NOTICE OF PRIVACY PRACTICES
MUSC Organized Health Care Arrangement (OHCA)
UNDERSTANDING YOUR PROTECTED HEALTH INFORMATION (PHI)
The Medical University of South Carolina and its affiliates (including but not limited to the Medical University Hospital Authority, MUSC Physicians,
MUSC Physicians Primary Care, MUSC Health Partners, MUSC Health Alliance, MUSC Strategic Ventures, LLC, and MUSC Strategic Ventures
(MSV) Health, Inc.) participate in a clinically integrated health care setting. As a result of this clinical integration, these organizations function as an
Organized Health Care Arrangement (OHCA) as defined by the Health Insurance Portability and Accountability Act (HIPAA). For purposes of this
notice, the members of the MUSC OHCA are collectively referred to in this document as “MUSC.” We collect, receive, or share this information
about your past, present or future health condition to provide health care to you, to receive payment for this health care, or to operate the
hospital and/or clinics.
OUR PLEDGE REGARDING YOUR HEALTH INFORMATION
MUSC is committed to protecting the privacy of health information we create and obtain about you. This Notice tells you about the ways in which we
may use and disclose health information about you. It also describes your rights and certain obligations we have regarding the use and disclosure of your
health information. We are required by law to: (i) make sure your health information is protected; (ii) give you this Notice describing our legal duties
and privacy practices with respect to your health information; and (iii) follow the terms of the Notice that is currently in effect.
HOW WE MAY USE AND RELEASE YOUR PROTECTED HEALTH INFORMATION (PHI) –
A. The following uses do NOT require your authorization, except where required by SC law:
1. For treatment. Your PHI may be discussed by caregivers to determine your plan of care. For example, the physicians, nurses, medical students and
other health care personnel may share PHI in order to coordinate the services you may need.
2. To obtain payment. We may use and disclose PHI to obtain payment for our services from you, an insurance company or a third party. For example, we
may use the information to send a claim to your insurance company.
3. For health care operations. We may use and disclose PHI for hospital and/or clinic operations. For example, we may use the information to review our
treatment and services and to evaluate the performance of our staff in caring for you.
4. Business Associates. Your medical information could be disclosed to people or companies outside our Health System who provide services. These
companies typically are required to sign special confidentiality agreements before accessing your information. They are also subject to fines by the federal
government if they use/disclosure your information in a way that is not allowed by law.
5. For public health activities. We report to public health authorities, as required by law, information regarding births, deaths, various diseases, reactions
to medications and medical products.
6. Victims of abuse, neglect, domestic violence. Your PHI may be released, as required by law, to the South Carolina Department of Social Services when
cases of abuse and neglect are suspected.
7. Health oversight activities. We will release information for federal or state audits, civil, administrative or criminal investigations, inspections, licensure
or disciplinary actions, as required by law.
8. Judicial and administrative proceedings. Your PHI may be released in response to a subpoena or court order.
9. Law enforcement or national security purposes. Your PHI may be released as part of an investigation by law enforcement or for continuum of care
when in the custody of law enforcement.
10. Military and Veterans. If you are a member of the U.S. or foreign armed forces, we may release your medical information as required by military
command authorities.
11. Uses and disclosures about patients who have died. We may provide medical information to coroners, medical examiners and funeral directors so
they may carry out their duties.
12. For purposes of organ donation. As required by law, we will notify organ procurement organizations to assist them in organ, eye or tissue donation
and transplants.
13. Research. We may use and disclosure your medical information for research purposes. Most research projects are subject to Institutional Review Board
(IRB) approval. The law allows some research to be done using your medical information without requiring your written approval.
14. To avoid harm. In order to avoid a serious threat to the health or safety of a person or the public, we may release limited information to law
enforcement personnel or persons able to prevent or lessen such harm.
15. For workers compensation purposes. We may release your PHI to comply with workers compensation laws.
16. Marketing. We may send you information on the latest treatment, support groups, reunions, and other resources affecting your health.
17. Fundraising activities. We may use your PHI to communicate with you to raise funds to support health care services and educational programs we
provide to the community. You have the right to opt out of receiving fundraising communications with each solicitation.
18. Appointment reminders and health-related benefits and services. We may contact you with a reminder that you have an appointment.
19. Disaster Relief Efforts. We may disclose your medical information to an entity assisting in disaster relief efforts so that your family can be notified
about your condition.
Note: incidental uses and disclosures of PHI sometimes occur and are not considered to be a violation of your rights. Incidental uses or disclosures
are by-products of otherwise permitted uses or disclosures which are limited in nature and cannot be reasonably prevented.
B. You may object to the following uses of PHI:
1. Inpatient hospital directories. Unless you tell us not to, we may include your name, location, general condition and religious affiliation in our patient
directory so your family, friends and clergy can visit you and know how you are doing.
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN
GET ACCESSS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
2. Information shared with family, friends or others. Unless you tell us not to, we may release your PHI to a family member, friend, or other person
involved with your care or the payment for your care.
3. Health plan. You have the right to request that we not disclose certain PHI to your health plan for health services or items when you pay for those
services or items in full.
C. Your prior written authorization is required (to release your PHI) in the following situations:
You may revoke your authorization by submitting a written notice to the privacy contact identified below. If we have a written authorization to release your
PHI, it may occur before we receive your revocation.
1. Any uses or disclosures beyond treatment, payment or healthcare operations and not specified in parts A & B above.
2. Mental Health Records unless permitted under an exception in section A.
3. Substance Use Disorder Treatment records unless permitted under an exception in section A.
4. Any circumstance where we seek to sell your information.
WHAT RIGHTS YOU HAVE REGARDING YOUR PHI
Although your health record is the physical property of MUSC, the information belongs to you, and you have the following rights with respect to your PHI:
A. The Right to Request Limits on How We Use and Release Your PHI. You have the right to ask that we limit how we use and release your PHI. We
will consider your request, but we are not always legally required to accept it. If we accept your request, we will put any limits in writing and abide by them
except in emergency situations. Your request must be in writing and state (1) the information you want to limit; (2) whether you want to limit our use,
disclosure or both; (3) to whom you want the limits to apply, for example, disclosures to your spouse; and (4) an expiration date.
B. The Right to Choose How We Communicate PHI with You. You have the right to request that we communicate with you about PHI and/or
appointment reminders in a certain way or at a certain location (for example, sending information to your work address rather than your home address). You
must make your request in writing and specify how and where you wish to be contacted. We will accommodate reasonable requests.
C. The Right to See and Get Copies of Your PHI. You have the right to inspect and/or receive a copy (an electronic or paper copy) of your medical and
billing records or any other of our records used to make decisions about your care. You must submit your request in writing. If you request a copy of this
information, we may charge a cost-based fee. MUSC will act on a request for access or provide a copy usually within 30 days of receipt of the request. We
may deny your request in limited circumstances. If you are denied access to your records, you may request that the denial be reviewed by a licensed health
care professional. Additionally, we may use and disclose information through our secure patient portal which may allow you to view and communicate with
certain health care providers in a secure manner. For more information see our https://mychart.musc.edu/mychart/
D. The Right to Get a List of Instances of When and to Whom We Have Disclosed Your PHI. This list may not include uses such as those made for
treatment, payment, or health care operations, directly to you, to your family, or in our facility directory as described above in this Notice of Privacy
Practices. This list also may not include uses for which a signed authorization has been received or disclosures made more than six years prior to the date of
your request.
E. The Right to Amend Your PHI. If you believe there is a mistake in your PHI or that a piece of important information is missing, you have the right to
request that we amend the existing information or add the missing information. You must provide the request and your reason for the request in writing. We
may deny your request in writing if the PHI is correct and complete or if it originated in another facility’s record. Notification will be provided within 60
days.
F. The Right to Receive a Paper or Electronic Copy of This Notice: You may ask us to give you a copy of this Notice at any time. For the above requests
(and to receive forms) please contact: Health Information Services (Medical Records), Attention: Release of Information / 169 Ashley Avenue / MSC 349 /
Charleston, SC 29425. The phone number is (843) 792-3881.
G. The Right to Revoke an Authorization. If you choose to sign an authorization to release your PHI, you can later revoke that authorization in writing.
This revocation will stop any future release of your health information except as allowed or required by law.
H. The Right to be Notified of a Breach. If there is a breach of your unsecured PHI, we will notify you of the breach in writing.
HEALTH INFORMATION EXCHANGES
MUSC, along with other health care providers, belongs to health information exchanges. These information exchanges are used in the diagnosis and
treatment of patients. As a member of these exchanges, MUSC shares certain patient health information with other health care providers. Should you require
treatment at another location that is a part of one of these exchanges, that provider may gather historical health information to assist with your treatment.
You have the option of saying that this cannot be done. If you choose not to take part in these alliances, please contact the MUSC Privacy Office at 792-
4037.
HOW TO COMPLAIN ABOUT OUR PRIVACY PRACTICES
If you think your privacy rights may have been violated, or you disagree with a decision we made about access to your PHI, you may file a complaint with
the office listed in the next section of this Notice. Please be assured that you will not be penalized and there will be no retaliation for voicing a concern
or filing a complaint. We are committed to the delivery of quality health care in a confidential and private environment.
PERSON TO CONTACT FOR INFORMATION ABOUT THIS NOTICE OR TO COMPLAIN ABOUT OUR PRIVACY PRACTICES
If you have any questions about this Notice or any complaints about our privacy practices please call the Privacy Officer (843) 792-4037, the Privacy Hotline
(800) 296-0269, or contact in writing: HIPAA Privacy Officer / 169 Ashley Avenue / MSC 332 / Charleston SC 29425. You also may send a written
complaint to the U.S. Dept. of Health and Human Services, Office for Civil Rights. The address will be provided at your request or by visiting
www.hhs.gov/ocr/privacy/hipaa/complaints/.
CHANGES TO THIS NOTICE
We reserve the right to change the terms of this Notice at any time. The changes will apply to all existing PHI we have about you.. This Notice will always
contain the effective date and may be reviewed at http://academicdepartments.musc.edu/musc/about/compliance/privacy.html
EFFECTIVE DATE OF THIS NOTICE
This Notice went into effect on April 14, 2003 and was last revised on August 2018.
