Notice of Privacy Practices

Effective Date: January 2, 2013

NOTICE OF PRIVACY PRACTICES

This Notice describes how “protected health information” about
you may be used and disclosed, and how you can gain access
to this information. Please review it carefully.

“Protected health information” is your health information
or other individually identifiable information, such as
demographic data, that may identify you. Protected health
information relates to your past, present or future physical or
mental health or condition related to healthcare services.

This Notice of Privacy Practices describes how Indiana
University Health may use and disclose your protected health
information to carry out treatment, for payment, for healthcare
operations and for other purposes permitted or required by law.
This Notice also describes certain rights that you may have to
access your protected health information. IU Health is required
to abide by the terms of this Notice of Privacy Practices.

The terms of this Notice may change at any time. The new
Notice will apply to all protected health information acquired
after it goes into effect. Upon your request, we will provide
you with any historical Notice of Privacy Practices or you may
obtain the most current copy by visiting the IU Health website
at iuhealth.org.

Uses and Disclosures of Protected Health Information
That Do Not Require Your Authorization

Your protected health information may be used and disclosed
by IU Health, our staff and others outside of our offices who
are involved in your care and treatment for the purpose of
providing healthcare services to you. Your protected health
information may also be used and disclosed to pay your
healthcare bills and to support the operations of IU Health.
The following list, by way of example rather than limitation,
explains certain uses and disclosures of your protected health
information that IU Health is permitted to make.

Treatment

IU Health will use and disclose your protected health
information to provide, coordinate or manage your healthcare
and any related services. This includes the coordination
or management of your healthcare with another provider.
For example, IU Health may disclose your protected health
information, as minimally necessary, to a home health agency
that provides care to you. 

IU Health will also disclose health information to physicians
or other healthcare providers who may be treating you. For
example, your protected health information may be provided to
a physician to whom you have been referred to ensure that the
physician has the necessary information to diagnose or treat you.

In addition, we may disclose your protected health information
from time-to-time to another physician or healthcare provider
(e.g., specialist or laboratory) who, at the request of your
physician becomes involved in your care by providing assistance
with your healthcare diagnosis or treatment. As another
example, a doctor treating you for a broken leg may need to
know if you have diabetes because diabetes may slow the
healing process.

IU Health participates in certain Health Information Exchanges
or Organizations (HIEs or HIOs). Specifically, IU Health participates
in the Indiana Health Information Exchange (IHIE) and Indiana
Network for Patient Care (INPC), which help to make your
protected health information available to other healthcare
providers who may need access to it in order to provide care
or treatment to you.

Payment

IU Health may use and disclose your protected health
information as necessary to obtain payment for healthcare
services. This may include providing it to your health insurance
plan before it approves or pays for recommended healthcare
services so that it may make a determination of eligibility or
coverage for insurance benefits. It may also include supplying
the information to review services provided to you for medical
necessity and to undertake utilization-review activities. For
example, obtaining approval for a hospital stay may require
that your relevant protected health information be disclosed
to the health insurance plan to obtain prior plan approval.

 

Healthcare Operations

IU Health may use or disclose your protected health information
in order to support our business activities. These activities
include, but are not limited to, quality assessment activities,
employee review activities, training of medical students,
licensing, fundraising activities, and conducting or arranging for
other business activities. IU Health may share your protected
health information with “business associates,” or third-party
organizations which perform services such as billing or
transcription services on behalf of IU Health. IU Health has
written contracts with our business associates to protect the
privacy of your protected health information, and business
associates are also required by law to comply with the same
privacy and security requirements that apply to IU Health.

IU Health may use and disclose your protected health
information to tell you about appointments and other matters
related to your care. We may contact you by mail, telephone or
e-mail. We may leave voice messages at the telephone number
you provide to us, and we may respond to your e-mails.

IU Health may use and disclose medical information to tell you
about possible treatment options, new services or alternatives
that may be relevant to your healthcare.

Fundraising Activities

IU Health may use necessary protected health information to
contact you in an effort to raise money for its operations. We
may disclose protected health information to a foundation
related to IU Health so that it may contact you to raise money
to support IU Health, unless you tell us in writing not to contact
you for this purpose.

Hospital Directory

IU Health may include limited information about you in the
hospital directory while you are a patient. This information may
include your name, location in the hospital and your general
condition (e.g., fair or stable). This directory information may
be released to people who ask for you by name so that they
may generally know how you are doing. If you do not want this
information shared, please let us know. Also, your religious
affiliation may be given to a member of the clergy even if they
do not ask for you by name.

Individuals Involved in Your Care or Payment
for Your Care

Unless you indicate otherwise, IU Health may disclose to a
relative, a close friend or any other person you identify, the
portion of your protected health information which directly
relates to that person’s involvement in your healthcare. If you
are unable to agree or object to such a disclosure, we may
disclose such information as necessary for your healthcare,
if, based on our professional judgment, we determine that
it is in your best interest. We may disclose protected health
information to notify or assist in notifying a family member
or personal representative (or any other person who is
responsible for your care) of your location, general condition
or death. Finally, we may use or disclose your protected health
information to an authorized public or private entity to assist in
disaster-relief efforts.

Research

IU Health performs medical research. IU Health may disclose
your protected health information to researchers when their
research has been approved by an institutional review board
that has reviewed the research proposal and established
protocols to ensure, among other things, the privacy of your
protected health information. IU Health may release information
about you to researchers who need to know how many patients
have a specific health issue in preparation for proposed research.
If a doctor caring for you believes you may be interested in,
or may benefit from, a research study, your physician and the
research review committee will designate someone to contact
you. This individual will see if you are interested in the study,
provide you with more information and give you the opportunity
to participate or to decline further contact.

To Avert a Serious Threat to Health or Safety

IU Health may use and disclose protected health information
about you when necessary to prevent a serious threat to your
health and safety, or the health and safety of another person or
the public. However, any disclosure would only be to someone
who is able to help prevent the threat.

Organ and Tissue Donation

If you are an organ donor, IU Health may release protected
health information to organizations that handle organ
procurement or organ, eye or tissue transplantation, or to an
organ-donation bank as necessary to facilitate organ or tissue
donation and transplantation.

Workers’ Compensation

IU Health may release protected health information about
you for workers’ compensation or similar programs. These
programs provide benefits for work-related injuries or illnesses.

Public Health Risks and Patient Safety Issues

IU Health may disclose protected health information about
you for public health activities and purposes to a public health
authority that is permitted by law to receive the information.
For example, disclosures may be made for the purposes
of preventing or controlling disease, injury or disability; to
report births and deaths; to report reactions to medications
or problems with products; and to notify people of recalls of
products that they may be using.

Communicable Diseases

IU Health may disclose or use your protected health information
to notify a person who may have been exposed to a disease
or may be at risk for contracting or spreading a disease
or condition; and to comply with state mandatory-disease
reporting, such as cancer registries.

Abuse or Neglect

IU Health may disclose your protected health information to
a public health authority authorized by law to receive reports
of child abuse or neglect, and to notify the appropriate
government authority if IU Health believes a patient has been
the victim of abuse, neglect or domestic violence. We will only
make this disclosure when required or authorized by law.

Health Oversight Activities

IU Health may disclose protected health information to a health
oversight agency for activities authorized by law, such as audits,
investigations, inspections and licensure. These activities
are necessary for the government to monitor the healthcare
system, government benefit programs and compliance with
civil-rights laws.

Food and Drug Administration (FDA)

IU Health may disclose your protected health information
to a person or company required by the Food and Drug
Administration for the purpose of quality, safety or effectiveness
of FDA-regulated products or activities, which include: to report
adverse events, product defects or problems, biologic product
deviations; to track products; to enable product recalls; to
make repairs or replacements; or to conduct post-marketing
surveillance, as required.

Legal Proceedings

IU Health may disclose protected health information in the
course of any judicial or administrative proceeding, in response
to an order of a court or administrative tribunal (to the extent
such disclosure is expressly authorized) or in certain conditions
in response to a subpoena, discovery request or other lawful
process.

Law Enforcement

IU Health may disclose protected health information for
certain law-enforcement purposes, such as: in response to a
court order, subpoena, warrant, summons or similar process;
to identify or locate a suspect, fugitive, material witness or
missing person; about the victim of a crime, if under certain
limited circumstances, we are unable to obtain the person’s
agreement; about a death we believe may be the result of
criminal conduct; about criminal conduct at the hospital; and,
in emergency circumstances, to report a crime, the location of
the crime or victims, or the identity, description or location of
the person who committed the crime.

Coroners, Medical Examiners and Funeral Directors

IU Health may release protected health information to a coroner
or medical examiner, for example, to identify a deceased person
or determine the cause of death. We may also release protected
health information about patients of the hospital to funeral
directors as necessary to carry out their duties.

Military Activity and National Security

IU Health may use or disclose the protected health information
of individuals who are Armed Forces personnel for activities
deemed necessary by appropriate military-command authorities,
for the purpose of a determination by the Department of
Veterans Affairs of your eligibility for benefits or to foreign
military authority if you are a member of that foreign military
service. We may also disclose your protected health information
to authorized federal officials for conducting national security
and intelligence activities, including for the provision of
protective services to the president or others legally authorized.

Inmates

If you are an inmate of a correctional institution or under the
custody of a law enforcement official, IU Health may release
protected health information about you to the correctional
institution or law enforcement official. This release would be
necessary for the institution to provide you with healthcare,
to protect your health and safety or the health and safety
of others, or for the safety and security of the correctional
institution.

Uses and Disclosures of Protected Health Information
That Do Require Your Authorization

As described above, IU Health will use your protected health
information and disclose it outside of IU Health for treatment,
payment, healthcare operations and when permitted or required
by law. IU Health will not disclose your protected health
information for other purposes without your prior written
authorization. These types of uses and disclosures will be
made only with your written authorization. In addition, certain
disclosures of your psychotherapy notes, mental health records,
and drug and alcohol abuse treatment records may require
your prior written authorization.

Your Rights Regarding Your Protected
Health Information

Right to Inspect and Copy

You have the right to inspect and obtain an electronic or paper
copy of your protected health information that may be used
to make decisions about your care. This includes medical and
billing records, but does not include psychotherapy notes. To
inspect and obtain a copy of your protected health information,
you must submit your request in writing to the IU Health Health
Information Management department. If you request a copy
of the information, IU Health may charge a fee for the cost of
copying, mailing or other supplies associated with your request.

IU Health may deny your request to inspect and copy in some
limited circumstances. If you are denied access to protected
health information, you may request that the denial be
reviewed. Another licensed healthcare professional chosen by
IU Health will review your request and the denial. The person
conducting the review will not be the person who denied your
request. We will comply with the outcome of the review.

Right to Amend

You have a right to request an amendment of the health
information that IU Health has in our records. Your request for
an amendment must be made in writing, including a reason for
the request and submitted to the IU Health Risk Management
department. IU Health may deny a request for an amendment
if it is not in writing and does not include a reason to support
the request or requests for amendment of information that:
was not created by IU Health; is not part of the protected
health information kept by IU Health; is not part of the
information which you would be permitted to inspect and
copy; or is accurate and complete.

Military Activity and National Security

IU Health may use or disclose the protected health information
of individuals who are Armed Forces personnel for activities
deemed necessary by appropriate military-command authorities,
for the purpose of a determination by the Department of
Veterans Affairs of your eligibility for benefits or to foreign
military authority if you are a member of that foreign military
service. We may also disclose your protected health information
to authorized federal officials for conducting national security
and intelligence activities, including for the provision of
protective services to the president or others legally authorized.

Inmates

If you are an inmate of a correctional institution or under the
custody of a law enforcement official, IU Health may release
protected health information about you to the correctional
institution or law enforcement official. This release would be
necessary for the institution to provide you with healthcare,
to protect your health and safety or the health and safety
of others, or for the safety and security of the correctional
institution.

Uses and Disclosures of Protected Health Information
That Do Require Your Authorization

As described above, IU Health will use your protected health
information and disclose it outside of IU Health for treatment,
payment, healthcare operations and when permitted or required
by law. IU Health will not disclose your protected health
information for other purposes without your prior written
authorization. These types of uses and disclosures will be
made only with your written authorization. In addition, certain
disclosures of your psychotherapy notes, mental health records,
and drug and alcohol abuse treatment records may require
your prior written authorization.

Right to an Accounting of Disclosures

You have the right to request an accounting of disclosures.
This is a list of disclosures IU Health has made of your protected
health information, excluding disclosures for treatment, payment,
healthcare operations or disclosures you authorized in writing.
To request an accounting of disclosures, submit your request
in writing and include the specific time period (which may not
be longer than six years and may not include dates before
April 14, 2003) to the IU Health Health Information Management
department.

The first accounting of disclosure in a 12-month period is free.
Additional accounting of disclosures may cost a fee; you will be
notified in advance of any cost involved so that you may choose
to withdraw or modify your request before incurring a cost.

Right to Request Restrictions

You have the right to request a restriction on the ways your
protected health information is used or disclosed. To request
a restriction, submit your request in writing to the IU Health
Risk Management department. The request should include
what information you want to limit, whether you want to limit
use or disclosure, or both, and to whom you want the limits to
apply—for example, disclosures to your spouse. IU Health is
not required to agree to your request. If we do agree, we will
comply with your restriction unless the information is needed
to provide emergency medical treatment.
IU Health will agree to restrict disclosures of your health
information to your health insurance plan for payment and
healthcare operations purposes (not for treatment) if the
disclosure pertains solely to a healthcare item or service for
which you paid in full.

Right to Request Confidential Communication

You have the right to request that IU Health communicate
with you about healthcare matters in a certain way or at a
certain location. For example, you can request that you are
only contacted at work or at a specific address. Such requests
should be made in writing to the IU Health Risk Management
department and should specify how or where you wish to be
contacted. IU Health will accommodate all reasonable requests.

Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice of Privacy
Practices, even if you have agreed to receive this Notice
electronically. You may also find a copy of this Notice on the
IU Health website, iuhealth.org.

Other Uses of Protected Health Information

 

Other uses and disclosures of your protected health information
not covered by this Notice or allowed by law will be made only
with your written permission. If you provide permission to
use or disclose protected health information, you may revoke
that permission, in writing, at any time. If you revoke your
permission, IU Health will no longer use or disclose protected
health information about you for the reasons covered by your
written authorization. IU Health is unable to take back any
disclosures it may have already made with your permission.

Changes to This Privacy Notice

IU Health reserves the right to change this Notice and to
make the revised or changed Notice effective for protected
health information we already have about you, as well as any
information we receive in the future. The revised Notice of
Privacy Practices will be posted on our website at iuhealth.org;
you may also request that a revised copy be sent to you in the
mail or obtain one at the time of an appointment at IU Health.

Questions or Complaints

If you believe IU Health has violated your privacy rights, you
may file a complaint with IU Health or with the Secretary of
the Department of Health and Human Services. You will not
be penalized for filing a complaint. To file a complaint with
IU Health, please submit a complaint in writing to the IU Health
Risk Management department.

If you have further questions about this Notice of Privacy
Practices, please contact the IU Health Hospital Privacy Officer
at 317.962.3597; or the IU Health Physicians Compliance
Officer and Privacy Officer at 317.948.8906.

Contact Information

IU Health Health Information Management Department
Release of Information
DG 412
1701 N. Senate Blvd.
Indianapolis, IN 46202
T 317.962.8670

IU Health Hospital Privacy Officer
Fairbanks Hall, Room 3110
340 W. 10th St.
Indianapolis, IN 46202
T 317.962.3597

IU Health Physicians Compliance Officer and Privacy Officer
6640 Parkdale Place, Suite K
Indianapolis, IN 46254
T 317.948.8906

IU Health Risk Management Department
Fairbanks Hall, Room 3119
340 W. 10th St.
Indianapolis, IN 46202
T 317.962.2130

Office for Civil Rights
U.S. Department of Health and Human Services
233 N. Michigan Ave., Suite 240
Chicago, IL 60601
dhhs.gov