Notice of Privacy Practices
This Notice describes how medical information about you may be used and disclosed by UConn Health, comprised of the following entities (collectively “UConn Health” in this Notice), and how you can get access to this information. This Notice applies to employees, physicians, dentists, volunteers, trainees, and other persons whose conduct is under the direct control of UConn Health, whether or not the person is paid by UConn Health. Please review it carefully.
- John Dempsey Hospital, including all outpatient locations on and off campus
- University of Connecticut School of Medicine
- University of Connecticut Medical Group (UMG) locations on and off campus
- School of Dental Medicine locations on and off campus and University Dentists
- UConn Health Pharmacy Services, Inc. (UHPSI)
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes standards to protect individuals’ medical records and other personal health information, granting patients some control over certain parts of their health information and requiring organizations such as UConn Health to implement certain safeguards and practices to keep each patient’s protected health information (PHI) safe. PHI includes any information created or received by UConn Health that relates to the health or condition of an individual, the provision of healthcare to an individual, or payment for the provision of healthcare to an individual, and either identifies the individual or is reasonably believed to provide information that can be used to identify the individual.
UConn Health’s Pledge Regarding PHI
UConn Health, in alignment with applicable laws, stands committed to the privacy of each patient’s PHI, and UConn Health understands and respects the personal and confidential nature of this information.
UConn Health creates and maintains a record of the care and services provided by UConn Health, as well as those records received in support of UConn Health care and services, to deliver quality care and to comply with certain legal requirements. This Notice applies to all PHI created, received, or maintained by UConn Health, including these records.
Laws Require That UConn Health:
- Safeguard the privacy and security of PHI;
- Explain how, when, and why UConn Health uses or discloses PHI;
- Notify affected patients or their representatives in the event of a breach of unsecured PHI; and
- Follow the terms of this Notice, including not using or disclosing PHI without written permission other than as described in this Notice.
How UConn Health Uses and Discloses Your PHI
The following categories describe different ways UConn Health uses and discloses your PHI as permitted or required by federal and state law. Though not an exhaustive list of examples, all the ways UConn Health is permitted to use and disclose your PHI fall within one of the categories below.
Treatment: UConn Health may use your PHI to treat you and may share your PHI with other healthcare providers, including those outside of UConn Health, to coordinate and manage your treatment (this includes psychiatric, HIV-related, certain records that may refer to substance abuse, and most other types of PHI, excluding psychotherapy notes, if necessary for your diagnosis and treatment). For example, a doctor treating you may need to know about a chronic condition or former treatment in order to provide the best treatment for your current condition.
Payment: UConn Health may use and disclose your PHI to bill and collect payment from you, an insurance company, a third party, or a state or federal healthcare program, including disclosure of PHI for the purpose of obtaining a prior authorization. UConn Health may disclose PHI to billing and collection agencies to collect payment and to consumer reporting agencies (e.g., credit bureaus).
Healthcare Operations: UConn Health may use and disclose your PHI for UConn Health’s own healthcare operations, including for the purpose of improving the quality, safety, and cost of care, evaluating the skills and performance of people providing care, and providing training programs for students, trainees, and other personnel.
Business Associates: Certain services may be provided on UConn Health’s behalf by another person or entity (a “business associate”) for the purposes of treatment, payment, or healthcare operations, and UConn Health may disclose PHI to these business associates for these purposes. UConn Health makes such disclosures according to written contracts that outline uses and disclosures of PHI and require business associates to appropriately safeguard information.
Fundraising Activities: UConn Health may contact you or disclose limited PHI to The University of Connecticut Foundation, Inc., (the “Foundation”) so the Foundation may contact you, in an effort to raise money for UConn Health, provided you have not opted out of receiving fundraising solicitations and communications. The Foundation has been delegated the primary responsibility for all fundraising for the benefit of the University of Connecticut, including UConn Health. If you wish to opt out of receiving these communications and you wish to direct UConn Health to not use or disclose your PHI for fundraising efforts, contact the University of Connecticut Foundation, Inc., at 1-800-269-9965 or visit www.foundation.uconn.edu.
Hospital Directory: While a patient at John Dempsey Hospital, UConn Health may include your name, location in the hospital, and religious affiliation, if any, in the hospital directory, provided you have not opted out of inclusion in the directory. UConn Health may disclose your location in the hospital to anyone asking for you by name; religious affiliation and other directory information, including your name, may be provided to clergy members. Notify a unit or department manager if you wish to opt out of the hospital directory; if you opt out of the directory, your information will not be disclosed to any callers or visitors asking about you. Please note, patients in the psychiatric units and patients in the custody of the Department of Correction are not included in the hospital directory.
Individuals Involved in Your Care: UConn Health may disclose to a family member, relative, friend, or other person involved in your care or payment for your care, PHI directly relevant to that person’s involvement in your care or payment for your care. UConn Health may use or disclose PHI to notify a family member, personal representative, or other person responsible for your care of your location, general condition, or death unless you object or otherwise instruct UConn Health. If you are incapacitated or otherwise unable to describe your wishes, UConn Health may make such disclosures if UConn Health determines such disclosures to be in your best interest. UConn Health complies with additional state law confidentiality protections for minors receiving treatment for HIV/AIDS, pregnancy, abortion, venereal disease, substance abuse, or mental health. UConn Health discloses PHI to correctional institution or law enforcement officials with custody of an inmate as required for the correctional institution to provide healthcare to the inmate, to protect the health or safety of the public or a person, or for the safety and security of the correctional institution.
Disaster Relief: UConn Health may disclose your PHI to an entity assisting in a disaster relief effort to aid in location of you, your friends, or your family members or to provide information about your general condition or death.
Research: UConn Health may contact you about research in which you may be interested, provided you have not opted out of receiving research recruitment communications, and UConn Health may disclose your PHI for research purposes only in accordance with your written authorization except under certain circumstances as allowed by federal and state law, such as disclosures to UConn Health researchers for the purposes of preparing to conduct a research project (in which case the PHI stays with UConn Health) or disclosures to improve public health and develop new knowledge. For example, a research project may compare the health and recovery of all patients who received one medication to those who received another for the same condition. All research projects receive approval through a specific, specialized process, which evaluates the proposed research and privacy needs before any use or disclosure occurs.
De-identified Information or Limited Data Sets: UConn Health may use and disclose health information about you after removing any information that potentially identifies you (de-identifying the health information). UConn Health may also use and disclose health information about you that constitutes a “Limited Data Set” (as defined by HIPAA), for purposes of research, public health, or healthcare operations, if the recipient of the information signs an agreement to protect the privacy of the information as required by federal and state law. Limited Data Sets do not contain any information that directly identifies you (such as your name, street address, Social Security number, phone number, email address, and other direct identifiers described in the HIPAA definition of a “Limited Data Set”).
As Required by Law: UConn Health discloses PHI as required by federal or state statute, regulation, or court opinion, including mandatory reporting obligations. Such reporting may include information about suspected abuse, abandonment, neglect, exploitation, domestic violence, workers’ compensation program services, and health oversight activities.
Public Safety: UConn Health may use and disclose your PHI when believed in good faith to be necessary to prevent a serious and imminent threat to the health or safety of a person or the public.
Organ and Tissue Donation: UConn Health may use and disclose PHI as necessary for organ, eye, or tissue donation, procurement, processing, distributing, or using a human body or body parts for use in medical education, therapy, or transplantation.
Public Health Activities: UConn Health may disclose your PHI to appropriate government agencies for public health activities for the purpose of preventing or controlling disease, injury, or disability. Such reporting may include births, deaths, suspected communicable disease, suspected overdose events, medication and medical product adverse events, and product recall information.
Lawsuits and Legal Disputes: In the context of any judicial or administrative proceeding, UConn Health may disclose your PHI in accordance with applicable law to comply with a court or administrative order, subpoena, discovery request, or other lawful process provided the court has appropriate jurisdiction over UConn Health. Notwithstanding the above, in the event UConn Health receives and maintains substance use disorder records about you subject to the confidentiality protections of 42 CFR Part 2 (“Part 2 records”), UConn Health may not use or disclose such Part 2 records for purposes of civil, criminal, administrative, or legislative proceedings against you without your written consent or an appropriate court order.
Law Enforcement: UConn Health may disclose a limited amount of PHI to law enforcement for specific purposes related to identifying or locating a suspect, fugitive, material witness, or missing person, related to a crime, or as required by law.
Coroners, Medical Examiners and Funeral Directors: UConn Health may disclose PHI concerning deceased patients to a coroner, medical examiner, or funeral director as necessary to carry out their duties.
Specialized Government Functions: UConn Health may disclose PHI as it relates to military and veterans’ activities, national security and intelligence activities, protective services for the President, and medical suitability determinations for the United States Armed Forces or Department of State.
Electronic Disclosures & Health Information Exchanges: UConn Health makes certain disclosures described within this Notice via electronic transmission, interface, or direct access to our electronic health records system. In addition, UConn Health may participate in certain health information exchanges involving disclosure of PHI as permitted by law to other healthcare providers or entities for permitted purposes. As mandated by the State of Connecticut, UConn Health participates in Connie, the statewide health information exchange. You may opt-out of Connie by contacting Connie directly as described on their website at www.conniect.org.
Other Uses and Disclosures of PHI
UConn Health will obtain your authorization to use or disclose your PHI for any reasons not covered by this Notice or applicable law, including certain uses and disclosures related to marketing and the sharing of psychotherapy notes.
If you provide authorization to UConn Health for a certain use or disclosure of your PHI, you may revoke that authorization, in writing, at any time unless UConn Health has already relied on that authorization for a use or disclosure. If you revoke your authorization, UConn Health will no longer use or disclose your PHI for the reasons covered by the revoked authorization.
Your Rights Regarding PHI
Right to Access PHI: You have the right to access the PHI about you that UConn Health maintains, including the right to inspect or obtain a copy, or both, of the PHI, as well as the right to direct UConn Health to transmit a copy to a designated person or entity of your choice. You may be charged a reasonable, cost-based fee for copies of PHI. UConn Health may deny a request to access PHI in certain limited circumstances, in which case UConn Health will provide the reason for the denial and how to request a review of the denial.
Right to Correct or Update: You have the right to request an amendment or correction of your PHI maintained by UConn Health if you feel the information is incomplete or inaccurate. You also have the right to have this request and any decision related to this request included in your record, if you so choose. UConn Health requires submission of amendment requests in writing. UConn Health reviews all requests and responds in writing within 60 days. If you disagree with UConn Health’s decision, you have the right to appeal the decision.
Right to an Accounting of Disclosures: You have the right to receive an accounting of certain disclosures of your PHI by UConn Health and its business associates. This accounting will not include disclosures for treatment, payment, and healthcare operations, and certain other exceptions. UConn Health requires submission of accounting of disclosure requests in writing and requires that the request state a time period no longer than six years prior to the date of the request. UConn Health will provide one accounting of disclosures to you each year at no charge but may charge for additional accountings. When you request an accounting of disclosures from UConn Health, UConn Health may provide you with the accounting of disclosures or the names and contact information of our business associates so that you may contact them directly for an accounting of disclosures made by them.
Right to Request Restriction of Use and Disclosure of PHI: You have the right to request that UConn Health restrict the use and disclosure of your PHI maintained by UConn Health. UConn Health requires submission of restriction requests in writing. While UConn Health will try to accommodate such requests, granting of such restrictions is not always possible. However, upon request, UConn Health will restrict the information disclosed to your health plan if you have already paid for the service in full prior to the time of service (unless UConn Health is legally required to submit the information to the health plan). UConn Health may terminate any restriction not legally required by notifying you in writing of the termination; likewise, you may terminate any restriction by notifying UConn Health in writing.
Right to Receive Confidential Communications by Alternative Means: You have the right to designate a specific means by which UConn Health must communicate with you about confidential matters. For example, you can require that UConn Health only contact you at a single address or phone number. UConn Health accommodates reasonable requests.
Right to a Copy of This Notice: You may download a copy of the current UConn Health Notice of Privacy Practices from UConn Health’s website at www.uchc.edu or you may obtain a paper copy of the current UConn Health Notice of Privacy Practices at any UConn Health facility.
To submit any written requests related to your rights regarding PHI, please contact the Health Information Management Department:
UConn Health – Health Information Management
263 Farmington Avenue, Mail Code: 2925
Farmington, CT 06030
Telephone: 860-679-3380
Fax: 860-679-1035
Changes to This Notice
UConn Health reserves the right to change this Notice, to change the practices informing this Notice, and to make the revised or changed Notice effective for all PHI maintained as well as any PHI received in the future.
Availability of This Notice
UConn Health conspicuously publishes the current Notice on the UConn Health website at www.uchc.edu, posts copies of the current Notice in all UConn Health locations where people receive care, and makes available copies of the current Notice throughout UConn Health. The effective date of the Notice is indicated at the end of the last page. UConn Health requires acknowledgement that you were offered a copy of this Notice as a condition of treatment. Any revisions of this Notice by patients or their representatives, including but not limited to strikeouts, insertions, and deletions, shall not be permitted, and UConn Health may refuse to provide treatment under such circumstances.
Questions and Complaints
If you have questions about this Notice, please direct them to your healthcare providers or the UConn Health Chief Healthcare Compliance & Privacy Officer in the Office of Healthcare Compliance & Privacy (contact information below). Additionally, if you believe your privacy rights have been violated or you wish to file a complaint about UConn Health’s privacy practices, please contact the UConn Health Chief Healthcare Compliance & Privacy Officer in the Office of Healthcare Compliance & Privacy:
UConn Health – Office of Healthcare Compliance & Privacy
263 Farmington Avenue
Farmington, CT 06030
860-679-6060
OHCP@uchc.edu
UConn Health acknowledges a patient’s right to file a complaint regarding UConn Health’s privacy practices. Patients or their representatives may file a complaint directly with UConn Health and/or with other agencies, including but not limited to the United States Department of Health and Human Services (DHHS) Office for Civil Rights (OCR), Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue, S.Q., Room 509F HHH Building, Washington, D.C., 20201, email: OCRComplaint@hhs.gov, online: https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf and https://www.hhs.gov/hipaa/filing-a-complaint/index.html or, for hospital-related complaints only, The Office of Quality and Patient Safety, The Joint Commission, One Renaissance Blvd, Oak Terrance, IL, 60181, fax: 630-792-5636, online: www.jointcommission.org.
UConn Health shall not retaliate against you or your representatives for filing a complaint or grievance with UConn Health or any other agency. Additionally, your care will not be affected by the filing of a complaint or grievance with UConn Health or any other agency.
Effective Date of Original Notice: April 14, 2003
Revision Date: May 1, 2023