This notice describes how medical information about you may be used and disclosed and how you can get access to this information. HIPAA privacy rules require that we furnish you with this notice. Please review it carefully.

Revised: March 16, 2022

Important Note: This Notice may not apply to you if you are a University of Houston student. If you are a UH student, the Family Educational Rights and Privacy Act governs your medical information, unless certain exceptions apply.

If you have any questions or requests, please contact the individuals listed at the end of this Notice.

The University of Houston Student Health Center (SHC) is committed to preserving the privacy of your health information. We are required by HIPAA (the Health Insurance Portability and Accountability Act of 1996) to ensure the privacy of your protected health information ("PHI"), and to provide you with this notice explaining when and under what conditions we may use or disclose your medical information, and what rights you have with respect to your PHI. Your PHI is contained in a medical record that is the physical property of SHC. Acknowledgment of the Notice of Privacy Practices is obtained electronically through the Healthy Coog Patient Portal.

We are required by law to ensure that medical information that identifies you is kept private, provide this Notice to you, and follow the procedures in this Notice as long as it is in effect. We reserve the right to change this Notice and to make the changed Notice effective for PHI we already have as well as for any PHI we create or receive in the future. A copy of our current Notice is posted in our office and on our website and available upon request (either at our offices or through the contact person listed in this Notice).

Ways We May Use and Disclose Your PHI

We may use and disclose your PHI to provide treatment, for payment, and for health care operations, as described below.

Health Care Treatment. We may use and share your PHI to provide, coordinate or manage your evaluation, treatment and related services. For example, information obtained by a health care provider, such as a physician, nurse practitioner, registered nurse, licensed vocational nurse, medical assistant, pharmacist, pharmacy technician or lab technician, will be recorded in your patient file at SHC. Healthcare providers will also record the types of treatment they provide and how you respond to such treatment. If you have been referred to our clinic by a healthcare provider outside the SHC, the referring professional may have sent information about you in advance to assist us in providing services to you. We will provide your healthcare provider with copies of your record or reports that will assist him/her in your health care.

Payment. We may use and share your PHI to bill and collect payment for the treatment and services provided to you. PHI may be shared for purposes of payment with an insurance company, a billing department, or a third party, including a collection agency or an individual you designate as being primarily responsible for paying for your treatment. For example: We may give your health plan(s) and our billing department information about your condition, supplies used and services you receive so we can be paid or you can be reimbursed. This information may be given prior to service to obtain approval or coverage for the proposed service(s). The information shared may include your identity, diagnosis, and treatment or supplies used in the course of the services we provide to you. However, if you paid out-of-pocket in full for a specific item or service, you have the right to ask that your PHI with respect to that item or service not be disclosed to a health plan, and we will honor that request.

Health Care Operations. We may use and disclose PHI in performing “health care operations” which allow us to improve the quality of care we provide and reduce health care costs. For example, we may use or disclose PHI about you to review the effectiveness of treatment and services; to evaluate the performance of our staff; or to determine how to continually improve the quality and effectiveness of the care and services we provide. We also may disclose PHI to students and other authorized personnel for educational and learning purposes. When we do disclose your PHI, we will provide only the “minimum necessary” information to accomplish the task.

SHC may also use and disclose your health information under the following circumstances:

Appointments. We may use your information to provide appointment reminders.

Military and Veterans. If you are a member of the armed forces, we may release your PHI as required by military command authorities or to the Department of Veterans Affairs upon your separation or discharge from military services.

Public Health Activities. We may disclose your PHI for public health activities, such as to prevent or control disease, injury or disability; to report births and deaths; to report child abuse or neglect; to report reactions to medications or problems with products; to notify people of recalls of products they may be using; to notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence. We will only make this disclosure when required or authorized by law or if you authorize such disclosure.

Lawsuits and Disputes. If you are involved in a lawsuit or dispute, we may disclose your PHI in response to a court or administrative order. We may also disclose your PHI information in response to a subpoena, discovery request or other lawsuit process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.

Law Enforcement. We may release PHI if asked to do so by a law enforcement official; in response to a court order, subpoena, warrant, summons or similar process to identify or locate a suspect, fugitive, material witness, or missing person; about the victim of a crime if, under certain limited circumstances we are unable to obtain the person’s agreement; about a death we believe may be the result of criminal conduct; about criminal conduct; and in emergency circumstances to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime.

National Security and Intelligence Activities. We may release your PHI information to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law and for authorized federal officials to provide protection to authorized persons or heads of state.

Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose information about you to the correctional institution or law enforcement official. This disclosure would be necessary for the institution to provide you with health care, to protect your health and safety or the health and safety of others, or the safety and security of the correctional institution.

Disaster Relief. We may use or disclose your PHI to a public or private entity, such as the American Red Cross, for the purpose of coordinating with that entity to assist in disaster relief efforts. We will provide you with an opportunity to agree or object to such a disclosure whenever we practicably can do so.

Decedents. We may release your PHI to a coroner, medical examiner, or funeral director so that they can carry out their duties. We may also disclose your PHI when the disclosure relates to organ, eye or tissue donation purposes.

Research. Under certain circumstances, we may use your PHI for research purposes if the research has been specially approved by an authorized institutional review board or a privacy board that has reviewed the research proposal and has set up protocols to ensure the privacy of your PHI. We may use and disclose a limited data set that does not contain specific readily identifiable information about you for research if we enter into agreements with the recipient that will ensure the confidentiality and security of the data.

Health and Safety. We may disclose your PHI to avert a serious threat to your health or safety or the health and safety of another person or the public.

Workers' Compensation. Your PHI may be used or disclosed in order to comply with laws and regulations related to Workers' Compensation.

Treatment Alternatives. We may use and disclose medical information to give you information about treatment options or alternatives or other health-related benefits or services that may interest you.

Data Breach Notification Purposes. We may use or disclose your PHI to provide legally required notices of unauthorized access to or disclosure of your health information.

As otherwise required by law. We may use and disclose your PHI to the extent otherwise required by law.

Uses And Disclosures That Require Us To Give You An Opportunity To Object And Opt Out.

Individuals Involved in Your Care or Payment for Your Care. Subject to any restrictions you may make, we may share your medical information to designated parties, such as a family member, other relative or close personal friend involved in your medical care if the medical information is directly relevant to the person’s involvement with your care. We also may give information to someone who helps pay for your care. You have the right to restrict to whom we may disclose information. If you are unable to agree or object to such a disclosure, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgment.

Fundraising Activities. We may use or disclose your PHI, as necessary, in order to contact you for fundraising activities. You have the right to opt out of receiving fundraising communications. If you do not want to receive these materials, please submit a written request to the Privacy Officer.

The following uses and disclosures of your PHI will be made only with your written authorization, unless otherwise permitted by applicable law: 1) Most uses and disclosures of psychotherapy notes; 2) Marketing communications paid for by a third party, except for refill reminders and similar communications; and 3) Sale of your PHI.

** ANY OTHER USE OR DISCLOSURE OF YOUR PHI REQUIRES YOUR WRITTEN AUTHORIZATION**

Under any circumstances other than those covered by this Notice or applicable law, release of your PHI will be made only with your written authorization. You may revoke the authorization in writing at any time by submitting a written revocation to our Privacy Officer. If you revoke your authorization, we will no longer use or disclose PHI under the authorization. However, disclosures we made with your permission prior to the revocation will not be affected by the revocation. We also are required to retain in your medical records disclosures made during the time the authorization was in effect.

YOU HAVE SEVERAL RIGHTS REGARDING YOUR PHI

1. You have the right to request how and where we contact you about PHI. For example, you may request that we contact you at work, by phone, or by mail. Your request must be in writing and submitted to the SHC. We must accommodate reasonable requests, but, when appropriate, may condition that request upon receipt of more specific contact or payment information.
2. You have the right to inspect and copy PHI. You have the right to request to inspect and copy your medical information that may be used to make decisions about your care. Your request must be in writing to the SHC. We may charge you related fees. Instead of providing you with a full copy of the information, we may give you a summary or explanation of the medical information, if you agree in advance to the form and cost of the summary or explanation. There are certain situations in which we are not required to comply with your request. Under these circumstances, we will respond to you in writing, stating why we will not grant your request and describing any rights you may have to request a review of our denial.
3. Right to an Electronic Copy of Electronic Medical Records. If your PHI is maintained in an electronic format, you have the right to request that an electronic copy of your record be given to you or transmitted to another individual or entity. We will make every effort to provide access to your PHI in the form or format you request if it is readily producible in such form or format. We may charge you a reasonable, cost-based fee for the labor associated with transmitting the electronic medical record.
4. You have the right to request amendment of PHI. If you feel that the PHI we have is incorrect or incomplete, you may ask us to amend the information. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request, or because i) the information was not created by us (unless you prove the creator of the information is no longer available to amend the record); ii) the information is not part of the records used to make decisions about you; iii) we believe the information is correct and complete; or iv) you would not have the right to see and copy the record as described in paragraph 2 above. We will tell you in writing the reasons for the denial and describe your rights to give us a written statement disagreeing with the denial. Please direct requests for amendment to the Privacy Officer at the address indicated below.
5. You have the right to request restrictions on uses and disclosures of your PHI. You have the right to request that we restrict or limit PHI we use or disclose for treatment, payment, or health care operations. You also have the right to request we limit the medical information we disclose about you to someone who is involved in your care or the payment for your care. To request a restriction on who may have access to your PHI, you must submit a written request to the Privacy Officer. Your written request must state what information you want to limit and to whom you want the limits to apply. We are not required to agree to your request unless you are asking us to restrict the use and disclosure of your PHI to a health plan for payment or health care operations purposes and such information you wish to restrict pertains solely to a health care item or service for which you have paid us “out-of-pocket” in full. You may request a restriction by contacting the Privacy Officer at SHC.
6. Out of pocket payments. If you paid out of pocket in full for a specific item or service, you have the right to ask that your PHI with respect to that item or service not be disclosed to a health plan for purposes of payment or health care operations, and we will honor that request.
7. You have the right to a listing of disclosures we have made. You have a right to an “accounting of disclosures” of your PHI. The request must be made in writing to our Privacy Officer and must state the period of time for which you request the listing, which may not be more than six years. We are required to provide a listing of all disclosures except for the following disclosures: those made more than six (6) years before your request; those disclosures made for purposes other than treatment, payment or healthcare operations as described in the Notice; those specifically authorized by you or made to you; those occurring as a byproduct of permitted uses and disclosures; those made to individuals involved in your care; for directory or notification or those made for disaster relief purposes; those allowed by law and related to certain specialized government functions; and those made as part of a set of information which does not contain identifying information about you. If you request a list of disclosures more than once in 12 months, we can charge you a reasonable fee. The right to receive this information is subject to certain exceptions, restrictions and limitations. Additional limitations may apply for electronic health records.
8. Right to a Paper Copy of this Notice. You have the right to a paper copy of this Notice, even if you have agreed to receive this Notice electronically. You may request a copy of this Notice at any time.
9. Right to Receive Notice of a Breach. You have the right to be notified upon a breach of any of your unsecured PHI.

You May File A Complaint About Our Privacy Practices

If you have any questions, if you believe we have violated your privacy rights, or if you wish to exercise your rights described in this Notice, please contact the persons listed below:

Chief Privacy Officer
HIPAA Compliance and Oversight
University of Houston Student Health Center
Health 2 Building
4349 Martin Luther King Boulevard, Room 2005
Houston, TX 77204-3019
713-743-5151

You may also send a written complaint to the U.S. Department of Health and Human Services (Office of Civil Rights).

If you file a complaint, we will not take any retaliatory action against you.