Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date September 23, 2013

PURPOSE OF THIS NOTICE.

Oregon Health & Science University (“OHSU”) is committed to preserving the privacy of your health information. In fact, we are required by law to do so for any health information created or received by us. OHSU is required to provide this Notice of Privacy Practices (“Notice”) to you. The Notice tells you how we can and cannot use and disclose the health information that you have given to us or that we have learned about you when you were a patient in our system. It also tells you about your rights and our legal duties concerning your health information.

OHSU is required to abide by this Notice and any future changes to the Notice that we are required or authorized by law to make at all OHSU locations, including the schools of Dentistry, Medicine, Nursing, and Science & Engineering; OHSU Hospital, and Doernbecher Children’s Hospital; numerous primary care and specialty clinics; multiple research institutes and centers; and several community service and outreach programs. This Notice applies to the practices of:

All OHSU employees, volunteers, students, residents and service providers, including clinicians, who have access to health information.
Any health care professional authorized to enter information into your OHSU health record.
Any non-OHSU clinicians who might otherwise have access to your health information created or kept by OHSU, as a result of, for example, their call coverage for OHSU clinicians.
For the rest of this Notice, “OHSU,” we” and “us” will refer to all services, service areas, and workers of OHSU. When we use the words “your health information,” we mean any information that you have given us about you and your health, as well as information that we have received while we have taken care of you (including health information provided to OHSU by those outside of OHSU).

We will have a copy of the current Notice with an effective date in clinical locations and on our website

USES AND DISCLOSURES OF HEALTH INFORMATION FOR TREATMENT, PAYMENT AND HEALTH CARE OPERATIONS AT OHSU.

Treatment, Payment and Health Care Operations

The following section describes different ways that we use and disclose health information for treatment, payment and health care operations. For each of those categories, we explain what we mean and give one or more examples. Not every use or disclosure will be noted and there may be incidental disclosures that are a byproduct of the listed uses and disclosures. The ways we use and disclose health information will fall within one of the categories.

For Treatment. We may use your health information to provide you with medical or dental treatment or services. We may disclose your health information to staff physicians, staff dentists, post-graduate fellows, midwives or nurse practitioners, and other personnel involved in your health care. We may also disclose your health information to students and resident physicians who, as a part of their OHSU educational programs (and while supervised
by physicians or dentists), are involved in your care. Treatment includes (a) activities performed by nurses, office staff, hospital staff, technicians and other types of health care professionals providing care to you or coordinating or managing your care with third parties, (b) consultations with and between OHSU providers and other health care providers, and (c) activities of non- OHSU providers or other providers covering an OHSU practice by telephone or serving as the on-call provider.

For example, a physician or dentist treating you for an infection may need to know if you have other health problems that could complicate your treatment. That provider may use your medical history to decide what treatment is best for you. They may also tell another provider about your condition so that he or she can decide the best treatment for you.

For Payment. We may use and disclose your health information so that we may bill and collect payment from you, an insurance company, or someone else
for health care services you receive from OHSU. We may also tell your health plan about a treatment you are going to receive to obtain prior approval, or to determine whether your plan will pay for the treatment.

For example, we may need to give your health plan information about surgery you received at OHSU so your health plan will pay us or reimburse you for the surgery.

For Health Care Operations. We may use and disclose your health information in order to run the necessary administrative, educational, quality assurance and business functions at OHSU. For example, we may use your health information to evaluate the performance of our staff in caring for you. We may also use health information about patients to help us decide what additional services we should offer, how we can improve efficiency, or whether certain treatments are effective. Or we may give health information to doctors, nurses, technicians, or health profession students for review, analysis and other teaching and learning purposes.

Fundraising Activities. As a part of OHSU’s healthcare operations, we may use and disclose a limited amount of your health information internally, or to the OHSU Foundation and Doernbecher Children’s Hospital Foundation (collectively, “Foundations”) to allow them to contact you to raise money for OHSU. The health information released for these fundraising purposes
can include your name, address, other contact information, gender, age, date of birth, dates on which you received service, health insurance status, the outcome of your treatment at OHSU and your treating physician’s name and department at OHSU. Any fundraising communications you receive from OHSU or its Foundations will include information on how you can elect not to receive any further fundraising communications from OHSU.

Uses and Disclosures You Can Limit

Hospital Directory. Unless you notify us that you object, we may include certain information about you in the hospital directory in order to respond to inquiries from friends, family, clergy and others who inquire about you when you are a patient in the hospital. Specifically, your name, location in the hospital and your general condition (e.g., good, fair, serious, critical) may be released to people who ask for you by name. In addition, your religious affiliation may be given to a member of the clergy, such as a priest or rabbi, even if they don’t ask for you by name.
Family and Friends. Unless you notify us that you object, we may provide your health information to individuals, such as family and friends, who are involved in your care or who help pay for your care. We may do this if you tell us we can do so, or if you know we are sharing your health information with these people and you don’t stop us from doing so. There may also be circumstances when we can assume, based on our professional judgment, that you would not object. For example, we may assume you agree to our disclosure of your information to your spouse if your spouse comes with you into the exam room during treatment.
Also, if you are not able to approve or object to disclosures, we may make disclosures to a particular individual (such as a family member or friend), that we feel are in your best interest and that relate to that person’s involvement in your care. For example, we may tell someone who comes with you to the emergency room that you suffered a heart attack and provide updates on your condition. We may also make similar professional judgments about your best interests that allow another person to pick up such things as filled prescriptions, medical supplies and X-rays.

OTHER PERMITTED USES AND DISCLOSURES OF HEALTH CARE INFORMATION.

We may use or disclose your health information without your permission in the following circumstances, subject to all applicable legal requirements and limitations:

1. Required By Law: As required by federal, state, or local law.
2. Public Health Activities: For public health reasons in order to prevent or control disease, injury or disability; or to report births, deaths, suspected abuse or neglect, non-accidental physical injuries, reactions to medications, school immunizations under certain circumstances or problems with products.
3. Victims of Abuse, Neglect or Domestic Violence: To a government authority authorized by law to receive reports of abuse, neglect or domestic violence when we reasonably believe you are the victim of abuse, neglect or domestic violence and other criteria are met.
4. Health Oversight Activities: To a health oversight agency for audits, investigations, inspections, licensing purposes, or as necessary for certain government agencies to monitor the health care system, government programs, and compliance with civil rights laws.
5. Lawsuits and Disputes: In response to a subpoena, discovery request or a court or administrative order, if certain criteria are met.
6. Law Enforcement: To a law enforcement official for law enforcement purposes as required by law; in response to a court order, subpoena, warrant, summons or similar process; for identification and location purposes if requested; to respond to a request for information on an actual or suspected crime victim; to report a crime in an emergency; to report a crime on OHSU premises; or to report a death if the death is suspected to be the result of criminal conduct.
7. Coroners, Medical Examiners and Funeral Directors: To a coroner or medical examiner, (as necessary, for example, to identify a deceased person or determine the cause of death) or to a funeral director, as necessary to allow him/her to carry out his/her activities.
8. Organ and Tissue Donation: To organizations that handle organ procurement or organ, eye or tissue transplantation, or to an organ donation bank, as necessary to facilitate a donation and transplantation.
9. Research: For research purposes under certain limited circumstances. Research projects are subject to a special approval process. Therefore, we will not use or disclose your health information for research purposes until the particular research project, for which your health information may be used or disclosed, has been approved through this special approval process.
10. Serious Threat to Health or Safety; Disaster Relief: To appropriate individual(s)/organization(s) when necessary (i) to prevent a serious threat to your health and safety or that of the public or another person, or (ii) to notify your family members or persons responsible for you in a disaster relief effort.
11. Military: To appropriate domestic or foreign military authority to assure proper execution of a military mission, if required criteria are met.
12. National Security; Intelligence Activities; Protective Service: To federal officials for intelligence, counterintelligence, and other national security activities authorized by law, including activities related to the protection of the President, other authorized persons or foreign heads of state, or related to the conduct of special investigations.
13. Inmates: To a correctional institution (if you are an inmate) or a law enforcement official (if you are in that person’s custody) as necessary (a) to provide you with health care; (b) to protect your or others’ health and safety; or (c) for the safety and security of the correctional institution.
14. Workers’ Compensation: As necessary to comply with laws relating to workers’ compensation or similar work-related injury program.
15. WHEN WRITTEN AUTHORIZATION IS REQUIRED.

Other than for those purposes identified above in Sections B and C, we will not use or disclose your health information for any purpose unless you give us your specifi written authorization to do so. Special circumstances that require an authorization include most uses and disclosures of your psychotherapy notes, certain disclosures of your test results for the human immunodefi cy virus or HIV, uses and disclosures of your health information for marketing purposes that encourage you to purchase

a product or service, and for sale of your health information with some exceptions. If you give us authorization, you can withdraw this written authorization at any time. To withdraw your authorization, deliver or fax a written revocation to OHSU Health Information Management, Mail Code OP17A, 3181 S.W. Sam Jackson Park Road, Portland, OR 97239; fax: (503) 494-6970. If you revoke your authorization, we will no longer use or disclose your health information as allowed by your written authorization, except to the extent that we have already relied on your authorization.

YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION.

You have certain rights regarding your health information which we list below. In each of these cases, if you want to exercise your rights, you must do so in writing by completing a form that you can obtain from the OHSU Integrity Office, Mail Code L106 IO, 3181 S.W. Sam Jackson Park Road, Portland, OR 97239, or on the Web at http://www.ohsu.edu/xd/about/services/integrity/ips/npp.cfm. In some cases, we may charge you for the costs of providing materials to you. You can get information about how to exercise your rights and about any costs that we may charge for materials by contacting the OHSU Integrity Office at (503) 494-0219.

1. Right to Inspect and Copy. With some exceptions, you have the right to inspect and get a copy of the health information that we use to make decisions about your care. For the portion of your health record maintained in our electronic health record, you may request we provide that information to or for you in
   an electronic format. If you make such a request, we are required to provide that information for you electronically (unless we deny your request for other reasons). We may deny your request to inspect and/or copy in certain limited circumstances, and if we do this, you may ask that the denial be reviewed.
2. Right to Amend. You have the right to amend your health information maintained by or for OHSU, or used by OHSU to make decisions about you. We will require that you provide a reason for the request, and we may deny your request for an amendment if the request is not properly submitted, or if it asks us to amend information that (a) we did not create (unless the source of the information is no longer available to make the amendment); (b) is not part of the health information that we keep; (c) is of a type that you would not be permitted to inspect and copy; or (d) is already accurate and complete.
3. Right to an Accounting of Disclosures. You have the right to request a list and description of certain disclosures by OHSU of your health information.
4. Right to Request Restrictions. You have the right to request a restriction or limitation on the health information we use or disclose about you (a) for treatment, payment, or health care operations, (b) to someone who is involved in your care or the payment for it, such as a family member or
   friend, or (c) to a health plan for payment or health care operations purposes when the item or service for which OHSU has been paid out of pocket in full by you or someone on your behalf (other than the health plan). For example, you could ask that we not use or disclose information about a surgery you had, a laboratory test ordered or a medical device prescribed for your care. Except for the request noted in 4(c) above, we are not required to agree to your request. Any time OHSU agrees to such a restriction, it must be in writing and signed by the OHSU Privacy Officer or his or her designee.
5. Right to Request Confidential Communications. You have the right to request that we communicate with you about health matters in a certain way or at a certain place. OHSU will accommodate reasonable requests. For example, you can ask that we only contact you at work or by mail.
6. Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice, whether or not you may have previously agreed to receive the Notice electronically.
7. Right to be Notified of a Breach. You have the right to be notified if there is a breach – a compromise to the security or privacy of your health information
   – due to your health information being unsecured. OHSU is required to notify you within 60 days of discovery of a breach.

REVISIONS TO THIS NOTICE

We have the right to change this Notice and to make the revised or changed Notice effective for health information we already have about you, as well as any information we receive in the future. Except when required by law, a material change to any term of the Notice may not be implemented prior to the effective date of the Notice in which the material change is reflected. OHSU will post the revised Notice at OHSU clinical locations and on its website and provide you a copy of the revised notice upon your request.

QUESTIONS OR COMPLAINTS

If you have any questions about this Notice, please contact OHSU (503) 494- 8311. If you believe your privacy rights have been violated, you may file a complaint with OHSU or with the Secretary of the Department of Health and Human Services. To file a complaint with OHSU, contact OHSU at (503) 494- 8311. You will not be penalized for filing a complaint.

This Notice tells you how we may use and share health information about you. If you would like a copy of this Notice, please ask your health care provider.