation. If you are an organ donor, we may release PHI to organizations that handle organ procurement; organ, eye, or tissue transplantation; or to an organ donation bank, as necessary, to facilitate organ or tissue donation and transplantation.  
5. Military and Veterans. If you are a member of the armed forces, we may release PHI as required by military command authorities. We also may release PHI to the appropriate foreign military authority if you are a member of a foreign military.  
6. Workers’ Compensation. We may disclose PHI as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.
7. Public Health Risks. We may disclose PHI for public health activities. These activities generally include disclosures to prevent or control disease, injury or disability; report births and deaths; report child abuse or neglect; report reactions to medications or problems with products; notify people of recalls of products they may be using; track certain products and monitor their use and effectiveness; if authorized by law, notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; and conduct medical surveillance of our facilities in certain limited circumstances concerning workplace illness or injury. We also may release PHI to an appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence; however, we will only release this information if the patient agrees or when we are required or authorized by law.  
8. Health Oversight Activities. We may disclose PHI to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure of our facilities and providers. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws. In requests that include PHI that is potentially related to reproductive health care, an attestation signed by the coroner or medical examiner will be required. 
9. Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose PHI in response to a court or administrative order. We also may disclose PHI in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested. In requests that include PHI that is potentially related to reproductive health care, an attestation signed by the coroner or medical examiner will be required. 
10. Law Enforcement. We may release PHI if asked by a law enforcement official as follows: (a) in response to a court order, subpoena, warrant, summons or similar process; (b) limited information to identify or locate a suspect, fugitive, material witness, or missing person; (c) about the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement; (d) about a death we believe may be the result of criminal conduct; (e) about evidence of criminal conduct on our premises; and (f) in emergency circumstances to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime. In requests that include PHI that is potentially related to reproductive health care, an attestation signed by the coroner or medical examiner will be required. 
11. Coroners, Medical Examiners and Funeral Directors. We may release PHI to a coroner or medical examiner. In some circumstances this may be necessary, for example, to determine the cause of death. We also may release PHI to funeral directors as necessary for their duties. In requests that include PHI that is potentially related to reproductive health care, an attestation signed by the coroner or medical examiner will be required. 
12. National Security and Intelligence Activities. We may release PHI to authorized federal officials for intelligence, counter-intelligence, and other national security activities authorized by law.  
13. Protective Services for the President and Others. We may disclose PHI to authorized federal officials so they may provide protection to the President, other authorized persons, foreign heads of state or to conduct special investigations.  
14. Inmates or Individuals in Custody. In the case of inmates of a correctional institution or that are under the custody of a law enforcement official, we may release PHI to the appropriate correctional institution or law enforcement official. This release would be made only if necessary (a) for the institution to provide you with health care; (b) to protect your health and safety or the health and safety of others; or (c) for the safety and security of the correctional institution.  

We may use and disclose HIV test results for the purposes described above only if you give your permission to use and disclose these HIV test results along with your medical records at the time of testing. If you did not give such permission, we may use and disclose this information only for the following limited purposes without your written authorization: (1) for health care treatment (as described above) and to provide you with health care services, such as informing a specialist about your HIV status to enable the specialist to provide additional services to you; (2) for payment (as described above), such as compiling or reviewing records as part of routine billing; (3) for health care operations (as described above), such as to enable our health facility staff to monitor and evaluate our programs; (4) to child-placing or child-caring agencies, family foster homes, residential facilities or community- based care programs that are directly involved in placement, care, control or custody and who have a need to know such information; (5) to a sex or needle sharing partner in accordance with applicable law; (6) to the Kansas Department of Health & Environment for public health reporting and disease control purposes, in accordance with applicable law; (6) to organizations that procure, process, distribute or use organs, eyes, or tissues for donation purposes; (7) to authorized medical or epidemiological researchers; (8) in accordance with a valid court order that specifically requires us to release HIV test results; (9) if an officer, law enforcement personnel, firefighter, ambulance driver, paramedic or emergency medical technician comes into contact with a person in such a way that significant exposure to HIV has occurred, then we may release such HIV test results to a person who was significantly exposed to HIV. 

HOW WE MAY USE AND DISCLOSE PSYCHOTHERAPY NOTES 
Separate authorizations are generally required for most uses and disclosures of psychotherapy notes. We may use and disclose notes taken during psychotherapy counseling that you received from WSU only for the following limited purposes: (1) for health care treatment (as described above) and to provide you with health care services, such as a physician reviewing his/her notes prior to your therapy session; (2) to defend WSU in a legal action or other proceeding, such as providing psychotherapy notes to our lawyers who are defending WSU in a legal case; (3) when required by law (as described above) under international, federal, state or local law; (4) to a health oversight agency for oversight activities involving the creator of the notes (as described above); (5) to identify you to a coroner or medical examiner (as described above); (6) when necessary to prevent or lessen a serious threat to health and safety (as described above). 

WSU may use and disclose your protected health information (PHI) that is potentially related to reproductive health care after obtaining a signed attestation that clearly states the requested use or disclosure is not for the prohibited purposes described below, and where the request is for PHI for any of the following purposes: (1) Health oversight activities; (2) Judicial or administrative proceedings; (3) Law enforcement; and (4) Regarding decedents, disclosures to coroners and medical examiners. WSU may not use or disclose your PHI for the following purposes: (1) To conduct a criminal, civil, or administrative investigation into you for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care; (2) To impose criminal, civil, or administrative liability on you for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care; (3) To identify you for any purpose described in (1) or (2).  This prohibition applies when the reproductive health care at issue: (1) is lawful under the law of the state in which such health care is provided under the circumstances in which it is provided; (2) is protected, required, or authorized by Federal law, including the United States Constitution, under the circumstances in which such health care is provided, regardless of the state in which it is provided; or (3) is provided by another person and presumed lawful.

HOW WE MAY USE AND DISCLOSE PART 2 SUBSTANCE USE DISORDER (SUD) RECORDS

WSU is not a Part 2 provider as defined under 42 CFR Part 2 but is required to comply with Part 2 confidentiality rules for any Part 2 Substance Use Disorder (SUD) records it receives. Part 2 SUD records shared with WSU may be subject to re-disclosure under the HIPAA rules and as outlined in this document. WSU will not disclose your Part 2 SUD records in a civil, criminal, administrative, or legislative proceeding unless you provide specific consent to do so or a court order is obtained. Your Part 2 SUD records will only be disclosed to public health authorities if it is de-identified. You have the same rights allotted to you regarding these Part 2 SUD records as listed in the next section, including the right to an accounting of disclosures regarding those records.

You have the following rights, subject to certain limitations, regarding PHI that we maintain about you: 

1. Right to Inspect and Copy. You have the right to inspect and receive a copy and/or tell us where to send a copy of PHI that may be used to make decisions about your care or payment for your care, including information kept in an electronic health record. 
2. Right to Amend. If you feel that PHI that we have is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is maintained by or for us. You must tell us the reason for your request. We may deny your request for an amendment to your record. We may do this if your request is not in writing or does not include a reason to support the request. We also may deny your request if you ask us to amend information that: 
   • we did not create;
   • is not part of the records used to make decisions about you;
   • is not part of the information which you are permitted to inspect and/or receive a copy of; or
   • is accurate and complete.
3. Right to an Accounting of Disclosures. You have the right to request, in writing, an accounting of certain disclosures of PHI that were made for purposes other than treatment, payment for care, or health care operations. You are entitled to one disclosure accounting in any 12-month period at no charge. For any additional accountings requested within the 12-month period, we may charge a reasonable cost-based fee.

4. Right to Request Restrictions. You have the right to request a restriction or limitation on the PHI that we use or disclose for treatment, payment, or health care operations. You have the right to request a limit on the PHI that we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not share information about your surgery with your spouse. We are not required to agree to your request. If we agree to your request, we will comply with your request unless we need to use the information in certain emergency treatment situations. 

   In addition, you have the right to request that we restrict disclosure of PHI to your health plan if the disclosure is for the purpose of carrying out payment or health care operations (and is not for the purpose of carrying out treatment) and the PHI pertains solely to a health care item or service for which you have paid in full, and WSU must comply with such a request unless the disclosure is otherwise required by law. WSU is not required to comply with your request if you do not pay for the service in full. 

5. Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we contact you only by mail or at work. Your request must specify how or where you wish to be contacted. We will accommodate reasonable requests.
6. Right to Opt-Out of Fundraising Communications. You have the right to ‘Opt-Out’ of receiving fundraising communications. You may do so by sending an email including your full name, address, and telephone number to hipaaprivacy@wichita.edu. In the alternative, you may send the same information via mail to the Privacy Office address below. Normal processing time may take up to two (2) weeks from the date of receipt. During that processing time, you may continue to receive fundraising communications until our system is updated.
7. Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of this Notice. You may obtain a copy of this Notice at any time by contacting hipaaprivacy@wichita.edu.

By providing us with certain information, you expressly agree that WSU and its business associates can use certain information (such as your home/work/cellular telephone number and your email) to contact you about various matters, such as follow-up appointments, collection of amounts owed and other health-related services and operational matters. You agree you may be contacted through the information you have provided and by use of pre-recorded/artificial voice messages and use of an automatic/predictive dialing system. 

We will keep PHI private and secure as required by law. If there is a breach (as defined by law) of any of your unsecured PHI, then we will notify you following the discovery of the breach in accordance with applicable state and federal laws. 

To exercise any of your rights described in this Notice, other than to obtain a paper copy of this Notice, you must email hipaaprivacy@wichita.edu or send a request, in writing, to our Chief Privacy Officer at the following address:

Wichita State University
HIPAA Privacy Officer
1845 Fairmount, Box 47
Wichita, Kansas 67260-0047

For additional information, please contact the HIPAA Privacy Officer at 316-978-4HIP or hipaaprivacy@wichita.edu. 

We reserve the right to change this Notice and to make the revised or changed Notice effective for PHI that we already have as well as any information we receive in the future. Changes to this Notice or our privacy policies and practices would apply to all health information, including PHI, maintained in and by the Covered Components.  We will post a copy of the current Notice at our Covered Components. The Notice will contain the effective date in the document footer. 

If you believe your privacy rights have been violated, you may file a complaint by contacting us at address listed above. All complaints must be made in writing. You will not be penalized for filing a complaint. 

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling (877) 696-6775, or visiting http://HHS.Gov/OCR/Privacy/HIPAA/Complaints. 

If you have any questions regarding your privacy rights or the information in this Notice, please contact WSU’s HIPAA Privacy Officer at the address, phone number, or email listed above.