Privacy and Confidentiality of Medical Information

Notice of Privacy Practices and Open Payments Database

Sonoma State University Student Health Center

Effective Date: September 2024

This notice describes how medical information about you may be used and disclosed as well as how you can get access to this information. Please review it carefully.

Sonoma State University’s Student Health Center is committed to preserving the privacy and confidentiality of your health information that is created and/or maintained at our clinic. State and federal laws and regulations require us to implement policies and procedures to safeguard the privacy of your health information. This Notice will provide you with information regarding our privacy practices and applies to all of your health information created and/or maintained at our clinic, including any information that we receive from other healthcare providers or facilities. This Notice describes your rights and our obligations concerning such uses or disclosures.

We will abide by the terms of this Notice, including any future revisions that we may make as required or authorized by law. We reserve the right to change this Notice and to make the revised or changed Notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the most current Notice, identified by its effective date, in our clinic and on our website: https://health.sonoma.edu/ We will also have hard copies of the most current notice available upon request.

The privacy practices described in this Notice will be adhered to by:

1. Any health care professional authorized to enter information into your health record created and/or maintained at our clinic;
2. All employees and other service providers who have access to your health information at our clinic; and
3. Any member of a volunteer group that is allowed to help you while receiving services at our clinic.

The individuals identified above will share your health information with each other for purposes of treatment, payment, and health care operations, and/or as further described in the Notice.

WE MAY USE AND DISCLOSE PROTECTED HEALTH INFORMATION ABOUT YOU IN SEVERAL CIRCUMSTANCES.

This section of our Notice explains in some detail how we may use and disclose medical information about you to those outside the Student Health Center in order to provide health care, obtain payment for that health care, and operate the center efficiently. This section then describes several other circumstances in which we may use or disclose medical information about you.

1.  TREATMENT

We may use and disclose medical information about you to provide health care treatment to you. In other words, we may use and disclose medical information about you to provide, coordinate, or manage your health care and related services. This may include communicating with other outside health care providers regarding your treatment and coordinating and managing your health care with others outside the organization. 

2.  PAYMENT

We may use and disclose medical information about you to obtain payment for health care services that you received. While the Student Health Center does not bill private health insurance companies, we do bill for some services through your Sonoma State University account and we do collect payment for some services including referral laboratory charges. This means that, within the Student Health Center, we may use medical information about you to arrange for payment (such as reviewing invoices from the referral laboratory). In some instances, we may disclose medical information about you to an insurance plan when assisting you in seeing a specialist within the community; for example, we may want to know whether the insurance plan will pay for a particular service.

3.  HEALTH CARE OPERATIONS

We may use and disclose medical information about you in performing a variety of business activities that we call “health care operations.” These “health care operations” activities allow us to improve the quality of care we provide, and reduce health care costs. For example, we may use or disclose medical information about you in performing the following activities:

• Reviewing and evaluating the skills, qualifications, and performance of health care providers taking care of you.
• Providing training programs for health care providers to help them practice or improve their skills.
• Cooperating with outside organizations that evaluate, certify, or license health care providers, staff, or facilities in a particular field or specialty.
• Reviewing and improving the quality, efficiency, and cost of care that we provide to you and our other patients.
• Improving health care and lowering costs for groups of people who have similar health problems and helping manage and coordinate the care for these groups of people.
• Cooperating with outside organizations that assess the quality of the care others and we provide, including government agencies and private organizations.
• Planning for our organization’s future operations.
• Resolving grievances within our organization.
• Reviewing our activities and using or disclosing medical information in the event that control of our organization significantly changes.
• Working with others (such as lawyers, accountants, and other providers) who assist us to comply with this Notice and other applicable laws.

4.  NOTIFICATION AND COMMUNICATION WITH SUPPORT PERSONS

As a general rule, we do not disclose your visits to the Health Center, or the reasons for your visits, to others, including spouses, parents, friends, or officials of the University. However, we may disclose your health information to individuals, such as family members and friends, who you have chosen to involve in your care as support persons or who help pay for your care. We may make such disclosures when: (a) we have your verbal or written agreement to do so, or (b) we can infer from the circumstances that you would not object to such disclosures, such as when you invite a support person into a healthcare visit with you. 

We may also disclose your health information to your emergency contact or accompanying support person in instances when you are unable to agree, or when you object to such disclosures, provided that we feel it is in your best interest to make such disclosures and the disclosures relate to that person’s involvement in your care. We may also disclose information to a disaster relief organization (such as the Red Cross) if we need to notify someone about your location or condition. If you are a minor, we may disclose medical information about you to a parent, guardian, or other responsible person except in limited circumstances when such information is protected by law.

5.  NATIONAL PRIORITY USES AND DISCLOSURES

When permitted or required by law, we may use or disclose medical information about you without your permission for various activities that are recognized as “national priorities.” We will disclose medical information about you only in the following circumstances when we are permitted to do so by law. Below are brief descriptions of the national priority activities recognized by law.

• Cases of considerable risk of serious or life-threatening harm to self or others. In such cases, we may release information pertinent to arranging or coordinating appropriate mental health care. In cases where you have indicated intent to seriously harm an identified person, we will also release necessary information in order to protect that person from harm.
• In cases of suspected abuse or neglect of a minor (including knowingly accessing child pornography).
• In cases of suspected elder or dependent adult abuse or neglect.
• Threat to health or safety: We may use or disclose medical information about you if we believe it is necessary to prevent or lessen a serious threat to health or safety.
• Public health activities: We may use or disclose medical information about you for public health activities. Public health activities require the use of medical information for various activities, including, but not limited to, activities related to investigating diseases, reporting child abuse and neglect, monitoring drugs or devices regulated by the Food and Drug Administration, and monitoring work-related illnesses or injuries. For example, if you have been exposed to a communicable disease (such as a sexually transmitted disease), we may report it to the State and take other actions to prevent the spread of the disease.
• Abuse, neglect, or domestic violence: We may disclose medical information about you to a government authority (such as the Department of Social Services) if you are an adult and we reasonably believe that you may be a victim of abuse, neglect, or domestic violence.
• Health oversight activities: We may disclose medical information about you to a health oversight agency — which is basically an agency responsible for overseeing the health care system or certain government programs. For example, a government agency may request information from us while they are investigating possible insurance fraud.
• Court proceedings: We may disclose medical information about you to a court or an officer of the court (such as an attorney). For example, we would disclose medical information about you to a court if a judge orders us to do so, or to an attorney in response to a legally valid subpoena that complies with the law, including federal privacy regulations (to the extent, if any, that they may be more protective of your privacy).
• Law enforcement: We may disclose medical information about you to a law enforcement official for specific law enforcement purposes. For example, we may disclose limited medical information about you to a police officer if the officer needs the information to help find or identify a missing person.
• Coroners and others: We may disclose medical information about you to a coroner, medical examiner, or funeral director or to organizations that help with organ, eye, and tissue transplants.
• Workers’ compensation: We may disclose medical information about you in order to comply with workers’ compensation laws.
• Research organizations: We may use or disclose medical information about you to research organizations if the organization has satisfied certain conditions about protecting the privacy of medical information.
• Certain government functions: We may use or disclose medical information about you for certain government functions, including but not limited to military and veterans activities and national security and intelligence activities. We may also use or disclose medical information about you to a correctional institution in some circumstances.

6. AUTHORIZATION

Other than the uses and disclosures described above (#1-5), we will not use or disclose medical information about you without the “authorization” -- or signed permission -- of you or your personal representative. In some instances, we may wish to use or disclose medical information about you, and we may contact you to ask you to sign an authorization form. In other instances, you may contact us to ask us to disclose medical information and we will ask you to sign an authorization form.

If you sign a written authorization allowing us to disclose medical information about you, you may later revoke (or cancel) your authorization in writing (except in very limited circumstances related to obtaining insurance coverage). If you would like to revoke your authorization, you may write us a letter revoking your authorization or fill out an Authorization Revocation Form. If you revoke your authorization, we will follow your instructions except to the extent that we have already relied upon your authorization and taken some action.

YOUR HEALTH INFORMATION RIGHTS

You have several rights with respect to medical information about you. This section of the Notice will briefly mention each of these rights.

1. Right to a copy of this Notice

You have a right to have a paper copy of our Notice of Privacy Practices at any time. In addition, a copy of this Notice will always be posted in our waiting area as well as on our website. If you would like to have a copy of our Notice, ask the receptionist for a copy.

2. Right of access to inspect and copy

You have the right to inspect (which means see or review) and receive a copy of medical information about you that we maintain in certain groups of records (your medical record). If you would like to inspect or receive a copy of medical information about you, you must provide us with a request in writing. We may deny your request in certain circumstances. If we deny your request, we will explain our reason for doing so in writing. We will also inform you in writing if you have the right to have our decision reviewed by another person.

3. Right to have medical information amended

You have the right to have us amend (which means correct or supplement) medical information about you that we maintain in certain groups of records. If you believe that we have information that is either inaccurate or incomplete, we may amend the information to indicate the problem and notify others who have copies of the inaccurate or incomplete information. If you would like us to amend information, you must provide us with a request in writing and explain why you would like us to amend the information. We may deny your request in certain circumstances. If we deny your request, we will explain our reason for doing so in writing. You will have the opportunity to send us a statement explaining why you disagree with our decision to deny your amendment request, and we will share your statement whenever we disclose the information in the future.

4. Right to an accounting of disclosures we have made

You have the right to receive an accounting (which means a detailed listing) of disclosures that we have made for the previous six (6) years. If you would like to receive an accounting, you may send us a letter requesting an accounting. The accounting will not include several types of disclosures, including disclosures for treatment, payment or health care operations. If you request an accounting more than once every twelve (12) months, we may charge you a fee to cover the costs of preparing the accounting.

5. Right to request restrictions on uses and disclosures

You have the right to request that we limit the use and disclosure of medical information about you for treatment, payment, and health care operations.

We are not required to agree to your request. If we do agree to your request, we must follow your restrictions (except if the information is necessary for emergency treatment). You may cancel the restrictions at any time. In addition, we may cancel a restriction at any time as long as we notify you of the cancellation and continue to apply the restriction to information collected before the cancellation.

6. Right to request an alternative method of contact

You have the right to request to be contacted at a different location or by a different method. For example, you may prefer to have all written information mailed to your work address rather than to your home address. We will agree to any reasonable request for alternative methods of contact. If you would like to request an alternative method of contact, you must provide us with a request in writing. 

PATIENT CORRESPONDENCE

The Student Health Center may need to contact you regarding lab results, to remind you of your appointments with us, or to communicate other important health information. We utilize the following methods of communication:

1. The MyHealthPortal secure patient portal that is utilized by the Student Health Center staff to correspond confidentiality with patients. Laboratory results, health education materials, and other health information may be sent to your account using this method.
2. Healthcare staff may utilize phone calls to notify patients of abnormal lab results and other important health information. Team members may also send text messages in limited circumstances when trying to reach you or to remind you of appointments or other information..
3. In the event that our staff cannot reach you by one of these methods, our staff may send a letter via the United States Postal Service to the address that we have on file for you or attempt to contact the person that you have designated as an emergency contact.
4. In some circumstances we may reach out to you using your student email. For example, we may email you a link to a patient satisfaction survey.

OPEN PAYMENTS DATABASE

The Open Payments database is a federal tool used to search payments made by drug and device companies to physicians and teaching hospitals. It can be found at https://openpaymentsdata.cms.gov. For informational purposes only, a link to the federal Centers for Medicare and Medicaid Services (CMS) Open Payments web page is provided here. The federal Physician Payments Sunshine Act requires that detailed information about payment and other payments of value worth over ten dollars ($10) from manufacturers of drugs, medical devices, and biologics to physicians and teaching hospitals be made available to the public.

QUESTIONS OR COMPLAINTS

If you would like to give anonymous feedback or have a complaint, we invite you to complete our online survey by visiting https://sonoma.az1.qualtrics.com/jfe/form/SV_6Jsm0xrXUzSzOxU.

In addition, comments, questions, or complaints may be directed to: