Notice of Privacy Practices for Protected Health Information

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Application of this Notice

In most cases, this notice will be provided to the patient. Accordingly, throughout this notice we use the terms “you” and “your” primarily with reference to the patient. In some cases, however, a patient representative such as a parent, guardian, or agent under a power of attorney for health care or a conservator will represent the patient. In those situations in which the patient is unable or unwilling to exercise certain patient rights regarding the control of medical information, “you” may refer to the patient representative.

This notice applies to information and records regarding your health care maintained at Drexel University (DU), including medical records and payment information (medical information).

If you have any questions about this notice, please speak with the office staff or contact the Privacy Officer at 267-359-5598.

About Drexel University

This notice describes Drexel University's privacy practices, including those of:

• Any health care professional authorized to enter information into your chart;
• All departments and units of Drexel University;
• All physicians, fellows, residents and other trainees of, or affiliated with, Drexel University;
• All employees, volunteers, staff and other Drexel University personnel.

This notice applies to information and records regarding your health care maintained at and/or by Drexel University.

Our Pledge Regarding Your Medical Information

Drexel University is committed to protecting medical information about you. We create a record of the care and services you receive at the Drexel University facilities for use in your care and treatment.

This notice tells you about the ways in which we may use and disclose medical information about you. It also describes your rights and certain obligations we have regarding the use and disclosure of your medical information.

The law requires us to:

• Make sure that your medical information is protected;
• Give you this notice describing our legal duties and privacy practices with respect to medical information about you;
• Follow the terms of the notice that is currently in effect.

How We May Use and Disclose Medical Information About You

The following sections describe different ways that we may use and disclose your medical information. For each category of uses or disclosures, we will explain what we mean and try to give some examples. Not every use or disclosure will be listed. All of the ways we are permitted to use and disclose information, however, will fall within one of the following categories.

For Treatment. We may use medical information about you to provide you with medical treatment or services. We may disclose medical information about you to doctors, nurses, technicians, medical students or other personnel who are involved in taking care of you at Drexel University. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. In addition, the doctor may need to tell the dietitian if you have diabetes so that we can arrange for appropriate meals. We may also share medical information about you with other Drexel University personnel or non-Drexel University providers, agencies or facilities in order to provide or coordinate the different things you need, such as prescriptions, lab work and X-rays. We also may disclose medical information about you to people outside Drexel University who may be involved in your continuing medical care after you leave Drexel University, including your referring or primary care physician, other health care providers, transportation companies, other health care facilities, community agencies, family members or others that are part of your care.

For Payment. We may use and disclose medical information about you so that the treatment and services you receive at Drexel University may be billed to, and payment may be collected from, you, an insurance company or a third party. For example, we may need to give your health plan information about the services that you received at Drexel University so your health plan will pay us or reimburse you for the services. We may also tell your health plan about a treatment you are going to receive so that we can obtain prior approval or determine whether your health plan will cover the treatment.

For Health Care Operations. We may use and disclose medical information about you for Drexel University's operations. These uses and disclosures are made to promote quality of care activities; compliance with laws and regulations, medical staff bylaws and rules and regulations, contractual obligations or patients' claims, grievances or lawsuits; health sciences education; health care contracting; legal services; business planning and development; business management and administration; underwriting and other insurance activities; and to operate Drexel University. For example, we may use medical information to review our treatment and services and to evaluate and improve the performance of our staff in caring for you. We may also combine medical information about many patients to decide what additional services Drexel University should offer, what services are not needed, and whether certain new treatments are effective. We may also disclose information to doctors, nurses, technicians, medical and other students, and other Drexel University personnel for performance improvement and educational purposes. We may also combine the medical information that we have with medical information from other providers to compare how we are doing and see where we can make improvements in the care and services that we offer.

Appointment Reminders. We may use and disclose medical information to contact you as a reminder that you have an appointment for treatment or medical care at Drexel University.

Treatment Alternatives. We may use and disclose medical information to tell you about or recommend possible treatment options or alternatives that may be of interest to you.

Health-Related Benefits and Services. We may use and disclose medical information to tell you about health-related benefits or services that may be of interest to you.

Development and Fundraising Activities. We may contact you to provide information to you about Drexel University-sponsored activities, including fundraising programs and events. We would use (i) your demographic information, including your name, address, other contact information, age, gender, and date of birth; (ii) dates you received treatment or services at Drexel University; (iii) the department of Drexel University that provided your services; (iv) your treating physician; (v) the outcome of your treatment; and (vi) your health insurance status. You have the right to opt-out of receiving such fundraising communications by contacting the Office of Institutional Advancement at 215-762-2209. If you opt-out, you may also later decide to again receive such fundraising communications by contacting the Office of Institutional Advancement at 215-762-2209.

Individuals Involved in Your Care or Payment for Your Care. We may release medical information to anyone involved in your medical care, for example, a friend, family member, personal representative or any other individual that you identify. We may also give information to someone who helps pay for your care. We may also tell the family or friends you have identified about your general condition.

Disaster Relief Efforts. We may disclose medical information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.

Research. Drexel University is a research institution. All research projects conducted by Drexel University must be approved through a special review process to protect patient safety, welfare and confidentiality. Your medical information may be important to further research efforts and the development of new knowledge. We may use and disclose medical information about our patients for research purposes including in connection with future research with your consent.

On occasion, researchers contact patients regarding their interest in participating in research studies. Enrollment in these studies can only occur after you have been informed about the study, had an opportunity to ask questions, and indicated your willingness to participate by signing a consent form. Other studies may be performed using information about your treatment without requiring your informed consent. For example, a research study may involve comparing the health and recovery of patients who receive one medication to those who receive another for the same condition.

As Required by Law. We will disclose medical information about you when we are required to do so by federal, state or local law.

To Avert A Serious Threat to Health or Safety. We may use and disclose medical information about you when necessary to prevent or lessen a serious and imminent threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent or lessen the threat.

Special Situations

Immunization Records. We may disclose proof of immunization to a school, if the school is required by State law to obtain such information to admit the student. Prior to making such disclosure we must obtain oral agreement to the disclosure from the student's parent or guardian (or student, if age 18 or older) and the disclosure must be limited to proof of the immunization.

Organ and Tissue Donation. If you are an organ donor, we may release medical information about you to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as may be necessary to facilitate organ or tissue donation and transplantation.

Military and Veterans. If you are or were a member of the armed forces, we may release medical information about you to military command authorities as required by law. We may also release medical information about foreign military personnel to the appropriate foreign military authority as required by law.

Workers' Compensation. We may use or disclose medical information about you for workers' compensation or similar programs as permitted or required by law. These programs provide benefits for work-related injuries or illness.

Public Health Risks. We may disclose medical information about you for public health purposes. These purposes generally include the following:

• Preventing or controlling disease (such as cancer and tuberculosis), injury or disability;
• Reporting vital events such as births and deaths;
• Reporting child abuse or neglect;
• Reporting adverse events or surveillance related to food, medications, or defects and other problems with products;
• Notifying persons of recalls, repairs or replacements of products they may be using;
• Notifying a person who may have been exposed to a disease or who may be at risk for contracting or spreading a disease or condition;
• Notifying the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence and making this disclosure as required or authorized by law.

Health Oversight Activities. We may disclose medical information about you to governmental, licensing, auditing and accrediting agencies for activities authorized by law.

Lawsuits and Other Legal Actions. In connection with lawsuits or other legal proceedings, we may disclose medical information about you in response to a court or administrative order, or in response to a subpoena, discovery request, warrant, summons or other lawful process.

Law Enforcement. If asked to do so by a law enforcement official, and in accordance with state and federal law, we may release medical information:

• To identify or locate a suspect, fugitive, material witness or missing person;
• About a suspected victim of a crime if, under certain limited circumstances, we are unable to obtain the person's agreement;
• About a death we suspect may be the result of criminal conduct;
• About criminal conduct at Drexel University; and
• In cases of medical emergency, to report a crime, the location of the crime or victim(s) or the identity, description or location of the person who committed the crime.

Coroners, Medical Examiners and Funeral Directors. In most circumstances, we may disclose medical information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also disclose medical information about Drexel University patients to funeral directors as necessary to carry out their duties.

National Security and Intelligence Activities. As required by law, we may disclose medical information about you to authorized federal officials for intelligence, counterintelligence and other national security activities authorized by law.

Protective Services for the President and Others. As required by law, we may disclose medical information about you to authorized federal officials so they may provide protection to the President and other authorized persons or foreign heads of state or conduct special investigations.

Inmates. If you are an inmate of a correctional institution under the custody of law enforcement officials, we may release medical information about you to the correctional institution if required by law.

Highly Confidential Information

Certain laws require special privacy protection for highly confidential information about you including the subset of your health information that: (1) is maintained in psychotherapy notes; (2) is about mental illness, mental health and developmental disabilities services; (3) is about alcohol and drug abuse prevention, treatment, and referral; (4) is about HIV/AIDS testing, diagnosis or treatment; (5) is about counseling for sexual assault; (6) is to be reported to the State DNA Data Bank. Under applicable law, we must generally get your authorization to disclose highly confidential information about you, but we may disclose it without first getting your authorization in the following circumstances:

Mental health treatment. We may disclose information from your mental health treatment records to those who are providing you with treatment. We may also disclose information from your mental health treatment records to someone you identify as being responsible for paying for your care, such as an insurance company, but we will only disclose the limited amount of information necessary for our payment purposes. We may disclose information from your mental health treatment records to the County Mental Health Administrator, a Mental Health Review Officer, or to an attorney representing you at a commitment hearing. We may disclose information from your mental health treatment records when we are required to do so by law, such as to meet our requirement to report suspected child abuse. Regulators such as licensing agencies may review our organization from time to time, and they may have access to your mental health treatment records during those reviews. Other legally authorized reviewers may also review the care and services we have provided, and we may disclose information from your mental health records to them. We may disclose information from your mental health treatment records, if we are ordered by a court to do so. If you are older than 14 but younger than 18, we may release your mental health treatment records to your parent or guardian, if you need medical care that they must agree to. In an emergency, we may release information from your mental health treatment records in order to prevent someone (including you) from being harmed.

Drug and alcohol treatment records. We may disclose information from your drug and alcohol treatment records to a judge who has sentenced you, if your being in treatment is a condition of the sentence. We may also disclose information from your drug and alcohol treatment records to a judge who has assigned you to a drug and alcohol treatment program under a pre-sentence conditional release program. We may also disclose information from your drug and alcohol treatment records to your probation or parole officer, if your probation or parole is conditioned on you being in treatment. If you have a medical emergency, we may release information from your drug and alcohol treatment records to proper medical authorities so that they may provide medical treatment to you.

HIV-related information. If you are HIV-positive, we will generally not disclose information about you that would identify you as being HIV-positive. Certain medications, for example, are typically only given to HIV-positive persons. If you were receiving such a medication, we would not generally disclose that information without your authorization. We may, however, disclose HIV-related information to a physician who ordered an HIV test, or to health care or social service providers who are providing you with care and services. We may disclose your HIV-related information to your health insurer, so that we can be paid for the care and services we have provided to you. We may disclose HIV-related information to persons or organizations who review our services for peer review, accreditation, licensure, or other oversight activities. We may disclose HIV-related information about you when we are required to do so by law—for instance, to the Department of Health. We may disclose your HIV-related information to a person so named in a court order. In the event of your death, we may disclose your HIV-related information to the funeral director who will receive your body. If we are pursuing youth residential placement for you, we may also disclose your HIV-related information to certain county agencies or facilities to help coordinate this placement.

Sexual assault counseling records. If we provide you with sexual assault victim counseling, we will not release or disclose those records without your authorization.

Results of DNA Testing and Genetic Information. If we perform DNA testing on you for purposes of reporting to the State DNA Data Bank, we are only permitted to disclose the results of that testing to the Data Bank authorities who are authorized to receive it. Genetic information is considered health information and may be used and disclosed by Drexel University in the same fashion as other medical information may be used and disclosed, as described in this notice. However, health plans are restricted as to the uses or disclosures that they may make with respect to your genetic information.

Your Rights Regarding Medical Information About You

The medical record that we create about you, including X-ray films, is the property of Drexel University. You have the following rights, however, regarding medical information we maintain about you.

Right to Inspect and Copy. With certain exceptions, you have the right to inspect and/or receive a copy of your medical information. If your medical information is maintained in an electronic medical record, you have the right to ask for a copy of your electronic medical record in an electronic form.

To inspect and/or receive a copy of your medical information, you must submit your request in writing to the department providing care. A form is available for this request. If you request a copy of the information, we may charge a fee for these services.

We may deny your request to inspect and/or to receive a copy in certain limited circumstances. If you are denied access to your medical information, we will explain the reason(s) to you. In most cases, you may have the denial reviewed. Another licensed health care professional chosen by Drexel University will review your request and the denial. The person conducting the review will not be the person who first denied your request. We will comply with the outcome of the review.

Right to Request an Amendment or Addendum. If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information or add an addendum. You have the right to request an amendment or addendum for as long as the information is kept by or for Drexel University.

To request an amendment, your request must be made in writing and submitted to the department providing care. A form is available from office staff for this purpose. In addition, you must provide a reason that supports your request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

• Was not created by Drexel University;
• Is not part of the medical information kept by or for Drexel University;
• Is not part of the information which you would be permitted to inspect and copy; or
• Is accurate and complete in the record.

An addendum must not be longer than 250 words per alleged incomplete or incorrect item in your record.

Right to an Accounting of Disclosures. You have the right to request an “accounting of disclosures.” This is a list of the disclosures we have made of medical information about you that were for purposes other than treatment, payment, heath care operations and certain other purposes. If such disclosures are made through an electronic health record, you have the right to receive a list of these types of disclosures as well.

To request this accounting of disclosures, you must submit your request in writing to the Privacy Officer, 13th Floor Bellet Building, 1505 Race Street, Philadelphia, PA 19102

Your request must state a time period that may not be longer than the six (6) previous years; provided, however that with respect to disclosures regarding treatment, payment and operations through an electronic health record, the period is no longer than three (3) years. You are entitled to one accounting within any twelve (12) month period at no cost. If you request any additional accountings within that twelve (12) month period, we may charge you for the cost of compiling the additional accountings. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time, before any costs are incurred.

Right to Request Restrictions. You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend. For example, you could ask that we not use or disclose information about an ultrasound that you had done at Drexel University.

We are not required to agree to your request.

If we do agree, our agreement must be in writing, and we will comply with your request unless the information is needed to provide you emergency treatment. However, if you pay for your treatment in full, you have the right to restrict, unless otherwise prohibited by law, the disclosure of your medical information to your insurance company or health plan in connection with the services that are paid for in full by you and we must abide by your request in such circumstances.

To request a restriction, you must make your request in writing to your physician. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply, for example, disclosures to your spouse or employer.

Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we contact you only at work or by mail.

To request confidential communications, you must make your request in writing to your treating physician through the office staff. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to a Paper Copy of This Notice. You have the right to a paper copy of this notice, even if you have agreed to receive this notice electronically. You may ask us to give you a copy of this notice at any time.

Right to Notice of a Breach. You have the right to be notified of a data breach.

Changes to Drexel University's Privacy Practices and This Notice

We reserve the right to change Drexel University's privacy practices and this notice. We reserve the right to make the revised or changed notice effective for medical information we already have about you as well as any information we receive in the future. We will post a copy of the current notice at Drexel University. The notice will contain the effective date on the first page in the top right-hand corner. In addition, each time you register at Drexel University for treatment or health care services, you may request a copy of the notice that is currently in effect.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with Drexel University or with the Secretary of the United States Department of Health and Human Services. All complaints to Drexel University must be in writing. To file a complaint with Drexel University, write the Privacy Officer, Drexel University, 1505 Race Street, 13th Floor, Mail Stop 666, Philadelphia, PA 19102.

You will not be penalized for filing a complaint.

Other Uses of Medical Information

Certain uses of your medical information, such as the use or disclosure of or access to psychotherapy notes or use or disclosure for marketing purposes, are prohibited without your express authorization. We also cannot sell your health information without your permission. Other uses and disclosures of medical information not covered by this notice or the laws that apply to us will be made only with your written permission on an authorization form. If you provide us with permission to use or disclose medical information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose medical information about you for the reasons covered by your written authorization. We are unable to take back any disclosures we have already made with your permission. We will retain our records of the care provided to you as required by law.

To obtain a copy of this notice, please ask the office staff.