Notice of Privacy Practices

Statement of Policy

Washington University and its member organizations (collectively, “Washington University” or “WU”) are committed to ensuring that Individuals are aware of their rights and responsibilities concerning their Protected Health Information (“PHI”). The commitment includes compliance with all applicable laws, regulations and WU policies to protect the privacy of PHI. To help strengthen that commitment, WU has adopted this Policy on Notice of Privacy Practices (Notice) in order to clearly define the rights of Individuals and the obligations of WU related to protecting the privacy of Individuals.

Scope of Policy

The Notice applies to all Individuals receiving Health Care services other than inmates. Each Individual has a right to receive the Notice, which contains information concerning the Uses and Disclosures of PHI. WU will provide a Joint Notice of Privacy Practices, along with BJH and SLCH as an Organized Health Care Arrangement (OHCA), when services are provided at BJH and SLCH. A Notice specific to WU is also available for distribution in other settings.

The Notice is available in a summary format and a long format.

Policy

1. When Should a Notice be Provided.

a) Direct Treatment Relationships: For Direct Treatment Relationships with Individuals, Notices will be provided to Individuals receiving services (i) no later than the date of the first service delivery, (including services delivered electronically), (ii) by posting the Notice in a clear and prominent location at the physical service delivery site of WU where it is reasonably expected to enable Individuals seeking services to read the Notice, and (iii) by making such Notice available to Individuals at the service delivery site to take with them upon request.

i) For Telephone Registration or Central Scheduling of Individuals or Telephone Triage of Patients: Prior to receiving any PHI from Individuals, WU will first ask the Individual if he or she has received the Notice or been informed of WU’s privacy practices.
• If yes, proceed to assist the Individual.
• If no, inform the Individual that he or she has a right to receive the Notice and advise the Individual of the availability of the Notice on the WU Web site and offer to provide the Individual with a copy of the Notice either by mail or e-mail. If the Individual would like to proceed with registration regardless of his or her receipt of the Notice, continue with the registration or triage process.
ii) Second Contact with Individuals: Individuals who have already received a Notice will not need to be provided a Notice again unless he or she requests a copy of such Notice.

b) Group Health Plans:

i) For WU Group Health Plans, Notices will be provided (1) no later than the compliance date for the Health Plan to Individuals covered by the Health Plan; (2) after the compliance date, at the time of enrollment to Individuals who are new enrollees; and (3) within 60 days of a material revision to the Notice to Individuals then covered by the plan.

ii) At least every three years, WU Group Health Plans will notify Individuals then covered by the Plan of the availability of the Notice and how to obtain the Notice.

iii) WU Group Health Plans will, at a minimum, provide Notice to the named insured of a policy under which coverage is provided to the named insured and one or more dependents.

2. Which Notice Should be Provided

a) For services provided at BJH or SLCH by WU physicians and other WU providers, the Joint Notice of Privacy Practices should be provided.

b) For service provided by WU physicians and other WU providers that do not involve BJH or SLCH, the WU Notice of Privacy Practice should be provided.

3. How Must the Notice be Provided to an Individual

WU will consider the needs of Individuals in providing the Notice and will comply with applicable laws concerning non-English speaking Individuals or Individuals who may not be able to read a written Notice.

a) Electronic Services: If the only service delivered to an Individual is electronic, WU will first deliver the Notice in response to an Individual’s first request for services. An Individual who receives an electronic notice retains the right to obtain a paper copy of the Notice from WU.

b) Web Notice. WU will post a Notice on its Web site and make the Notice available electronically through its Web site. Individuals may still receive a paper copy of the Notice even if he or she has received an electronic Notice.

c) E-Mail Notices. To provide Notices by electronic mail (“E-mail”), an Individual must first agree to accept the Notice electronically. If WU knows that the E-mail transmission failed, a paper copy of the Notice will be provided to the Individual. E-mail notices will comply with the timing of Notices as set forth in paragraph (1), (a), (i) and (ii) above.

4. Content of Notice

WU will provide a Notice written in plain, understandable language and containing the following:

a) Header. A Header at the top of the Notice that states, in bold type:
“THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.”

b) Uses and Disclosures. Several descriptions of the required and permitted Uses and Disclosures of the PHI including:

i) a description, of sufficient detail, together with at least one example, of the types of Uses and Disclosures permitted for Treatment, Payment, and Health Care Operations;
ii) a description, of sufficient detail, of all the types of Uses and Disclosures, together with each of the purposes, that the WU member organization is permitted or required to make without the Individual’s written consent or Authorization;
iii) a description of any more stringent law than the Privacy Regulations governing any particular Use or Disclosure of PHI;
iv) a statement that any other Uses or Disclosures will be made only with the Individual’s written Authorization, and that the Individual may revoke such Authorization in writing (except to the extent the WU member organization has taken action in reliance on the Authorization or if the Authorization was obtained as a condition of obtaining insurance). (See WU HIPAA Policy on Authorization Required to Use or Disclose Protected Health Information.); and
v) a statement that the WU Group Health Plan is permitted to Disclose PHI to the plan sponsor without Authorization.

c) Contacting Individuals. If WU provides reminders or other Information to Individuals, including fund raising events, a statement that Individuals may be contacted for appointment reminders, for information on other health services, or for raising funds for WU.

d) Individual Rights. A list of an Individual’s rights with respect to PHI (See related policies on requests for amendment of PHI, accounting for Disclosures of PHI, access to one’s own PHI and requests to restrict communication of PHI) and a brief description of how an Individual may exercise such rights including:

i) the right to request restriction(s) on certain Uses and Disclosures, including a statement that the WU member organization is not required to agree to a requested restriction, unless the request is to restrict disclosure of health information to a health plan if the disclosure is not required by law and the health information to be restricted pertains solely to a health care item or service for which the patient has paid us for in full;
ii) the right to receive confidential communications of PHI;
iii) the right to inspect and to receive a copy PHI;
iv) the right to amend PHI;
v) the right to receive an accounting of Disclosures of PHI; and
vi) the right to receive notification following a breach of unsecured PHI.

e) Washington University Duties.

i) a statement that WU is required by law to protect and maintain the privacy of PHI, to provide Individuals with Notice of its legal duties, and to abide by the terms of such Notice and
ii) a statement that WU reserves the right to change the terms of its Notice and apply the revised privacy practices to PHI previously created or received, and a statement of how it will provide Individuals with a new revised Notice.

f) Complaint.

i) a statement that an Individual may file a complaint with WU and/or the Department of Health and Human Services (“HHS”) for suspected violation of his or her privacy rights including a description of the process to file a complaint and
ii) a statement of assurance that an Individual will not be retaliated against for filing a complaint.

g) Washington University Contact Person. The name, title and telephone number(s) of the person(s) to contact at WU or its member organizations and/or its OHCA members, BJH and SLCH for further information.

h) Effective Date. The effective date of the Notice.

5. Notice Review and Revisions Procedure

WU will establish a process to review and revise the Notice if material changes are identified to the Uses or Disclosures of PHI, the Individual rights, WU’s legal duties, or other privacy practices concerning PHI.

6. Joint Notices

Because WU, BJH and SLCH have designated themselves as an OHCA, the Joint Notice will state that WU, when providing services at BJH or SLCH will abide by the terms of the Joint Notice concerning PHI. The Joint Notice will contain the required elements (above), will list the applicable WU member organizations and service delivery sites to which the Joint Notice applies, and will state that the participating member organizations will share PHI with each other, as necessary, to carry out Treatment, Payment, or Health Care Operations relating to the organized healthcare delivery arrangement.

7. Documentation

WU will retain a file copy of the Notices issued for at least a six-year period from and after April 14, 2003 to demonstrate compliance with the Notice requirement.
Creation Date: November 22, 2002
Effective Date: April 14, 2003
Last Revision Date: January 9, 2003; August 2013