Notice of Privacy Practices

• How we may use and disclose your health information in the course of providing treatment and services to you.
• What rights you have with respect to your health information? These include the right:
  
  • To inspect and obtain a copy of your health information.
  • To request that we amend health information in our records.
  • To receive an accounting of certain disclosures we have made of your health information.
  • To request that we restrict the use and disclosure of your health information.
  • To request confidential communication about health information.
  • To receive a paper copy of this Notice.
• How to file a complaint if you believe your privacy rights have been violated.

If you have questions about this document, our privacy policies or any other questions regarding the privacy of your health information, please call 1-800-688-1867.

NOTE:
For your convenience, an English PDF version of this Notice is available for download. English version (PDF, 1 MB).
Para su conveniencia, una versión PDF en español de este Aviso está disponible. Versión en español (PDF, 808 KB).

Si necesita una copia en español por favor pídasela a un empleado del hospital o de le clínica. Gracias.

This Notice describes the practices of the Duke Health Enterprise (DHE) Organized Health Care Arrangement, which is composed of the following entities (referred to as “DHE Entities” in this Notice):

• Duke University Health System, Inc.
• Duke University Hospital
• Duke Regional Hospital
• Duke Raleigh Hospital, a campus of Duke University Hospital
• Duke Home Care and Hospice
• Duke University Affiliated Physicians, Inc. (dba Duke Primary Care)
• Associated Health Services, Inc. (dba Davis Ambulatory Surgery Center)
• Duke Health Integrated Practice, Inc.
• Duke PRMO, LLC
• Duke University Hospital Medical Staff
• Duke Regional Hospital Medical Staff
• Duke Raleigh Medical Staff
• Davis Ambulatory Surgical Center Medical Staff
• Duke University Health Care Components, including:
  
  • Duke University School of Medicine
  • Duke University School of Nursing
  • Duke University Student Health
  • Counseling and Psychological Services
  • Sexual Assault Support Services
  • Live for Life

We are committed to protecting the privacy of “protected health information” about you, as that term is defined in the privacy regulations issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). With certain limited exceptions, protected health information is generally defined as information that identifies an individual or that reasonably can be used to identify an individual, and that relates to the individual’s past, present, or future health or condition, healthcare provided to the individual, or the past, present, or future payment for healthcare provided to the individual. For simplicity, we will refer to protected health information simply as “health information” in this Notice. DHE Entities may share health information with other DHE Entities about treatment, payment and health care operations of the DHE. Our privacy practices concerning your health information are as follows:.

• We will safeguard the privacy of health information that we have created or received as required by law.
• We will explain how, when and why we use and/or disclose your health information.
• We will comply with the provisions of this Notice and only use and/or disclose your health information as described in this Notice.
• We will provide notice of a DHE breach of unsecured health information.

This Notice applies to the facilities, providers and workforce members of the DHE Entities, including:

• Any health care professional authorized to enter health information into your DHE medical record.
• All departments and units of the DHE.
• All employees, staff, volunteers and other DHE personnel.
• All hospitals, ambulatory surgery centers, clinics, ancillary provider locations, and other healthcare facilities and administrative offices of the DHE.

The following categories describe different ways that we may use and disclose health information. For each category of uses or disclosures, we will explain what we mean and try to give some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose health information will fall within at least one of the categories.

For Treatment. We may use your health information to provide, coordinate or manage your healthcare treatment and related services. This may include communication with other health care providers regarding your treatment and coordinating and managing your healthcare with others. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. The doctor may need to tell the dietitian if you have diabetes so that we can arrange for appropriate meals. Different DHE departments may also access your health information in order to coordinate services or items that you may need, such as prescriptions, lab work and x-rays. We may also disclose your health information to people, such as home health providers, who may be involved in your medical care after you leave our care.

For Payment. We may use and disclose your health information in order to bill and collect payment for treatment and services provided to you by the DHE. We may also disclose your health information to other providers so they may bill and collect payment for treatment and services they provided to you. Before you receive scheduled services, we may share health information about these services with your health plan(s) to obtain prior approval or to determine whether your insurance will cover the treatment. We may also share your health information with billing and collection departments or agencies, insurance companies and health plans to collect payment for services, departments that review the appropriateness of the care provided and the costs associated with that care and to consumer reporting agencies (e.g., credit bureaus). For example, if you have a broken leg, we may need to give your health plan(s) health information about your condition, supplies used (medications or crutches) and services you received (x-rays or surgery). This health information is given to our billing agency and your health plan so we can be paid or you can be reimbursed.

For Health Care Operations. We may use and disclose your health information to conduct activities that are called healthcare operations that allow us to improve the quality of care we provide and reduce healthcare costs. Examples of uses and disclosures for healthcare operations include the following:

• Reviewing and improving the quality, efficiency and cost of care that we provide to you and other patients.
• Combining health information of many patients to identify new services or improve care to the communities we serve.
• Evaluating the skills, qualifications, and performance of healthcare providers taking care of you.
• Providing training programs for students, trainees, healthcare providers or non-healthcare professionals (for example, billing clerks) to help them practice or improve their skills.
• Cooperating with outside organizations that assess the quality of care we provide. These organizations might include government agencies or accrediting bodies like the Joint Commission and the Accreditation Association of Ambulatory Healthcare, Inc.
• Cooperating with outside organizations that evaluate, certify or license healthcare providers, staff or facilities in a particular field or specialty. For example, we may use or disclose health information so that one of our nurses may become certified in a specific field of nursing.
• Sharing health information with the Duke University Police Department to maintain safety at our facilities.
• Assisting various people who review our activities. Health information may be seen by doctors reviewing services provided to you, and by accountants, lawyers and others who assist us in complying with applicable laws.
• Conducting business management and general administrative activities related to our organizations and services we provide.
• Resolving grievances within our organizations.
• Complying with this Notice and with applicable laws.

Contacting You. We may use and disclose health information to contact you about appointments, prescription reminders, clinical instructions, surveys, billing, or general communications. We may contact you by mail, telephone, email, or text message when you provide your address, telephone number, email address, or mobile phone number There is a risk that someone else could read or access unencrypted emails or text messages. If you do not wish to receive these types of text or email messages, please contact us @ appointmentcommunications@dm.duke.edu .

De-identified Health Information. We may use your health information to create “de-identified” information that is not identifiable to any individual in accordance with HIPAA. . We may create data sets of de-identified information of many patients to share with outside persons and companies to discover new ways to diagnose and treat diseases and to improve care for the communities we serve. We may also disclose your health information to a business associate for the purpose of creating de-identified information

Limited Data Set. We may use your health information to create a “limited data set” by removing certain identifying information. We may also disclose your health information to a business associate for the purpose of creating a limited data set. We may use and disclose a limited data set only for research, public health, or health care operations purposes. We may create a limited data set of many patients to share with outside persons and companies to perform research, public health or health care operations. Persons or companies receiving the limited data set must sign an agreement to protect your health information.

Treatment Alternatives. We may use and disclose your health information to manage and coordinate your healthcare and inform you of treatment alternatives and other health related benefits that may be of interest to you. This may include telling you about treatments, services, products and/or other healthcare providers. For example, if you are diagnosed with diabetes, we may tell you about nutritional and other counseling services that may be of interest to you.

Electronic Health Information Exchange (HIE) and other de-identified data partnerships. We may participate in certain HIEs that permit health care providers or other health care entities, such as your health plan or health insurer, to share your health information for treatment, payment and other purposes permitted by law, including those described in this Notice. We currently participate in the HIEs listed here .

We collaborate in the nference de-identified data partnership (“nference”) that permits researchers to use de-identified information to discover new ways to diagnose and treat diseases to improve care for the communities we serve. You may ask that your health information no longer be contributed to an HIE or nference by sending your request as described here . Opting out will not recall your health information that has already been shared, nor will it prevent access to health information about you by other means, e.g., request by your individual providers.

We participate in NC HealthConnex (the “Exchange”). You may request to opt out by submitting the form downloaded directly from https://hiea.nc.gov/patients/your-choices . Your opt out will not affect our obligation to disclose your health information to the Exchange when you receive services that are paid for by Medicaid.

Business Associates.There are some services provided in our organization through our business associates. For example, we may use a copy service to make copies of your medical record. When we hire companies to perform these services, we may disclose your health information to these companies so that they can perform the job we have asked them to perform. To protect your health information, however, we require the business associate to appropriately safeguard your health information.

Fundraising Activities. We may use your health information to contact you or your legal representative in an effort to raise money for DHE and its operations. We would only use contact information, such as your name, address and phone number, department of service, treating physician, outcome information, health insurance status, and the dates you received treatment or services. You have the right to opt out of receiving these communications. If you do not want us to contact you for fundraising efforts, please call 1-800-688-1867 or send your written request to: Office of the Assistant Vice President, Development and Alumni Affairs, Box 90616, Durham, NC 27701 or dukemed@duke.edu .

Hospital Directory. We may include certain limited information about you in the hospital directory while you are a patient at one of our hospitals. This information may include your name, location in the hospital, your general condition (e.g., fair, stable, etc.) and your religious affiliation. The directory information, except for your religious affiliation, may be released to people who ask for you by name. Your religious affiliation and other directory information may be given to a member of the clergy, such as a priest or rabbi, even if they do not ask for you by name. If you do not want information about you listed in the hospital directory, please notify Registration when you arrive or call the DHE facility’s Admitting Office.

Individuals Involved in Your Care or Payment for Your Care. We may share with a family member, relative, friend, or other person identified by you, health information that is directly relevant to that person’s involvement in your care or payment for your care. We may use or disclose health information in order to notify a family member, personal representative, or other person responsible for your care of your location, general condition or death. In addition, we may disclose health information about you to an entity assisting in a disaster relief effort so that your family, personal representative or others responsible for your care can be notified about your location, general condition or death. If you do not want health information about you used or disclosed in the above circumstances, please call 1-800-688-1867. We will comply with additional state law confidentiality protections if you are a minor and receive treatment for pregnancy, drug and/or alcohol abuse, communicable disease, or mental health.

We may use and/or disclose health information about you for a number of circumstances in which you do not have to consent, give authorization or otherwise have an opportunity to agree or object. Those circumstances include:

As Required by Law. We will disclose your health information when required to do so by federal, state, or local law or other judicial or administrative proceedings. For example, we may disclose your health information in response to an order of a court or administrative tribunal.

To Avert a Serious Threat to Health or Safety. We may use and disclose your health information when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent or reduce the threat.

Public Health Risks. We may disclose your health information to appropriate government authorities for public health activities. These activities generally include the following:

• To prevent or control disease, injury or disability.
• To report births and deaths.
• To report child abuse or neglect.
• To report reactions to medications or problems with products.
• To notify people of recalls of products they may be using.
• To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease.
• To notify the appropriate government authority if we believe an adult patient has been the victim of abuse, neglect or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.
• To support public health surveillance and combat bioterrorism.

Health Oversight Activities. We may disclose your health information to a federal or state health oversight agency for oversight activities authorized by law.

Law Enforcement. We may release health information to a law enforcement official for certain law enforcement purposes. For example, we may disclose your health information to report a gunshot wound. However, if you request treatment and rehabilitation for drug dependence from us, your request will be treated as confidential and we will not disclose your name to any law enforcement officer unless you consent.

Lawsuits and Disputes.In the course of any judicial or administrative proceeding, we may disclose your health information in response to a court or administrative order, subpoena, discovery request, or other lawful process.

Coroners, Medical Examiners and Funeral Directors. We may release health information to a coroner or medical examiner. This may be necessary to identify a deceased person or determine the cause of death. We may also release health information to funeral directors as necessary for them to carry out their duties.

Organ and Tissue Donation. We may release health information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

Research. Under certain circumstances, we may use and disclose health information about you for research purposes. For example, we may use health information in preparing to conduct a research project or to see if you are eligible to participate in certain research activities. Before we use or disclose health information for research, however, the research project will have been approved through a specialized approval process. We may also contact you to see if you are interested in participating in research. If you do not wish to be contacted to participate in research, please contact Research Navigators at 919-660-9172 or myresearchnavigators@duke.edu . We will use reasonable efforts to prevent this research contact. Calling Research Navigators will not apply to the use of your health information for research purposes as described above and will not prevent your providers from discussing research with you.

Specialized Government Functions. We may disclose health information about you if it relates to military and veterans’ activities, national security and intelligence activities, protective services for the President, and medical suitability determinations of the Department of State.

Workers’ Compensation. We may release your health information for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.

Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release your health information to the correctional institution or law enforcement official. This release is required: (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; and (3) for the safety and security of the correctional institution.

Other uses and disclosures of health information not covered by this Notice or the laws that apply to us will be made only with your written permission. We will ask your written permission before we use or disclose health information, for example, for the following purposes:

• Psychotherapy notes made by your individual mental health provider during a counseling session, except for certain limited purposes related to treatment, payment and health care operations, or other limited exceptions, including government oversight and safety.
• Certain marketing activities, including if we are paid by a third party for marketing statements as described in your executed authorization.
• Sale of your health information except certain purposes permitted under the regulations.

If you provide us permission to use or disclose your health information, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose your health information for the reasons covered by your written authorization. We are unable to take back any disclosures we have already made with your permission. We are required to retain records of the care that we provided to you.

North Carolina Law. In the event that North Carolina Law requires us to give more protection to your health information than stated in this Notice or required by federal law, we will give that additional protection to your health information. We will comply with additional state law confidentiality protections relating to treatment for mental health and drug or alcohol abuse. Unless you object in writing, we may release health information related to your mental health to other health care providers for treatment, quality assessment and improvement activities, and other permitted purposes, including case management and care coordination, disease management, outcomes evaluation, development of clinical guidelines and protocols, population-based activities and the provision, coordination, or management of mental health, developmental disabilities, and substance abuse services and other health or related services. Also, state law permits a hospice, home health, ambulatory surgery or outpatient cardiac rehabilitation patient to object in writing to having state licensing inspectors review their health information during a licensure survey, and we will comply with such written objection.

In accordance with federal law, generally we will obtain your written consent before we may disclose health information that would identify you as a patient for substance abuse services. There are exceptions to this general requirement. For instance, we may disclose health information to our workforce as needed to coordinate your care, to agencies or individuals who help us carry out our responsibilities in serving you, and to health care providers in an emergency.

You have the following rights regarding the health information we maintain about you:

Right to Inspect and Copy. You have the right to inspect and obtain a copy of your health information. To inspect and copy your health information, please visit www.dukehealth.org/medical-records or call 1-800-688-1867 for instructions on how to submit your written request. If you request a copy of the health information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request. We will respond to you within 30 days of receiving your written request. Under certain situations, we may deny your request in writing, describing the reason for denial and your rights to request a review of our denial.

Right to Amend. You have the right to request that we make amendments to clinical, billing and other records used to make decisions about you. Your request must be in writing and must explain your reason(s) for the amendment. We may deny your request if:

• The health information was not created by DHE unless you provide a reasonable basis for us to believe that the originator of the health information is no longer available to make the amendment.
• The health information is not part of the health information used to make decisions about you.
• We believe the health information is correct and complete.
• You would not have the right to inspect and copy the record as described above.

We will tell you in writing the reasons for the denial and describe your rights to give us a written statement disagreeing with the denial. If we accept your request to amend the health information, we will make reasonable efforts to inform others of the amendment, including persons you name that have received your health information. Please visit www.dukehealth.org/medical-records or call 1-800-688-1867 to obtain the appropriate form to request an amendment to your record.

Right to an Accounting of Disclosures. You have the right to receive a written list of certain disclosures we made of your health information. You may ask for disclosures made, up to six (6) years before your request. We are required to provide a listing of all disclosures, except the following:

• For treatment, payment, or health care operations purposes.
• Occurring as a byproduct of permitted uses and disclosures.
• Made to or requested by you or that you authorized.
• Made to individuals involved in your care, for directory or notification purposes, or for disaster relief purposes.
• Made for national security or intelligence purposes.
• Made to correctional institutions and other law enforcement officials.
• Made as part of a limited data set which does not contain certain health information which would identify you.

The list will include the date of the disclosure, the name (and address, if available) of the person or organization receiving the health information, a brief description of the health information disclosed, and the purpose of the disclosure. To request this list or accounting of disclosures, you must submit your request on the appropriate DHE form, which can be obtained by calling 1-800-688-1867.

Right to Request Restrictions. You have the right to request that we restrict the use and disclosure of your health information. We are not required to agree to your requested restrictions, except we will honor your request to not disclose to your health plan if the disclosure is for payment or healthcare operations purposes (and is not otherwise required by law) and the health information pertains solely to items or services for which you have paid out of pocket in full. If we agree to your request, there are certain situations when we may not be able to comply with your request. These situations include emergency treatment, disclosures to the Secretary of the Department of Health and Human Services, and uses and disclosures that do not require your authorization. You may request a restriction by submitting the appropriate DHE form, which can be obtained by calling 1-800-688-1867.

Right to Request Confidential Communication (Alternative Ways). You have the right to request confidential communications, i.e., how and where we contact you, about your health information. For example, you may request that we contact you at your work address or phone number. Your request must be in writing. We will accommodate reasonable requests, but when appropriate, may condition that accommodation on you providing us with information regarding how payment, if any, will be handled and your specification of an alternative address or other method of contact. You may request alternative means of communications by submitting the appropriate DHE form, which can be obtained by calling 1-800-688-1867.

Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice upon request. We will make available a copy of this Notice to you no later than the date you first receive service from us except for emergency services, in which case we will provide the Notice to you as soon as practicable. You may also obtain a copy of this Notice at any time from our website, www.dukehealth.org , or from any of the DHE treatment facilities listed in this Notice.

If you have any questions regarding this Notice, our privacy policies or if you believe your privacy rights have been violated or you wish to file a complaint about our privacy practices, you may contact:

Privacy Officer
Duke University Health System
DUMC Box 3162
Durham, NC 27710
1-800-688-1867

You may also send a written complaint to the United States Secretary of the Department of Health and Human Services. You will not be retaliated against for filing a complaint.

We reserve the right to change the terms of this Notice and to make new notice provisions effective for all health information that we maintain by:

• Posting the revised Notice at our facilities.
• Making copies of the revised Notice available upon request at DHE facilities.
• Posting the revised Notice on our website, www.dukehealth.org .

To receive a copy of this Notice in an alternate format, please contact the Duke Disability Management System at 919-668-1499.

Effective 04/14/2003
Revised 11/7/2003
Revised 05/2007
Revised 09/23/2013
Revised 08/01/2014
Revised 03/01/2019

Duke University Health System, Duke University, and other members of the Duke Health Enterprise identified in its Notice of Privacy Practices (collectively “Duke Health”), as well as any duly authorized affiliates, subsidiaries. Duke Health complies with applicable Federal civil rights laws and does not discriminate on the basis of race, color, national origin, age, disability, or sex. Duke Health does not exclude people or treat them differently because of race, color, national origin, age, disability, or sex. Duke Health:

• Provides free aids and services to people with disabilities to communicate effectively with us, such as: Qualified sign language interpreters
• Written information in other formats (large print, audio, accessible electronic formats, other formats)
• Provides free language services to people whose primary language is not English, such as: Qualified interpreters

ATTENTION: Language assistance services, free of charge, are available to you. Call 1-919-681-3007.

View our Notice of Nondiscrimination for more information.