Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND SHARED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.
If you have any questions about this notice or would like further information, please contact our Privacy Manager at 212-263-8488.
Who Follows the Privacy Practices in this Notice?
All employees, medical and dental staff, trainees, students, volunteers, and agents of NYU Langone Medical Center must follow these practices. This includes NYU Hospitals Center, the NYU School of Medicine, and our Faculty Group Practices.
Our Commitment to Your Privacy
NYU Langone Medical Center (“NYULMC”) is committed to maintaining the privacy of your health information in all formats (electronic, paper or verbally). We keep your health information in a secure (safe) electronic health record. We will only use or disclose (share) your health information as described in this notice.
How We May Use and Share Your Health Information with Others?
We may use and share your health information for treatment, payment, and health care operation purposes. We may use and share your health information with other health care providers who are treating you or with a pharmacy that is filling your prescription;
We may use and share your health information with your health insurance plan to get pre-approval for your treatment or to collect payment for health care services; or
We may use and share your health information to run our business, to evaluate practitioner or provider performance, or to educate health care professionals.
We may share your health information with business associates who are helping us collect payment for services or other business operations. All of our business associates are required to protect the privacy and security of your health information.
We may use and share your health information to contact you about health-related benefits and services or to fundraise for the benefit of NYULMC. You have the right not to receive fundraising communications and should email firstname.lastname@example.org or call 212-404-3640 or 1-800-422-4483 (toll free).
We may also use and disclose your health information for the following reasons:
For public health activities (for example, to report injuries, diseases, births and deaths to a public health official authorized to receive such information);
For workers’ compensation or similar programs that provide benefits for work-related injuries;
To alert appropriate authorities about victims of abuse, neglect, or domestic violence; if we reasonably believe that you have been a victim of such abuse, neglect, or domestic violence, we will make every effort to get your permission before sharing this information. However, in some cases we may be required or authorized to act without your permission;
For oversight by government or private agencies that review health care organization’s practices to ensure safety and quality activities;
For monitoring products which may need repair or are being recalled (for example, to satisfy FDA requirements);
For research studies where health records are analyzed (when it cannot be done through the normal authorization procedures) and approved by our institutional privacy board. This is done through a special process that makes sure that the research may only be a small risk to your privacy and that researchers keep your information confidential and secure; for preparing for research, such writing a research proposal or recruiting possible subjects; or, in the unfortunate event of your death, for research solely on information about people who have died;
To create and disclose de-identified (does not have your name, SS#, etc.) health information or limited data sets that do not have direct identifiers about you;
For judicial and administrative proceedings (for example, a court order);
For law enforcement purposes (for example, to identify or find a suspect or missing person, or to report a crime that occurred on or off our property);
To coroners, medical examiners, or funeral directors as necessary to do their jobs;
To organizations that handle organ, eye or tissue donation, or transplantation;
To avoid a serious threat to health or public safety;
For specialized government functions;
Incidental uses and disclosures (for example, if a patient or staff member overhears a discussion in our Emergency Department even when reasonable steps were taken to keep your information confidential; and
As otherwise required or allowed by local, state or federal law.
If you give us permission, we may use or share your health information for:
Our patient directory;
Members of our Chaplaincy Services Department, such as a priest or a rabbi;
To family or friends involved in your care;
Payment for your care;
A disaster relief agency for purposes of notifying your family or friends where you are and what your status is in an emergency situation.
Uses and disclosures of your health information that involve psychotherapy notes, marketing, payments from a third party, or any other use or disclosure not described in this notice or required by law will only be made with your written authorization (permission). You have the right to withdraw (take back) your authorization, except when we have already relied on it, by contacting our privacy official provided below.
Additional privacy protections may apply if we are using or sharing sensitive health information, such as HIV-related information, mental health information, alcohol or drug abuse treatment information and genetic information. For example, under New York State Law, confidential HIV-related information can only be shared with persons allowed to have it by law, or persons you have allowed to have it by signing a specific authorization form.
What Rights do you have About Your Health Information?
Although your health record is the property of NYULMC, you have the right to:
Request restrictions on how we use or share your information for treatment, payment, and health care operations, and how we may share it with your family and friends. We are not required to agree to your request, except when you pay for services out-of-pocket, in full and request us not to share the health information with your health insurance plan.
Request confidential communications of your health information.
Review and copy health information in your medical and billing records upon written request. If you request an electronic or paper copy of your health information, one will be provided to you within 3 to 10 days of your request. You may be charged no more than .75¢ per page for paper copies. For electronic copies, we may also charge you a reasonable fee for using electronic media.
Request amendment (changes) to information in your medical and billing records. You must make your request to change, in writing and provide a reason for the request. We are not required to agree to your request, but will let you know in writing, and state a reason, when we do not agree. If we agree, your suggested amendment will be added to your record.
Receive an accounting of disclosures. An “accounting of disclosures” is a report that identifies certain other people or organizations to which we have disclosed your health information without your authorization. (See the section on “We may also use and disclose your health information for the following reasons” for an explanation of who might be included.) You have a right to receive one accounting of disclosures every 12 months without charge; however, we may charge you for the cost of providing any additional accounting in the same 12-month period.
Name a personal representative who may act on your behalf to control the privacy of your health information. Parents and guardians will generally have the right to control the privacy of health information of minors (children under 18 years old) unless the minors are permitted by law to act on their own behalf. There may also be exceptions to this per individual state law.
Ask for and be given a paper copy of this notice.
Request additional privacy protections with respect to your electronic medical record.
Requests must be made in writing to the privacy official or appropriate doctor’s office or hospital department. For more information or to get a designated request form, please contact the privacy official provided below.
What are Our Duties about Your Health Information and this Notice?
We are required by federal and state law to keep the privacy and security of health information that may tell your identity. If there is a breach of privacy that compromises your identifiable health information, we will notify you in writing or by email.
We are required to provide you with a copy of this notice and agree to the terms of this notice. We reserve the right to change the terms of this notice; the revised notice will be effective for all health information that we keep. We will post any revised notices on our public website at www.nyumc.org and in admitting or waiting room areas. You may also request a paper copy of the revised notice at the time of your next visit.
If you have any questions about this notice or believe your privacy rights have been violated, please contact us at:
Internal Audit, Compliance & Enterprise Risk Management
One Park Avenue, 3rd Floor, New York, NY 10016, Attention: Privacy Manager
212-263-8488 or 1-877-PHI-LOSS
You may also contact the Secretary of the United States Department of Health and Human Services. We will not retaliate or take action against you for filing a complaint.
REQUEST FOR ACKNOWLEDGMENT
An acknowledgment form will be printed for you to sign during your registration process. By signing the Notice of Privacy Practices Acknowledgment Form, you are confirming that you have received a copy of this notice.
NYU Langone Medical Center
550 First Avenue
New York, NY 10016
Be sure to include the name of the department to which you are writing.
Phone and Fax Information:
Phone: 212-263-8488 Fax: 212-263-8437
Medical Records Department:
Phone: 212-263-5497 Fax: 212-263-7665
Patient Access (Admitting) Department:
Phone: 212-263-5005 Fax: 212-263-8960
Patient Representative Department:
Phone: 212-263-6906 Fax: 212-263-8460
CONFIDENTIALITY OF HIV-RELATED INFORMATION,
MENTAL HEALTH INFORMATION AND PSYCHOTHERAPY NOTES,
AND GENETIC INFORMATION
The privacy and confidentiality of some types of information maintained by this Hospital is protected by Federal and State law and regulations that go beyond the protections described in this general Notice of Privacy Practices. This information includes:
Mental Health Information
If there is any conflict between the general Notice of Privacy Practices and this notice, the protections described in this notice will apply instead of the protections described in the general Notice of Privacy Practices.
Confidential HIV-related information is any information indicating that you had an HIV-related test, have HIV-related illness or AIDS, or have an HIV-related infection, as well as any information which could reasonably identify you as a person who has had a test or has HIV infection.
Under New York State law, confidential HIV-related information can only be given to persons allowed to have it by law, or persons you have allowed to have it by signing a specific authorization form. You can ask to see a list of people who can be given confidential HIV-related information by law without a specific authorization form.
With your written consent, confidential HIV-related information about you may be used by personnel within the Hospital who need the information to provide you with direct care or treatment, to process billing or reimbursement records, or to monitor or evaluate the quality of care provided at the Hospital. Generally this Hospital may not reveal to a person outside of the Hospital any confidential HIV-related information that the Hospital obtains in the course of treating you, unless:
• We obtain your written permission on a specific authorization form;
•The disclosure is to a person who is authorized under applicable law to make health care decisions on your behalf and the information disclosed is relevant to those health care decisions;
• The disclosure is for treatment or payment purposes, so long as the Hospital has obtained your general consent to such disclosures;
• The disclosure is to an external agent of the Hospital who needs the information to provide you with direct care or treatment, to process billing or reimbursement records, or to monitor or evaluate the quality of care provided at the Hospital. In such cases, we will ordinarily obtain your general consent and have an agreement with the agent to ensure that your confidential HIV-related information is protected as required under
Federal and State confidentiality laws and regulations;
• The disclosure is required by law or court order;
• The disclosure is to an organization that procures body parts for transplantation;
• You receive services under a program monitored or supervised by a federal, state or local government agency and the disclosure is made to such government agency or other employee or agent of the agency when reasonably necessary for the supervision, monitoring, administration of provision of the program’s services;
• The Hospital is required under Federal or State law to make the disclosure to a health officer;
• The disclosure is required for public health purposes;
• If you are an inmate at a correctional facility and disclosure of confidential HIV-related information to the medical director of such facility is necessary for the director to carry out his or her functions;
• For decedents, the disclosure is made to a funeral director who has taken charge of the decedent’s remains and who has access in the ordinary course of business to confidential HIV-related information on the decedent’s death certificate;
• The disclosure is made to report child abuse or neglect to appropriate State or local authorities.
Violation of these privacy regulations may subject the Hospital to civil or criminal penalties. Suspected violations may be reported to appropriate authorities in accordance with Federal and State law.
MENTAL HEALTH INFORMATION
With your written consent, mental health information about you may be used by personnel within the Hospital (or its business associates) in connection with their duties to provide you with treatment, obtain payment for that treatment, or conduct the Hospital’s normal business operations. Generally the Hospital may not reveal mental health information about you to other persons outside of the Hospital, except in the following situations:
• When the Hospital has obtained your written permission on a specific authorization form;
• To a personal representative who is authorized to make health care decisions on your behalf;
• To government agencies or private insurance companies in order to obtain payment for services we provided to you;
• To comply with a court order;
• To appropriate persons who are able to avert a serious and imminent threat to the health or safety of you or another person;
• To appropriate government authorities to locate a missing person or conduct a criminal investigation as permitted under Federal and State confidentiality laws and regulations;
• To other licensed Hospital emergency services as permitted under Federal and State confidentiality laws;
• To the mental hygiene legal service offered by the State;
• To attorneys representing patients in an involuntary hospitalization proceeding;
• To authorized government officials for the purpose of monitoring or evaluating the quality of care provided by the Hospital or its staff;
• To qualified researchers without your specific authorization when such research poses minimal risk to your privacy;
• To coroners and medical examiners to determine cause of death; and
• If you are an inmate, to a correctional facility which certifies that the information is necessary in order to provide you with health care, or in order to protect the health or safety of you or any other persons at the correctional institution.
Psychotherapy notes are notes by a mental health professional that document or analyze the contents of a conversation during a private counseling session – or during a group, joint, or family counseling session. If these notes are maintained separate from the rest of your medical records, they can only be used and disclosed as follows.
In general, psychotherapy notes may not be used or disclosed without your special written authorization, except in the following circumstances.
With your general written consent, psychotherapy notes about you may be used and disclosed in the following situations:
• The mental health professional who created the notes may use them to provide you with further treatment;
• The mental health professional who created the notes may disclose them to students, trainees, or practitioners in mental health who are learning under supervision to practice or improve their skills in group, joint, family, or individual counseling;
• The mental health professional who created the notes may disclose them as necessary to defend his or herself, or the Hospital, in a legal proceeding initiated by you or your personal representative;
Psychotherapy notes may be used and disclosed without your consent or other authorization in the following situations to comply with the law or meet an important public need:
• The mental health professional who created the notes may disclose them as required by law;
• The mental health professional who created the notes may disclose the notes to appropriate government authorities when necessary to avert a serious and imminent threat to the health or safety of you or another person;
• The mental health professional who created the notes may disclose them to the United States Department of Health and Human Services when that agency requests them in order to investigate the mental health professional’s compliance, or the Hospital’s compliance, with Federal privacy and confidentiality laws and regulations; and
• The mental health professional who created the notes may disclose them to medical examiners and coroners if necessary to determine your cause of death.
All other uses and disclosures of psychotherapy notes require your special written authorization.
A genetic test means a laboratory test of human DNA, chromosomes, genes or gene products to diagnose the presence of a genetic variation linked to a predisposition to a genetic disease or disability in the individual or the individual’s offspring. A genetic test does not include any test of blood or other medically prescribed test in routine use that has been or may be found to be associated with a genetic variation unless it is conducted purposely to identify such genetic information.
All records, findings and results of any genetic test performed on any person shall be confidential and generally shall not be disclosed without the written informed consent of the person to whom such genetic test relates.
With your consent, the results of your genetic test may be disclosed to a health insurer or health maintenance organization if the information disclosed is reasonably required for purposes of claims administration. However, any further distribution of the information within the insurer or to other recipients will require your written consent in each case.
Information derived from your genetic test may not be incorporated into the records of a non-consenting individual who may be genetically related to you, and no inferences may be drawn, used or communicated regarding the possible genetic status of the non-consenting individual.
The results of your genetic test may be disclosed to specified individuals without your consent if such disclosure is required by a court order or otherwise required or authorized by State law.
Your genetic information shall not be released to any person or organization not specifically authorized by you without additional written consent. The Hospital is aware that an individual who might ordinarily be authorized to act as your personal representative, such as your spouse or a parent, may not be considered a personal representative for purposes of accessing your genetic information. For example, if you have authority to provide written consent on your own, your genetic information should not be released to your parent or guardian unless you have specifically authorized such a disclosure. If your parent or guardian is authorized under law to sign the written consent form on your behalf, the results of the test may be provided to him or her.
HOW TO FILE A COMPLAINT
If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the Department of Health and Human Services. To file a complaint with us, please contact our Privacy Officer. No one will retaliate or take action against you for filing a complaint.
If you experience discrimination because of the release of confidential HIV-related information, you may contact the New York State Division of Human Rights at (212) 566-8624 or the New York City Commission of Human Rights at (212) 566-5493. These agencies are responsible for protecting your rights.
If you have any questions about the policies in this Appendix or would like further information, please contact our Privacy Officer at 212-263-8488.
Contact a hospital operator at (212) 263-7300