���Ҵ�ý�ƽ������

If you are a student at the University of Colorado Boulder (���Ҵ�ý�ƽ������), the following Notice of Privacy Practices (Notice) describes how Student Health and Well-Being (HW) will use and disclose your Medical Services and/or Counseling and Psychiatric Services (CAPS) health information. Your health information has confidentiality and privacy protections under the Family Educational Rights and Privacy Act (FERPA) and Colorado law. Your health information will remain confidential and private to the extent provided by law and this notice.

FERPA protects the privacy of your information and does not allow disclosure of your education record without your consent outside the university, except in limited circumstances. FERPA defines education records as records that are directly related to a student and maintained by an educational agency or institution or a party acting for the agency or institution and does not include treatment records unless disclosed for purposes other than treatment. FERPA defines treatment records as records that are maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional capacity or assigned capacity that are made, maintained, or used only in connection with treatment of the student and disclosed only for treatment. Most HW health information is considered education records and not treatment records as defined under FERPA because we disclose information to meet certain payment, operational, and legal requirements as described in this Notice.

HIPAA ensures the privacy of protected health information (PHI). The definition of PHI in the HIPAA Privacy Law excludes education records that are subject to FERPA, therefore the privacy of your HW education records is protected by FERPA instead of HIPAA. In addition, Colorado state law may be applicable to afford confidentiality under the psychotherapy or physician-patient privilege.

Medical Health Information
State law and professional ethical rules indicate that your medical health information is protected by privilege and is generally confidential. Subject to exceptions provided by law, HW physicians, surgeons, and registered nurses, as well as members of their staff, will not disclose any health information gathered for your treatment without your consent.

Mental Health Information
State law provides that your mental health information, which includes any communications you have with a HW mental health professional or their colleagues during the course of treatment, is confidential and protected by privilege. Additionally, individual mental health providers are required to keep communications that occur in the course of their professional employment confidential. Subject to specific exceptions provided by law, and as provided for in this notice, mental health information will generally remain confidential and will not be revealed without your consent.

When you sign the General Agreement for Health Care Services you are providing consent for us to use or disclose your health information in the following limited ways:

For Treatment - We may use health information about you to help us treat you and we may share information with other health care providers, within and outside of Medical Services and CAPS, who are treating you. We may also use health information about you to provide information to other providers for referrals. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process.

For Payment - We may use and disclose health information about you so we can bill and be paid for the services we or another provider provide to you. For example, we may need to give your insurance company information about a clinic visit you had so your insurance company will reimburse you for amounts you have paid.

For Health Care Operations - We may use and disclose health information about you so we can run our business, contact you, improve your care, and maintain our accreditation. For example, we may use health information to review your treatment and our services, to evaluate the performance of our staff caring for you, conduct compliance and medical reviews, maintain our compliance programs, and/or receive legal services to defend against possible malpractice suits and complaints.

Public Health Activities - We may disclose health information about you to officials in certain situations, such as

• Reporting information to public health authorities, including, but not limited to, Centers for Disease Control, Boulder County Public Health, the Colorado Department of Public Health and Environment, and their related reporting systems, to help prevent or control disease, including health information related to vaccines given to you by our clinic;
• Reporting abuse, neglect, or domestic violence to the proper law enforcement agency, and
• Reporting adverse events or reactions, enabling product recalls, or reporting defects to the Food and Drug Administration

To Avert a Serious Threat to Health or Safety - We may disclose health information about you to the University of Colorado Police Department, the Office of the Dean of Students, and/or the Students of Concern Team, if we believe it may prevent or lessen a serious or imminent threat to the health or safety of you or others.

Health Oversight Activities, Law Enforcement, and Government Requests - We may disclose health information about you

• To a health oversight agency for reasons, such as audits of the care we give, investigations, inspections, licensure or disciplinary actions;
• In response to a court order, administrative order, or lawfully issued subpoena;
• To law enforcement officials to assist locating a suspect, finding a missing person, or apprehending an individual; and
• For certain government functions, such as for national security, intelligence, or for the military.

Required by Law - We may use or disclose health information about you when we are required to do so by federal, state, or local law. For example, the Colorado Medical Practice Act requires us to report certain noninfectious injuries or conditions to law enforcement or state officials, such as gunshot wounds, abuse, death, etc. In addition, certain health professionals have a duty to warn others if you make a serious threat of imminent physical violence against a specific person or persons, including those identifiable by their association with a specific location or entity.

Agents of HW - We may disclose health information about you to agents of HW or to business associates working on our behalf. For example, software companies who assist us with our information systems may have access to information to help us perform our health care operations. They are required to maintain the privacy and security of your information.

Disaster Relief - We may use or disclose health information about you to a disaster relief organization, such as the Red Cross so that your family members, other relatives, close personal friends, or others can be notified of your location or general condition.

Coroners and Medical Examiners or Funeral Directors - We may disclose health information to a coroner, medical examiner, or funeral director. This may be necessary, for example, to identify a deceased person or to determine the cause of death.

Organ, Eye or Tissue Donation - If you are an organ donor, we may disclose health information to organizations that handle organ procurement or organ, eye, or tissue transplantation or to an organ donation bank.

Workers Compensation - We may disclose health information about you to the extent necessary to comply with workers’ compensation and similar laws that provide benefits for work-related injuries or illness without regard to fault.

Prescription Drug Monitoring Program (PDMP) - If you receive a controlled substance from the pharmacy, your prescription information will be submitted to the PDMP, and the information may be queried by specific individuals for a limited number of purposes as authorized by law.

The above is neither intended to nor may be construed as a waiver of or limitation to any legal authority for University of Colorado to otherwise use or disclose student information, including health information.

For certain health information, you can tell us your choices about what we share.

Individuals Involved in Your Care or Payment for Your Care - We may disclose health information about you to a friend, relative, family member, or any other person involved in your care if you choose. We also may use or disclose health information about you to notify, or assist in notifying, those persons of your location, general condition, or death.

Written Authorization Required - We will not disclose your health information without your written permission for marketing purposes or for the sale of your health information.

Fundraising - We may contact you regarding fundraising efforts, but it is your right to inform us to not contact you again.

CORHIO - We participate in the Colorado Regional Health Information Organization (CORHIO), which is an electronic health information exchange (HIE) among participating health care providers in Colorado. Our participation with CORHIO allows our providers to access health information electronically through the HIE for the purposes described in this Notice. At this time, our participation does not include entering health information into the HIE so none of your personal health information obtained at Medical Services or CAPS will be placed on the HIE network. You may choose to opt out of participation with the HIE. If you choose to opt out, your provider will not be able to view your patient information through the HIE. Please notify any health care provider if you would like to exercise your choice to opt out. A patient that has opted out previously may choose to opt in at any time.

Other Uses and Disclosures - If you provide us with authorization to use or disclose your health information for another purpose, you may revoke that authorization, in writing, at any time. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care we provided to you

You have the following rights with respect to health information that we maintain about you.

Right to Request Restrictions - You have the right to request a restriction or limitation on the health information we use or disclose about you. We are not required to agree to your request, and we may deny the request if it would affect your care or impede the University’s existing legal authority to use and disclose information. Even if we agree to a restriction, we may terminate the restriction at a later date. To request restrictions, please contact the compliance coordinator. Your request must be in writing.

Right to Receive Confidential Communications - We may contact you by telephone, mail or secure messaging. We may leave messages for you on your voicemail. We will try not to leave messages with specific information about you. You have the right to request that we communicate health information about you to you in a certain way or at a certain location. For example, you can ask that we only contact you by mail or at work. Contact your care provider or the compliance coordinator if you would like to request confidential communication and we will say yes to all reasonable requests.

Right to Inspect and Copy - You have the right to inspect and/or request a copy of health information that may be used to make decisions about your care. To inspect and/or request a copy of your health information, you must submit an Authorization for Release of Information form on the HW portal or in writing to the release of information coordinator. Your request should state specifically what health information you want to inspect or obtain. We will provide you with a summary or a copy of your health information, usually within 30 days of your request. We may charge a reasonable cost-based fee for providing the copy of health information.

Right to Request Amendments - You have the right to ask us to amend health information about you that you feel is incorrect or incomplete. This right does not pertain to information that was not created by us; information that is not part of the health information kept by us; information which you would not be permitted to inspect or obtain; and information that is accurate and complete as originally documented. To request an amendment, you must submit your request in writing to the compliance coordinator. A form is available to make this request. Your request must state the amendment desired and provide a reason in support of that amendment. If we grant the request, in whole or in part, we will seek your identification of, and agreement to share the amendment with other relevant persons. We also will make the appropriate amendment to the health information by appending or otherwise providing a link to the amendment.

Right to an Accounting of Disclosures - You have the right to request a list (accounting) of the times we have disclosed your health information, who we shared it with, and why. The accounting may be for up to six (6) years prior to the date on which you request the accounting. The accounting will not include disclosures made for the purposes of treatment, payment, and health care operations; disclosures of your health information made to you; or disclosures that you authorized in writing. To request an accounting of disclosures, you must submit your request in writing to the compliance coordinator. A form is available to make this request. Your request must state a time period for the disclosures. It may not be longer than six (6) years from the date we receive your request.

Right to a Copy of this Notice - You have the right to obtain a paper copy of this Notice. The Notice is displayed prominently, and copies are freely available in each clinical department and on the HW website.

We reserve the right to change this Notice. We reserve the right to make the revised or changed Notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice at our facilities. The Notice will contain the effective date on the first page. In addition, when you visit one of our facilities you may request an updated copy of the current Notice in effect.

As a student, if you believe your privacy rights under FERPA have been violated you may obtain a complaint form at https://studentprivacy.ed.gov/file-a-complaint.

You are encouraged to contact the compliance coordinator with any privacy complaints. You may submit a written complaint, which should include the date of occurrence, description of the activity or event, and the identity of the person filing the complaint. We have a complaint form that you may use. Anonymous complaints may be submitted, however anonymous complaints can only be investigated to the extent information is provided. To help us investigate your complaint, please include how to contact you. You will not be retaliated against or penalized for filing a complaint. Complaints should be filed in writing within 180 days of the occurrence and addressed to the compliance coordinator (see contact information below).

Beginning January 1, 2020, Colorado state law protects you* from “surprise billing,” also known as “balance billing.” These protections apply when:

• You receive covered emergency services, other than ambulance services, from an out-of-network provider in Colorado, and/or
• You unintentionally receive covered services from an out-of-network provider at an in-network facility in Colorado

What is surprise/balance billing, and when does it happen?

If you are seen by a health care provider or use services in a facility or agency that is not in your health insurance plan’s provider network, sometimes referred to as “out-of-network,” you may receive a bill for additional costs associated with that care. Out-of-network health care providers often bill you for the difference between what your insurer decides is the eligible charge and what the out-of-network provider bills as the total charge. This is called “surprise” or “balance” billing.

When you CANNOT be balance-billed:

Emergency Services
If you are receiving emergency services, the most you can be billed for is your plan’s in-network cost-sharing amounts, which are copayments, deductibles, and/or coinsurance. You cannot be balance-billed for any other amount. This includes both the emergency facility where you receive emergency services and any providers that see you for emergency care.

Nonemergency Services at an In-Network or Out-of-Network Health Care Provider
The health care provider must tell you if you are at an out-of-network location or at an in-network location that is using out-of-network providers. They must also tell you what types of services that you will be using may be provided by any out-of-network provider. You have the right to request that in-network providers perform all covered medical services. However, you may have to receive medical services from an out-of-network provider if an in-network provider is not available. In this case, the most you can be billed for covered services is your in-network cost-sharing amount, which are copayments, deductibles, and/or coinsurance. These providers cannot balance bill you for additional costs.

Additional Protections

• Your insurer will pay out-of-network providers and facilities directly.
• Your insurer must count any amount you pay for emergency services or certain out-of-network services (described above) toward your in-network deductible and out-of-pocket limit.
• Your provider, facility, hospital, or agency must refund any amount you overpay within sixty days of being notified.
• No one, including a provider, hospital, or insurer can ask you to limit or give up these rights.

If you receive services from an out-of-network provider or facility or agency OTHER situation, you may still be balance billed, or you may be responsible for the entire bill. If you intentionally receive nonemergency services from an out-of-network provider or facility, you may also be balance billed.

If you want to file a complaint against your health care provider, you can submit an online complaint by visiting this website: https://www.colorado.gov/pacific/dora/DPO_File_Complaint.

If you think you have received a bill for amounts other than your copayments, deductible, and/or coinsurance, please contact the billing department, or the Colorado Division of Insurance at 303-894-7490 or 1-800-930-3745.

*This law does NOT apply to ALL Colorado health plans. It only applies if you have a “CO-DOI” on your health insurance ID card.

Please contact your health insurance plan at the number on your health insurance ID card or the Colorado Division of Insurance with questions.

If you have any questions or want more information concerning this Notice, please contact the compliance coordinator at:

Student Health and Well-Being
Attn: Compliance Coordinator
119 UCB, Boulder, CO 80309-0119
Phone: 303-735-3004, E-mail: hwcompliance@colorado.edu

Email is not a secure form of communication. There is some risk that any confidential information contained in your email may be disclosed or intercepted. Please contact the compliance coordinator if you have sensitive information that you do not feel comfortable sending via email.