At Upham’s Corner Health Committee, Inc. (hereafter referred to as “UCHC” and encompassing all components) we understand that you expect quality care from us and we want to assure you that we are committed to treating and using health information about you responsibly and in a confidential manner. The law requires UCHC to keep health information private. UCHC is also required by law to notify patients of our legal duties and privacy practices used to keep health information private. This Notice of Information Practices describes the personal information we collect and how and when we use that information. It also describes your rights as they relate to your health information.

UCHC is a participating community health center of Boston HealthNet and is part of an integrated health care delivery system comprised of Partners HealthCare System (Partners), Children’s Hospital and Boston Medical Center (BMC). UCHC shares medical information with Partners, Children’s Hospital and BMC for treatment, payment and health care operations purposes, as described in this Notice.

Understanding Your Personal Health Record Information

Each time you visit UCHC, your provider makes a record of your visit. Typically, this record contains your health history, current symptoms, examination and test results, diagnoses, treatment, and a plan for future care or treatment.

This information, often referred to as your medical record, serves as a:

Understanding what is in your health records and how your health information is used helps you to

Examples of How UCHC May Use or Disclose Your Information

Treatment: Your primary doctor, optometrist, dentist, nurse practitioner, physician assistant, nurse or health care student involved in taking care of you at UCHC may use your health information to provide, coordinate or manage your health care and related services.

Example: A physician, nurse, or other member of your healthcare team will record information in your record to diagnose your condition and determine the best course of treatment for you. The primary care giver will give treatment orders and document what he or she expects other members of the healthcare team to do to treat you. Those other members will then document the actions they took and their observations. In that way, the primary caregiver will know how you are responding to treatment.

Payment: UCHC may use your health information to get paid for the health care services we have provided to you.

Example: We may send a bill to you, or to a third-party payer, such as your health insurance company. The information on or accompanying the bill may include information that identifies you, your diagnosis, treatment received, and supplies used.

Healthcare Operations: Healthcare operations are activities that all health care facilities, including UCHC, perform to make sure you are receiving appropriate and quality care and that UCHC is running properly.

Example: Members of the medical staff or quality improvement professionals may use information in your health record to assess the care and outcomes in your cases and the competence of the caregivers. We will use this information in an effort to continually improve the quality and effectiveness of the healthcare and services we provide.

Appointment Reminders & Other Care Issues: We may contact you (by telephone or by postcard or other mail) to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you.

Fund-raising: We may contact you, typically by mail, as part of a fund-raising effort. You have the right to opt out of this process and request not to receive such fund-raising materials.

Communication with Family: Unless you object, health professionals, using their best judgment, may disclose to a family member, other relative, close personal friend or any other person you identify, health information relevant to that person’s involvement in your care or payment related to your care.

Notification: To notify your family or other person responsible for your care of your location or general condition.

Disaster Relief Purposes: To authorized public or private entities to assist in disaster relief efforts.

Patient Directory: Unless you notify us that you object, we will use your name, UCHC account number and location in the facility for directory purposes. If it is determined that it is in your best interest, this information may be provided to our staff or others to help expedite your treatment or to inform other persons who ask for you by name.

Public Health: As required by law, we may disclose your health information to public health or legal authorities charged with preventing or controlling disease, injury, disability, or death.

Food and Drug Administration (FDA): We may disclose to the FDA health information relative to adverse effects / events with respect to food, drugs, supplements, product or product defects, or post marketing surveillance information to enable product recalls, repairs or replacement.

Health Oversight Agencies: We may disclose health information to authorities so they can monitor, investigate, inspect, discipline or license those who work in the health care system or for audits intended to oversee government benefit programs.

As Required by Law: Sometimes, we may disclose health information for purposes as required by law to persons such as law enforcement officials, court officials or government agencies.

Worker’s Compensation: We may disclose health information to the extent authorized by and to the extent necessary to comply with laws relating to worker’s compensation or other similar programs established by law.

Correctional Institutions: Should you be an inmate of a correctional institution, we may disclose to the institution or agents thereof health information necessary for your health and the health and safety of other individuals.

Research: On occasion, and only after a special approval process, UCHC may use or disclose health information to help conduct research. Most of the time you will be asked for authorization to participate in the research study. On rare occasions, and after UCHC staff performs special review and approval, we may participate in a research study where the requirement to obtain authorization is waived. In these occasional cases, UCHC staff will abide by established protocols to ensure the privacy of your health information. Such research might try to determine whether a certain treatment is effective in curing an illness.

Coroners and Medical Examiners: We are required by law to disclose certain information when requested by such persons to identify, determine cause of death or for the performance of other related duties.

Funeral Directors: We are required by law to disclose certain information when requested by funeral directors in order to carry out their duties.

Department of Health and Human Services (DHHS): Under the HIPAA privacy standards, we are required to disclose any health information that DHHS requests as necessary for them to determine our compliance with those standards. Your information may be requested.

*Please note that before we disclose your health information to any of the above-mentioned individuals or entities, we will verify their legal authority to receive such information. Additionally, please feel assured that whether we disclose your information orally, over the telephone or in person, or in writing, via U.S. Postal Service, E-mail or facsimile transmittal, we have policies and procedures in place to ensure that the intended recipient receives the information in a confidential and private manner.

Uses and Disclosures that Require Your Authorization

Other uses or disclosures of your record (not specifically identified above) will be made only with your written authorization. Specific disclosures requiring written authorization in Massachusetts include drug and alcohol treatment records, mental health records, records of sexually transmitted diseases (STDs) and HIV/AIDS and genetic testing information. In addition, under Federal law, UCHC must get your written authorization before (a) disclosing ‘psychotherapy notes’ (which are personal notes your behavioral health provider may keep separate from your medical record); (b) using or disclosing your information for marketing purposes; and, (c) making any disclosure that constitutes a sale of protected health information. You may withdraw an authorization at any time; however, we are not able to take back disclosures that we have already made with your authorization. All withdrawals must be made in writing.

YOUR RIGHTS Under the Federal HIPAA Privacy Standards

Although your health records are the physical property of the Upham’s Corner Health Committee, you have certain rights with regard to the information contained therein.
You have the right to:

If we grant the requested restriction, we will adhere to it unless you request otherwise or we give you advance notice. Please note that we are not required to agree to all requested restrictions; however, we are required to agree to your request to restrict disclosure of your information to a health plan (your medical insurer) concerning a specific item or service which you (or someone on your behalf) have paid for in full.

We reserve the right to charge a reasonable, cost-based fee for making copies.

In order to exercise this right, you must complete the UCHC Request for an Accounting of Disclosures Report form. We must provide you with the accounting report within 60 days.
The first accounting in any 12 month period is free. Thereafter, we reserve the right to charge a reasonable, cost based fee.

* Please note that you are only entitled by law to an accounting of disclosures that were made after April 14, 2003.

Revoke (cancel) your consent or authorization to use or disclose protected health information (PHI) except to the extent that we have already taken action in reliance on the consent or authorization.

Receive notification following a breach of unsecured electronic health information that affects you. [Please be assured that all electronic systems are secure and protected by numerous security mechanisms; and, numerous administrative security policies are in place and enforced. Despite this, there is the potential for unintended electronic breaches.]

How to Exercise These Rights (listed above) or Get More Information

To learn how to exercise your rights or for more information about matters listed in this Notice of Information Practices, please contact:
UCHC Privacy Officer

Address: Upham’s Corner Health Committee, Inc. / 500 Columbia Road, Dorchester, MA 02125
Telephone Number: (617) – 287 – 8000 x8131

OUR RESPONSIBILITIES Under the Federal HIPAA Privacy Standards

In addition to providing you your rights, as detailed above, the federal HIPAA privacy standard requires us to:

Maintain the privacy of your health information, including implementing reasonable and appropriate physical, administrative, and technical safeguards to protect the information.

Provide you with this notice as to our legal duties and privacy practices with respect to individually identifiable health information we collect and maintain about you.

Abide by the terms of this notice.

Train our staff on privacy and confidentiality laws as well as the UCHC procedures in place to comply with such laws.

Investigate and mitigate (lessen the harm of) any breach of privacy/confidentiality of which we become aware.

We will not use or disclose your health information without your consent or authorization, except as described in this notice or otherwise required by law.

How to Report a Problem: If you believe your privacy rights have been violated, please contact the Privacy Officer at Upham’s Corner Health Committee, Administration Department, 500 Columbia Road, Dorchester, MA 02125, (617)-287-8000 x8131.

If you feel that we have not adequately addressed your concerns, you may contact the Privacy Officer at the above address or contact the Secretary of the Department of Health and Human Services by calling (202) 619-0257 or 877-696-6775.

You will not be penalized for filing a complaint.

Note About the Destruction of Clinic Medical Records: Massachusetts General Law-chapter 111, section 70 includes a requirement for the amount of time a clinic, licensed by the Department of Public Health (DPH), must keep medical records of patients who no longer receive care at that clinic. After the stated time period, the clinic is allowed to destroy the medical records in order to make room for records of current and new patients. This law states that a clinic may destroy a record 20 years after the final treatment of the patient and after notifying DPH that the record(s) will be destroyed. It is the policy of UCHC to maintain medical records of all patients in accordance with applicable law. Periodically, medical record data is reviewed to determine which records meet the criteria for destruction. UCHC will only destroy records of patients who have not been treated by the health center in over 20 years; and, will do so only after notifying DPH of UCHC’s intent to destroy (following the notification process established by DPH). [This policy is only applicable to records of departments covered by the ‘clinic license’.]

We reserve the right to change our practices and to make the revisions effective for all protected health information (PHI) we maintain, including previously created or received PHI. Should our information practices change, we will post such changes in a public location within our buildings and make available a revised ‘Notice’.

EFFECTIVE DATE: September 23, 2013