Notice of Privacy Practices
Notice of Privacy Practices and Disclosure of Health Information
STUDENTS:
Notice of Privacy Practices and Disclosure of Health Information for Students
If you are a student at the University of Colorado Boulder (Ƶ Boulder), the following Notice of Privacy Practices (Notice) describes how Health and Wellness Services (HWS) will use and disclose your Medical Services and/or Counseling and Psychiatric Services (CAPS) health information. Your health information has confidentiality and privacy protections under the Family Educational Rights and Privacy Act (FERPA) and Colorado law. Your health information will remain confidential and private to the extent provided by law and this notice.
FERPA Protections
FERPA protects the privacy of your information and does not allow disclosure of your education record without your consent outside the university, except in limited circumstances. FERPA defines education records as records that are directly related to a student and maintained by an educational agency or institution or a party acting for the agency or institution and does not include treatment records unless disclosed for purposes other than treatment. FERPA defines treatment records as records that are maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional capacity or assigned capacity that are made, maintained, or used only in connection with treatment of the student and disclosed only for treatment. Most HWS health information is considered education records and not treatment records as defined under FERPA because we disclose information to meet certain payment, operational, and legal requirements as described in this Notice.
HIPAA ensures the privacy of protected health information (PHI). The definition of PHI in the HIPAA Privacy Law excludes education records that are subject to FERPA, therefore the privacy of your HWS education records is protected by FERPA instead of HIPAA. In addition, Colorado state law may be applicable to afford confidentiality under the psychotherapy or physician-patient privilege.
State Law Protections
Medical Health Information
State law and professional ethical rules indicates that your medical health information is protected by privilege and is generally confidential. Subject to exceptions provided by law, HWS physicians, surgeons, and registered nurses, as well as members of their staff, will not disclose any health information gathered for your treatment without your consent.
Mental Health Information
State law provides that your mental health information, which includes any communications you have with a HWS mental health professional or their colleagues during the course of treatment, is confidential and protected by privilege. Additionally, individual mental health providers are required to keep communications that occur in the course of their professional employment confidential. Subject to specific exceptions provided by law, and as provided for in this notice, mental health information will generally remain confidential and will not be revealed without your consent.
How We Can Use or Share Your Health Information
When you sign the General Agreement for Health Care Services you are providing consent for us to use or disclose your health information in the following limited ways:
For Treatment - We may use health information about you to help us treat you and we may share information with other health care providers, within and outside of Medical Services and CAPS, who are treating you. We may also use health information about you to provide information to other providers for referrals. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process.
For Payment - We may use and disclose health information about you so we can bill and be paid for the services we or another provider provide to you. For example, we may need to give your insurance company information about a clinic visit you had so your insurance company will reimburse you for amounts you have paid.
For Health Care Operations - We may use and disclose health information about you so we can run our business, contact you, improve your care, and maintain our accreditation. For example, we may use health information to review your treatment and our services, to evaluate the performance of our staff caring for you, conduct compliance and medical reviews, maintain our compliance programs, and/or receive legal services to defend against possible malpractice suits and complaints.
Public Health Activities - We may disclose health information about you to officials in certain situations, such as
- reporting information to public health authorities, including, but not limited to, Centers for Disease Control, Boulder County Public Health, the Colorado Department of Public Health and Environment, and their related reporting systems, to help prevent or control disease, including health information related to vaccines given to you by our clinic;
- reporting abuse, neglect, or domestic violence to the proper law enforcement agency;
- reporting adverse events or reactions, enabling product recalls, or reporting defects to the Food and Drug Administration; and
- use and sharing as outlined in the COVID-19 Addendum (attached).
To Avert a Serious Threat to Health or Safety - We may disclose health information about you to the University of Colorado Police Department, the Office of the Dean of Students, and/or the Students of Concern Team, if we believe it may prevent or lessen a serious or imminent threat to the health or safety of you or others.
Health Oversight Activities, Law Enforcement, and Government Requests - We may disclose health information about you:
- to a health oversight agency for reasons, such as audits of the care we give, investigations, inspections, licensure or disciplinary actions;
- in response to a court order, administrative order, or lawfully issued subpoena;
- to law enforcement officials to assist locating a suspect, finding a missing person, or apprehending an individual; and
- for certain government functions, such as for national security, intelligence, or for the military.
Required by Law - We may use or disclose health information about you when we are required to do so by federal, state, or local law. For example, the Colorado Medical Practice Act requires us to report certain noninfectious injuries or conditions to law enforcement or state officials, such as gunshot wounds, abuse, death, etc. In addition, certain health professionals have a duty to warn others if you make a serious threat of imminent physical violence against a specific person or persons, including those identifiable by their association with a specific location or entity.
Agents of HWS - We may disclose health information about you to agents of HWS or to business associates working on our behalf. For example, software companies who assist us with our information systems may have access to information to help us perform our health care operations. They are required to maintain the privacy and security of your information.
Disaster Relief - We may use or disclose health information about you to a disaster relief organization, such as the Red Cross so that your family members, other relatives, close personal friends, or others can be notified of your location or general condition.
Coroners and Medical Examiners or Funeral Directors - We may disclose health information to a coroner, medical examiner, or funeral director. This may be necessary, for example, to identify a deceased person or to determine the cause of death.
Organ, Eye or Tissue Donation - If you are an organ donor, we may disclose health information to organizations that handle organ procurement or organ, eye, or tissue transplantation or to an organ donation bank.
Workers Compensation - We may disclose health information about you to the extent necessary to comply with workers’ compensation and similar laws that provide benefits for work-related injuries or illness without regard to fault.
Prescription Drug Monitoring Program (PDMP) - If you receive a controlled substance from the pharmacy, your prescription information will be submitted to the PDMP, and the information may be queried by specific individuals for a limited number of purposes as authorized by law.
The above is neither intended to nor may be construed as a waiver of or limitation to any legal authority for University of Colorado to otherwise use or disclose student information, including health information.
Your Choices Regarding Health Information about You
For certain health information, you can tell us your choices about what we share.
Individuals Involved in Your Care or Payment for Your Care - We may disclose health information about you to a friend, relative, family member, or any other person involved in your care if you choose. We also may use or disclose health information about you to notify, or assist in notifying, those persons of your location, general condition, or death.
Written Authorization Required - We will not disclose your health information without your written permission for marketing purposes or for the sale of your health information.
Fundraising - We may contact you regarding fundraising efforts but it is your right to inform us to not contact you again.
CORHIO - We participate in the Colorado Regional Health Information Organization (CORHIO), which is an electronic health information exchange (HIE) among participating health care providers in Colorado. Our participation with CORHIO allows our providers to access health information electronically through the HIE for the purposes described in this Notice. At this time, our participation does not include entering health information into the HIE so none of your personal health information obtained at Medical Services or CAPS will be placed on the HIE network. You may choose to opt out of participation with the HIE. If you choose to opt out, your provider will not be able to view your patient information through the HIE. Please notify any health care provider if you would like to exercise your choice to opt out. Any patient that has opted out previously may choose to opt in at any time.
Other Uses and Disclosures - If you provide us with authorization to use or disclose your health information for another purpose, you may revoke that authorization, in writing, at any time. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care we provided to you.
Your Rights With Respect to Health Information Ƶ You
You have the following rights with respect to health information that we maintain about you.
Right to Request Restrictions - You have the right to request a restriction or limitation on the health information we use or disclose about you. We are not required to agree to your request and we may deny the request if it would affect your care or impede the university’s existing legal authority to use and disclose information. Even if we agree to a restriction, we may terminate the restriction at a later date. To request restrictions, please contact the compliance coordinator. Your request must be in writing.
Right to Receive Confidential Communications - We may contact you by telephone, mail or secure messaging. We may leave messages for you on your voicemail. We will try not to leave messages with specific information about you. You have the right to request that we communicate health information about you to you in a certain way or at a certain location. For example, you can ask that we only contact you by mail or at work. Contact your care provider or the compliance coordinator if you would like to request confidential communication and we will say yes to all reasonable requests.
Right to Inspect and Copy - You have the right to inspect and/or request a copy of health information that may be used to make decisions about your care. To inspect and/or request a copy of your health information, you must submit an Authorization for Release of Information form on the HWS portal or in writing to the release of information coordinator. Your request should state specifically what health information you want to inspect or obtain. We will provide you with a summary or a copy of your health information, usually within 30 days of your request. We may charge a reasonable cost-based fee for providing the copy of health information.
Right to Request Amendments - You have the right to ask us to amend health information about you that you feel is incorrect or incomplete. This right does not pertain to information that was not created by us; information that is not part of the health information kept by us; information which you would not be permitted to inspect or obtain; and information that is accurate and complete as originally documented. To request an amendment, you must submit your request in writing to compliance coordinator. A form is available for making this request. Your request must state the amendment desired and provide a reason in support of that amendment. If we grant the request, in whole or in part, we will seek your identification of and agreement to share the amendment with other relevant persons. We also will make the appropriate amendment to the health information by appending or otherwise providing a link to the amendment.
Right to an Accounting of Disclosures - You have the right to request a list (accounting) of the times we have disclosed your health information, who we shared it with, and why. The accounting may be for up to six (6) years prior to the date on which you request the accounting. The accounting will not include disclosures made for the purposes of treatment, payment, and health care operations; disclosures of your health information made to you; or disclosures that you authorized in writing. To request an accounting of disclosures, you must submit your request in writing to the HWS release of information coordinator. A form is available for making this request. Your request must state a time period for the disclosures. It may not be longer than six (6) years from the date we receive your request.
Right to a Copy of this Notice - You have the right to obtain a paper copy of this Notice. The Notice is displayed prominently and copies are freely available in each clinical department and on the HWS website.
Our Right to Change Notice of Privacy Practices
We reserve the right to change this Notice. We reserve the right to make the revised or changed Notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice at our facilities. The Notice will contain the effective date on the first page. In addition, each time you register at or are admitted to or treated at one of our facilities you may request an updated copy of the current Notice in effect.
Complaints
As a student, if you believe your privacy rights under FERPA have been violated you may obtain a complaint form by calling U.S. Department of Education at (202) 260-3887.
You are encouraged to contact the compliance coordinator with any privacy complaints. You may submit a written complaint, which should include the date of occurrence, description of the activity or event, and the identity of the person filing the complaint. We have a complaint form that you may use. Anonymous complaints may be submitted, however anonymous complaints can only be investigated to the extent information is provided. To help us investigate your complaint, please include how to contact you. You will not be retaliated against or penalized for filing a complaint. Complaints should be filed in writing within 180 days of the occurrence and addressed to the compliance coordinator (see contact information below).
Questions and Information
If you have any questions or want more information concerning this Notice please contact the compliance coordinator at:
Health and Wellness
Attn: Compliance Coordinator
119 UCB, Boulder, CO 80309-0119
Phone: 303-492-6712
Email: whccompliance@colorado.edu
Email is not a secure form of communication. There is some risk that any confidential information contained in your email may be disclosed or intercepted. Please contact the compliance coordinator if you have sensitive information that you do not feel comfortable sending via email.
NON-STUDENTS:
Notice of Privacy Practices for Non-Students
If you are not a student at the University of Colorado, the following Notice of Privacy Practices (Notice) describes how Health and Wellness (HWS) will use and disclose your Medical Services and/or Counseling and Psychiatric Services (CAPS) health information about you and how you can access this information.
Health and Wellness (HWS) is required by law to protect your personal health information. In addition, HWS is required to maintain the privacy of your health information by the terms of its most current Notice, and to provide you with notice of its legal duties and privacy practices with respect to your health information. This Notice tells you how we may use and disclose protected health information (PHI) about you. PHI means any health information about you that identifies you or that could be used to identify you. In this Notice, we call all of that PHI, “health information.” This Notice also tells you about your rights and our duties with respect to health information about you. In addition, it will tell you how to complain to us if you believe we have violated your privacy rights.
How We Typically Use or Share Your Health Information
The following categories describe different ways that we may use and disclose your Medical Services and/or CAPS health information.
For Treatment - We may use health information about you to help us treat you and we may share information with other health care providers who are treating you. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process.
For Payment - We may use and disclose your health information to bill and be paid for the services we provide to you. For example, we may need to give your insurance company information about a clinic visit you had so your insurance company will reimburse you for amounts you have paid.
For Health Care Operations - We may use and disclose your health information to run our business, contact you, improve your care, and maintain our accreditation. For example, we may use health information to review your treatment and our services and to evaluate the performance of our staff caring for you.
Other Ways We Can Use or Share Your Health Information
We are allowed or required to disclose your information in other ways – usually ways that contribute to the public good, such as for public health. We must meet the conditions of the law before we can disclose your information for these purposes.
Public Health and Safety Activities - We may disclose health information about you to officials in certain situations, such as:
- reporting information to public health authorities, including, but not limited to, Centers for Disease Control, Boulder County Public Health, the Colorado Department of Public Health and Environment, and their related reporting systems, to help prevent or control disease, including health information related to vaccines given to you by our clinic;
- reporting abuse, neglect, or domestic violence;
- to avert a serious threat to health or safety;
- reporting adverse events, adverse reactions, enabling product recalls, or reporting defects to the Food and Drug Administration; and
- use and sharing as outlined in the COVID-19 Addendum (attached).
Health Oversight Activities, Law Enforcement, and Government Requests - We may disclose health information about you:
- to a health oversight agency for reasons, such as audits of the care we give, investigations, inspections, licensure, or disciplinary actions;
- in response to a court order, administrative order, or lawfully issued subpoena;
- to law enforcement officials to assist locating a suspect, finding a missing person, or apprehending an individual; and
- for certain government functions, such as for national security, intelligence, or for the military.
Required by Law - We may use or disclose health information about you when we are required to do so by federal, state, or local law.
Disaster Relief - We may use or disclose health information about you to a disaster relief organization, such as the Red Cross so that your family members, other relatives, close personal friends, or others can be notified of your location or general condition.
Coroners and Medical Examiners or Funeral Directors - We may disclose health information to a coroner, medical examiner, or funeral director. This may be necessary, for example, to identify a deceased person or to determine the cause of death.
Organ, Eye or Tissue Donation - If you are an organ donor, we may disclose health information to organizations that handle organ procurement or organ, eye, or tissue transplantation or to an organ donation bank.
Research - We may disclose your information for certain health research purposes.
Workers Compensation - We may disclose health information about you to the extent necessary to comply with workers’ compensation and similar laws that provide benefits for work-related injuries or illness without regard to fault.
Prescription Drug Monitoring Program (PDMP) - If you receive a controlled substance from the pharmacy, your prescription information will be submitted to the PDMP, and the information may be queried by specific individuals for a limited number of purposes as authorized by law.
Your Choices Regarding Health Information about You
For certain health information, you can tell us your choices about what we share.
Individuals Involved in Your Care or Payment for Your Care - We may disclose health information about you to a friend, relative, or family member or any other person involved in your care if you choose. We also may use or disclose health information about you to notify, or assist in notifying, those persons of your location, general condition, or death.
Written Authorization Required - We will not disclose your health information without your written permission for marketing purposes, for the sale of your health information, or in most situations that involve the sharing of psychotherapy notes.
Fundraising - We may contact you regarding fundraising efforts but it is your right to inform us to not contact you again.
CORHIO - We participate in the Colorado Regional Health Information Organization (CORHIO), which is an electronic health information exchange (HIE) among participating health care providers in Colorado. Our participation with CORHIO allows providers to access health information electronically through the HIE for the purposes described in this Notice. At this time, our participation does not include entering health information into the HIE so none of your personal health information obtained at Medical Services or CAPS will be placed on the HIE network. You may choose to opt out of participation with the HIE. If you choose to opt out, your provider will not be able to view your patient information through the HIE. Please notify any health care provider if you would like to exercise your choice to opt out. Any patient that has opted out previously may choose to opt in at any time.
Other Uses and Disclosures - Except as described in this Notice, we will not use or disclose your health information without your written authorization. If you provide us with authorization to use or disclose your health information for another purpose, you may revoke that authorization, in writing, at any time. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care we provided to you.
Your Rights With Respect to Health Information Ƶ You
You have the following rights with respect to health information that we maintain about you.
Right to Request Restrictions - You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment or health care operation purposes. We are not required to agree to your request and we may deny the request if it would affect your care. You also have the right to request that we restrict the uses or disclosures we make to: (a) a family member, other relative, a close personal friend or any other person identified by you; or, (b) to public or private entities for disaster relief efforts. You also have the right to request a limit on the health information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. Even if we agree to a restriction, we may terminate the restriction at a later date. To request restrictions, please contact the compliance coordinator. Your request must be in writing.
If you pay for a service or healthcare item out-of-pocket in full, you can request us to not disclose information for the purpose of payment or healthcare operations with your health insurer. We will agree unless the law requires us to disclose the information.
Right to Receive Confidential Communications - We may contact you by telephone or mail. We may leave messages for you on your voicemail. We will try not to leave messages with specific information about you. You have the right to request that we communicate health information about you to you in a certain way or at a certain location. For example, you can ask that we only contact you by mail or at work. Contact your care provider or the compliance coordinator if you would like to request confidential communication and we will say yes to all reasonable requests.
Right to Inspect and Copy - You have the right to inspect and/or request a copy of health information that may be used to make decisions about your care. You have the right to request that this copy be provided to you in an electronic format. This right does not pertain to psychotherapy notes; information compiled in anticipation of, or use in a civil, criminal or administrative action or proceeding; information restricted by the Clinical Laboratory Improvement Amendments of 1988 (CLIA); or information that is not part of the record set we use to make decisions about your care and treatment. To inspect and/or request a copy of your health information, you must submit an Authorization for Release of Information form to the release of information coordinator. Your request should state specifically what health information you want to inspect or obtain. We will provide you with a summary or a copy of your health information, usually within 30 days of your request. We may charge a reasonable cost-based fee for providing the copy of health information.
Right to Request Amendments - You have the right to ask us to amend health information about you that you think is incorrect or incomplete. This right does not pertain to information that was not created by us; information that is not part of the health information kept by us; information which you would not be permitted to inspect or obtain; and information that is accurate and complete as originally documented. To request an amendment of your health information, you must submit your request in writing to the compliance coordinator. A form is available for making this request. Your request must state the amendment desired and provide a reason in support of that amendment. If we grant the request, in whole or in part, we will seek your identification of, and agreement to share the amendment with other relevant persons. We also will make the appropriate amendment to the health information by appending or otherwise providing a link to the amendment.
Right to an Accounting of Disclosures - You have the right to receive a list (accounting) of the times we disclosed your information, who we shared it with, and why. The accounting may be for up to six (6) years prior to the date of your request. The accounting will not include disclosures made for the purposes of treatment, payment, and health care operations; disclosures of your health information made to you; disclosures made for national security or intelligence purposes; disclosures made to correctional institutions or law enforcement officials; or disclosures that you authorized in writing. To request an accounting of disclosures, you must submit your request in writing to the release of information coordinator. A form is available for making this request.
Right to a Copy of this Notice - You have the right to obtain a paper copy of this Notice. The Notice is displayed prominently and copies are freely available in each clinical department and on the HWS website.
Our Right to Change Notice of Privacy Practices
We reserve the right to change this Notice. We reserve the right to make the revised or changed Notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice at our facility. The Notice will contain the effective date on the first page. In addition, each time you register at or are admitted to or treated at one of our facilities you may request an updated copy of the current Notice in effect.
Complaints
If you believe your privacy rights have been violated you have the right under HIPAA to complain to the U.S. Secretary of the Department of Health and Human Services. To complain to the Secretary contact: Region VIII, Office for Civil Rights, U.S. Department of Health and Human Services, 1961 Stout Street – Room 1185 FOB, Denver, CO 80294-3538. Fax: (303) 844-2025.
You are encouraged to contact the compliance coordinator with any privacy complaints. You may submit a written complaint, which should include the date of occurrence, description of the activity or event and the identity of the person filing the complaint. We have a complaint form that you may use. Anonymous complaints may be submitted, however anonymous complaints can only be investigated to the extent information is provided. To help us investigate your complaint, please include how to contact you. You will not be retaliated against or penalized for filing a complaint. Complaints should be filed in writing within 180 days of the occurrence and addressed to the compliance coordinator (see contact information below).
Questions and Information
If you have any questions or want more information concerning this Notice of Privacy Practices please contact the compliance coordinator at:
Health and Wellness
Attn: Compliance Coordinator
119 UCB, Boulder, CO 80309-0119
Phone: 303-492-6712
Email: whccompliance@colorado.edu
Email is not a secure form of communication. There is some risk that any confidential information contained in your email may be disclosed or intercepted. Please contact the compliance coordinator if you have sensitive information that you do not feel comfortable sending via email.
COVID-19 Addendum
Effective January 25, 2021
This addendum applies to both students and nonstudents.
When you sign the General Agreement for Health Care Services, you are consenting to the following use and sharing:
COVID-19 Vaccination – Pursuant to the declaration of a public health emergency by the United States Government, federal and state public health authorities have authorized the University of Colorado Boulder to administer vaccines as a public health intervention to mitigate the spread of the coronavirus (SARS-CoV-2), called COVID-19. In order to facilitate this public health activity, Health and Wellness Services (HWS) may use and disclose identifiable information such as your name, any student or employee ID number, and personally identifiable information and/or protected health information regarding whether or not you appeared for a vaccine appointment, received a vaccine, and when you received a vaccine or a dose of a vaccine, to other university administrators and university staff outside of HWS who have a legitimate need to know to do their jobs regarding these vaccination efforts. This specifically includes, but is not limited to, the acts of determining your eligibility for the vaccine and communicating with you about vaccination opportunities and appointments.