Notice of Privacy Practices

The Columbia University Healthcare Component (CUHC) will provide every new patient with the Organized Health Care Arrangement (OHCA) Notice of Privacy Practices (Notice) in compliance with the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Columbia University, NewYork-Presbyterian, and Weill Cornell Medicine participate in an Organized Health Care Arrangement (OHCA).  This allows us to share health information to carry out treatment, payment and joint health care operations relating to the OHCA, including integrated information system management, health information exchange, financial and billing services, insurance, quality improvement, and risk management activities.  Organizations that will follow this notice include Weill Cornell Medicine, NewYork-Presbyterian sites, Columbia University and their entities.  

Reason(s) for the Policy

Health Insurance Portability and Accountability Act of 1996 includes a regulatory requirement to provide every new patient with the organization's Notice of Privacy Practices (Notice). The Notice informs patients how their Protected Health Information (PHI) may be accessed, used and disclosed by CUHC, CUHC’s duty to protect their PHI, and their rights with respect to their PHI and how to exercise those rights.

Primary Guidance To Which This Policy Responds

The Health Insurance Portability and Accountability Act of 1996 45 CFR 164.520

HHS Privacy Guidance for the Notice of Privacy Practices for Protected Health Information

Who is Governed by This Policy

This policy applies to all CUHC workforce members including but not limited to faculty, staff and students.

Who Should Know This Policy

All CUHC workforce members.

  1. The OHCA Notice of Privacy Practices shall be provided to all new patients and any person who requests it.
  2. Paper copies of the Notice shall be available in all faculty practice locations. In addition, an electronic copy of the Notice is available, and posted prominently, on the Privacy Office web page and can be provided to patients via email. If the patient opts-out of receiving the Notice electronically, this should be reflected in their medical record.
  3. The Notice shall be posted in all practice locations and on the webpage for ColumbiaDoctors, Columbia School of Dental Medicine, Student Health Services and Columbia Health Services.
  4. Contact ColumbiaDoctors Administration or the Privacy Office to obtain copies of the Notice and the poster.
  5. The patient (or designated representative) shall sign an acknowledgement form to document their receipt of the Notice. The acknowledgment form shall be maintained in the medical record. If the patient refuses to sign the acknowledgment form, indicate on the form “Patient refused to sign”, document staff name, the date the Notice was offered.
  6. Receipt of the Notice may also be documented within the applicable patient registration system.
  7. Whenever the Notice is revised, CUHC will make the revised Notice available upon request on or after the effective date of a revision and comply with the distribution requirements outlined in this Policy. CUHC will promptly revise the Notice whenever a material change is made to CUHC’s HIPAA privacy policies and procedures that affect the Notice.
  8. All documentation related to the receipt and acknowledgment of the Notice shall be maintained in the medical record for a minimum of six (6) years.
  9. Patients may not be required to waive their privacy rights as a condition of the provision of treatment.
  10. Questions about the Notice shall be directed to the Practice Manager or the Privacy Office.
  11. If the patient requests the Notice via email, ensure that the correct email address is utilized, and if a failed transmission notification is received, a paper copy of the notice must be provided.

The Notice in plain language describes:

  • How CUHC may access, use and disclose an individual’s PHI.
  • A patient’s rights with respect to their information and how an individual may exercise their rights, including how to report a complaint.
  • CUHC’s legal duties to maintain the privacy of the individual’s PHI.
  • Who to contact for further information about the CUHC’s privacy policies.
  • The effective date on which the Notice is first in effect.
 
Responsibilities

CUHC workforce members must:

  • Provide the Notice to new patients
  • Obtain a signed acknowledgement form from the patient and maintain the form in the medical record
  • Document receipt of the Notice in the patient registration system (if applicable)
  • Forward patient inquiries about Notice and/or patient rights to the appropriate Practice Manager or the Privacy Office
  • Have copies of the Notice available at all practice locations
 
Definitions

Columbia University Healthcare Component (CUHC) – Columbia University is a Hybrid Entity that has designated as its Healthcare Component (the Columbia University Healthcare Component) Columbia University Medical Center and the other colleges, schools, departments and offices of the University to the extent that they (i) provide treatment or health care services and engage in Covered Transactions electronically or (ii) receive Protected Health Information to provide a service to, or perform a function for or on behalf of, the Columbia University Healthcare Component.

Covered Entity – (i) a health plan, (ii) healthcare clearinghouse, or (iii) healthcare provider that transmits any health information in electronic form in connection with a Covered Transaction.

Hybrid Entity – A single legal entity (i) that is a Covered Entity (ii) whose business activities include both Covered and non-Covered functions and (iii) that designates health care components within the Hybrid Entity as more particularly described in Section 164.103.

Protected Health Information (PHI) is individually identifiable health information:
(1) Except as provided in section (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium (includes paper and oral communications).
(2) Protected Health Information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In employment records held by a covered entity in its role as employer; and (iv) Regarding a person who has been deceased for more than 50 years.

HIPAA Privacy Rule and Patient Rights

Forms:

Notice of Privacy Practices (English)

Notice of Privacy Practices Patient Acknowledgement Form (English)

 

Other Related Document:

Office of Civil Rights: Notice of Privacy Practices FAQs