This notice describes how medical records about you may be used and disclosed and how you can get access to this records. Please review it carefully.

(Effective date: August 1, 2016) When this notice applies: This notice summarizes the privacy practices of Hospitaly / UCBM-affiliated covered entities, which include, but are not limited to: UCBM: University Bio-Medico Campus Hospital of Rome and the medical staffs and personnel who provide you with care or services at these Hospitaly / UCBM facilities. In addition, we may share information with each other for purposes described in this notice, including for our joint healthcare operations activities.

Our obligations

We have a long-standing commitment to protecting the privacy rights of our patients. In keeping with this commitment, and as required by law, we:

• Obtain your consent to use and disclose records about your health and healthcare. 
• We are required to maintain the privacy and security of your protected health information; 
• We must follow the duties and privacy practices described in this notice and give you a copy of it; 
• We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind; and 
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your records.

When you receive services or treatment at a Hospitaly / UCBM facility, you will be asked to sign an acknowledgment of this notice that describes how we use and disclose information about you in ways that are permitted by federal law. The federal law provides for significant privacy protections of health information.The following categories describe ways that we may use and disclose health information that identifies you. Some of the categories include examples, but not every type of use or disclosure of health information in a category is listed.

The following categories describe ways that we may use and disclose health information that identifies you. Some of the categories include examples, but not every type of use or disclosure of health information in a category is listed.

Except for the purposes described below, we will use and disclose health information only with additional written permission from you. If you give us permission to use or disclose health information for a purpose not discussed in this notice, you may revoke that permission at any time by sending a written request to our Chief Privacy Officer at the address listed at the end of this notice.

Protected Health information may also be disclosed to the Secretary of the Department of Health and Human Services for the purpose of investigating or determining the covered entity’s compliance with the HIPAA Privacy Rule. 

• a) For Treatment. We may use health information to treat you or provide you with healthcare services. We may disclose health information to doctors, nurses, technicians or other personnel, including people outside our facility, who may be involved in your medical care. For example, to coordinate your ongoing care both at our facilities and when you leave them, we may exchange health information with other healthcare providers like your primary care physician regarding the care we provided you, a specialist so they can provide you with additional services, or your pharmacy about the medicines you are taking or are prescribed.
• b) For Payment. We may use and disclose health information so that we or others may bill or receive payment from you, an insurance company or a third party for the treatment and services you receive. For example, we may give your health plan information about your treatment so they will pay for such treatment. We also may tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment.
• c) For Healthcare Operations. We may use and disclose health information for healthcare operations and administrative purposes. These uses and disclosures are necessary to make sure all our patients receive quality care and for operation and management purposes. For example, we may use health information to review the treatment and services we provide to ensure the care you receive is of the highest quality, or we may post in employee areas thank-you notes or pictures you send us.
• d) Appointment Reminders, Treatment Alternatives and Health-related Benefits and Services. We may use and disclose health information to contact you as a reminder that you have an appointment with us. We may use and disclose health information to tell you about treatment options or alternatives or health-related benefits and services that may be of interest to you. We also may make your health information available for you to access through a secure online patient portal.
• e) Fundraising Activities. We may use certain limited health information to contact you in the future to raise money for us. We also may provide this information to our Foundation, for the same purpose. The money raised will be used to expand and improve the clinical services and programs we provide the community. Please contact us if you would like to opt-out of these campaigns.
• f) Facility Directory. We may list your name, general condition (e.g., fair, critical) and location in our directory, unless you ask us not to. We may disclose this information to anyone who asks for you by name.
• g) Pastoral Care. We may disclose the information in our facility directory and information that you provide us regarding your religious affiliation to members of the clergy for use and disclosure in their religious activities. In addition, where you elect to receive individualized spiritual services from a member of our Pastoral Care department, the clergy member may use health information to provide you with such services.
• h) Individuals Involved in Your Care or Payment for Your Care. We may disclose health information to a person, such as a family member or friend, who is involved in your medical care or who helps pay for your care. We also may notify your family about your location or general condition or disclose such information to a family member, relative, close personal friend or any other person identified by you who may be involved in your care or payment related to your healthcare, or for notification purposes. We may also disclose health information to a personal representative. A personal representative is generally a person who has legal authority to act on your behalf in making decisions related to your healthcare.

Under certain circumstances, we may use and disclose health information for research purposes. For example, a research project may involve comparing the health and recovery of all patients who received one medication or treatment to those who received another, for the same condition. In addition, we may use your data for health services research to improve the health of our patients and the communities we serve. However, before we use or disclose health information for research, the project will go through a special approval process. This process evaluates a proposed research project and its use of health information to balance the benefits of research with the need for privacy of health information. Even without special approval, we may permit researchers to look at records to help them identify patients who may be included in their research project or for other similar purposes, as long as they do not remove or take a copy of any health information with them. If you are eligible for participation in a study, we may contact you to discuss your potential participation. In the unfortunate event of your death, we may use or disclose your health information with people who are conducting research using the information of deceased persons.

• a) As Required by Law. We will disclose health information when required to do so by international, federal, state or local law.
• b) To Avert a Serious Threat to Health or Safety. We may use and disclose health information when necessary to prevent or lessen a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, will be to someone who may be able to help prevent the threat.
• c) Business Associates. We may disclose health information to our business associates who perform functions on our behalf or provide us with services, if the information is necessary for such functions or services. For example, we may use another company to perform billing services on our behalf. All of our business associates are obligated by law and under contract with us, to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract.
• d) Organ and Tissue Donation. We may release health information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary, to facilitate organ or tissue donation and transplantation.
• e) HIV Test Results. If you received an HIV test and did not give us permission to use and disclose the results, we will use and disclose the results of HIV tests that identify you only: (1) to provide you with healthcare services (for example, we may tell a specialist about your HIV status so the specialist can treat you); (2) when compiling or reviewing your records as part of routine billing; (3) if necessary, to enable us to protect the quality of our services (for example, we may disclose HIV test results to our committees to monitor and evaluate our programs); (4) to child-placing or child-care agencies, family foster homes, residential facilities or community based care programs that are directly involved in placement, care, control or custody and that have a need to know such information; (5) to a sex- or needle-sharing partner in accordance with the law; (6) in accordance with a court order that specifically requires us to release HIV test results; and (7) in connection with organ donation.
• f) Military and Veterans. If you are a member of the armed forces, we may release health information as required by military command authorities. We also may release health information to the appropriate foreign military authority if you are a member of a foreign military.
• g) Workers’ Compensation. We may disclose health information for workers’ compensation or similar programs that provide benefits for work related injuries or illnesses.
• h) Public Health Risks. We may disclose health information for public health activities. These activities generally include disclosures to prevent or control disease, injury or disability; report births and deaths; report child abuse or neglect; report reactions to medications or problems with products; notify people of recalls of products they may be using; track certain products and monitor their use and effectiveness; notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; and conduct medical surveillance of our facilities in certain limited circumstances concerning workplace illness or injury. We also may release health information to an appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence; however, we will release this information only if you agree or when we are required or authorized by law.
• i) Health Oversight Activities. We may disclose health information to a health oversight agency for activities authorized by law. For example, these oversight activities include, audits, investigations, inspections and licensure as well as quarterly reports to the Agency for Healthcare Administration. These activities are necessary for the government to monitor the healthcare system, government programs and compliance with civil rights laws.
• j) Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose health information in response to a court or administrative order. We also may disclose health information in response to a subpoena, discovery request or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.
• k) Law Enforcement. We may release health information if asked by a law enforcement official for the following reasons: (1) in response to a court order, subpoena, warrant, summons or similar process; (2) limited information to identify or locate a suspect, fugitive, material witness or missing person; (3) about the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement; (4) about a death we believe may be the result of criminal conduct; (5) about criminal conduct on our premises; and (6) in emergency circumstances to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime.
• l) Medical Examiners and Funeral Directors. We may release health information to authorized federal officials for intelligence, counterintelligence and other national security activities authorized by law.
• m) National Security and Intelligence Activities. We may release Health Information to authorized federal officials for intelligence, counterintelligence and other national security activities authorized by law.
• n) Protective Services for the President and Others. We may disclose health information to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.
• o) Inmates or Individuals in Custody. In the case of inmates of a correctional institution or those who are under the custody of a law enforcement official, we may release health information to the appropriate correctional institution or law enforcement official. This release would be made only if necessary: (1) for the institution to provide you with healthcare; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
• p) Disaster Relief Purposes. Health information may be used or disclosed to a public or private entity authorized by law or by its charter to assist in disaster relief efforts for the purpose of coordinating disaster relief efforts.
• q) Separate Authorizations. Separate authorizations are generally required for most uses and disclosures of psychotherapy notes, marketing, to sell health information or for other uses or disclosures not mentioned in this notice.
• r) Electronic Health Information Exchange. We participate in systems that exchange health information electronically with other healthcare providers, health information exchange networks and health plans. When we participate in these systems, your health information maintained by us may be shared with or accessed by other providers, health information exchange networks and health plans for the purposes of treatment, payment or healthcare operations. In addition, we may access your health information maintained by other providers, health information exchange networks and health plans for our treatment, payment or healthcare operation purposes.

You have the following rights regarding health information we maintain about you:

• a) Right to Inspect and Copy. You have the right to see or get an electronic or paper copy of your medical record and other health information we have about you. We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable, cost-based fee.
• b) Right to Amend. If you feel that the health information we have is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for us. You must tell us the reason for your request. We may say “no” to your request, but we will tell you why in writing within 60 days.
• c) Right to an Accounting of Disclosures. You can ask for a list (accounting) of the times we’ve shared your health information for six years prior to the date you ask, who we shared it with, and why. We will include all the disclosures except for those about treatment, payment and healthcare operations, and certain other disclosures (such as any you asked us to make).
• d) Right to Request Restrictions. You can ask us not to use or share certain health information for treatment, payment or our operations. We are not required to agree to your request, and we may say “no” if it would affect your care. In addition, you have the right to request a limit on the health information we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend. For example, you could ask that we not share information about your surgery with your spouse or that we not share information with your insurance company if you choose to pay for your service. We are not required to agree to your request except in circumstances where you have made a request to restrict disclosures about healthcare services you have received at a Hospitaly / UCBM affiliate to a health plan for payment or healthcare operations, the healthcare services that are the subject of the restriction have been paid for in full “out of pocket” by you or on your behalf, and the disclosure is not required by law. If we agree, we will comply with your request unless we need to use the information in certain emergency treatment situations or are required by law to make a disclosure of health information.
• e) Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we contact you only by mail or at work. Your request must specify how or where you wish to be contacted. We will say “yes” to all reasonable requests.
• f) Right to a Paper Copy of This Notice. You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. 
• g) Choose Someone to Act for You. If you have given someone legal authority to act on your behalf, such as medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.

To exercise your rights described in this notice (other than to obtain a copy of this notice), you must email patients@www.hospitaly.it.

Changes to this notice:

We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for health information we already have as well as for any information we receive in the future. We will post a copy of the current notice at these Hospitaly / UCBM facilities. The notice will contain the effective date on the first page, in the top right-hand corner.