Patient and Web Site User Privacy Rights

Patients Privacy Rights

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

Northwestern Medical Faculty Foundation (“NMFF,” “we,” or “us”) is committed to respecting the privacy and confidentiality of your health information.  In addition, the Health Insurance Portability and Accountability Act (HIPAA) requires us to maintain the privacy of your health information.  We are also required to give you this notice that explains NMFF’s privacy practices and legal duties related to your health information, as well as your rights with regard to your health information.  This notice describes the practices of all health care professionals allowed to enter information into your health care records at NMFF, all NMFF workforce, and any volunteers we allow to help you while you are at NMFF.

YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION AND HOW TO EXERCISE THEM

NMFF seeks to not only provide quality care, but also to make your overall experience here at NMFF ideal.  We strive to accommodate patient needs and requests – including needs and requests with respect to your health information.  Specifically, you have the right to:

• View and receive in a timely manner a copy of your health information (with some limited exceptions) held by NMFF. You may request this information in an electronic format.
• Have your health information amended if you believe that it is wrong or if information is missing, and NMFF agrees.  If NMFF disagrees, you may have a statement of your disagreement added to your health information.
• Obtain a listing of those getting your health information from NMFF.  The listing will not cover uses and disclosures made: to you; for payment, treatment or health care operations; pursuant to an authorization; incidentally; for uses and disclosures for which you have the right to object (and you did not object); for national security purposes; to corrections or law enforcement personnel; or as part of a limited data set.
• Ask NMFF to communicate with you in a different manner (for example, by email) or at a different place (for example, by sending materials to a P.O. box instead of your home address).  NMFF must accommodate reasonable requests.
• Request NMFF to limit how your health information is used and disclosed for treatment, payment, or health care operations or for uses or disclosures for which you have the right to object (discussed below).  It is your responsibility to make such requests. NMFF is not required to agree to your request except as otherwise required by law.  Even if we do agree, we may still use or disclose the information for your emergency treatment.   NMFF is required by law to comply with your request to restrict disclosure of your health information to a health plan for purposes of payment or health care operations if the information relates to a health care item or services for which you have paid NMFF out-of-pocket in full. This restriction will apply only to those health care records created on the date that you received the item or service and made payment out-of-pocket and which document services provided by NMFF. .
• Get a separate paper copy of this Notice even if you agreed to receive this Notice by e-mail.

To accomplish any of the above items, contact the Patient Services Center,   2nd Floor, Galter Pavilion, 312-695-1920 (TDD: 312-695-3661).  For tracking purposes, you may have to complete a form and submit your request in writing.

HOW NMFF MAY USE AND SHARE YOUR HEALTH INFORMATION
We use your health information within NMFF.  We share or disclose your health information to others outside NMFF for many different reasons.  The Notice explains the ways we use and disclose your health information.  It will also advise you when we need to get your specific permission or authorization to use or disclose your information.  With some exceptions, we use or disclose only those portions of your health information that are necessary to satisfy the need for which the information is being used or disclosed.

Those Instances that Require the Use or Disclosure of Your Health Information

NMFF must use and disclose your health information:

• With some limited exceptions, to you or someone who has the legal right to act for you (your personal representative);
• to the Secretary of the Department of Health and Human Services, if necessary, to make sure your privacy is protected; and
• when required by law.

The Use and Disclosure of Your Health Information for Treatment, Payment, and Health Care Operations

NMFF is allowed to use and disclose your health information without your authorization for treatment, payment, and health care operations.

• Treatment.  NMFF will use and disclose your health information to provide, coordinate or manage your health care and related services.  For example, your NMFF primary care doctor may refer you to an NMFF specialist, such as a radiologist or surgeon.  In doing so, the primary care doctor will likely share information about you with the specialist. NMFF will also share information with other non-NMFF providers for treatment purposes.   In some instances, NMFF may ask that you give us written permission to share your health information with other providers.  The reason for this request is to verify that the other doctor is a provider of your care and, thus, should receive your health information. We may also ask for your written permission if certain kinds of information are being disclosed (such as mental health, HIV, or genetic information).   NMFF may also use your health information to provide appointment reminders or give you information about treatment alternatives, or other health care services or benefits that may be of interest to you.
• Payment.  NMFF will use and disclose you health information to bill and collect payment for the health care services it provides to you.  For example, if you have health insurance, NMFF may disclose your information to the insurance company to receive payment.  NMFF may also disclose your information to other providers for their payment activities.
• Health Care Operations.  NMFF may use and disclose your health information to carry out ”health care operations.”  These are activities that are needed to operate NMFF facilities and carry out its mission.  They include, for example:
• Conducting quality assessment and improvement activities.
• Reviewing the qualifications and performance of health care providers, training, and performing accreditation, certification, or licensing activities.
• Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs.
• Managing NMFF business and performing general administrative activities.

NMFF may disclose your information to other organizations covered under HIPAA and with whom you have a relationship for certain activities of their health care operations.

Other Purposes for which NMFF is Allowed to Use or Disclose Your Health Information

NMFF may use or disclose your health information to others without your authorization as permitted by law, and examples are listed below.  NMFF must comply with various legal requirements in order to do so.

• For judicial or administrative proceedings (such as in response to court order).
• For law enforcement purposes (such as providing limited information to locate a missing person).
• For public health activities (such as reporting specific diseases or outbreaks).
• To report to appropriate authorities incidents of abuse, neglect or domestic violence.
• For government health oversight activities (such as fraud and abuse investigations).
• To facilitate organ and tissue donation.
• To coroners, medical examiners and funeral directors.
• To avoid a serious and imminent threat to health or safety.
• For specific government functions (such as disclosing health information for national security purposes, including protecting the President of the United States or conducting intelligence operations).
• For workers’ compensation purposes.
• To create a collection of de-identified information that can no longer be traced back to you.

NMFF is allowed to disclose your health information to its “business associates” -- individuals or companies that provide services to NMFF.  For example, this would include the company that administers the billing claims for NMFF, software vendors, and other service providers.  NMFF requires that business associates appropriately safeguard your information.

Finally, NMFF may use or disclose your health information incidentally as part of another use or disclosure that is permitted under law.

Fundraising

NMFF may use your demographic information (such as name, address, phone number) and the dates you received services at NMFF and disclose that information to either our business associate or certain affiliated entities for our fundraising purposes.  For example, in order to provide expanded programs in specialty areas we may want to raise additional money and, therefore, may contact you for a donation.  You can opt out of receiving such communications by, contacting the Patient Services Center at 312-695-1920 (TDD: 312-695-3661).

Research

Because NMFF is part of an academic medical center, asking scientific questions and conducting medical research are key parts of our mission.  Physician researchers and scientists share a commitment to research that brings the promise of new and better treatments and the constant search for cures.  Your medical information may be important to research efforts and may be used for research purposes in accordance with state and federal law.

All research projects conducted at NMFF by researchers associated with Northwestern University Feinberg School of Medicine are approved through a review process designed to protect the safety, welfare, and confidentiality of our patients.  Feinberg acts as a custodian of a secure electronic database that contains a copy a NMFF’s electronic medical record, including your medical information, as well as information from other participating health care providers, such as Northwestern Memorial Hospital.

Except as otherwise required by certain state or federal laws, researchers may use this database is several ways, some of which may not require your written permission.  For example, researchers may look at your medical information as necessary within the database:

• To plan future research studies.  For example, your information could be viewed by researchers trying to determine how often heart disease occurs in individuals of a certain age.
• To identify and contact you regarding your interest in taking part in a specific research study.  Your part in that study can only start after you have been told about the study, are given a chance to ask questions and have shown your willingness to be in the study by signing a consent form.
• If information that identifies you has been removed.
• When the research has been approved through a special review process that finds that there is little risk to patient privacy.  For example, a research study may involve comparing the outcomes of patients who received different treatments. 

In other situations, your written permission will be required.  For example, if a research project will involve information that is specially protected under Illinois law – such as mental health, developmental disabilities, HIV/AIDS, and genetic counseling or testing information – your written consent may be needed for the researcher to remove any information that identifies you or to look at your medical information for any of the reasons listed above.

If you have questions regarding the above, please call the Northwestern University Office for the Protection of Research Subjects at 312-503-9338.  To learn more about research at Feinberg, please contact the Office of Research at 312-503-1499 or go to www.feinberg.northwestern.edu/research.

Uses and Disclosures for Which You Have the Opportunity to Object

Unless you object, NMFF may share relevant health information about you with a family member or other person close to you if they are involved in your care or payment for your care.  NMFF may use or share your health information to notify a family member or other person responsible for you of your location, general medical condition, or death.

NMFF also may use or share your health information with a public or private agency assisting in disaster relief.  This is to coordinate efforts to notify someone on your behalf.  If we can reasonably do so while trying to respond to the emergency, we will try to find out if you want us to share this information and abide by your wishes.

Uses and Disclosures of Immunization Records

NMFF may disclose immunization records to schools to support public health efforts if we obtain and document an oral or written agreement from the parent, guardian, or other person acting in loco parentis (or an adult individual or emancipated minor, if applicable). In addition, all immunizations given by NMFF are entered into I-CARE (Illinois’ immunization registry). If you do not want to have your immunization information shared with other participating physicians in I-CARE, you must request and sign a special opt-out form. After signing the form, your immunization information will still be entered into I-CARE, but will only be seen by NMFF. Demographic information will continue to be shared with other Illinois physicians participating in the I-CARE program.

Uses and Disclosures of Information for Marketing

Unless otherwise allowed under law, we will need your written authorization to use and disclose your health information to contact you for marketing purposes.  “Marketing” includes communication about a product or service that encourages you to purchase or use the product or service.  Marketing does not include NMFF’s describing a health-related product or service that NMFF provides, performing treatment, providing refill reminders or communications about prescriptions you currently use, case management or care coordination, or recommending alternative treatments, therapies, health care providers, or setting of care, unless NMFF receives compensation from a third party for these activities.   NMFF may also conduct marketing activities with you without your authorization if the marketing is face-to-face or if it involves a promotional gift of nominal value.

Uses and Disclosures for the Sale of Protected Health Information

Unless otherwise allowed under law, we will need your written authorization to use and disclose your health information for the sale of your health information. The authorization will include a statement that NMFF is receiving compensation in exchange for the health information.   A “sale” does not include the following situations—even if NMFF receives a fee:  when the purpose of the exchange is for public health activities; for research purposes where NMFF does not profit from the exchange; for NMFF’s treatment and payment purposes;  when providing health information to you (such as when you request access to your health information or an accounting of disclosures); for the sale, transfer, merger, or consolidation of all or part of NMFF; or in other situations where NMFF does not make a profit and is only covering its costs.

Uses and Disclosures of Information that Require Your Written Permission (Authorization)

Uses and disclosures of your health information for purposes other than those referred to in this Notice will be made only with your written authorization.  If you choose to sign an authorization to disclose your health information, you can later take back (revoke) that authorization to stop any future uses and disclosures.  However, it will not stop any uses or disclosures that NMFF has already made before you took back your authorization.  Your revocation must be in writing.

Additional State and Federal Requirements

Some Illinois and federal laws provide additional privacy protection of your health information.  These include:

• Sensitive Information.  Some types of health information are particularly sensitive, and the law, with limited exceptions, may require that we obtain your written permission or in some instances, a court order, to use or disclose that information.  Sensitive health information includes information dealing with genetics, HIV/AIDS, mental health (including psychotherapy notes), developmental disabilities, and alcohol and substance abuse. Prior to receiving care from NMFF, a patient signs a consent to allow NMFF to disclose any sensitive information to Northwestern Memorial Hospital and its affiliated entities (NMH), and to non-NMFF physicians who practice at NMH (and their employees). NMFF discloses this information for treatment, payment, and certain health care operations purposes in order to better coordinate care for NMFF patients who receive care at NMH or from a physician on staff at NMH. A listing of entities affiliated with Northwestern Memorial Hospital, as well as a listing of non-NMFF physicians who admit and treat patients at Northwestern Memorial Hospital and its affiliates is available from the Patient Service Center.
• Information Used in Certain Disciplinary Proceedings.  State law may require your written permission if certain health information is to be used in various review and disciplinary proceedings by state health oversight boards (e.g., the Department of Professional Regulation).
• Information Used in Certain Litigation Proceedings.  State law may require your written permission for certain providers to disclose information in certain legal proceedings.
• Disclosures to Certain Registries.  Some laws require your written permission if we disclose your health information to certain state-sponsored registries.

NMFF is committed to following all state and federal legal requirements.

OUR DUTIES WITH RESPECT TO YOUR HEALTH INFORMATION

NMFF must abide by the terms of this Notice as long as it is in effect.  NMFF reserves the right to change its privacy practices and the terms of this Notice at any time.  Changes will apply to the protected health information currently residing in NMFF.  Any updated Notice will be posted on the NMFF web site and in all NMFF operational practice areas for public viewing.  You may pick up a copy at our offices or request a copy of the current Notice by calling the Patient Services Center at the number listed below.  You may also view it on our web site at www.nmff.org.  In addition, NMFF must notify you if there has been a breach involving your health information.

WHAT TO DO IF YOU BELIEVE NMFF HAS VIOLATED YOUR PRIVACY RIGHTS

If you believe that we may have violated your privacy rights or you disagree with any action we have taken with regard to your health information, you may file a complaint with NMFF or the Office of Civil Rights of the Department of Health and Human Services.  The Patient Services Center will provide you with the necessary assistance and paperwork.  No retaliatory action will be taken.

PERSON TO CONTACT FOR INFORMATION OR WITH A COMPLAINT

If you have any questions about this Notice or any complaints, please contact the Patient Services Center at 312-695-1920 (TDD: 312-695-3661).

EFFECTIVE DATE OF THIS NOTICE

This Notice is effective as of May 1, 2013.