EFFECTIVE: April 14, 2003
REVISED: October 13, 2014

At ECU Physicians (ECUP) and the other Health Care Components at East Carolina University (collectively referred to as ECU), we are committed to keeping your health information private. We are also required by law to keep your health information confidential.

This Notice describes the privacy practices of ECU. This Notice applies to all of your protected health information (PHI) that we keep here at East Carolina University. We are required to follow the terms of this Notice of Privacy Practices. We reserve the right to change the terms of this Notice. Any change to this Notice may apply to PHI we already have about you and any PHI we may receive in the future.
Copies of our Notice are on hand at all of our Health Care Components. You can also contact the Privacy Officer whose address and phone number are at the end of this Notice. You can see the Notice at any of our sites and on our website at
http://www.ecu.edu/ecuphysicians.

1. WE MAY USE AND DISCLOSE PHI ABOUT YOU WITHOUT YOUR AUTHORIZATION IN THE FOLLOWING SETTINGS.
   • Treatment: We may use and disclose PHI about you to provide you with health care treatment.
     • EXAMPLE - Your doctor may share PHI about you with another health care provider, or by ordering lab or radiology services, or by calling in a prescription.

Electronic Health Information Exchange Program. ECUP, and any Health Care Component that utilizes the ECUP electronic health record system, uses an electronic health information exchange program that allows patient information to be shared with providers that are involved in the patient's care. This exchange program provides a fast, secure, and reliable way to provide health information to providers. The health information is shared in accordance with this Notice of Privacy Practices and federal and state law. Patients have the right to opt out of the electronic health information exchange program; however, providers may still request and receive information using other methods, such as fax or mail.

If you have previously opted out of the electronic health information exchange program and would like to change this designation, you may obtain a form from patient registration staff or the ECU Physicians website. Complete the form and return to the address listed on the form or to the registration staff.

• Payment: We may use and disclose PHI about you to obtain payment for services. This could include certain sharing of PHI that your health insurance plan may require before it approves or pays for the health care services we advise for you.
  • EXAMPLE - Your health plan may have to approve any treatment. We will have to share your PHI with them so they will approve the treatment. We may also have to share more of your PHI with them after treatment so they will pay us.
• Healthcare Operations: We may use or reveal PHI about you to carry out certain business actions separately or as part of our involvement in an Organized Health Care Arrangement (OHCA) with Vidant Medical Center (VMC). These actions include, but are not limited to, quality assessment activities, training of medical students and residents, licensing, solving complaints, and carrying out other business actions.
  • EXAMPLE - We are reviewed by outside groups that measure the quality of the care our patients receive. They include government agencies or accrediting groups. We also review and measure the skills and training of the doctors that care for you. Both ECU and non-ECU health care workers not directly involved in your care may do such reviews.

Shared Electronic Medical Record System with Vidant Health. ECUP, and any Health Care Component that utilizes the ECUP electronic health record system, shares its electronic medical record system with Vidant Health (VH). This means that if you have ever been hospitalized at VMC or any other Vidant hospital, ECUP staff and physicians will be able to access your PHI on your medical record at Vidant if this access is required for your treatment at ECUP. Also, if you ever receive treatment at any Vidant hospital, any approved staff member or physician working at VMC or any other Vidant hospital may be able to access your PHI in our medical record if such access is required for your treatment while you are in the hospital. Access of your PHI by individuals at ECUP or VMC may also be permitted if it is required for payment for treatment or the mutual health care operations of ECUP and VH. The ability of your health care team to access your PHI at both ECUP and VH will help us provide you with better quality care.

2. WE MAY USE AND REVEAL PHI ABOUT YOU IN A NUMBER OF OTHER SETTINGS IN WHICH YOU DO NOT HAVE THE CHANCE TO AGREE OR OBJECT. THESE MAY INCLUDE:
   • Required By Law: For certain judicial or other administrative actions. For example, we may reveal PHI about you in response to a court order.
   • Public Health: For public health activities required by law to receive the information.
   • Health Oversight: To health oversight agencies for legally allowed audits, investigations, certain government programs, and inspections.
   • Abuse, Neglect, or Domestic Violence: To a public health expert for reports of child abuse or neglect. We may reveal PHI if we believe that you have been a victim of abuse, neglect or domestic violence to governmental agencies who are allowed to receive such information.
   • Food and Drug Administration: To a person required by the Food and Drug Administration to report harmful events, product defects or problems, tracking of products to permit recalls, or to conduct post marketing surveillance.
   • Law Enforcement: We may disclose your PHI to law enforcement for several law enforcement reasons including (1) legal courses of action required by law, (2) limited information requests for identification and location purposes, (3) pertaining to victims of a crime, (4) suspicion that death has occurred as a result of criminal conduct, (5) in the event that a crime occurs on the site of the practice, and (6) medical emergency when it is likely that a crime has occurred.
   • Serious Threat to Health or Safety: We may use and disclose information when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.
   • Coroners, Funeral Directors, and Organ Donation: To a coroner or medical examiner for identification purposes, or to find out the cause of death. We may also reveal protected health information to a funeral director in order to permit them to carry out their duties. PHI may be used and revealed if you are an organ, eye, or tissue donor.
   • Research: PHI may be used for research without the individual' s authorization if the University and Medical Center Institutional Review Board (UMCIRB) grants a waiver of the requirement for authorization. Two situations that require neither authorization nor waiver of authorization: 1) reviews preparatory to research, and 2) research on decedent's information
   • Criminal Activity: We may use or disclose PHI as necessary to prevent or lessen a serious threat to the health or safety of a person.
   • Specialized Government Functions: We may use or disclose PHI for the purpose of eligibility determination by the Department of Veterans Affairs. We may also reveal your PHI with federal officials for conducting national security activities and intelligence activities, protective services for the President, and medical suitability or determinations of the Department of State.
   • Inmates and other Law Enforcement Custodial Situations: If you are a prisoner and your doctor created or received your PHI in the course of giving care to you, we may use or disclose PHI as necessary to a correctional institution or law enforcement official.
   • Worker's Compensation: We may use or disclose PHI as necessary to support worker's compensation claims pending before the Industrial Commission.
3. OTHER USES AND DISCLOSURES OF PHI ABOUT YOU.
   • Appointment Reminders: We may contact you to remind you of an appointment for treatment.
   • Prescription Refill Reminders: We may contact you to remind you of a prescription refill.
   • Information About Treatment, Services or Products: We may use or reveal PHI to manage your care. This may include telling you about treatments, services, or products on hand.
   • Fundraising Activities: We may use or reveal PHI about you in order to contact you to raise money for ECU and its Health Care Components. If you do not want us to contact you about fundraising activities, you must tell our Privacy Officer as described below.
   • Family or Personal Representative: In certain situations, we may use or reveal PHI to a family member, other relative, or a close personal friend of the patient, or any other person identified by the patient, PHI directly relevant to such person's involvement with the patient's care or payment related to the patient's care.
4. ANY OTHER USE OR DISCLOSURE OF PHI ABOUT YOU REQUIRES YOUR WRITTEN AUTHORIZATION.
   • Written Authorization: For any reason other than those listed above, we will ask for your written authorization before we use or disclose your PHI. Specifically, the following reasons require your prior written authorization for most uses and disclosures of: (i) most uses and disclosures of psychotherapy notes; (ii) uses and disclosures of PHI for marketing purposes; and (iii) disclosures of PHI that constitute a sale.
   • Ability to Revoke a Written Authorization: Any written authorization we receive can be canceled at any time in writing. We will not disclose PHI about you if you cancel your authorization unless we did this prior to your cancellation.
5. YOUR RIGHTS REGARDING PHI ABOUT YOU.
   • Request Limits: You may request further limits on our uses and disclosure of PHI about you. We are not required to agree to all requested limits. If we agree, there still may be circumstances such as those described above in which you cannot object. Ask the clinic front desk or contact the Privacy Official as described below if you want to request further limits on your PHI.
   • Request for Required Restrictions: ECU is required to grant your request for restriction on the disclosure of PHI when such disclosure is (i) to a health plan for purposes of carrying out payment or health care operations and is not otherwise required by law; and (ii) such PHI pertains solely to a health care item or service for which you, or someone on your behalf other than your health plan, has paid ECU in full for the item or service.
   • Different ways to Contact You: You may request different ways for us to contact you about your PHI. Examples include using a different address, phone number, or mailing address. We will honor your request if we can. Ask the clinic front desk or contact the Privacy Officer as described below if you want to change the way we contact you about your PHI.
   • Right to see and get Copies of PHI: In most cases, you may see and receive a copy of your PHI kept in our clinical or billing records used to make decisions about you. You have a right to obtain copies of your PHI in electronic format and direct ECU to transmit the requested PHI to a clearly, conspicuously and specifically identified entity or person. We may charge you for copies or for providing you your PHI in electronic format. There are times in which we do not have to fulfill your request. We will write to you in these cases. Ask the clinic front desk or contact the Privacy Officer as described below if you want to see or get copies of your PHI.
   • Right to Request Amendments of PHI: You may request that the PHI in your medical record be amended (changed). We may tum down your request if we did not create the information, or if we believe the information is correct. If we tum down a request, we will write to you and will describe your rights for further review. Ask the clinic front desk or contact the Privacy Officer as described below if you want to request an amendment.
   • Listing of Disclosures we have made: You may request a list of the persons or places that PHI about you was revealed to for up to the last six (6) years. This does not include PHI disclosed because of your need for treatment , payment, our health care operations, and those allowed by law. Ask the clinic front desk or contact the Privacy Officer as described below if you want to request a listing of disclosures.
   • Copy of this Notice: You may request a copy of this Notice at any time. This will be on hand in our patient care delivery sites, or you may contact the Privacy Officer as described below.
6. NOTICE OF BREACH OF UNSECURED PHI
   • Breach Notification: We are required by law to notify you if a breach of your unsecured PHI occurs.
7. YOU MAY FILE A COMPLAINT ABOUT OUR PRIVACY PRACTICES.
   • If you think we have denied your privacy rights described in this Notice, if you have any questions about this Notice, or you want to complain to us about our privacy practices, you can contact the person below: