CENTRAL WASHINGTON UNIVERSITY
STUDENT MEDICAL AND COUNSELING CLINIC
NOTICE OF PRIVACY PRACTICES
The CWU Student Medical and Counseling Clinic (SMACC) safeguards the privacy of your health care information.
This Notice of Privacy Practices describes how we may use and/or disclose protected health information (PHI) to carry out treatment,
payment, or health care operations, or for the purposes that are permitted or required by law. It also describes your rights to access
and control of your protected health information. “Protected Health Information” (PHI) includes information that we have created or
received regarding your health. The PHI can relate to your past, present or future physical or mental health. PHI describes a disease,
diagnosis, procedure, prognosis, or condition of the individual and can exist in any medium, including but not limited to paper and
electronic files and electronic mail. It includes your medical records and personal information such as your name, social security
number, address, and phone number. We are required, under federal and state laws, to protect the privacy of your PHI. All employees
of the SMACC are required to maintain confidentiality of PHI, receive appropriate privacy training, provide you with this Notice of
Privacy Practices, and follow the practices and procedures set forth in this Notice.
AS AN EDUCATIONAL INSTITUTION, CWU IS SUBJECT TO THE FEDERAL FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT (FERPA)
WHICH PROTECTS THE PRIVACY OF STUDENT EDUCATION RECORDS., ALTHOUGH FERPA DOES NOT COVER STUDENT “TREATMENT
RECORDS,” THE PRIVACY OF STUDENT TREATMENT RECORDS IS SEPARATELY PROTECTED UNDER STATE LAW (RCW 70.02) AND
OTHER APPLICABLE STATE AND FEDERAL LAWS.
FOR NON-STUDENT CLIENTS OF SMACC, THE FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)
REQUIRES THAT WE PROVIDE YOU WITH THIS WRITTEN NOTICE OF HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND
DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. HIPAA APPLIES ONLY TO NON-STUDENTS WHO RECEIVE
SERVICES THROUGH SMACC AND WHEN PHI IS ELECTRONICALLY TRANSMITTED IN CONNECTION WITH SPECIFIED “COVERED
TRANSACTIONS” (SUCH AS BILLING HEALTH INSURANCE PLANS).
I.
CONFIDENTIALITY AND RIGHTS
Students:
Student health care information maintained by SMACC is confidential and will not be disclosed without the student’s
written consent, except as otherwise provided by law. SMACC will provide written notification to the student when treatment
records are sought by means of a third-party subpoena or other legal process. The confidentiality of student health care information
is protected by RCW 70.02 and other state and federal laws governing patient records.
Students have a right under RCW 70.02, except as provided under RCW 70.02 090, to review their own patient records and
to authorize disclosure of the records to third parties. Students have the right to authorize disclosure of their patient records to their
parents/guardians.
Non-Students:
Health care information about non-student patients of SMACC is confidential and will not be disclosed without the patient’s
written consent, except as otherwise provided by law. SMACC will provide written notification to the patient when treatment
records are sought by means of a third-party subpoena or other legal process. The confidentiality of non-student health care
information is protected by RCW 70.02 and other state and federal laws governing patient records, including the HIPPA Privacy Rule
when PHI is transmitted electronically in connection with specified “covered transactions,” such as billing the patient’s health
insurance plan.
The HIPPA Privacy Rule provides for the following patient rights:







Patients have a right to receive a notice of the privacy practices of any health care provider.
Patients have a right to see their PHI and get a copy.
Patients have a right to request that changes be made to correct errors in their records or to add information that has been
omitted.
Patients have a right to see a list of some of the disclosures that have been made of their PHI.
Patients have a right to request special treatment to their PHI.
Patients have a right to request confidential communications.
Patients have a right to complain.
Revised 09/24/2015
Shared_Data (S:) \Health_Center\Policies and Procedures\Privacy Policy 08/04/2015
The SMACC can disclose a patient’s PHI without the patient’s authorization if the disclosure pertains to treatment, payment, or
health care operations, or if the disclosure is otherwise required by law. For most other uses, the patient must authorize the
provider to make the disclosure.
II.
USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION
Uses and Disclosures of PHI based upon your written consent: You will be asked to sign a consent for release of information form
to use and disclose your PHI for treatment, payment, and health care operations.
For Treatment: We may use health information about you to provide you with medical treatment or services. We may disclose health
information about you to doctors, nurses, therapists, office staff, or personnel who are involved in taking care of you and your health.
For example, your provider may use your medical history to decide what treatment is best for you. He or she may also consult with
another practitioner about your condition in order to determine the most appropriate care for you.
For Payment: Health information will be used and disclosed to bill insurance companies. If you have an outstanding charge to your
CWU student account, do not provide your SMACC billing statement with your payment to the Student Accounts Office.
For Healthcare Operations:
The SMACC may use or disclose your PHI to support quality assurance, accreditation, peer review, and risk management
activities. These activities evaluate the performance of our staff to ensure that our patients receive quality care. Another activity would
be the preceptoring of a provider in-training (e.g., physician assistant or nurse practitioner who may, with your oral consent, have
access to PHI).
We may call you by name in the waiting room when it is time to see you. Our transcriptionist transcribes our records. All
SMACC employees sign a confidentiality statement that prohibits release of PHI without your authorization or notification.
Appointment Reminders: We may remind you by phone, text, voicemail, or in writing that you have a healthcare appointment
with us, unless you specifically ask us not to do so.
III.
SPECIAL SITUATIONS WHEN PROTECTED HEALTH INFORMATION MAY BE DISCLOSED WITH OR WITHOUT YOUR
WRITTEN AUTHORIZATION OR CONSENT
Family and Friends: We may disclose PHI about you to your family members or friends if we obtain your verbal agreement to do so,
of if we give you an opportunity to object to such a disclosure and you do not raise an objection. We may also disclose health
information to your family or friends if we can infer from the circumstances that you would not object. For example, we may assume
you agree to disclosure of PHI to your spouse or friend if they accompany you in the exam room during treatment. In a medical or
treatment emergency we may determine that disclosing information to a close relative or friend, who brought you to the office, is in
your best interests.
Health or Safety Threat: We may use or disclose PHI needed to prevent the spread of a communicable disease as authorized by law,
such as disclosure to a health department official for public health surveillance and intervention. We may disclose PHI, in order to
avert a serious threat, to appropriate CWU personnel on a need-to-know basis in a situation where your health or the health of others
may be jeopardized.
Military, Veterans, National Security: We may be required by military command or other government authorities, including ROTC, to
release to them health information about you. However, in most cases you will be informed of the request and be asked to authorize
a release of information.
Lawsuits, Disputes, Law Enforcement: If you are involved in a lawsuit, dispute, or suspected criminal activity, we must comply with
any court or administrative order, subpoena, warrant, or summons, subject to all applicable legal requirements, which may involve
disclosing PHI. Unless otherwise prohibited by law, CWU will provide you with written notice of any third-party subpoena or other
legal process seeking to obtain your PHI. Your PHI may be disclosed to CWU administrators and attorneys as needed to defend CWU
and/or SMACC against a lawsuit brought by you or on your behalf.
Correctional Facilities: If you are incarcerated in a correctional facility, we may disclose your PHI to the correctional facility for certain
purposes, such as providing health care to you or protecting your health and safety or that of others.
Abuse or Neglect: We may provide protected health information to government entities authorized to receive reports regarding
abuse, neglect, or domestic violence (i.e., posing a significant risk to safety).
Revised 09/24/2015
Shared_Data (S:) \Health_Center\Policies and Procedures\Privacy Policy 08/04/2015
Oversight Agencies: Under the law, we may make disclosures about you to health oversight agencies for certain activities such as
audits, examinations, investigations, inspections, and licensures.
Communication Barriers: We will assume that you agree to PHI disclosure to an interpreter or other person who assists with a
communication barrier and accompanies you into the exam room.
Coroners, Medical Examiners, Funeral Directors: We may release PHI to a coroner or medical examiner. This may be necessary, for
example, to identify a deceased individual or determine the cause of death.
Workers’ Compensation: We may release PHI as needed in connection with workers’ compensation claims.
IV.
Other Uses and Disclosures of Health Information Made With Your Authorization
We will not disclose your health care information for any purpose other than those identified above without your specific, written
authorization. An authorization differs from consent. Your consent gives us permission for treatment, billing, and healthcare
operations as described above. An authorization is more detailed and specific, and gives permission for purposes other than treatment,
billing and healthcare operations, and has an expiration date. If you give us authorization to use or disclose health information about
you, you may revoke that authorization in writing at any time. If you do revoke it, we will not disclose further information but cannot
take back any uses already made with your original permission.
V.
Your Rights: You have the right to authorize your PHI to be used in the following ways.
RIGHT TO INSPECT AND COPY: You may request to inspect and obtain a copy of your PHI contained in your records. We maintain
medical records for up to 8 years. In certain circumstances, such as those specified in RCW 70.02.090, your request could be denied.
A decision to deny access may be reviewable in the manner provided by law.
RIGHT TO AMEND: If you believe health information we have about you is incorrect or incomplete, you may ask us to amend the
information. Your request should be in writing with the reason to support the request. If your request is denied, you may respond
with a written statement of disagreement and ask that your statement be included with your PHI.
RIGHT TO REQUEST RESTRICTION OF DISCLOSURE: We cannot release or acknowledge the existence of HIV, substance abuse,
sexually transmitted infection (STI), or mental health information about you without a specific authorization or notification. You
have the right to request a restriction or limitation on any PHI we use or disclose for treatment, payment or healthcare operations.
You have the right to request a limit on the health information we disclose about you to someone who is involved in your care or the
payment for it (e.g., a relative or friend). Your request in writing must state the specific restriction requested and to whom you want
the restriction to apply.
RIGHT TO REQUEST ALTERNATIVE COMMUNICATION REGARDING PROTECTED HEALTH INFORMATION: You may request that we
communicate with you other than by phone, text or e-mail. You may choose an alternative method of communicating with you
about your health care. The request must be in writing. We will accommodate all reasonable requests.
RIGHT TO A LISTING OF DISCLOSURES: You may request, in writing, any disclosures of PHI made about you other than for
treatment, billing, or healthcare operation purposes. For additional information, you can contact the CWU Public Records Officer.
RIGHT TO A PAPER COPY OF THIS NOTICE: This is your paper copy of SMACC’s Notice of Privacy Practices. The Notice is also posted
on the CWU Student Medical and Counseling Clinic website.
VI.
COMPLAINTS
If you have any questions about this Notice, or if you believe your privacy rights have been violated, you may contact or file a
complaint with the Clinic’s Privacy Officer, Chris De Villeneuve, Executive Director and Privacy Officer at the Student Medical and
Counseling Clinic, 400 E. University Way, Ellensburg, WA 98926 (509) 963-1874.
VII.
CHANGES TO THIS NOTICE
Revised 09/24/2015
Shared_Data (S:) \Health_Center\Policies and Procedures\Privacy Policy 08/04/2015
We may change the terms of this Notice if clarifications or updates of the law are required. The revised Notice would apply to all PHI
that we maintain. We would post the revised Notice at our clinic and on the CWU Student Medical & Counseling Clinic website. You
may request a copy of any revised notice in effect at the time.
WHAT AM I BEING ASKED TO SIGN? Part of our legal responsibility is to ask for confirmation that you have received and reviewed
this Notice. This Notice is also to inform that you have rights under applicable laws governing your health care information. Your
signature here or on your demographics form is confirmation that you have received or reviewed a copy of this Notice.
______________________________
SIGNATURE / DATE
AAG 09.15.15
Revised 09/24/2015
Shared_Data (S:) \Health_Center\Policies and Procedures\Privacy Policy 08/04/2015