Hospitals and Facilities

UPMC's Notice of Privacy Practices

Summary

At the University of Pittsburgh Medical Center (UPMC), we are committed to protecting the privacy of your medical information, as federal and state laws require. When we say “information,” we mean health, treatment, or payment information that identifies you. Attached is UPMC’s “Notice of Privacy Practices.” The Notice explains how we meet this commitment. The Notice also explains your legal rights about what is in your health record. All people and places that make up UPMC must follow the Notice. This does not include UPMC Health Plan or UPMC as an employer. This Summary tells you in brief what the Notice says. THIS SUMMARY IS NOT A COMPLETE LISTING OF HOW WE USE AND DISCLOSE (SHARE) YOUR HEALTH INFORMATION. UPMC has the right to change this Summary and the Notice without first notifying you.

How UPMC may use and share your health information
Without your consent, UPMC can use and share your health information to:

  • Provide you with medical treatment and other services
  • Receive payment from you, an insurance company, or someone else for services we provide to you
  • Operate UPMC, which includes such things as giving you appointment reminders, telling you about other treatment options, and contacting you for certain marketing and fund-raising activities
  • Comply with the law
  • Meet special situations as described in the Notice, such as public health, safety, and research

Exception:This does not include behavioral health, drug and alcohol, and AIDS/HIV information.

With your verbal agreement, UPMC can:

  • Include your name and other information in the hospital directory as described in the Notice
  • Share your health information with the family and friends you agree can have this information

All other uses and sharing of your health information will be done only with your specific written permission or as required by law.

Your legal rights about your health information

  • Right to ask to see and copy your medical record
  • Right to ask that incorrect or incomplete information in your medical record be corrected
  • Right to ask for a list of non-UPMC parties with whom we have shared your health information. This right does not include health information we shared (1) if we had your written permission to share the information, and (2) to carry out treatment, payment, and health care operations.
  • Right to ask UPMC to limit how we use and share your health information without your consent. UPMC is not required to agree to your request.
  • Right to ask for confidential communications
  • Right to ask for a paper copy of the Notice of Privacy Practices

      • Violation of privacy rights
      If you believe your privacy rights have been violated, you have a right to file a complaint. Please see the attached Notice for more details.

      Full Notice

      This Notice describes how medical information about you may be used and disclosed (shared) and how you can get access to (see and copy) this information.

      What is a notice of privacy practices?
      The University of Pittsburgh Medical Center (UPMC) understands that your health information is personal. We create and maintain a record with information about the care and services you receive at UPMC. We need this information to provide you with quality care and to comply with the law. This Notice of Privacy Practices (Notice) applies to all information about your care that UPMC (and all of the people and places that make up UPMC) may create, maintain, or receive. This includes information that UPMC receives from other doctors and medical facilities that are not part of UPMC, but that UPMC keeps to help give you better care. The Notice tells you about the ways we may use and share your health information, as well as the legal duties we have about your health information. The Notice also tells you about your rights under federal (United States) and state (Pennsylvania) laws. In this Notice, the words “we,” “us,” and “our” mean UPMC and all the people and places that make up UPMC, which are described below.

      Who follows UPMC’s Notice of Privacy Practices?
      All of the people and places that make up UPMC follow this Notice. UPMC includes hospitals, doctors, rehabilitation services, skilled nursing services, home health services, pharmacy services, laboratory services, and other related health care providers. UPMC also includes departments, units, and staff within our health care facilities; health care professionals permitted by us to provide services to you; and students, residents, trainees, volunteers, and others involved in providing your care. UPMC people and places may share your health information with each other for the treatment, payment, or health care operations that this Notice describes. You can learn more about the groups and places that are part of UPMC at http://www.upmc.com.

      This Notice does not apply to the UPMC Health Plan or UPMC as an employer. These UPMC entities are separate covered entities for the purpose of the Health Insurance Portability and Accountability Act (HIPAA) and have their own Notice. Additionally, if your doctor is not a member of a physician practice that is owned by UPMC, he or she may have different policies about how to handle your information and will have a separate Notice.

      Our duty to protect your health information
      We are required by law to:

      • make sure that information that identifies you is kept private
      • make available to you this Notice that describes the ways we use and share your health information as well as your rights under the law about your health information
      • follow the Notice that is currently in effect

      How we may use and share your health information with others
      The law permits us to use and share your health information in certain ways. The list below tells you about different ways that we may use your health information and share it with others. The list also includes some examples of what we mean. When sharing this information with others outside of UPMC, we share what is reasonably necessary, unless we are sharing information to help treat you, in response to your written permission, or as the law requires. In these three cases, we share all information that you, your health care provider, or the law has asked for. We will use health information that does not identify you whenever possible. Every possible example of how we may use or share information is not listed below; however, all of the ways we are permitted to use and share information fall into one of the groups below.

      1. Ways we are allowed to use and share your health information with others without your consent or as the UPMC General Consent for Treatment, Payment, and Health Care Operations provides:
        1. Treatment. We may use your health information to give you medical treatment or services. We may share your health information with people and places that provide treatment to you. For example, if you have diabetes, the doctor may need to tell the dietitian about your diabetes so that you get the kind of meals you need. We may share health information about you with people outside of UPMC who provide follow-up care to you, such as nursing homes and home care agencies.
        2. Payment. In order to receive payment for the services we provide to you, we may use and share your health information with your insurance company or a third party. We may also share your health information with another doctor or facility that has treated you so that they can bill you, your insurance company, or a third party. For example, some health plans require your health information to pre-approve you for surgery and require preapproval before they pay us.
        3. Health Care Operations. We may use and share your health information so that we, or others that have provided treatment to you, can better operate the office or facility. For example, we may use your health information to review the treatment and services we gave you and to see how well our staff cared for you. We may share your health information with our researchers so they can develop plans to conduct research. We may share information with our students, trainees, and staff for review and learning purposes.
        4. Business Associates. We may share your health information with others called “business associates,” who perform services on our behalf. The business associate must agree in writing to protect the confidentiality of the information. For example, we may share your health information with a billing company that bills for the services we provided.
        5. Appointment Reminders. We may use and share your health information to remind you of your appointment for treatment or medical care. For example, if your doctor has sent you for a test, the place where the testing will be done may call you to remind you of the date you are scheduled. Treatment Options and Other Health-Related
        6. Benefits and Services. We may use and share your health information to tell you about possible treatment options and other health-related benefits and services that may interest you. For example, if you suffer from an illness or condition, we may tell you about a special treatment or research study that is being offered.
        7. Fund-Raising Activities. We may use and share with a business associate or a foundation that is related to us your name, address, phone number, and other such information (called “demographic information”) and dates that health care was provided to you. You may then be asked for a donation to UPMC. For example, you may receive a letter from a UPMC foundation asking for a donation to support enhanced patient care, treatment, education, or research at UPMC. Any fund-raising materials will explain how you can tell us, a business associate, or a foundation that you do not want to be contacted in the future. If you do so, we will use reasonable efforts to avoid contacting you in the future.
        8. Marketing Activities. We may use or share your health information for marketing purposes without your permission when we discuss such products or services with you face-to-face or to provide you with an inexpensive promotional gift related to the product or service. For example, you may receive samples of products or drugs during a visit to a UPMC hospital or facility. For other types of marketing activities, we wi