Privacy Policy
Notice of Privacy Practices
MUSC Organized Health Care Arrangement (OHCA)
Understanding Your Protected Health Information (PHI)
Effective Date: April 14, 2003 | Last Revised: February 13, 2026The Medical University of South Carolina and its affiliates participate in a clinically integrated health care setting. As a result of this clinical integration, these organizations function as an Organized Health Care Arrangement (OHCA) as defined by the Health Insurance Portability and Accountability Act (HIPAA). For purposes of this notice, the members of the MUSC OHCA are collectively referred to in this document as “MUSC.”
How We May Use and Disclose Your PHI
The following uses and disclosures do not require your authorization except where required by SC law:
- Treatment. Your PHI may be discussed by caregivers to determine your plan of care (e.g., physicians, nurses sharing info).
- Payment. We may use/disclosed PHI to obtain payment from you or insurance companies.
- Health Care Operations. Used for hospital/clinic operations, reviewing treatment, and evaluating staff performance.
- Business Associates. Disclosed to outside companies providing services (subject to confidentiality agreements).
- Public Health Activities. Reporting births, deaths, diseases, etc., as required by law.
- Victims of Abuse/Neglect. Released to SC Department of Social Services when suspected.
- Health Oversight Activities. Released for audits, investigations, licensure, etc.
- Judicial Proceedings. Released in response to subpoena or court order.
- Law Enforcement/National Security. Released for investigations or continuum of care in custody.
- Military and Veterans. Released as required by military command authorities.
- Deceased Individuals. Provided to coroners, examiners, funeral directors.
- Organ/Tissue Donation. Notifying procurement organizations.
- Research. Used for research purposes (often subject to IRB approval).
- To Avoid Harm. Limited info released to prevent serious threat to health/safety.
- Workers’ Compensation. Released to comply with workers comp laws.
- Marketing. Sending info on treatments, support groups, etc.
- Fundraising. Using PHI to raise funds (you have the right to opt-out).
- Appointment Reminders. Contacting you regarding appointments.
- Disaster Relief. Disclosing info to notify family during disasters.
- EPIC Community Connect. Sharing common medical record with unaffiliated providers via Epic.
*Note: Incidental uses/disclosures may occur as a by-product of permitted uses if reasonable safeguards are in place.
- Inpatient Directories: Name, location, condition, religious affiliation (unless you object).
- Family/Friends: Releasing PHI to those involved in your care/payment (unless you object).
- Health Plan: Requesting no disclosure to health plan for services you pay for in full.
We will obtain your written authorization before using or disclosing your PHI for:
- Uses not otherwise described in this Notice.
- Psychotherapy notes (except as permitted by law).
- Any sale of your PHI.
You may revoke an authorization in writing at any time; however, revocation does not apply to disclosures already made.
Your Rights Regarding Your PHI
Access & Copies
You have the right to inspect and/or receive copies of your medical/billing records. Requests must be in writing. MUSC usually acts within 30 days. You may access info via our secure patient portal: myChart.
Amendments
If you believe there is a mistake or missing info, you have the right to request an amendment in writing. We may deny requests if the PHI is correct/complete or originated elsewhere.
Request Limits
You may request limits on how we use/disclose your PHI. We are not always legally required to accept, but if accepted, we will abide by them (except in emergencies).
Communication Choices
You may request we communicate with you in a specific way or at a specific location (e.g., work address). Requests must be in writing.
- Accounting of Disclosures: Right to get a list of instances when PHI was disclosed (excludes treatment/payment/ops, family, directory).
- Copy of Notice: Right to receive a paper/electronic copy of this Notice.
- Revoke Authorization: Right to revoke written authorization for future releases.
- Breach Notification: Right to be notified in writing if there is a breach of unsecured PHI.
Health Information Exchanges (HIE)
MUSC belongs to health information exchanges used in diagnosis and treatment. As a member, MUSC shares certain patient health information with other providers. If you require treatment at another location part of these exchanges, that provider may gather historical health info.
Additional Protections: Substance Use Disorder (SUD) Records
Substance use disorder treatment records are protected by federal laws ("Part 2") in addition to HIPAA. MUSC will not use or disclose these records in civil, criminal, administrative, or legislative proceedings without specific written consent or a court order.
Limited Uses Without Consent:
- Sharing with Program personnel for diagnosis/treatment/referral.
- Medical emergencies where consent cannot be obtained.
- FDA notifications regarding product safety.
- Public health authorities (if records do not identify you).
- Qualified service organizations.
- Reporting crimes committed in facilities/against personnel.
- Reporting suspected child abuse/neglect.
- Research, audit, or program evaluation (qualified personnel).
- Providing you access to your SUD Record.
- Reporting cause of death where required by law.
Uses Requiring Consent:
Other uses, including treatment/payment/operations (unless a one-time consent is given), reporting to PDMP, sharing with criminal justice systems, and disclosing counseling notes require specific written consent.
- Right to revoke consent.
- Right to request restrictions on disclosures made with prior consent.
- Right to request restrictions on disclosures to health plans for services paid in full.
How to File a Complaint
If you think your privacy rights may have been violated, you may file a complaint without fear of retaliation.
MUSC Privacy Office
HIPAA Privacy Officer
22 Westedge Street / Suite 347
Charleston, SC 29403
Phone: (843) 792-4037
Privacy Hotline: (800) 296-0269
Email: privacy@musc.edu
U.S. Department of HHS
You may also file a written complaint with the Office for Civil Rights.
For Forms & General Requests:
Health Information Services (Medical Records)
Attention: Release of Information / 169 Ashley Avenue / MSC 349
Charleston, SC 29425
Phone: (843) 792-3881