Notice of Privacy Practices and Disclosure of Health Information

Effective October 2018
Students : Please read the following information regarding your health information.
Non-students : If you are not a CU student, please see the section below for Non-Students.

STUDENTS:

Notice of Privacy Practices and Disclosure of Health Information for Students

If you are a student at the University of Colorado Boulder, the following Notice of Privacy Practices (Notice) describes how Health and Wellness (HW) will use and disclose your Medical Services and/or Counseling and Psychiatric Services (CAPS) health information. Your health information has confidentiality and privacy protections under the Family Educational Rights and Privacy Act (FERPA) and Colorado law. Your health information will remain confidential and private to the extent provided by law and this notice.

FERPA Protections

FERPA protects the privacy of your information and does not allow disclosure of your education record without your consent outside the university, except in limited circumstances. FERPA defines education records as records that are directly related to a student and
maintained by an educational agency or institution or a party acting for the agency or institution and does not include treatment records unless disclosed for purposes other than treatment. FERPA defines treatment records as records that are maintained by a physician,
psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional capacity or assigned capacity that are made, maintained, or used only in connection with treatment of the student and disclosed only for treatment. Most HW
health information is considered education records and not treatment records as defined under FERPA because we disclose information to meet certain payment, operational, and legal requirements as described in this Notice. HIPAA ensures the privacy of protected health information (PHI). The definition of PHI in the HIPAA Privacy Law excludes education records that are subject to FERPA, therefore the privacy of your HW education records is protected by FERPA instead of HIPAA. In addition, Colorado state law may be applicable to afford confidentiality under the psychotherapy or physician-patient privilege.

State Law Protections

Medical Health Information

State law and professional ethical rules indicates that your medical health information is protected by privilege and is generally confidential. Subject to exceptions provided by law, HW physicians, surgeons, and registered nurses, as well as members of their staff, will not disclose any health information gathered for your treatment without your consent.

Mental Health Information

State law provides that your mental health information, which includes any communications you have with a HW mental health professional or their colleagues during the course of treatment, is confidential and protected by privilege. Additionally, individual mental health providers are required to keep communications that occur in the course of their professional employment confidential. Subject to specific exceptions provided by law, and as provided for in this notice, mental health information will generally remain confidential and
will not be revealed without your consent.

How We Can Use or Share Your Health Information

When you sign the General Agreement for Health Care Services you are providing consent for us to use or disclose your health information in the following limited ways:

For Treatment - We may use health information about you to help us treat you and we may share information with other health care providers, within and outside of Medical Services and CAPS, who are treating you. We may also use health information about you to
provide information to other providers for referrals. For example , a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. 

For Payment - We may use and disclose health information about you so we can bill and be paid for the services we or another provider provide to you. For example , we may need to give your insurance company information about a clinic visit you had so your
insurance company will reimburse you for amounts you have paid.

For Health Care Operations - We may use and disclose health information about you so we can run our business, contact you, improve your care, and maintain our accreditation. For example , we may use health information to review your treatment and our services, to evaluate the performance of our staff caring for you, conduct compliance and medical reviews, maintain our compliance programs, and/or receive legal services to defend against possible malpractice suit and complaints.

Public Health Activities - We may disclose health information about you to officials in certain situations, such as:

  • reporting to public health authorities to help prevent or control disease, such as the Colorado Department of Public Health and Environment;
  • reporting abuse, neglect, or domestic violence to the proper law enforcement agency; and
  • reporting adverse events, adverse reactions, enabling product recalls, or reporting defects to the Food and Drug Administration.

To Avert a Serious Threat to Health or Safety - We may disclose health information about you to the University of Colorado Police Department, Dean of Student’s Office, and/or the Students of Concern Team, if we believe it may prevent or lessen a serious or
imminent threat to the health or safety of you or others.

Health Oversight Activities, Law Enforcement, and Government Requests - We may disclose health information about you:

  • to a health oversight agency for reasons, such as audits of the care we give, investigations, inspections, licensure or disciplinary actions;
  • in response to a court order, administrative order, or lawfully issued subpoena;
  • to law enforcement officials to assist locating a suspect, finding a missing person, or apprehending an individual; and
  • for certain government functions, such as for national security, intelligence, or for the military.

Required by Law - We may use or disclose health information about you when we are required to do so by federal, state, or local law. For example, the Colorado Medical Practice Act requires us to report certain noninfectious injuries or conditions to law enforcement or
state officials, such as gunshot wounds, abuse, death, etc. In addition, certain health professionals have to a duty to warn others if you make a serious threat of imminent physical violence against a specific person or persons, including those identifiable by their
association with a specific location or entity.

Agents of HW - We may disclose health information about you to agents of HW or to business associates working on our behalf. For example, software companies who assist us with our information systems may have access to information to help us perform our health
care operations. They are required to maintain the privacy and security of your information.

Disaster Relief - We may use or disclose health information about you to a disaster relief organization, such as the Red Cross so that your family members, other relatives, close personal friends, or others can be notified of your location or general condition.

Coroners and Medical Examiners or Funeral Directors - We may disclose health information to a coroner, medical examiner, or funeral director. This may be necessary, for example, to identify a deceased person or to determine the cause of death.

Organ, Eye or Tissue Donation - If you are an organ donor, we may disclose health information to organizations that handle organ procurement or organ, eye, or tissue transplantation or to an organ donation bank.

Workers Compensation - We may disclose health information about you to the extent necessary to comply with workers’ compensation and similar laws that provide benefits for work-related injuries or illness without regard to fault.

The above is neither intended to nor may be construed as a waiver of or limitation to any legal authority for University of Colorado to otherwise use or disclose student information, including health information.

Your Choices Regarding Health Information about You

For certain health information, you can tell us your choices about what we share.

Individuals Involved in Your Care or Payment for Your Care - We may disclose health information about you to a friend, relative, family member, or any other person involved in your care if you choose. We also may use or disclose health information about you to
notify, or assist in notifying, those persons of your location, general condition, or death.

Written Authorization Required - We will not disclose your health information without your written permission for marketing purposes or for the sale of your health information.

Fundraising - We may contact you regarding fundraising efforts but it is your right to inform us to not contact you again.

CORHIO - We participate in the Colorado Regional Health Information Organization (CORHIO), which is an electronic health information exchange (HIE) among participating health care providers in Colorado. Our participation with CORHIO allows our providers
to access health information electronically through the HIE for the purposes described in this Notice. At this time, our participation does not include entering health information into the HIE so none of your personal health information obtained at Medical Services or CAPS
will be placed on the HIE network. You may choose to opt out of participation with the HIE. If you choose to opt out, your provider will not be able to view your patient information through the HIE. Please notify any health care provider if you would like to exercise your
choice to opt out. Any patient that has opted out previously may choose to opt in at any time.

Other Uses and Disclosures - If you provide us with authorization to use or disclose your health information for another purpose, you may revoke that authorization, in writing, at any time. You understand that we are unable to take back any disclosures we have already
made with your permission, and that we are required to retain our records of the care we provided to you.

Your Rights With Respect to Health Information About You

You have the following rights with respect to health information that we maintain about you.

Right to Request Restrictions - You have the right to request a restriction or limitation on the health information we use or disclose about you. We are not required to agree to your request and we may deny the request if it would affect your care or impede the
university’s existing legal authority to use and disclose information. Even if we agree to a restriction, we may terminate the restriction at a later date. To request restrictions, please contact the compliance coordinator. Your request must be in writing.

Right to Receive Confidential Communications - We may contact you by telephone, mail or secure messaging. We may leave messages for you on your voicemail. We will try not to leave messages with specific information about you. You have the right to
request that we communicate health information about you to you in a certain way or at a certain location. For example, you can ask that we only contact you by mail or at work. Contact your care provider or the compliance coordinator if you would like to request
confidential communication and we will say yes to all reasonable requests.

Right to Inspect and Copy - You have the right to inspect and/or request a copy of health information that may be used to make decisions about your care. To inspect and/or request a copy of your health information, you must submit an Authorization for Release of
Information form on the HW portal or in writing to the release of information coordinator. Your request should state specifically what health information you want to inspect or obtain. We will provide you with a summary or a copy of your health information, usually within
30 days of your request. We may charge a reasonable cost-based fee for providing the copy of health information.

Right to Request Amendments - You have the right to ask us to amend health information about you that you feel is incorrect or incomplete. This right does not pertain to information that was not created by us; information that is not part of the health information
kept by us; information which you would not be permitted to inspect or obtain; and information that is accurate and complete as originally documented. To request an amendment, you must submit your request in writing to compliance coordinator. A form is
available for making this request. Your request must state the amendment desired and provide a reason in support of that amendment. If we grant the request, in whole or in part, we will seek your identification of and agreement to share the amendment with other
relevant persons. We also will make the appropriate amendment to the health information by appending or otherwise providing a link to the amendment.

Right to an Accounting of Disclosures - You have the right to request a list (accounting) of the times we have disclosed your health information, who we shared it with, and why. The accounting may be for up to six (6) years prior to the date on which you request the
accounting. The accounting will not include disclosures made for the purposes of treatment, payment, and health care operations; disclosures of your health information made to you; or disclosures that you authorized in writing. To request an accounting of
disclosures, you must submit your request in writing to the HW release of information coordinator. A form is available for making this request. Your request must state a time period for the disclosures. It may not be longer than six (6) years from the date we receive your
request.

Right to a Copy of this Notice - You have the right to obtain a paper copy of this Notice. The Notice is displayed prominently and copies are freely available in each clinical department and on the HW website.

Our Right to Change Notice of Privacy Practices

We reserve the right to change this Notice. We reserve the right to make the revised or changed Notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice at our facilities.
The Notice will contain the effective date on the first page. In addition, each time you register at or are admitted to or treated at one of our facilities you may request an updated copy of the current Notice in effect.

Complaints

As a student, if you believe your privacy rights under FERPA have been violated you may obtain a complaint form by calling U.S. Department of Education at (202) 260-3887.

You are encouraged to contact the compliance coordinator with any privacy complaints. You may submit a written complaint, which should include the date of occurrence, description of the activity or event, and the identity of the person filing the complaint. We have a
complaint form that you may use. Anonymous complaints may be submitted, however anonymous complaints can only be investigated to the extent information is provided. To help us investigate your complaint, please include how to contact you. You will not be retaliated
against or penalized for filing a complaint. Complaints should be filed in writing within 180 days of the occurrence and addressed to the compliance coordinator (see contact information below).

Questions and Information

If you have any questions or want more information concerning this Notice please contact the compliance coordinator at:

Health and Wellness
Attn: Compliance Coordinator
119 UCB, Boulder, CO 80309-0119
Phone: 303-492-6712, E-mail: whccompliance@colorado.edu

Email is not a secure form of communication. There is some risk that any confidential information contained in your email may be disclosed or intercepted. Please contact the compliance coordinator if you have sensitive information that you do not feel comfortable
sending via email.


NON-STUDENTS:

Notice of Privacy Practices for Non-Students

If you are not a student at the University of Colorado, the following Notice of Privacy Practices (Notice) describes how Health and Wellness (HW) will use and disclose your Medical Services and/or Counseling and Psychiatric Services (CAPS) health information
about you and how you can access this information.

Health and Wellness (HW) is required by law to protect your personal health information. In addition, HW is required to maintain the privacy of your health information by the terms of its most current Notice, and to provide you with notice of its legal duties and privacy
practices with respect to your health information. This Notice tells you how we may use and disclose protected health information (PHI) about you. PHI means any health information about you that identifies you or that could be used to identify you. In this Notice, we call
all of that PHI, “health information.” This Notice also tells you about your rights and our duties with respect to health information about you. In addition, it will tell you how to complain to us if you believe we have violated your privacy rights.

How We Typically Use or Share Your Health Information

The following categories describe different ways that we may use and disclose your Medical Services and/or CAPS health information.

For Treatment - We may use health information about you to help us treat you and we may share information with other health care providers who are treating you. For example , a doctor treating you for a broken leg may need to know if you have diabetes because
diabetes may slow the healing process.

For Payment - We may use and disclose your health information to bill and be paid for the services we provide to you. For example, we may need to give your insurance company information about a clinic visit you had so your insurance company will reimburse you for
amounts you have paid.

For Health Care Operations - We may use and disclose your health information to run our business, contact you, improve your care, and maintain our accreditation. For example , we may use health information to review your treatment and our services and to evaluate
the performance of our staff caring for you.

Other Ways We Can Use or Share Your Health Information

We are allowed or required to disclose your information in other ways – usually ways that contribute to the public good, such as for public health. We must meet the conditions of the law before we can disclose your information for these purposes.

Public Health and Safety Activities - We may disclose health information about you to officials in certain situations, such as:

  • reporting to public health authorities to help prevent or control disease;
  • reporting abuse, neglect, or domestic violence;
  • to avert a serious threat to health or safety; and
  • reporting adverse events, adverse reactions, enabling product recalls, or reporting defects to the Food and Drug Administration.

Health Oversight Activities, Law Enforcement, and Government Requests - We may disclose health information about you:

  • to a health oversight agency for reasons, such as audits of the care we give, investigations, inspections, licensure, or disciplinary actions;
  • in response to a court order, administrative order, or lawfully issued subpoena;
  • to law enforcement officials to assist locating a suspect, finding a missing person, or apprehending an individual; and
  • for certain government functions, such as for national security, intelligence, or for the military.

Required by Law - We may use or disclose health information about you when we are required to do so by federal, state, or local law.

Disaster Relief - We may use or disclose health information about you to a disaster relief organization, such as the Red Cross so that your family members, other relatives, close personal friends, or others can be notified of your location or general condition.
Coroners and Medical Examiners or Funeral Directors - We may disclose health information to a coroner, medical examiner, or funeral director. This may be necessary, for example, to identify a deceased person or to determine the cause of death.

Organ, Eye or Tissue Donation - If you are an organ donor, we may disclose health information to organizations that handle organ procurement or organ, eye, or tissue transplantation or to an organ donation bank.

Research - We may disclose your information for certain health research purposes.

Workers Compensation - We may disclose health information about you to the extent necessary to comply with workers’ compensation and similar laws that provide benefits for work-related injuries or illness without regard to fault.

Your Choices Regarding Health Information about You

For certain health information, you can tell us your choices about what we share.

Individuals Involved in Your Care or Payment for Your Care - We may disclose health information about you to a friend, relative, or family member or any other person involved in your care if you choose. We also may use or disclose health information about you to
notify, or assist in notifying, those persons of your location, general condition, or death.

Written Authorization Required - We will not disclose your health information without your written permission for marketing purposes, for the sale of your health information, or in most situations that involve the sharing of psychotherapy notes .
Fundraising - We may contact you regarding fundraising efforts but it is your right to inform us to not contact you again.

CORHIO - We participate in the Colorado Regional Health Information Organization (CORHIO), which is an electronic health information exchange (HIE) among participating health care providers in Colorado. Our participation with CORHIO allows providers to
access health information electronically through the HIE for the purposes described in this Notice. At this time, our participation does not include entering health information into the HIE so none of your personal health information obtained at Medical Services or CAPS
will be placed on the HIE network. You may choose to opt out of participation with the HIE. If you choose to opt out, your provider will not be able to view your patient information through the HIE. Please notify any health care provider if you would like to exercise your
choice to opt out. Any patient that has opted out previously may choose to opt in at any time.

Other Uses and Disclosures - Except as described in this Notice, we will not use or disclose your health information without your written authorization. If you provide us with authorization to use or disclose your health information for another purpose, you may
revoke that authorization, in writing, at any time. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care we provided to you.

Your Rights With Respect to Health Information About You

You have the following rights with respect to health information that we maintain about you.

Right to Request Restrictions - You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment or health care operation purposes. We are not required to agree to your request and we may deny
the request if it would affect your care. You also have the right to request that we restrict the uses or disclosures we make to: (a) a family member, other relative, a close personal friend or any other person identified by you; or, (b) to public or private entities for
disaster relief efforts. You also have the right to request a limit on the health information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. Even if we agree to a restriction, we may terminate
the restriction at a later date. To request restrictions, please contact the compliance coordinator. Your request must be in writing.

If you pay for a service or healthcare item out-of-pocket in full, you can request us to not disclose information for the purpose of payment or healthcare operations with your health insurer. We will agree unless the law requires us to disclose the information.

Right to Receive Confidential Communications - We may contact you by telephone or mail. We may leave messages for you on your voicemail. We will try not to leave messages with specific information about you. You have the right to request that we
communicate health information about you to you in a certain way or at a certain location. For example, you can ask that we only contact you by mail or at work. Contact your care provider or the compliance coordinator if you would like to request confidential
communication and we will say yes to all reasonable requests.

Right to Inspect and Copy - You have the right to inspect and/or request a copy of health information that may be used to make decisions about your care. You have the right to request that this copy be provided to you in an electronic format. This right does not
pertain to psychotherapy notes; information compiled in anticipation of, or use in a civil, criminal or administrative action or proceeding; information restricted by the Clinical Laboratory Improvement Amendments of 1988 (CLIA); or information that is not part of the record
set we use to make decisions about your care and treatment. To inspect and/or request a copy of your health information, you must submit an Authorization for Release of Information form to the release of information coordinator. Your request should state specifically
what health information you want to inspect or obtain. We will provide you with a summary or a copy of your health information, usually within 30 days of your request. We may charge a reasonable cost-based fee for providing the copy of health information.

Right to Request Amendments - You have the right to ask us to amend health information about you that you think is incorrect or incomplete. This right does not pertain to information that was not created by us; information that is not part of the health information
kept by us; information which you would not be permitted to inspect or obtain; and information that is accurate and complete as originally documented. To request an amendment of your health information, you must submit your request in writing to the compliance
coordinator. A form is available for making this request. Your request must state the amendment desired and provide a reason in support of that amendment. If we grant the request, in whole or in part, we will seek your identification of, and agreement to share the
amendment with other relevant persons. We also will make the appropriate amendment to the health information by appending or otherwise providing a link to the amendment.

Right to an Accounting of Disclosures - You have the right to receive a list (accounting) of the times we disclosed your information, who we shared it with, and why. The accounting may be for up to six (6) years prior to the date of your request. The accounting will not
include disclosures made for the purposes of treatment, payment, and health care operations; disclosures of your health information made to you; disclosures made for national security or intelligence purposes; disclosures made to correctional institutions or law
enforcement officials; or disclosures that you authorized in writing. To request an accounting of disclosures, you must submit your request in writing to the release of information coordinator. A form is available for making this request.

Right to a Copy of this Notice - You have the right to obtain a paper copy of this Notice. The Notice is displayed prominently and copies are freely available in each clinical department and on the HW website.

Our Right to Change Notice of Privacy Practices

We reserve the right to change this Notice. We reserve the right to make the revised or changed Notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice at our facility.
The Notice will contain the effective date on the first page. In addition, each time you register at or are admitted to or treated at one of our facilities you may request an updated copy of the current Notice in effect.

Complaints

If you believe your privacy rights have been violated you have the right under HIPAA to complain to the U.S. Secretary of the Department of Health and Human Services. To complain to the Secretary contact: Region VIII, Office for Civil Rights, U.S. Department
of Health and Human Services, 1961 Stout Street – Room 1185 FOB, Denver, CO 80294-3538. Fax: (303) 844-2025.

You are encouraged to contact the compliance coordinator with any privacy complaints. You may submit a written complaint, which should include the date of occurrence, description of the activity or event and the identity of the person filing the complaint. We have a
complaint form that you may use. Anonymous complaints may be submitted, however anonymous complaints can only be investigated to the extent information is provided. To help us investigate your complaint, please include how to contact you. You will not be retaliated
against or penalized for filing a complaint. Complaints should be filed in writing within 180 days of the occurrence and addressed to the compliance coordinator (see contact information below).

Questions and Information

If you have any questions or want more information concerning this Notice of Privacy Practices please contact the compliance coordinator at:

Health and Wellness
Attn: Compliance Coordinator
119 UCB, Boulder, CO 80309-0119
Phone: 303-492-6712, E-mail: whccompliance@colorado.edu

Email is not a secure form of communication. There is some risk that any confidential information contained in your email may be disclosed or intercepted. Please contact the compliance coordinator if you have sensitive information that you do not feel comfortable sending via email.