Notice of Privacy Practice

Effective Date: September 12, 2020

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN OBTAIN ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. 

IF YOU HAVE ANY QUESTIONS ABOUT THIS NOTICE OR IF YOU NEED MORE INFORMATION, PLEASE CONTACT OUR PRIVACY OFFICE. THE CONTACT INFORMATION IS LISTED AT THE END OF THIS NOTICE.

This Notice of Privacy Practices ("Notice") describes the privacy practices of the University of Illinois Hospital & Health Sciences System (UI Health). It applies to the health care services you receive at UI Health, including its physicians, nurses, staff, and volunteers. UI Health is an academic environment; therefore, residents, medical students, nursing students, and students of other health professions may also use or disclose your protected health information. In this Notice, UI Health and all of its departments, units, health care providers, staff, volunteers, residents, students, and trainees are collectively referred to as "we" or "us."

We are required by law to give you this Notice of our privacy practices, legal responsibilities, and your rights. We are required to follow the terms of this Notice or other notice in effect at the time we use or disclose your health information. This Notice also describes (i) the types of uses and disclosures we may make with your health information; and (ii) your rights to access and control your health. There are other laws that provide additional protections for certain medical information related to services or treatment for certain conditions including genetic testing and counseling, mental health and developmental disabilities, substance use disorder treatment (including alcohol or drug use), and HIV/AIDS. We will follow the requirements of those laws with respect to those types of medical information.

WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION FOR THE FOLLOWING PURPOSES

This section explains how we may use and share (disclose) your health information, without your written permission, with others outside of UI Health for the purpose of providing health care services to you, obtaining payment for services provided to you and to support our business operations. 

The following are examples of the types of uses and disclosures of your PHI that UI Health is permitted to make under HIPAA for treatment, payment, and healthcare operations. These examples are not meant to be all inclusive.


Treatment: We may use or disclose your health information to provide treatment, and to coordinate, or manage your healthcare and any related services to carry out treatment functions. For example, we give information to doctors, nurses, lab technicians, students, and others, including information from tests you receive and we record that information for others to use. Note, however, that we may ask for your written permission if certain kinds of information are being disclosed, such as mental health information. We may also provide information to other providers outside of the UI Health to arrange for a referral or consultation. This disclosure of your health information to non-UI Health providers may be done electronically through a health information exchange that allows providers involved in your care to access some of your UI Health records to coordinate services and provide treatment for you.

Payment: We may use or disclose your health information, as needed, to obtain payment for our health care services. For example, we may contact your insurance company to verify benefits for which you are eligible, obtain prior authorization, and give them details about your treatment to make sure they will pay for your care. We may also use or disclose your health information to obtain payment from third parties that may be responsible for payment, such as family members. In addition, we may disclose your information to collection agencies and other subcontractors engaged in obtaining payment for care.

Healthcare Operations: We may use or disclose your health information, as needed, in order to perform healthcare operations. Healthcare operations include, but are not limited to: training and education, quality assessment/improvement activities, risk management, claims management, legal consultation, physician and employee review activities, licensing, regulatory surveys,

 and other business planning activities. For example, we may contact you about products or services we provide that are related to your health, recommend treatment alternatives and to provide information about health related benefits or services that may be of interest to you.

Business Associates: We may also disclose your health information to our third-party business associates. For example, a business associate would include an accounting firm or billing company that perform activities or services on our behalf. Each business associate must agree in writing to protect the confidentiality of your information.

Fundraising: We may use and/or disclose to our Foundation, the University of Illinois Foundation, your name, contact information, and the dates of your care (but not your treatment information) to contact you about fundraising efforts. If you receive such a communication from us, you will be provided an opportunity to opt-out of receiving such communication in the future.

Marketing Activities: We may use or share your health information to discuss products or services with you face to face or to provide you with an inexpensive promotional gift related to a product or service. For any other types of marketing activities, including sending you marketing materials (excluding direct mail sent to targeted zip codes that are not based off patient lists), we must obtain your written permission before using or disclosing your health information.

Directory Information: Unless you object, we will use and disclose in our facility directory - your name, the location at which you are receiving care, your condition (in general terms, e.g. fair, stable, etc.), and your religious affiliation. All of this information, except religious affiliation will be disclosed to people that ask for you by name, including the media. We will give your religious affiliation to clergy only, even if they do not ask for you by name. You may tell patient registration to keep your information out of the directory, but if you do, florists and other visitors may not be able to find your room or contact you.

Individuals Involved in Your Care or Payment for Your Care: We may disclose your health information to a family member or relative, a close personal friend, or another person who is involved in your care unless you ask us not to. If, for some reason such as medical emergency, you are not able to agree or disagree, we may use our professional judgment to decide whether sharing your information is in your best interest. This includes information about your location and general condition. We may also provide limited information to someone who helps pay for your care. 

Parents and Legal Guardians of Minors: We may disclose health information of minor children to their parents or guardians, unless such disclosure is otherwise prohibited by law. If a minor is emancipated, married, pregnant or a parent, we will not share information with the minor’s parents or guardians. Also, if a minor consented to receiving care for sensitive conditions (such a genetic or HIV testing, testing for sexually transmitted diseases, mental health, drug or alcohol use counseling, or other certain types of treatments), we will not disclose information to the minor’s parents or guardians except in certain situations as required or allowed by law (e.g. to protect the minor’s safety or safety of others or in the minor’s best interest).  

Immunizations: We may disclose proof of immunization to a school to support public health efforts if we obtain and document a verbal or written agreement from you or in case of a minor, from the parent, guardian, or other person acting in loco parentis. 

Appointments and Messages: If you provide us with your contact information at registration or admission to the hospital and agree to receive cell phone calls and text messages to your cell phone and emails, we may use and disclose your health information to contact you about payment and healthcare related activities. These activities include but are not limited to appointment confirmations and reminders, general health reminders, such as flu shot, immunizations, hospital registration instructions, pre-operative instructions, post- discharge follow-up, patient experience feedback, home healthcare instructions, servicing your account or collecting amounts due.  In addition, you may be contacted by any third party acting on behalf of UI Health. This includes collection agencies. You may be contacted by text message, pre-recorded messages, artificial voice messages, and/or automatic dialing system. You can cancel these in any reasonable way. This includes canceling in person or by phone (call 866.600.2273). You can also text STOP when you receive a UI Health text message. UI Health does not charge you for these contacts but your phone plan’s standard message and data rates may apply. These costs are your responsibility.

Disaster Relief Organizations: We may disclose information to disaster relief organizations, such as the Red Cross, so that your family can be notified about your condition, status and location. 

Health Information Exchange: We may  share and disclose your health information, including sensitive health information, with your past, present, and future health professionals and treating and referring providers outside of UI Health through health information exchange (HIE) programs and web-based portal systems. These programs allow secure, encrypted electronic sharing and exchange of health information, including sensitive health information, to allow providers to have the most recent available information to care for you. These programs include, but are not limited to, Epic Care Everywhere®, CarEquality, eHealth Exchange, and EpicCare® Link. If you receive services at a UI Health substance use disorder treatment program and your information is shared via an HIE, you have the right to request a list of organizations/providers to whom your substance use information has been disclosed for the past two years. You can revoke the consents described above by giving written notice to UI Health, but any revocation will not apply to the uses and disclosures made by UI Health before your revocation. You have the right to inspect and copy the mental health and developmental disabilities records that may be released. You can opt out of participating in the Epic Care Everywhere, CarEquality, and eHealth Exchange programs by completing a patient opt-out form. To request or submit an opt-out form, you can contact the Privacy Office. 

OTHER USES AND DISCLOSURES OF YOUR HEALTH INFORMATION WE MAY MAKE WITHOUT YOUR AUTHORIZATION, CONSENT OR OPPORTUNITY TO OBJECT

Required By Law: We may use or disclose your health information to the extent that the use or disclosure is required by federal, state or local law, but only to the extent and under the circumstances provided in such law(s).

Legal Proceedings: We may disclose your health information in response to court or administrative orders, or under certain circumstances in response to subpoenas, discovery requests or other lawful processes.

Law Enforcement: We may disclose your health information to law enforcement in certain circumstances, i.e., to identify or locate suspects, fugitives or witnesses, or victims of crime, to report deaths from crime, to report crimes on the premises, or in case of medical emergencies, to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime.

National Security: We may disclose your health information to authorized federal officials for conducting national security and intelligence activities, including for the provision of protective services to the President.

Criminal Activity: We may disclose your health information consistent with applicable federal and state laws if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

Public Health: We may use or disclose your health information for public health activities such as reporting births, deaths, communicable diseases, injury or disability, ensuring the safety of drugs and medical devices, and for work place surveillance or work related illness and injury.

Communicable Diseases: We may disclose your health information, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.

Health Oversight Activities: We may disclose your health information to a health oversight agency for activities authorized by law, such as audits, administrative or criminal investigations, inspections, licensure or disciplinary action and monitoring compliance with the law.

Abuse, Neglect or Domestic Violence: We may disclose your health information to a public health authority that is authorized by law to receive reports of abuse or neglect, including reporting child and sexual abuse. In addition, we may disclose your health information if we believe you may be a victim of abuse, neglect, or domestic violence to the governmental agency or entity authorized to receive such information. This disclosure will be made consistent with the requirements of applicable federal and state laws.

Food and Drug Administration (FDA): We may disclose your health information to a person or company required by the FDA to report adverse events, product defects or problems, biologic product deviations, or to track products; to enable product recalls; to make repairs or replacements; or to conduct post marketing surveillance, as required.

Coroners, Medical Examiners, Funeral Directors: We may disclose your health information to a coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose your health information to a funeral director in order to permit them to carry out their legal duties.

Organ Donation: We may disclose your health information to organizations that handle organ procurement and/or eye or tissue transplantation.

Research: We may disclose your health information to researchers at UI Health when their research has been approved by our institutional review board that has reviewed the research proposal and established protocols to ensure your privacy. If you participate in a research study that requires you to obtain hospital and/or other health care services, we may disclose your information that we create to the researcher who ordered the hospital or healthcare services. We may also use and disclose with a researcher your information if certain parts of your information that would identify you, such as your name, are removed before we share it with the researcher. You may be contacted by healthcare providers or researchers at UI Health to discuss voluntary participation in clinical research projects. You may refuse to participate without affecting your access to future care in any way at UI Health. I
f you have enrolled in a clinical trial or research study at UI Health, EpicCare Link may be used to disclose  your health information (including sensitive health information) with people involved in the research. This includes the clinical trial, research sponsor and other research staff who are part of the clinical trial or research study. 

Limited Data Set: We may use or disclose a limited data set (i.e., in which certain identifying information has been removed) of your protected health information for purposes of research, public health, or health care operations. Any recipient of that limited data set must agree to appropriately safeguard your information by signing a data use agreement.


Military and Veterans Activity: We may disclose your health information if you are in the armed forces and information is required by command authorities, or for the purposes of a determination by the Department of Veteran Affairs of your eligibility for benefits. 

Correctional Institutions: If you are an inmate or under the custody of law enforcement officials, we may disclose your health information to the correctional institution for your health and the health and safety of others.

Worker's Compensation: We may disclose your health information as authorized to comply with worker's compensation laws and other similar legally established programs.

Other Uses and Disclosures: Any other uses and disclosures of your health information not described in this Notice will be made only with your authorization. Examples of uses and disclosures which require your written authorization include: (i) most uses and disclosures of psychotherapy notes (private notes of a mental health professional kept separately from the record); (ii) subject to limited exceptions (described above), uses and disclosures of your health information for marketing purposes; and (iii) disclosures that constitute the sale of your health information. You may revoke your authorization at any time, in writing, but only as to future uses or disclosures, and only where we have not already acted in reliance on your authorization.

YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION 

You have the following rights regarding the health information we maintain about you: 

Right to Obtain a Copy of this Notice of Privacy Practices: You have the right to obtain a paper copy of the Notice currently in effect upon request. A copy of the current Notice is available at the registration areas of our facilities. It is also available on our website: hospital.uillinois.edu. You have the right to obtain a paper copy of this Notice upon request, even if you have agreed to accept this notice electronically. 

Right to Request a Restriction on Certain Uses and Disclosures: You have the right to request restrictions on uses and disclosures of your medical information for the purposes of treatment, payment or healthcare operations. We ask that such requests be made in writing. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply, for example, only to you and your spouse. Although we will consider your request, we are not required to abide by your request except in the following situation: If you have paid an item or service out-of- pocket in full, at your request, we will not disclose information relating solely to that item or service to your health plan for purposes of payment or health care operations, unless we are required by law to make the disclosure. It is your responsibility to notify any other providers about such a request. Please contact our Privacy Office if you have any questions about requesting restrictions on the uses and disclosures of your medical information.

Right to Inspect and Request a Copy of your Health Record: You have the right to inspect and obtain a copy of your health record, except in limited circumstances defined by federal and state laws and regulations. You may request that we send copies of your health record to another person designated by you. A reasonable fee may be charged to copy and/or send your record, as permitted by law. If your record is maintained electronically, we will provide you with a copy of the record in a readable electronic form and format. You may also access information via the patient portal if made available by UI Health. If you are denied access to your health record for certain reasons, the denial may be reviewable. Please contact our Privacy Office at the telephone number or address below for more information or to request access to or copies of your records.

Right to Request an Amendment to your Health Record: You may make a written request to amend your protected health information, as long as the information is kept by or for us. You must give us a reason for the amendment. In certain cases, we may deny your request for an amendment. For example, we may deny your request if you ask us to amend information that was not created by UI Health, is not part of the health information kept by or for UI Health, is not part of the information that you would be permitted to inspect or copy, or UI Health believes to be accurate and complete. If we deny your request for amendment, you have the right to file a statement of disagreement with us and we may prepare a rebuttal to your statement. We will provide you with a copy of any such rebuttal. Please contact our Privacy Office if you have any questions about amending your health record.

Right to Obtain an Accounting of Disclosures of Your Health Information: You have the right to request an accounting of the disclosures of your health information made by us, except for the following disclosures: to carry out treatment, payment or healthcare operations, made to you or to persons involved in your care, for national security or intelligence purposes, or to correctional facilities or law enforcement officials. You must include the time period of the accounting, which may not be longer than six years. The first accounting will be provided to you for free, but you may be charged for any additional accountings requested during the same calendar year. Please contact our Privacy Office to obtain an Accounting and Disclosure Report.

Right to Request Confidential Communication of your Health Information: You have the right to request that confidential communications be made by alternate means (e.g. fax versus mail) or at alternate locations (alternate address or telephone number). Your request must be in writing. We will honor your request if it is reasonable. Please make this request in writing to our Privacy Office.

Right to Receive Notice of a Breach: You have the right to be notified in writing  if UI Health or one of our Business Associated discovers a breach of your health information that was not secured in accordance with security standards as required by law.

Contact for Requests or Questions About this Notice: To exercise any of the rights described above, or if you have any questions about this Notice, please contact our Privacy Office at 312.355.5650 or by mail at the University of Illinois Hospital, Health Information Management Department (MC 772), 833 South Wood Street, B52, Chicago, Illinois, 60612-7209, Attention: Privacy Office or by e-mail at privacyoffice@uic.edu.

Complaints: If you believe that your privacy rights have been violated by us, you may file a complaint with us by contacting our Privacy Office at 312.355.5650 or by writing to the University of Illinois Hospital, Health Information Management Department/Privacy Office (MC 772), 833 South Wood Street, B-52, Chicago, Illinois, 60612-7209, Attention: Privacy Office. To file a complaint with the Compliance Hotline, call 1.866.665.4296.

You also have the right to file a written complaint with the Secretary of the Department of Health and Human Services, Office of Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue. S.W., Room 509F, HHH Building, Washington, D.C. 20201. There will be no retaliation for filing a complaint.

Changes to this Notice: We reserve the right to change this Notice at anytime. We reserve the right to make the revised or changed Notice effective for information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice in our facilities and it will also be posted on our web site at hospital.uillinois.edu.