HIPAA Notice of Privacy Practice

Effective Date February 24, 2020
University of Pennsylvania School of Dental Medicine.
This notice describes how dental information about you may be used and disclosed and how you can get access to this information. Please review it carefully. You will be asked to acknowledge that you have received our notice of privacy practices.

We understand that information about you and your health is very personal and therefore, we will strive to protect your privacy as required by law. We will only use and disclose your personal health information as allowed by applicable law.

We are committed to excellence in the provision of state-of-the-art health care services through the practice of patient care, education, and research. Therefore, as described below, your health information will be used to provide you care and may be used to educate health care professionals and for research. We train our staff and workforce to be sensitive about privacy and to respect the confidentiality of your personal health information.

We are required by law to maintain the privacy of our patients’ personal health information and to provide you with notice of our legal duties and privacy practices with respect to your personal health information. We are required to abide by the terms of this Notice of Privacy Practices so long as it remains in effect. We reserve the right to change the terms of this Notice of Privacy Practices as necessary and to make the new Notice of Privacy Practices effective for all personal health information maintained by us. You may receive a copy of any revised notice at any Penn Dental Medicine practice location.

Uses and disclosures of your personal health information
The following categories detail the various ways in which we may use or disclose your personal health information. For each category of uses or disclosures, we will give you illustrative examples. It should be noted that while not every use or disclosure will be listed, each of the ways we are permitted to use or disclose information will fall into one of the following categories.

Your Authorization. In specific situations, Penn Dental Medicine will not use or disclose your protected health information (PHI) without you signing an authorization form. This form will describe what information will be disclosed, to whom, for what purpose, and when. You have the right to revoke this authorization in writing, except to the extent we have already relied upon it. These situations include:

• Uses and disclosures of psychotherapy notes;
• Uses and disclosures of PHI for marketing purposes, including subsidized treatment communications;
• Disclosures that constitute a sale of PHI.

Except as outlined below, we will not use or disclose your personal health information for any purpose unless you have signed a form authorizing the use or disclosure.

Uses and Disclosures for Treatment. We will make uses and disclosures of your personal health information as necessary for your treatment. For instance, doctors, nurses, and other professionals involved in your care will use information in your medical record to plan a course of treatment for you that may include procedures, medications, tests, etc. We may also disclose your personal health information to institutions and individuals outside of Penn Dental Medicine that are or will be providing treatment to you.

Uses and Disclosures for Payment. We will make uses and disclosures of your personal health information as necessary for payment purposes. For instance, we may forward information regarding your medical procedures and treatment to your insurance company to arrange payment for the services provided to you or we may use your information to prepare a bill to send to you or to the person responsible for your payment.

Uses and Disclosures for Health Care Operations. We will use and disclose your personal health information as necessary, and as permitted by law, for health care operations. This is necessary to run the Penn Dental Medicine practices to ensure that our patients receive high quality care and that our health care professionals receive superior training. For example, we may use your personal health information in order to conduct an evaluation of the treatment and services we provide, or to review the performance of our staff. And, for education and training purposes, your health information may also be disclosed to doctors, nurses, technicians, medical students, residents, fellows and others.

Persons Involved in Your Care. Unless you object, we may in our professional judgment disclose to a member of your family, a close friend, or any other person you identify, your personal health information to facilitate that person’s involvement in caring for you or in payment for that care. We may use or disclose personal health information to assist in notifying a family member, personal representative or any other person that is responsible for your care of your location and general condition. We may also disclose limited personal health information to a public or private entity that is authorized to assist in disaster relief efforts in order for that entity to locate a family member or other persons that may be involved in some aspect of caring for you.

Appointments and Services. We may use your personal health information to remind you about appointments or to follow up on your visit.

Health Products and Services. We may from time to time use your personal health information to communicate with you about treatment alternatives and other health-related benefits and services that may be of interest to you.

Research. We may use and disclose your personal health information as permitted by law for research, subject to your explicit authorization, and/or oversight by the University of Pennsylvania Institutional Review Boards (IRBs), committees charged with protecting the privacy rights and safety of human subject research, or similar committee. In all cases where your specific authorization has not been obtained, your privacy will be protected by confidentiality requirements evaluated by such committee. For example, the IRB may approve the use of your health information with only limited identifying information to conduct outcomes research to see if a particular procedure is effective.

Business Associates. Certain aspects and components of our services are performed through contracts with outside persons or organizations, such as auditing, accreditation, legal services, etc. At times it may be necessary for us to provide your personal health information to one or more of these outside persons or organizations who assist us with our payment/billing activities and health care operations. In such cases, we require these business associates and any of their subcontractors, to appropriately safeguard the privacy of your information.

Other Uses and Disclosures. We are permitted or required by law to make certain other uses and disclosures of your personal health information without your consent or authorization. Subject to conditions specified by law:

• We may release your personal health information for any purpose required by law;
• We may release your personal health information for public health activities, such as required reporting of disease, injury, and birth and death, and for required public health investigations;
• We may release your personal health information to certain governmental agencies if we suspect child abuse or neglect; we may also release your personal health information to certain governmental agencies if we believe you to be a victim of abuse, neglect, or domestic violence;
• We may release your personal health information to entities regulated by the Food and Drug Administration if necessary to report adverse events, product defects, or to participate in product recalls;
• We may release your personal health information to your employer when we have provided health care to you at the request of your employer for purposes related to occupational health and safety; in most cases you will receive notice that information is disclosed to your employer;
• We may release your personal health information if required by law to a government oversight agency conducting audits, investigations, inspections and related oversight functions;
• We may use or disclose your personal health information in emergency circumstances, such as to prevent a serious and imminent threat to a person or the public;
• We may release your personal health information if required to do so by a court or administrative order, subpoena or discovery request; in most cases you will have notice of such release;
• We may release your personal health information to law enforcement officials to identify or locate suspects, fugitives or witnesses, or victims of crime, or for other allowable law enforcement purposes;
• We may release your personal health information to coroners, medical examiners, and/or funeral directors;
• We may release your personal health information if necessary to arrange an organ or tissue donation from you or a transplant for you;
• We may release your personal health information if you are a member of the military for activities set out by certain military command authorities as required by armed forces services; we may also release your personal health information if necessary for national security, intelligence, or protective services activities; and
• We may release your personal health information if necessary for purposes related to your workers’ compensation benefits.

Confidentiality of Alcohol and Drug Abuse Patient Records, HIV-Related Information, and Mental Health Records. The confidentiality of alcohol and drug abuse patient records, HIV-related information, and mental health records maintained by us is specifically protected by state and/or Federal law and regulations. Generally, we may not disclose such information unless you consent in writing, the disclosure is allowed by a court order, or in limited and regulated other circumstances.

Rights that you have Access to Your Personal Health Information. Generally, you have the right to access, inspect, and/or receive paper and/or electronic copies of the personal health information that we maintain about you. Requests for access must be made in writing and be signed by you or your representative. We will charge you for a copy of your medical records in accordance with a schedule of fees established by applicable state law. You may obtain an access request form from any of the Penn Dental Medicine practice locations.

Amendments to Your Personal Health Information. You have the right to request that personal health information that we maintain about you be amended or corrected. We are not obligated to make all requested amendments but will give each request careful consideration. All amendment requests, in order to be considered by us, must be in writing, signed by you or your representative, and must state the reasons for the amendment/correction request. If an amendment or correction you request is made by us, we may also notify others who work with us and have copies of the uncorrected record if we believe that such notification is necessary. Please note that even if we accept your request, we may not delete any information already documented in your medical record. You may obtain an amendment request form from any of the Penn Dental Medicine practice locations.

Accounting for Disclosures of Your Personal Health Information. You have the right to receive an accounting of certain disclosures made by us of your personal health information except for disclosures made for purposes of treatment, payment, and healthcare operations or for certain other limited exceptions. This accounting will include only those disclosures made in the six years prior to the date on which the accounting is requested but, in no event will include disclosures made prior to April 13, 2003. Requests must be made in writing and signed by you or your representative. The first accounting in any 12-month period is free; you will be charged a fee of $20 for each subsequent accounting you request within a 12-month period.

Restrictions on Use and Disclosure of Your Personal Health Information. You have the right to request restrictions on certain of our uses and disclosures of your personal health information for treatment, payment, or health care operations. A restriction request form can be obtained from the any Penn Dental Medicine practice location. We are not required to agree to your restriction request, unless otherwise described in this notice, but will attempt to accommodate reasonable requests when appropriate and we retain the right to terminate an agreed-to restriction if we believe such termination is appropriate. In the event we have terminated an agreed upon restriction, we will notify you of such termination.

Restrictions on Disclosures to Health Plans. You have the right to request a restriction on certain disclosures of your PHI to your health plan. We are only required to honor such requests for restriction when you or someone on your behalf, other than your health plan, pay for the health care item(s) or service(s) in full. Such requests must be made in writing, and should identify the services that the restriction will apply to.

Please note that Penn Dental Medicine is not required to inform and other providers of your request not to disclose PHI to a health plan, but will attempt to do so where feasible.

Confidential Communications. You have the right to request communications regarding your PHI from us by alternative means or at alternative locations and we will accommodate reasonable requests by you. You must request such confidential communication in writing to each department to which you would like the request to apply.

Breach Notification. We are required to notify you in writing of any breach of your Unsecured Protected Health Information as soon as possible, but in any event, no
later than 60 days after we discover the breach.

Paper Copy of Notice. As a patient you retain the right to obtain a paper copy of this Notice of Privacy Practices, even if you have requested such copy by e-mail or other electronic means.

Additional information Complaints. If you believe your privacy rights have been violated, you may file a complaint in writing with the doctor’s office or Guest Services department of the practice you visited. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services in Washington D.C. All complaints must be made in writing and in no way will affect the quality of care you receive from us.

For further information. If you have questions or need further assistance regarding this Notice of Privacy Practices, you may contact us in writing at Penn Dental Medicine Privacy Officer 240 South 40th Street, Philadelphia PA 19104, email at privacy@dental.upenn.edu or phone at 215-898-8975.