Patient Privacy Policy

This Notice describes the privacy practices of University of Florida (“UF”) and University of Florida Health (“UF Health”), including how we may use and disclose medical information about you and how you can access your medical information. This Notice applies to all of the records of your care at UF and UF Health. Please review it carefully.

Summary

Your rights

The following is a brief summary of your rights. A more detailed description of each right is also included in this document.

• Get an electronic or paper copy of your medical record
• Ask us to correct your medical record
• Request confidential communications
• Ask us to limit the information we use or share about you
• Get a list of those with whom we have shared your information
• Get a copy of this Notice
• Choose someone to act for you
• File a complaint if you believe your privacy rights have been violated

Your choices

You have choices in some of the ways UF Health uses and discloses your health information such as:

• Discussing information about your condition with family, friends or other individuals involved in your care
• During disaster relief efforts
• Including your name in a hospital directory
• Mental health care provided to you
• Marketing of our services
• Our fundraising efforts

Our uses and disclosures

UF Health may use and disclose your medical information for the following purposes:

• Treating you and coordinating your care
• Billing for the services we provide to you
• Contacting you
• Running our organization
• Education
• Assisting with public health and safety issues
• Providing schools with proof of student immunizations
• Complying with the law and crime prevention
• Working with a medical examiner, coroner or funeral director
• Conducting scientific research
• Responding to organ and tissue donation requests
• Addressing workers’ compensation, law enforcement and other government requests
• Coordinating with a correctional institution if you are in lawful custody
• Sharing with business associates assisting us with providing services
• Creating de-identified health information and limited data sets needed for research and other purposes
• Responding to lawsuits and legal actions
• Health Information Exchange participation

UF is designated as a hybrid entity for compliance with the Health Insurance Portability and Accountability Act (“HIPAA”). UF’s healthcare components include the UF health science colleges, and primary care and specialty physician practices. UF and these healthcare components comprise an Organized Health Care Arrangement (“OHCA”) combined with UF Health’s hospital affiliates including UF Health Shands Hospital, UF Health Jacksonville Hospital, UF Health Leesburg Hospital, UF Health Spanish Plaines Hospital, UF Health St. Johns Hospital, Florida Recovery Center (Part 2 program), UF Health Proton Therapy Institute and other affiliated remote hospital locations, clinics, health care providers and entities. Under the OHCA, UF operates as an organized, clinically integrated health system known as UF Health. UF and UF Health share a Notice and appropriately collaborate to comply with HIPAA and respond jointly to matters involving mutual patients and health care operations.

Your rights

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

Get an electronic or paper copy of your medical record

• You can see or get an electronic or paper copy of your medical record and other health information we have about you.
• We will provide you with a copy or a summary of your health information in accordance with applicable state and federal requirements. We may charge you a reasonable, cost-based fee.
• You may revoke a signed authorization to use or disclose your health information, except to the extent that action has already been taken in reliance on your signed authorization.
• To obtain a copy of your medical record or revoke an authorization, directly contact the physician practice or Health Information Management Department at the hospital, or Part 2 program where you received care.

Ask us to correct your medical record

• You can ask us to correct health information about you that you think is incorrect or incomplete.
• We may not honor your request, but we will explain why in writing within 60 days.
• To request a correction to your medical record, directly contact the physician practice, Health Information Management Department at the hospital, or Part 2 program where you received care.

Request confidential communications

• You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address.
• We will agree to all reasonable requests.
• To request confidential communications, directly contact the Admissions Department supervisor at the hospital or Part 2 program, or the manager/supervisor at the physician practice where you received care.

Ask us to limit what information we use or share about you

• You can ask us not to use or share certain health information for treatment, payment or our operations.
• We are not required to agree to your request. For example, we may say “no” if it would affect your care.
• If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will agree unless a law requires us to share that information.

Get a list of those with whom we have shared your information

• You can ask for a list (accounting) of the times we’ve shared your health information for six years prior to the date you ask, who we shared it with, and why.
• We will include all the disclosures except for those related to treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We will provide one accounting per year for free, but will charge a reasonable, cost-based fee if you ask for another one within 12 months.
• For Substance Use Disorder treatment records by our Part 2 program, you can ask for an accounting for three years prior to the date of your request of all the times we’ve shared your records:
  • With your signed authorization; and
  • For treatment, payment and health care operations, but only when the records were disclosed through our electronic health record system.
• To request an accounting, contact the Privacy Office at 1-866-682-2372 (toll-free) or send an email to privacy@ufhealth.org.

Get a copy of this privacy Notice

• You can ask for a paper copy of this Notice at any time, even if you have agreed to receive the Notice electronically.
• You may also view a copy of this Notice on our websites.

Choose someone to act for you

• If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.
• We will make sure the person has this authority and can act for you before we take any action.

Revoke your written consent to share health information

• You can revoke your written authorization giving us permission to share your health information by directly contacting the physician practice, Health Information Management Department at the hospital, or Part 2 program where you gave your written authorization. Revoking your written authorization will not apply to actions already taken in reliance of your written authorization.

File a complaint if you believe your privacy rights have been violated

• For questions, more information about this Notice, or concerns and complaints, please contact us.
  UF Health Privacy Office
  P.O. Box 103175
  Gainesville, FL 32610-3175
  Phone: 1-866-682-2372 (toll-free)
  Email: privacy@ufhealth.org
• If you believe your rights have been violated, you can also file a complaint with the Office for Civil Rights at:
  Centralized Case Management Operations
  U.S. Department of Health and Human Services
  200 Independence Avenue, S.W., Room 509F HHH Bldg.
  Washington, D.C. 20201
  Phone: 1-800-368-1019 (toll-free)
  Email: ocrcomplaint@hhs.gov
  Or visit: www.hhs.gov/ocr/privacy/hipaa/complaints/.
• We will not retaliate against you for filing a complaint.

Your choices

For certain health information, you can tell us your choices about how we use and disclose your health information. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions.

In these cases, you have both the right and choice to tell us whether to:

• Share information with your family, close friends, or others involved in your care;
• Share information in a disaster relief situation; and
• Include limited health information about you in our hospital directory while you are a patient at one of our hospitals such as your name, room number, your general condition (e.g., fair, stable, etc.) and your religious affiliation, which is shared with members of clergy and people who ask for you by name. If you do not want information about you listed in the hospital directory, please notify Registration when you arrive.

If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat.

In most cases, we will not share your information without written permission for:

• Marketing purposes
• Selling your information
• Psychotherapy notes kept by a mental health professional that document or analyze the contents of a therapy session as defined under HIPAA

Fundraising

• We may contact you for fundraising efforts, but you can tell us not to contact you again.
• If you do not wish to be contacted for this reason, please let us know by calling 352-273-7986 or visit www.giving.ufhealth.org/about-us/opt-out/.

Our uses and disclosures

How do we typically use or share your health information? We typically use or share your health information in the following ways:

Treatment

• We can use your health information and share it with other professionals who are treating you, and for purposes of recommending treatment alternatives, care coordination, and alternative care settings.

Artificial Intelligence (“AI”) in care and operations

• We may use AI-enabled tools, products and devices to support the delivery of clinical care (e.g., imaging analysis), in patient communications, quality improvement and business operations. AI outputs do not replace clinician judgment; we use human oversight for clinical decision-making. We may use de-identified or limited data sets to develop, validate or monitor AI tools.

Bill for our services

• We can use and share your health information to bill and get payment from health plans or other entities.
• Example: We give information about you to your health insurance plan so it will pay for the services you received from us.

Contact you

• We may use and disclose your health information to contact you about appointments, clinical instructions, surveys or general communications.
• We may contact you about treatment alternatives, our health-related products or services and to provide information about your general health that may be of interest to you.
• We may contact you by mail, telephone, email or text message when you provide your address, telephone number, email address or mobile phone number.

Run our organization

• We can use and share your health information to run our organization, improve patient care, and contact you when necessary.
• Example: We can use and share your health information to support programs and activities to improve the quality of treatment services and provide customer service. To do so, we may combine health information about many patients to evaluate the need for new services or treatments to improve the quality of patient care.
• We can disclose your health information to doctors, nurses, technicians, medical students and other personnel for review and educational purposes.
• We can share your health information for quality improvement activities, evaluations of healthcare professionals, and state and federal regulatory reviews.
• We can disclose your health information to health oversight agencies such as those that enforce compliance with licensure or accreditation requirements.

Education

• We can use and share photographs, videos and/or health information related to your treatment with residents, interns, students and other individuals observing or participating in your care at UF and UF Health and our affiliated teaching organizations for education purposes.

How else can we use or share your health information?

We are allowed or required to share your information in other ways – usually in ways that contribute to the public good, such as the ways mentioned below.

Student immunizations

• We can disclose proof of your child’s immunizations to their school based on your verbal or written permission.

Compliance with the law

• We will share information about you if federal, state or local law or regulations require it, including with the Department of Health and Human Services if it seeks evidence that we are complying with federal privacy law.

Medical examiner, coroner or funeral director

• We can share health information with a coroner, medical examiner or funeral director to report the death of a patient.

Public health and safety

• We can share health information about you for certain situations such as:
  • Preventing or controlling disease, injury or disability
  • Reporting births and deaths
  • Helping with product recalls
  • Reporting adverse reactions to medications
  • Reporting suspected abuse, neglect or domestic violence if required by law
  • Notifying a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease
  • Supporting and complying with public health surveillance activities and requirements
  • Combatting bioterrorism
  • Preventing or reducing a serious threat to anyone’s health or safety; however, any disclosure would only be to someone able to help prevent or reduce the threat

Research

• Under certain circumstances, we can use or share your information for research purposes and collect information in databases to be used later for research. All research projects are reviewed and approved by an Institutional Review Board (“IRB”) to protect the privacy of your health information. We may also contact you about research opportunities if you choose to participate in the Consent2Share Research Contact Registry. If you choose to participate and later decide you no longer want to be contacted about research, you can request to have your name removed from our contact list by calling the Consent2Share Helpline at 352-265-3282.
• Example: We might use health information in preparing to conduct a research project or to see if you are eligible to participate in certain research activities.

Florida law generally requires patient consent for disclosures of identifiable health information to outside researchers for medical research purposes.

Organ and tissue donation

• We can share health information about you with organ procurement organizations.

Workers’ Compensation, law enforcement and other governmental entities

We can use or share health information about you:

• For workers’ compensation claims or other similar programs
• For law enforcement purposes or with a law enforcement official
• With health oversight agencies for activities authorized by law
• For special government functions such as military and veterans’ activities, national security, intelligence activities and protective services for the President

Florida law generally requires patient consent for disclosures of health information for national security purposes, unless the disclosure is specifically required by federal law.

Correctional Institution

• We can share your health information when you are in lawful custody when necessary for your health and the safety of others.

Associates

• We can share health information about you with business associates that assist us and who have the same contractual obligation to safeguard your information.

De-identified information

• We may use health information about you to create de-identified information. This is information that has gone through a rigorous process to remove identifiers, so the risk the information can identify you is very small. Once health information is de-identified in compliance with HIPAA, we may use or disclose it for various purposes, such as research or development of new health care technologies, and the de-identified information will no longer be subject to this Notice or your rights described herein. We may receive payment for the de-identified information.

Limited data set

• We may use your health information to create a limited data set. This is health information that has certain identifying information removed.
• We may use and disclose a limited data set only for research, public health or health care operations purposes, and any person receiving the limited data set is obligated to agree to protect the information.

Lawsuits and legal action

• We can share health information about you when required to do so by federal, state or local law. Example: We may disclose your health information in response to a court or administrative order, or in response to a subpoena.

Electronic Health Information Exchange (“HIE”)

• We use and participate in health information exchanges (HIEs), including the Florida HIE, to exchange electronic health information about you with other health care providers or entities that are not part of our health care system. Information exchanged between providers or entities may be stored in their own systems.
• As allowed by law, our health care system and these other providers or entities can use the HIEs to see your electronic health information for the purposes described in this Notice, in order to provide faster access, better coordination of care and assist providers and public health officials in making more informed decisions.
• We monitor who can view your information within our health care system, but other individuals and entities who use the HIEs may disclose your information to others subject to the rules of each HIE.
• You may “opt-out” and disable access to your health information available through the Florida HIE by calling 1-877-940-6144 (toll-free) or completing and submitting an Opt-Out form to Florida HIE by mail, fax or through their website at www.flhie.org.
• You may opt-out of all other HIEs by providing a written request. To find out how to do this, contact the Privacy Office at P.O. Box 103175, Gainesville, FL 32610-3175, by email at privacy@ufhealth.org, or call 1-866-682-2372 (toll-free).
• If you opt-out, others may still request your information through the HIEs, but your health information will not be viewable through the HIEs. You may opt back in to the HIEs at any time by contacting the Privacy Office.
• You do not have to participate in any HIE to receive care.

Information with additional privacy protections

Substance Use Disorder

(“SUD”) treatment records by our Part 2 program protected under 42 C.F.R. Part 2, which is limited to SUD treatment programs and does not apply to information related to care provided outside of these programs such as substance use screening that is performed in emergency rooms or by your primary care provider:

• We will share your SUD treatment information amongst our staff as needed to provide care to you or to bill for your services.
• You can provide a single written consent to allow us to share information about you outside of our program for all future treatment, payment and health care operations purposes.
• Generally, however, we will not disclose to individuals outside of our SUD treatment program (“Program”) that you attend the Program or any Program treatment information identifying you as a person with a substance use disorder, unless:
  • You consent in writing, such as but not limited to;
    • Whomever you name in a consent to share your information
    • Prevent multiple enrollments in withdrawal management or maintenance treatment programs
    • Report participation in treatment required by the criminal justice system
    • Report prescribed substance use disorder treatment medications to a state prescription drug monitoring program when required by law
  • Medical personnel who need the information to treat you in a medical emergency;
  • The Food and Drug Administration (“FDA”) needs your identifying information to notify you or your doctor about unsafe products you may be using;
  • The information is needed by a business associate providing services on our behalf, and agrees in writing, to protect the information in the same way that we are required to protect the information;
  • The disclosure is made to qualified personnel for research, auditing or program evaluations;
  • It is necessary to report a crime you commit, or threaten to commit, in our facility or against our personnel;
  • We are required by law to share identifying information about a deceased patient relating to cause of death; or
  • It is required by law to report abuse or neglect.

Redisclosure According to HIPAA

• When you consent to uses and disclosures for all future treatment and payment purposes and to run our business, we may share your information with other substance use disorder treatment programs, doctors’ offices and health care businesses for those activities. If the person who receives it is subject to HIPAA, then they are allowed to use and share your information again without your consent for the purposes that HIPAA allows. Your information still cannot be used in legal proceedings against you, unless:
  • You consent; or
  • Based on a Part 2 court order and a subpoena (or similar legal requirement).

Legal Proceedings and Court Orders

• We will not use or share your SUD treatment records, or provide testimony relaying the content of such records, in any civil, criminal, administrative or legislative proceedings against you without your written consent or a court order.
• We will only respond to a court order to use or share your health information if it is accompanied by a subpoena or other similar legal mandate requiring us to comply.
• Your SUD treatment records will only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to you or the holder of your record.
• We may use or share your information to respond to legal proceedings against our program based on a court order, and you may not be notified in advance. You have the right to seek to overturn or change the court order after you learn about it.
• We may disclose your de-identified SUD treatment records to public health authorities without your consent.

We will not use your SUD treatment records against you.

Our Responsibilities

• We are required by law to maintain the privacy and security of your protected health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this Notice and give you a copy of it.
• We will not use or share your information other than as described here, unless you tell us we can in writing. If you consented to us using your information and you later change your mind, let us know in writing.

Changes to the Terms of this Notice

We can change the terms of this Notice, and the changes will apply to all information we have about you. We will promptly revise and distribute this Notice to you whenever there is a material change to: (1) how we may use or disclose your medical information, (2) your individual rights, (3) our legal duties, or (4) other privacy practices stated in this Notice. The new Notice will also be available to any person upon request, in our facilities, in our office and on our websites.

United States (“U.S.”) Federal and State Law

UF Health may use, process and disclose your medical information in accordance with U.S. law. U.S. federal and state laws require UF Health to protect your medical information and federal law requires us to describe to you how we handle that information. When federal and state laws are different and conflict, and the state law is more protective of your information or provides you with greater access to your information, then we will follow state law in most instances.

Contact our patient experience and relations departments

UF Health Shands

• Patient Experience Department
• Phone: 352-265-0123
• TDD/TTY: 711 or 1-800-955-8771

UF Health Jacksonville

• Patient Experience/ Patient Relations Department
• Phone: 904-244-4427
• TDD/TTY: 711 or 1-800-955-8771

UF Health Central Florida

• Clinical Risk Management/ Patient Relations Department
• Phone: 352-323-5410 Leesburg, 352-751-8008 Spanish Plaines
• TDD/TTY: 711 or 1-800-955-8771

UF Health St. Johns

• Risk Management / Patient Experience Department
• Phone: 904-819-4667
• TDD/TTY: 711 or 1-800-955-8771

Language Assistance Services

ATTENTION: Language assistance services and appropriate auxiliary aids and services are available to you free of charge. Call UF Health or speak to your provider.

• SPANISH (ESPAÑOL): ATENCIÓN: si habla español, tiene a su disposición servicios gratuitos de asistencia lingüística. Llame UF Health o hable con su proveedor.
• French Creole (HAITIAN): ATANSYON: Si w pale Kreyòl Ayisyen, gen sèvis èd pou lang ki disponib gratis pou ou. Rele UF Health oswa pale ak founisè ou.
• VIETNAMESE (TIẾNG VIỆT): CHÚ Ý: Nếu bạn nói Tiếng Việt, có các dịch vụ hỗ trợ ngôn ngữ miễn phí dành cho bạn. Gọi UF Health hoặc trao đói với nhà cung cấp của bạn.
• PORTUGUESE (Português): ATENÇÃO: Se fala português, encontram-se disponíveis serviços linguísticos, grátis. Ligue para UF Health ou fale com o seu prestador de serviços.
• CHINESE (繁體中文): 语言协助服务以及适当的辅助工具和服务可免费为您提供 。 请致电 UF Health-的提供者联系。
• FRENCH (FRANÇAIS): ATTENTION: Si vous parlez français, des services d’aide linguistique vous sont proposés gratuitement. Appelez UF Health ou parlez à votre prestataire.
• TAGALOG -FILIPINO (TAGALOG): PAUNAWA: Kung nagsasalita ka ng Tagalog, maaari kang gumamit ng mga serbisyo ng tulong sa wika nang walang bayad. Tumawag sa UF Health.
• RUSSIAN (Русский): ВНИМАНИЕ: Услуги языковой поддержки и соответствующие вспомогательные средства и услуги предоставляются вам бесплатно. Позвоните по номеру UF Health или обратитесь к вашему поставщику услуг.
• ITALIAN (ITALIANO): ATTENZIONE: In caso la lingua parlata sia l'italiano, sono disponibili servizi di assistenza linguistica gratuiti. Chiami UF Health oppure si rivolga al suo fornitore.
• GERMAN (DEUTSCH): ACHTUNG: Wenn Sie Deutsch sprechen, stehen Ihnen kostenlos sprachliche Hilfsdienstleistungen zur Verfügung. Rufen Sie UF Health an oder sprechen Sie mit Ihrem Anbieter.
• KOREAN (한국어): 주의: 한국어를 사용하시는 경우, 언어 지원 서비스를 무료로 이용하실 수 있습니다. UF Health 로 전화하거나 담당자에게 문의하세요.
• POLISH (POLSKI): UWAGA: Usługi pomocy językowej oraz odpowiednie środki wspomagające I usługi są dostępne dla Pana/Pani bezpłatnie. Prosimy zadzwonid pod numer UF Health lub skontaktowad się ze swoim świadczeniodawcą.
• GUJARATI (ગુજરાતી): (યાન આપો: ભાષા સહાયતા સેવાઓ અને યો6ય સહાયક સાધનો અને સેવાઓ તમને મફતમાં ઉપલ>ધ છે. UF Health પર કોલ કરો અથવા તમારા પ્રદાતાને સંપર્ક કરો.
• THAI (ไทย): แจ้ ้งให้ ้ทราบ : บริ ิการช่ ่วยเหลื ือด้ ้านภาษาและการบริ ิการเสริ ิมที่ ี่เหมาะสม พร้ ้อมให้ ้บริ ิการให้ ้คุ ุณโดยไม่ ่เสี ียค่ ่าใช้ ้จ่ ่ายเพี ียงโทร UF Health หรื ือสอบถามกั ับผู้ ู้ให้ ้บริ ิการคุ ุณ.