NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Pupil, Inc. (“Pupil”) offers limited ocular data collection services (the “Pupil Services” or the “Services”) in connection with certain licensed eye care professionals. Pupil is not permitted to give any medical advice, treat or diagnose anyone. Pupil is required by law to maintain the privacy of medical and health information about you (“Protected Health Information” or “PHI”) and to provide you with this Notice of Pupil’s legal duties and privacy practices with respect to PHI. When Pupil uses or discloses PHI, Pupil is required to abide by the terms of this Notice (or other notice in effect at the time of the use or disclosure).
How Pupil May Use or Disclose your PHI
The following categories describe ways Pupil may use and disclose your PHI (however, not every use or disclosure in a category is listed). Your written authorization is not required before Pupil may use or disclose your PHI for the purposes listed below, unless otherwise noted.
Treatment- Pupil itself does not provide treatment in connection with the offering of Pupil Services; Pupil is not permitted to give any medical advice, treat or diagnose anyone. However, Pupil necessarily discloses collected PHI to approved eye care professionals who are ultimately treating you in a limited capacity. With your consent, Pupil may disclose information about you to health care providers who are involved in your care and treatment.
Health Care Operations- Pupil may use, and with your consent, disclose your PHI as necessary to support the day-to-day activities and management of Pupil. For example, Pupil may use and disclose your PHI for purposes of internal administration and planning, quality review and improvement, legal services, etc. Additionally, Pupil must necessarily transmit your PHI to licensed eye care professionals for the purpose of providing you treatment.
Communication with Family and Others- Pupil may disclose your PHI to a family member, other relative, close personal friend or others who are identified by you, who are involved in facilitating Pupil Services or payment for your Pupil Services, when you are present for, or otherwise available prior to, the disclosure, and you do not object to such disclosure after given the opportunity to do so. Pupil also may disclose your PHI to such person upon your written consent or verbal agreement. If you are incapacitated or in an emergency circumstance, Pupil may exercise judgment to determine whether a disclosure is in your best interest. If Pupil discloses your PHI in such an event, Pupil would disclose only PHI that it believes directly relevant. Pupil also may disclose your PHI in order to notify, or assist in notifying, such persons of your location, general condition or death.
Public Health Reporting- Your PHI may be disclosed for public health purposes as required by law. For instance, Pupil is required to: 1) report cases of child abuse and neglect, elder abuse, disabled persons abuse, rape, and sexual assault; 2) report medical information for the purpose of preventing or controlling disease, injury or disability; 3) report information about products and services under the jurisdiction of the U.S. Food and Drug Administration; 4) report information to your insurer and/or any party involved in a Worker’s Compensation matter as required under laws addressing work-related illnesses and injuries or workplace medical surveillance; and 5) file a death certificate.
Health Oversight Activities- Your PHI may be disclosed to health oversight agencies as required by law. Health oversight activities include audit, investigation, inspection, licensure or disciplinary actions, and civil, criminal or administrative proceedings or actions. Pupil may be required to disclose your PHI to the Secretary of Health and Human Services, upon request, to determine Pupil’s compliance with the Health Insurance Portability and Accountability Act.
Health or Safety- Pupil may use or disclose PHI to prevent or lessen a serious and imminent danger to you or to others if the disclosure is to a person who is reasonably able to lessen or prevent the threat, including the target of the threat.
Judicial and Administrative Proceedings- Pupil may disclose PHI in the course of a judicial or administrative proceeding in response to a legal order or other lawful process.
Law Enforcement Officials- Your PHI may be disclosed to the police or other law enforcement officials as required or permitted by law or in compliance with a court order or a grand jury or administrative subpoena accompanied by a court order.
Specialized Government Functions- Pupil may use and disclose your PHI to units of the government with special functions, such as the U.S. military or U.S. Department of State under certain circumstances as required by law.
Ordered Examinations- Pupil may release your PHI when required to report findings from an examination ordered by a court or detention facility.
Decedents- Pupil may disclose your PHI to a coroner or medical examiner as authorized by law.
Organ and Tissue Procurement- If you are an organ donor, Pupil may disclose your PHI to organizations that facilitate organ, eye or tissue procurement, banking or transplantation.
Research- Pupil may use or disclose your PHI without your consent or authorization for research purposes if an Industrial Review Board/Privacy Board approved a waiver of authorization for such use or disclosure.
Required by Law- Pupil may use and disclose your PHI when required to do so by federal, state or local law.
Sale of PHI, Marketing and Other Uses & Disclosures Require Your Authorization- Pupil will not sell your PHI or otherwise use or disclose it for purposes of marketing (as defined by federal privacy laws) without obtaining your prior written authorization. Furthermore, use or disclosure of your PHI for any purpose other than is listed above requires your written authorization or that of your legal representative. Pupil will not deny Pupil Services if you do not sign the authorization. Furthermore, you may revoke the authorization at any time, in writing. If you revoke the authorization, Pupil will no longer use or disclose information about you for the reason covered in your written revocation.
Highly Confidential Information- Federal and state law require special privacy protection for certain highly confidential information about you (“Highly Confidential Information”); including 1) your HIV/AIDS status; 2) genetic testing information; 3) substance abuse (alcohol or drug) treatment or rehabilitation information; 4) confidential communications with psychotherapist, psychologist, social worker, sexual assault counselor, domestic violence counselor, or other allied mental health professional, or human services professional; 5) venereal disease information; 6) mammography records; 7) mental health community program records; 8) research involving controlled substances; 9) abortion consent form(s); and 10) family planning services. In order for Pupil to disclose your Highly Confidential Information, Pupil must obtain your separate, specific written consent and/or authorization unless Pupil is otherwise permitted by law to make such disclosure.
Your Rights Regarding Your PHI
Although your PHI is the physical property of Pupil, you have certain rights with regard to the information Pupil maintains about you in said PHI.
Notice- You have the right to receive a paper copy of this Notice (even if you have agreed to receive this Notice electronically).
Revoke Your Authorization- You have the right to revoke your authorization (or consent) to Pupil’s use/disclosure of your PHI, as long as you make your request in writing to Pupil. You can revoke your authorization (or consent) for future disclosures, but not for any disclosures made prior to when you first gave your authorization (or consent).
Receive Confidential Communications- You have the right to receive confidential communications of your PHI from Pupil by alternative means or at alternative locations. Pupil is required to accommodate any reasonable request you make. Requests must be submitted in writing to Pupil.
Inspect and Copy Your PHI- You have the right to inspect and copy your PHI that we hold in a designated record set. This usually includes medical records and billing records. To the extent that electronic health records are available, you have a right to an electronic copy of your record, and if you choose, to direct Pupil to transmit a copy of the electronic health record to a designated individual or entity. Pupil may charge a fee for copies of your records. If you wish to access your records, please obtain a record request form from, and submit the completed form to, Pupil’s Records Administrator. Questions about fees may be directed to Pupil’s Records Administrator as well.
Amend Your PHI- You have a right to request that Pupil amend your PHI if you feel that the information Pupil has is inaccurate or incomplete, as long as Pupil created the information you wish to amend. Pupil will not make changes to medical information created by another health care provider or changes that would make your medical record inaccurate or incomplete. If you wish to request an amendment to your records, please obtain an amendment request form from, and submit the completed form to, our Records Administrator.
Accounting and Access Report- You have a right to receive a list of how and to whom certain medical information has been disclosed, called an “accounting of disclosures.” The accounting does not include disclosures of your PHI that pertain to treatment, payment or other health care operations. To the extent Pupil uses or maintains your PHI in an electronic designated record set, you also have a right to receive an access report indicating who has accessed such PHI during a period of time up to six years prior to the date of your request. Pupil will provide an access report relating to such disclosures made by us and all of Pupil’s Business Associates. If you would like to request an accounting and/or an access report, please obtain a request form from, and submit the completed form to, our Records Administrator.
Notice of Breach- You have the right to receive a breach notification that complies with applicable Federal and State laws and regulations in the event of a breach of your unsecured PHI.
Revisions to Pupil’s Privacy Policies and Practices
Pupil is required by law to: make sure that the privacy of your PHI is maintained, provide you with this Notice of our legal duties and privacy practices and abide by the terms of the Notice that is currently in effect. Pupil reserves the right to change its privacy policies and practices, including this Notice, and to make the new policies and practices, including the revised Notice provisions, effective for all PHI that Pupil maintains. Pupil will post a copy of the current Notice in its office. You may request a copy of it at any time.
Questions Regarding the Privacy of Your Health Information
If you have questions regarding information contained in this Notice, if you would like to obtain additional information about our privacy practices, or if you wish to exercise your rights as listed in this Notice, you may contact Pupil’s Records Administrator.
How to File a Complaint
If you would like to submit a comment or complaint about Pupil’s privacy practices, you can do so by contacting our Records Administrator. You may also contact the Secretary of the Department of Health and Human Services. You will not be penalized or otherwise retaliated against for filing a complaint.
Office of Civil Rights
Department of Health and Human Services
Attn: Patient Safety Act
200 Independence Ave., SW, Rm. 509F
Washington, D.C. 20201
Practice Contact Information
You may contact our Records Administrator at:
3070 Larimer Street
c/o Records & Administration
Denver, CO 80205
Email Address: firstname.lastname@example.org
This Notice is effective as of March 23, 2016.