Notice of privacy practices
We are committed to protecting the privacy of your protected health information. This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
How we may use and disclose your health information in the course of providing treatment and services to you.
What rights you have with respect to your health information. These include the right:
- To inspect and obtain a copy of your health information.
- To request that we amend health information in our records.
- To receive an accounting of certain disclosures we have made of your health information.
- To request that we restrict the use and disclosure of your health information to your health plan.
- To request confidential communication about health information.
- To receive a paper copy of this notice.
- How to file a complaint if you believe your privacy rights have been violated.
If you have questions about this document, our privacy policies or any other questions regarding the privacy of your health information, please call 1-800-688-1867.
Si necesita una copia en español por favor pídasela a un empleado del hospital o de le clínica. Gracias.
- Duke University Health System, Inc.
- Duke University Hospital
- Duke Regional Hospital
- Duke Raleigh Hospital
- Duke University Affiliated Physicians, Inc. (dba Duke Primary Care)
- Associated Health Services, Inc. (dba Davis Ambulatory Surgery Center)
- Private Diagnostic Clinic, PLLC
- Duke PRMO, LLC
- Duke University School of Medicine
- Duke University School of Nursing
- Duke University Hospital Medical Staff
- Duke Regional Hospital Medical Staff
- Duke Raleigh Hospital Medical Staff
- Davis Ambulatory Surgical Center Medical Staff
- Duke University Student Health
- Counseling and Psychological Services (CAPS)
- Sexual Assault Support Services (SASS)
- Duke University Police Department
- Live for Life
We are committed to protecting the privacy of protected health information about you and that can identify you, which we call “health information” in this Notice. Protected health information includes information about your past, present or future health, healthcare we provide you, and payment for your healthcare contained in the record of care and services provided by Duke University Health System and the entities and medical staffs listed in this brochure (collectively, the “Duke Health Enterprise” or “DHE”). This Notice will apply only to records of your care at facilities of Duke University, Duke University Health System, Duke University Hospital, Duke Regional Hospital, Duke Raleigh Hospital, Davis Ambulatory Surgical Center; and offices or services of Duke Primary Care, Private Diagnostic Clinic; CAPS, Duke University Student Health, SASS, and Live for Life; and records maintained by the PRMO (collectively, “DUHS Sites”). DUHS Sites may share health information with other DUHS Sites about treatment, payment and health care operations of DHE.
Our privacy practices concerning your health information are as follows:
- We will safeguard the privacy of health information that we have created or received as required by law.
- We will explain how, when and why we use and/or disclose your health information.
- We will comply with the provisions of this Notice and only use and/or disclose your health information as described in this Notice.
- We will provide notice of a DHE breach of unsecured health information.
This notice describes the practices of the Duke Health Enterprise (DHE) at DUHS Sites and that of:
- Any health care professional authorized to enter information into your medical record at DHE.
- All departments and units of DHE.
- All employees, staff, volunteers and other DHE personnel.
The following categories describe different ways that we may use and disclose health information. For each category of uses or disclosures, we will explain what we mean and try to give some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within at least one of the categories.
For Treatment. We may use your health information to provide, coordinate or manage your healthcare treatment and related services. This may include communication with other health-c are providers regarding your treatment and coordinating and managing your healthcare with others. For ex ample, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. The doctor may need to tell the dietitian if you have diabetes so that we can arrange for appropriate meals. Different DHE departments may also access your health information in order to coordinate the different things you need, such as prescriptions, lab work and x-rays. We ma y also disclose your health information to people, such as ho me health providers, who may be involved in your medical care after you leave our care
For Payment. We may use and disclose your health information to other providers so they may bill and collect payment for treatment and services they provided to you. Before you receive scheduled services, we may share information about these services with your health plan(s) to obtain prior approval or to determine whether your insurance will cover the treatment. We may also share your health information with billing and collection departments or agencies, insurance companies and health plans to collect payment for services, departments that review the appropriateness of the care provided and the costs associated with that care and to consumer reporting agencies (e.g., credit bureaus). For example, if you have a broken leg, we may need to give your health plan(s) information about your condition, supplies used (medications or crutches) and services you received (X-rays or surgery). This information is given to our billing agency and your health plan so we can be paid or you can be reimbursed
For Health Care Operations. We may use and disclose your health information for healthcare operations. These uses and disclosures allow us to improve the quality of care we provide and reduce healthcare costs. Examples of uses and disclosures for healthcare operations include the following:
- Reviewing and improving the quality, efficiency and cost of care that we provide to you and other patients.
- Evaluating the skills, qualifications, and performance of healthcare providers taking care of you.
- Providing training programs for students, trainees, healthcare providers or non-healthcare professionals (for example, billing clerks) to help them practice or improve their skills.
- Cooperating with outside organizations that assess the quality of care we provide. These organizations might include government agencies or accrediting bodies like the Joint Commission and the Accreditation Association of Ambulatory Healthcare, Inc.
- Cooperating with outside organizations that evaluate, certify or license healthcare providers, staff or facilities in a particular field or specialty. For example, we may use or disclose health information so that one of our nurses may become certified in a specific field of nursing.
- Sharing information with the Duke University Police Department to maintain safety at our facilities.
- Assisting various people who review our activities. Health information may be seen by doctors reviewing services provided to you, and by accountants, lawyers and others who assist us in complying with applicable laws.
- Conducting business management and general administrative activities related to our organizations and services we provide.
- Resolving grievances within our organizations.
- Complying with this Notice and with applicable laws.
Appointment Reminders. We may use and disclose health information to provide a reminder to you about an appointment you have for treatment or medical care at DHE.
Treatment Alternatives. We may use and disclose your health information to manage and coordinate your healthcare and inform you of treatment alternatives and other health related benefits that may be of interest to you. This may include telling you ab out treatments, services, products and/or other healthcare providers. For example, if you are diagnosed with diabetes, we may tell you about nutritional and other counseling services that may be of interest to you
Business Associates. There are some services provided in our organization through contracts with business associates. For example, we may use a copy service to make copies of your medical record. When we hire companies to perform these services, we may disclose your health information to these companies so that they can perform the job we’ve asked them to do. To protect your health information, however, we require the business associate to appropriately safeguard your health information.
Fund-raising Activities. We may use your health information to contact you or your legal representative in an effort to raise money for DHE and its operations. We would only use contact information, such as your name, address and phone number, department of service, treating physician, outcome information, health insurance status, and the dates you received treatment or services. You have the right to opt out of receiving these communications. If you do not want us to contact you for fundraising efforts, please call 1-800-688-1867 or send your written request to:
Office of the Assistant Vice President
Development and Alumni Affairs
Durham, NC 27710
Hospital Directory. We may include certain limited information about you in the hospital directory while you are a patient at one of our hospitals. This information may include your name, location in the hospital, your general condition (e.g., fair, stable, etc.) and your religious affiliation. The directory in formation, except for your religious affiliation, may be released to people who ask for you by name. Your religious affiliation may be given to a member of the clergy, such as a priest or rabbi, even if they don’t ask for you byname. If you do not want your information listed in the hospital directory, please notify Registration when you arrive or call the facility’s Admitting Office.
Individuals Involved in Your Care or Payment for Your Care. We may share your health information with a family member or other person identified by you or who is involved in your care or payment for your care. We may tell your family or friends you condition. In addition, we may disclose health information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition and location. If you do not want health information about you released to those involved in your care, please call 1-800-688-1867. We will comply with additional state law confidentiality protections if you are a minor and receive treatment for pregnancy, drug and/or alcohol abuse, venereal disease or emotional disturbances.
We may use and/or disclose health information about you for a number of circumstances in which you do not have to consent, give authorization or otherwise have an opportunity to agree or object. Those circumstances include:
As Required by Law. We will disclose your health information when required to do so by federal, state, or local law or other judicialor administrative proceedings. For example,we may disclose your health information in response to an order of a court or administrative tribunal.
To Avert a Serious Threat to Health or Safety. We may use and disclose your health information when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent or reduce the threat.
Public Health Risks. We may disclose your health information to appropriate government authorities for public health activities. These activities generally include the following:
- To prevent or control disease, injury or disability.
- To report births and deaths.
- To report child abuse or neglect.
- To report reactions to medications or problems with products.
- To notify people of recalls of products they may be using.
- To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease.
- To notify the appropriate government authority if we believe an adult patient has been the victim of abuse, neglect or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.
- To support public health surveillance and combat bioterrorism.
Health Oversight Activities. We may disclose your health information to a federal or state health oversight agency that is authorized by law to oversee our operations.
Law Enforcement. We may release health information if asked to do so by a law enforcement official and such release is required or permitted by law. For example, we may disclose your health information to report a gunshot wound. However, if you request treatment and rehabilitation for drug dependence from us, your request will be treated as confidential and we will not disclose your name to any law enforcement officer unless you consent.
Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose your health information in response to a court or administrative order. We may also disclose your health information in response to a subpoena, discovery request or other lawful process by someone else involved in the dispute.
Coroners, Medical Examiners and Funeral Directors. We may release health information to a coroner or medical examiner. This may be necessary to identify a deceased person or determine the cause of death. We may also release health information to funeral directors as necessary for them to carry out their duties.
Organ and Tissue Donation. We may release health information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.
Research. Under certain circumstances, we may use and disclose health information about you for research purposes. All research projects, however, are subject to a special approval process. Before we use or disclose medical information for research, the project will have been approved through this research approval process. We may, however, use health information about you in preparing to conduct a research project, for example, to look for patients with specific needs, so long as the health information reviewed does not leave our entity.
Specialized Government Functions. We may disclose health information about you if it relates to military and veterans’ activities, national security and intelligence activities, protective services for the President, and medical suitability or determinations of the Department of State.
Workers’ Compensation. We may release your health information for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.
Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release your health information to the correctional institution or law enforcement official. This release is required: (1) For the institution to provide you with health care; (2) To protect your health and safety or the health and safety of others; and (3) For the safety and security of the correctional institution.
Other uses and disclosures of health information not covered by this Notice or the laws that apply to us will be made only with your written permission. We will ask your written permission before we use or disclose health information, for example for the following purposes:
- Psychotherapy notes made by your individual mental health provider during a counseling session, except for certain limited purposes related to treatment, payment and health care operations, or other limited exceptions, including government oversight and safety.
- Certain marketing activities, including if we are paid by a third party for marketing statements as described in your executed authorization.
- Sale of your health information except certain purposes permitted under the regulations.
If you provide us permission to use or disclose your health information, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose your health information for the reasons covered by your written authorization. We are unable to take back any disclosures we have already made with your permission. We are required to retain records of the care that we provided to you.
North Carolina Law. In the event that North Carolina Law requires us to give more protection to your health information than stated in this notice or require d by federal law, we will give that additional protection to your health information. We will comply with additional state law confidentiality protections relating to treatment for mental health and drug or alcohol abuse. Unless you object in writing, we may release health information related to your mental health to any health care provider involved in your care, to third party payers for payment or to others for quality improvement activities. Also, state law permits a hospice, home health, ambulatory surgery or outpatient cardiac rehabilitation patient to object in writing to having state licensing inspectors review their health information during a licensure survey, and we will comply with such written objection. If you apply for and receive substance abuse services from us, federal law generally requires that we obtain your written consent before we may disclose information that would identify you as a substance abuser or a patient for substance abuse services. There are exceptions to this general requirement. For instance, we may disclose information to our workforce as needed to coordinate your care, to agencies or individuals who help us carry out our responsibilities in serving you, and to health care providers in an emergency.
You have the following rights regarding the health information we maintain about you:
Right to Inspect and Copy. You have the right to inspect and obtain a copy of your health information. To inspect and copy your health information, please call 1-800-688-1867 for instructions on how to submit your written request. If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request. We will respond to you within 30 days of receiving your written request. There are certain situations in which we are not required to comply with your request. Under these circumstances, we will respond to you in writing, stating why we will not grant your request and describing any rights you may have to request a review of our denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.
Right to Amend. You have the right to request that we make amendments to clinical, billing and other records used to make decisions about you. Your request must be in writing and must explain your reason(s) for the amendment. We may deny your request if:
- The information was not created by us, unless the person or entity that created the information is no longer available to make the amendment.
- The information is not part of the health information used to make decisions about you.
- We believe the information is correct and complete.
- You would not have the right to inspect and copy the record as described above.
We will tell you in writing the reasons for the denial and describe your rights to give us a written statement disagreeing with the denial. If we accept your request to amend the information, we will make reasonable efforts to inform others of the amendment, including persons you name that have received your health information. Please call 1-800-688-1867 to obtain the appropriate form to request amendment to your record.
Right to an Accounting of Disclosures. You have the right to receive a written list of certain disclosures we made of your health information. You may ask for disclosures made, up to six (6) years before your request. We are required to provide a listing of all disclosures except the following:
- For your treatment.
- For billing and collection of payment for your treatment.
- For our healthcare operations.
- Occurring as a byproduct of permitted uses and disclosures.
- Made to or requested by you or that you authorized.
- Made to individuals involved in your care, for directory or notification purposes, or for disaster relief purposes.
- Allowed by law when the use and/or disclosure relate to certain specialized government functions or relates to correctional institutions and in other law enforcement custodial situations.
- As part of a limited set of information which does not contain certain information which would identify you.
The list will include the date of the disclosure, the name (and address, if available) of the person or organization receiving the information, a brief description of the information disclosed, and the purpose of the disclosure. To request this list or accounting of disclosures, you must submit your request on the appropriate DHE form which can be obtained by calling 1-800-688-1867.
Right to Request Restrictions. You have the right to request that we restrict the use and disclosure of your health information. We are not required to agree to your requested restrict ions, except we will honor your request to not disclose to your health plan health information or services for which you paid out of pocket prior to the performance of such services. If we agree to your request, there are certain situations when we may not be able to comply with your request. These situations include emergency treatment, disclosures to the Secretary of the Department of Health and Human Services, and uses and disclosures that do not require your authorization. You may request a restriction by submitting the appropriate DHE form, which can be obtained by calling 1-800-688-1867.
Right to Request Confidential Communication (Alternative Ways). You have the right to request confidential communication, i.e., how and where we contact you, about health information. For example, you may request that we contact you at your work address or phone number. Your request must be in writing. We will accommodate reasonable requests, but when appropriate, may condition that accommodation on your providing us with information regarding how payment, if any, will be handled and your specification of an alternative address or other method of contact. You may request alternative means of communications by submitting the appropriate DHE form, which can be obtained by calling 1-800-688-1867.
Right to a Paper Copy of This Notice. We will provide a paper copy of this notice to you no later than the date you first receive service from us except for emergency services, in which case we will provide the notice to you as soon as practicable. You may also obtain a copy of this notice at any time by clicking here or from any of the DHE treatment facilities listed above.
If you have any questions regarding this Notice, our privacy policies or if you believe your privacy rights have been violated or you wish to file a complaint about our privacy practices, you may contact:
Privacy Officer Duke University Health System
DUMC Box 3162
Durham, NC 27710
You may also send a written complaint to the United States Secretary of the Department of Health and Human Services. You will not be retaliated against for filing a complaint.
We reserve the right to change the terms of this Notice and to make new notice provisions effective for all health information that we maintain by:
- Posting the revised notice at our facilities.
- Making copies of the revised notice available upon request (either at our facilities or through the contact listed in this notice).
To receive a copy of this Notice in an alternate format, please contact the Duke Disability Management System at 919-668-1499
Effective April 14, 2003