This notice describes how health information about you may be used and disclosed and howyou can get access to this information. Please review it carefully.

This Notice is provided on behalf of the University of North Carolina at Chapel Hill Department of Psychology, Community Clinic, The Clinic. The Clinic provides psychological services to the community and University of North Carolina at Chapel Hill campus.

PURPOSE OF NOTICE:
This Notice of Privacy Practices describes how we may use and disclose your Protected Health Information, PHI, to carry out treatment, payment or healthcare operations and for other purposes permitted or required by law. This Notice will also describe your rights and certain obligations we have prior to using or disclosing your PHI. “Protected Health Information” or “PHI” is information about you or your minor child, including demographic data such as name, address, phone numbers, et cetera, that may identify you or your minor child and that relates to your or your minor child’s past, present or future physical or mental health and related healthcare services.

We understand that PHI about you is personal and confidential, and we are committed to protecting its confidentiality. We create a record of the care and services you receive at the Clinic to enable us to provide such services and to comply with legal requirements. We are required by law to provide this Notice and to maintain the privacy of PHI. We must abide by the most current version of this Notice, and we reserve the right to change the privacy practices described in it, with such changes to be effective for all PHI that we maintain. You may receive a current copy of this Notice either at our Clinic locations or by downloading it from our website.

THIS NOTICE DESCRIBES THE PRACTICES OF:
The Clinic’s healthcare professionals, employees, students-in-training and others who work or provide healthcare services at our facility.

Your Privacy Rights:
You have the following rights relating to your Protected Health Information and may:

• Request a paper copy of this Notice.
• Inspect and/or obtain a copy of PHI in records used to make decisions about you. You have a right to a copy of such records in their original electronic version, or if this is not possible, in another electronic form that is mutually agreeable to you and us. We may charge you related fees. Under certain circumstances, we may deny this request. In some situations, you have the right to have the denial of your request reviewed by a licensed healthcare professional from the Clinic who was not involved in the original denial decision.
• Request that an amendment be added to your record. We will ask you to put these requests in writing and provide a reason that supports your request. We are allowed to deny these requests in certain circumstances.
• Request in writing a restriction on certain uses and disclosures of your PHI. We are not required to abide by the
  requested restrictions in most circumstances, however, we must agree to your request to restrict disclosure of PHI about you to your health plan for payment purposes when the PHI pertains solely to a health care item or service for which you, or someone on your behalf, have paid in full out of pocket.
• Obtain a record (“accounting”) of certain disclosures of PHI about you.
• Make a reasonable request to have confidential communications of PHI about you sent to you by alternative means or at alternative locations.
• Revoke your authorization for use or disclosure of PHI about you, except that such revocation will not affect uses or disclosures permitted or required by law without authorization or any use or disclosure that already has occurred prior to the revocation. A revocation of authorization must be in writing and signed by you.
• Receive notice of any breach of your unsecured PHI.

You may exercise any of the above rights by contacting Department of Psychology Community Clinic, Attn: HIPAA Liaison, CB# 3270, UNC Chapel Hill, Chapel Hill, NC 27599-3270, and/or by calling the Clinic HIPAA Liaison at 919-962-6906.

Our Responsibilities:
We are required by law to protect the privacy of your PHI; abide by the terms of this Notice; make this Notice available to you; and notify you if we are unable to agree to a requested restriction or an alternative means of communicating. We will obtain your general consent for some uses and disclosures of PHI about you, for other uses and disclosures of PHI about you we will obtain your authorization, and, in some circumstances, we may use and/or disclose PHI about you without your authorization.

Uses & Disclosures:
Unless otherwise stated below, the use or disclosure described is permitted by law to be made without your authorization.

Treatment:
We need to use and disclose PHI about you to provide, coordinate or manage your health care and related services. This may include communicating with other health care providers regarding your treatment and coordinating and managing your health care with others. For example, we need to use and disclose PHI about you, both inside and outside our Clinic, to coordinate services you may need and when referring you to another health care provider.

Payment:
Generally, we need to use and disclose PHI about you to others to bill and collect payment for the treatment and services provided to you by us or by another provider. Before you receive scheduled services, we may need to share information about these services with your health plan(s). Sharing information allows us to ask for coverage under your plan or policy and for approval of payment before we provide the services.

Regular Healthcare Operations:
We may use PHI about you to review the care you received, how you responded to it, and for other business purposes related to operating our clinic. “Healthcare operations” also may include activities such as training or evaluating staff or trainees within our organization.

Business Associates:
There are some services we provide through outside individuals or companies that we call “Business Associates”, including vendors, contracted health care providers, offsite storage facilities, and liability insurance carriers. In order to protect PHI about you, “Business Associates” are required by law to provide appropriate safeguards and procedures for privacy and security of the PHI entrusted to them under their contract with us.

Communication with Involved Individuals:
We may share PHI with a family member, a close personal friend, or a person that you identify, if we determine they are involved in your care or in payment for your care, unless you tell us not to do so.

Research:
We may disclose information to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your health information.

Coroners, Medical Examiners, Funeral Directors:
The law allows us to disclose PHI to these people so that they may carry out their duties.

Organ Donor Organizations:
We are required to share PHI about you for purposes of tissue, eye or organ donation.

Contacts:
We may contact you to provide appointment reminders, to discuss treatment alternatives or other health related benefits that may be of interest to you as a patient.

Fundraising:
We may use and/or disclose certain PHI about you for fundraising purposes. This may include disclosure to a foundation, or contacting you to raise money for the Clinic and its operations. All fundraising communications will give you a way to opt out of receiving such communications in the future.

Food and Drug Administration (FDA):
We may share PHI about you with certain government agencies like the FDA so they can recall drugs or equipment.

Workers Compensation and Your Employer:
In certain circumstances, we may disclose PHI about you to your employer and your employer’s workers’ compensation carrier regarding a work-related injury or illness.

Public Health Activities:
We may disclose PHI about you to public health agencies that are charged with preventing or controlling disease, injury or disability or as required by law. We may disclose PHI about you if you have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition. Disclosures include for example, lifetime reporting to the North Carolina Cancer Registry information about cancer patients that we treat and is required by law.

Correctional Institution:
We may disclose PHI about you to a correctional institution having lawful custody of you.

Law Enforcement:
We may disclose PHI about you in order to comply with laws that require the reporting of certain types of wounds or other physical injuries.

As Required by Law:
We must disclose PHI about you when required by federal, state or local law.

Health Oversight:
We may disclose PHI about you to a state or federal health oversight agency, for activities it is authorized by law to carry out, such as investigations and inspections.

Abuse, Neglect or Domestic Violence:
We must disclose PHI about you to government authorities that are authorized by law to receive reports of suspected abuse, neglect or domestic violence.

Legal Proceedings:
We may disclose PHI about you in the course of any judicial or administrative proceeding and in response to a court order, subpoena, discovery request or other lawful process.

Required Uses and Disclosures:
We must make disclosures of PHI when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the requirements of the HIPAA Privacy Regulations.

To Avoid Harm:
We may use and/or disclose PHI about you when necessary to prevent or lessen a serious threat to your health or safety, or to the health or safety of the public or another person.

For Specific Government Functions:
In certain situations, we may disclose PHI of military personnel and veterans for national security activities or other purposes, as required by law.

Marketing:
We will not, without your advance authorization, use and/or disclose PHI about you to engage in a marketing activity for which we receive financial compensation, nor will we sell your PHI.

Application of Other Laws:
If a use and/or disclosure of PHI about you described above is prohibited or materially limited by other laws that apply to us, it is our intent to meet the requirements of the more stringent law. For example, some North Carolina laws provide more protection, with some exceptions, for specific types of information, including: specific communicable diseases, for example, HIV/AIDS, syphilis, TB, mental health, developmental disabilities, and substance abuse.

Special Provisions for Minors:
Certain minors may be treated as adults for all purposes. These minors have all rights and authority included in this Notice for all services.

OTHER USES OF PROTECTED HEALTH INFORMATION
Under any circumstances other than those listed above, we will obtain your written authorization before we use or disclose PHI about you. If you sign a written authorization allowing us to use or disclose PHI about you in a specific situation, you can later revoke your authorization by contacting the Clinic’s HIPAA Liaison. You must revoke your authorization in writing. The revocation will not apply to PHI about you that has already been used or disclosed in reliance on your authorization. Upon receiving your written revocation, we will not use or disclose PHI about you, except for disclosures already in process.

If you think we have violated your privacy rights, you want to complain to us about our privacy practices, or you have any questions regarding the privacy of PHI about you, you can contact the person listed below:
UNC Privacy Office
Attn: Chief Privacy Officer
CB #1150, 440 W. Franklin St., Chapel Hill, NC 27599
919-962-6332
privacy@unc.edu

You may also send a written complaint to the United States Secretary of the Department of Health and Human Services. Contact information can be found at the website for the Office of Civil Rights. If you file a complaint, we will not take any action against you or change our treatment of you in any way.

Effective: March 10, 2003, Revisions: February 2011; August 2012; September 2013