HIPAA
Patients can visit the U.S. Department of Health and Human Services for more information.
Notice of Privacy Practices
Notice of Privacy Practices This Notice Describes How Medical Information About You May Be Used and Disclosed and How You Can Get Access to This Information. Please Review It Carefully.
During your treatment at Des Moines University Clinic (the “Clinic”), providers, nurses, therapists, technicians, staff members and students may gather information about your medical history and your current health. Your health information includes your individually identifiable medical, insurance, demographic, and medical payment information. For example, it includes information created or received by the Clinic about your diagnosis, treatment, medications, insurance status, medical claims history, address, and insurance policy or social security numbers. This Notice of Privacy Practices (this “Notice”) explains how that information may be used and shared with others. It also explains your privacy rights regarding this kind of information. This notice does not establish a contract with you. Des Moines University Clinic operates in multiple locations. All patient care records and PHI are stored within a single Electronic Medical Record system, regardless of location or type of care provided.
How We May Use and Disclose Your Health Information
The following are the types of uses and disclosures we may make of your health information without your permission. These are general descriptions only. They do not cover every example of disclosure within a category.
TREATMENT. We will use your information to provide, coordinate, and manage your care and treatment. We will share health information about you with providers, nurses, therapists, technicians, students, or other clinical personnel who are involved in taking care of you at the Clinic. Our personnel enter and can view your health information in our electronic medical record system. We may also disclose medical information about you to medical providers outside of the Clinic who are involved in your medical care. For example, a Clinic provider may share your medical information with another provider for a consultation or a referral or with a pharmacy that will fill your prescription.
PAYMENT. We will use and disclose your health information for payment purposes. For example, we will use your health information to prepare your bill and submit a claim for payment. We may need to give your health plan information about the treatment you received so your health plan will pay us or will reimburse you for the treatment. We may also tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment.
HEALTH CARE OPERATIONS. We may use or disclose your health information for our health care operations. Health care operations are the uses and disclosures of information that are necessary to run the Clinic and to make sure that our patients receive quality care. For example, we may use medical information to review our treatment and services, and to evaluate the performance of our staff in caring for you. We may also disclose information to providers, nurses, therapists, medical students, and other Clinic personnel for review and learning purposes. If state law requires, we will obtain your permission prior to disclosing your health information to other providers or health insurance companies for their health care operations.
CONTACTING YOU. We may contact you for a variety of reasons, such as to remind you of an appointment for treatment or to provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you. If you provide us with your mobile telephone number, we may contact you by call or text message at that number for treatment-related purposes such as appointment reminders, wellness checks, registration instructions, etc. We will identify Des Moines University as the sender of the communication and provide you with a way to “opt out” and not receive further communication in this manner. With your consent, we may contact you on your mobile phone for certain other purposes.
TREATMENT ALTERNATIVES. We may contact you to provide information about treatment alternatives or other health-related benefits and services that may be of interest to you.
PEOPLE ASSISTING IN YOUR CARE. We may disclose medical information about you to a friend or family member who is involved in your care or payment for care, if these people need to know this information to help you, and then only as it is directly relevant to their involvement in your care. We will release this information only if you agree, are given the opportunity to object and do not, or if in our professional judgment, it would be in your best interest to allow the person to receive the information or act on your behalf. For example, we may allow a family member to pick up your prescriptions, or medical supplies. If you are unable to make health care decisions, we may disclose limited information to these persons if we feel it is in your best interest to do so, including in an emergency situation.
REQUIRED BY LAW. We will use and disclose medical information about you when we are required to do so by federal, state, or local law, including disclosures to the Secretary of the Department of Health and Human Services to evaluate our compliance with privacy laws. Types of disclosures made to authorities include reporting child or dependent adult abuse or certain wounds of violence.
PUBLIC HEALTH ACTIVITIES. We may disclose medical information about you to public health authorities for public health activities. These activities generally include the following:
• Preventing or controlling disease, injury or disability;
• Reporting child abuse or neglect, or abuse of a vulnerable adult;
• Reporting reactions to medications or problems with products;
• Notifying people of recalls of products they may be using;
• Notifying a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
• Reporting to the FDA, as permitted, or required by law, for purposes of monitoring or reporting the quality, safety, or effectiveness of FDA-regulated products; or
• Proving proof of required immunization(s) to a school.
ABUSE, NEGLECT OR DOMESTIC VIOLENCE. To the extent required or permitted by law, we may notify the appropriate government authority if we believe an individual has been the victim of abuse, neglect, or domestic violence. Unless such disclosure is required by law (for example, to report a particular type of injury), we will only make this disclosure if you agree or in other limited circumstances when such disclosure is authorized by law.
LAW ENFORCEMENT. We may release certain health information to law enforcement authorities for law enforcement purposes, such as:
• As required by law, including reporting certain wounds and physical injuries;
• In response to a court order, subpoena, warrant, summons or similar process;
• To identify or locate a suspect, fugitive, material witness or missing person;
• If you are the victim of a crime, if, under limited circumstances we are unable to obtain your agreement;
• To alert authorities of a death we believe may be the result of criminal conduct;
• To report to authorities information we believe is evidence of criminal conduct occurring on our premises;
• As permitted by law and necessary for your care, if you are under the custody of a law enforcement official; or
• In emergency circumstances to report a crime; the location of the crime or victims or the identity, description or location of the person who committed the crime.
DECEASED INDIVIDUALS. Following your death, we may disclose health information to a coroner or to a medical examiner as necessary for them to carry out their duties and to funeral directors as authorized by law. In addition, following your death, we may disclose health information to a personal representative (for example, the executor of your estate), and unless you have expressed a contrary preference, we may also release your health information to a family member or other person who acted as a personal representative or was involved in your care or payment for care before your death, if the health information is relevant to such person’s involvement in your care or payment for care. We are required to apply safeguards to protect your health information for 50 years following your death.
ORGAN, EYE OR TISSUE DONATION. We may release limited health information to organ, eye or tissue procurement, transplantation or banking organizations or entities as necessary to facilitate organ, eye or tissue donation and transplantation.
RESEARCH. Under certain circumstances, we may use or disclose your health information for research, subject to certain safeguards. For example, we may disclose information to researchers when their research has been approved by a special committee that has reviewed the research proposal and established protocols to ensure the privacy of your health information. We may disclose health information about you to people preparing to conduct a research project.
THREATS TO HEALTH OR SAFETY. We may use and disclose medical information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any such disclosure will be made only to someone able to help lessen or prevent the threat (including the target) or as necessary for law enforcement authorities to identify or apprehend an individual involved in a crime.
With regard to HIV/AIDS related information, we may release to the Department of Public Health any relevant information provided by an HIV-positive person regarding any person with whom the HIV-positive person has had sexual relations or has shared drug injecting equipment. We may also reveal the identity of a person who has tested positive for HIV to the extent necessary to protect a third party from the direct threat of transmission. In the event the person who tests positive for HIV is a convicted or alleged sexual assault offender, we are required under Iowa law to disclose the test results to the convicted or alleged offender and to the victim counselor or other person designated by the victim, who shall disclose the results to the victim.
We may notify a care provider who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition (notification will not include the name of the individual tested for the contagious or infectious disease unless the individual consents).
We may report to the Iowa Department of Transportation information about patients with physical or mental impairments that would interfere with their ability to safely operate a motor vehicle.
SPECIALIZED GOVERNMENT FUNCTIONS. We may use and disclose your health information for national security and intelligence activities authorized by law or for protective services of the President. If you are a military member, we may disclose to military authorities under certain circumstances. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose to the institution, its agents, or the law enforcement official your health information necessary for your health and the health and safety of other individuals.
HEALTH OVERSIGHT ACTIVITIES. We may disclose health information to a health oversight agency for activities that are authorized by law. These oversight activities include, for example, audits, investigations, inspections and licensure. These activities are necessary for the government to monitor the health care system, government programs and compliance with civil rights laws.
LEGAL PROCEEDINGS. If you are involved in a lawsuit or a dispute, we may disclose health information about you in response to a court or administrative order. We may also disclose health information about you in response to a subpoena, discovery request or other lawful process. We may disclose information in the context of civil litigation where you have put your condition at issue in the litigation.
WORKERS’ COMPENSATION. We may release health information about you as authorized by law for workers’ compensation or similar programs that provide benefits for work-related injuries or illness.
FUNDRAISING. We may contact you by writing, phone or other means as part of a fundraising effort for the purpose of raising money for Des Moines University. The money raised will be used to expand and improve services and programs we provide to the community. You have the right to opt out of receiving such fundraising communications. Each fundraising solicitation will include an opportunity to opt out of future fundraising communications. You are free to opt out of fundraising solicitation, and your decision will have no impact on your treatment or payment for services by the Clinic.
INCIDENTAL USES AND DISCLOSURES. There are certain incidental uses or disclosures of your information that occur while we are providing service to you or conducting our business. For example, when calling you in the waiting room, others waiting in the same area may hear your name called or may overhear a Clinic provider relaying a treatment order to a staff member. We will make reasonable efforts to limit these incidental uses and disclosures.
HEALTH INFORMATION EXCHANGE. We may make your protected health information available electronically through an electronic health information exchange (HIE). An HIE is a system that facilitates the exchange of electronic health records or other clinical or public health information between its participants. As a participant in the HIE, we may provide your health information to other providers and health plans that request your information for their treatment, payment and healthcare operations purposes. Participation in an HIE also permits us to access their information about you for our treatment, payment and healthcare operations purposes. We may allow other parties, for example, public health department that participate in the health information exchange, to access your protected health information for their limited uses in compliance with federal and state privacy laws, such as to conduct public health activities.
BUSINESS ASSOCIATES. Some services are provided by or to the Clinic through contracts with outside vendors called business associates. We may disclose your health information to our business associates and allow them to create, use and disclose your health information so they can perform the job we have contracted with them to do. Examples include, but are not limited to, the Clinic’s attorneys, consultants, billing and collection agencies, interpreters, and accreditation organizations. We require business associates to appropriately safeguard the privacy of your information.
Uses and Disclosures Requiring Your Authorization
Other uses and disclosures of medical information not covered by this Notice or the laws that apply to us will be made only with your written authorization. If you provide us with written authorization to use or disclose medical information about you, you may revoke it at any time by giving us notice in accordance with our authorization policy and the instructions on our authorization form. Your revocation will not be effective for uses and disclosures made in reliance on your prior authorization. Examples of uses and disclosures requiring your authorization include:
• Marketing. We will not use or disclose your protected health information for marketing purposes without your authorization. Moreover, if we will receive any financial remuneration from a third party in connection with marketing, we will tell you that in the authorization form.
• Sale. We will not sell your protected health information to third parties without your authorization. Any such authorization will state that we will receive remuneration in the transaction.
YOUR RIGHTS
ACCESS TO HEALTH INFORMATION. You may inspect and receive a copy of your medical information that is used to make decisions about your care. Usually, this includes medical and billing records maintained by the Clinic. If you request a copy of the information, we may charge a reasonable fee for the costs of producing, mailing, or other supplies associated with your request, to the extent permitted by state and federal law. If we maintain your health information electronically, you have the right to receive a copy of your health information in electronic format upon your request. You may also direct us, in writing, to transmit your health information (whether in hard copy or electronic form) directly to an entity or person clearly and specifically designated by you.
We may deny your request to access your information in certain very limited circumstances. For example, we may deny access if your provider believes it will be harmful to your health or could cause a threat to others. If you are denied access to medical information, you may request that the denial be reviewed. Another licensed health care professional chosen by the Clinic will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.
REQUEST FOR RESTRICTIONS. You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment or health care operations or to persons involved in your care or payment for your care. We are not required to agree to your request, with one exception explained in the next paragraph, but we will let you know whether we have agreed to your request.
We are required to agree to your request that we not disclose certain health information to your health plan for payment or certain health care operations purposes if: (1) we are permitted by law and terms of your health plan contract to accept full payment from you, (2) you pay out-of-pocket in full for all expenses related to that service at the time of service; and (3) the disclosure is not otherwise required by law. Such a restriction will apply only to records that relate solely to the service for which you have paid in full. If we later receive an authorization from you dated after the date of your requested restriction which authorizes us to disclose all of your records to your health plan, we will assume you have withdrawn your request for restriction.
AMENDMENT. You may request that we amend certain health information that we keep in your records if you believe that it is incorrect or incomplete. We may require you to give a reason to support your request. We are not required to make all requested amendments. If we deny your request, we will provide you with a written explanation of the reasons and your rights.
ACCOUNTING. You have the right to receive a list of certain disclosures of your health information made by us or our business associates. This list will not include disclosures for treatment, payment, and health care operations; disclosures that you have authorized or that have been made to you; and certain other types of disclosures. The first list in any 12-month period will be provided to you for free; you may be charged a fee for each subsequent list you request within the same 12-month period.
CONFIDENTIAL COMMUNICATIONS. You have the right to request that we communicate with you about your health information in a different way or at a different place. We will agree to your request if it is reasonable and specifies the alternate means or location to contact you.
NOTICE IN THE CASE OF BREACH. You have the right to receive notice of an access, acquisition, use or disclosure of your health information that is not permitted by HIPAA, if such access, acquisition, use or disclosure compromises the security or privacy of your information (we refer to this as a breach).
HOW TO EXERCISE THESE RIGHTS. All requests to exercise these rights must be in writing. We will follow written policies to handle requests and notify you of our decision or actions and your rights. We will respond to your requests to exercise any of the above rights on a timely basis in accordance with our policies and as required by law. Contact the Privacy Officer for more information or to obtain request forms using the contact information provided at the end of this Notice.
COMPLAINTS. If you have concerns about any of our privacy practices or believe that your privacy rights have been violated, you may file a complaint using the contact information at the end of this Notice. You may also submit a written complaint to the U.S. Department of Health and Human Services. You will not be penalized or retaliated against for filing a complaint.
About This Notice
We are required to follow the terms of the Notice currently in effect. We reserve the right to change our practices and the terms of this Notice and to make the new practices and Notice provisions effective for all health information that we maintain. If the terms of this Notice are changed, the Clinic will provide you with a revised Notice upon request, and we will post the revised Notice in designated locations in the Clinic. The revised Notice will also be posted on our website at www.dmu.edu. You are entitled to receive this Notice in written form at any time. Please contact the Privacy Officer at 515-271-1417 to obtain a written copy.
Contact Information
If you have questions about this Notice or wish to exercise your rights described in this Notice, please contact the Privacy Officer at 515-271-1417. You may also contact the Privacy Officer for Des Moines University by sending written communications to: Privacy Officer, Des Moines University Clinic, 3200 Grand Avenue, Des Moines, Iowa, 50312.
EFFECTIVE DATE OF NOTICE: The effective date of this Notice is April 14, 2003, and it has been updated effective June 1, 2023.