Each time you use services provided by Student Health, Counseling or Psychiatric Services, a record is generated. This record contains medical information about you ("medical records"). This notice applies to all of your medical records generated by the Counseling and Educational Support Services and Student Health Services on the University of Kansas Medical Center campus. All of the providers at Student Health and the counselors and psychiatrists at the Counseling and Educational Support Services will follow the terms of this notice. This notice does not apply to records created by Academic Accommodations, the writing center and Educational Support Services.

We are required by law to protect the privacy of your medical information, provide you with this notice, abide by the terms of the notice currently in effect and notify you if we are unable to agree to a requested restriction on use or disclosure of your medical information.

In certain situations, Student Health, Counseling and Psychiatric Services may use or disclose medical information about you without your consent or authorization (e.g. when there is an emergency or when there are substantial communication barriers to obtaining consent from you). Further, Student Health, Counseling and Psychiatric Services may use or disclose your medical information without your consent or authorization in the following circumstances:

As required by law: When you first apply for services from Student Health, Counseling and Psychiatric Services, we will ask you to consent to disclosures required by law. These uses and disclosures are for the following types of entities: Food and Drug Administration; Department of Health and Human Services or Education; public health authorities or legal authorities charged with tracking, preventing or controlling diseases (e.g., communicable diseases, STDs, HIV), injuries or disabilities; workers compensation agents; proper military authorities, state or national security or intelligence authorities; and health oversight agencies.

Law enforcement/legal proceedings: Student Health, Counseling and Psychiatric Services may disclose health information for law enforcement purposes as required by law or in response to a valid subpoena or other legal process. If you are a student, we will make reasonable efforts to notify you in advance of complying with the subpoena or court order so that you can take protective action unless we are legally required not to disclose the existence of the subpoena.

Research: Student Health, Counseling and Psychiatric Services may disclose medical information to researchers when their research has been approved by an institutional review board.

You have the following rights regarding medical information we maintain about you:

Right to access and to receive copies: You have the right to see and receive copies of the medical information used to make decisions about your care, including information kept in an electronic health record and/or to tell us where to send the information. Usually, this includes medical and billing records. It does not include some records such as psychotherapy notes.

To see and receive copies of medical information used to make decisions about you, you must submit your request in writing to Student Health Services for health records or Counseling and Educational Support Services for counseling or psychiatric records. We may charge a fee for the costs of processing your request. In some limited cases, we may decline your request, such as a request for psychotherapy notes. You may ask that such a decision be reviewed. To ask for a review, contact the Privacy Officer in writing at 3901 Rainbow Blvd. Mailstop 1032, Kansas City, Kansas 66160.

Right to amend: You have the right to ask for an amendment of your medical information that you believe is inaccurate, misleading or in violation of your rights. You must make your request in writing on the approved form and submit it to the Privacy Officer at 3901 Rainbow Blvd. Mailstop 1032, Kansas City, Kansas 66160. You must give a reason that supports your request. We will give the form to request amendment of your medical records to you upon request.

We may decline your request for an amendment to your record if your request is not in writing or does not include a reason to support the request. We also may decline your request if you ask us to amend information that:

• we did not create, unless the person or entity that created the information is no longer available to make the amendment;
• is not part of the records used to make decisions about you;
• is not part of the information which you are permitted to inspect and to receive a copy; or
• is accurate and complete.

Right to accounting of disclosures: You have the right to receive a list of the disclosures we made of your medical information, including medical information we maintain in an electronic health record. This list may not include all disclosures that we made. For example, this list will not include disclosures that we made for treatment, payment or health care operations purposes. To ask for this list, you must submit your request in writing on the approved form. We will give you the form upon request.

Right to request restrictions: You have the right to ask for a restriction or limitation on the medical information we use or share for treatment, payment or health care operations. In addition, you have the right to request that we restrict disclosure of your medical information if the disclosure is to a health plan for the purpose of carrying out payment or health care operations (and is not for the purpose of carrying out treatment) and the medical information pertains solely to a health care item or service for which you have paid out of pocket in full. You also have the right to ask for a limit on the medical information we share with someone who is involved in your care or in the payment for your care. Such a person may be a family member or friend. We do not have to agree to your request. If we do agree, we will fulfill your request unless the information is needed to provide you with emergency treatment.

To ask for restrictions, you must make your request in writing on a form that we will provide you upon request. You must tell us:

• what information you want to limit,
• how you want us to limit the information, and
• to whom you want the limits to apply.

Right to request confidential communications: You have the right to ask us to communicate with you about medical matters in a certain way or at certain places. You must make your request in writing on a form that we will provide you upon request. We will fulfill all reasonable requests.

Right to a paper copy of this notice: You may ask us to provide you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you still have a right to receive a paper copy.

We may update this notice to show any changes in our privacy practices. We reserve the right to make the updated notice effective for medical information we already have about you. It also will be effective for any information we receive in the future. We will post a copy of the current notice in the places where you receive services. The effective date of this notice is on the first page.

If you think your privacy rights have been violated, you may file a complaint with Student Health, Counseling and Psychiatric Services or with the Secretary of the Department of Health and Human Services (medical records) or the United States Department of Education (education records). If you want to file a complaint with Student Health, Counseling and Psychiatric Services, contact the Privacy Officer at 913-588-0940. You will not be retaliated against for filing a complaint.

We will keep your medical information private and secure as required by law. If any of your medical information is acquired, accessed, used or disclosed in a manner that is not permitted by law, we will notify you within 60 days following the discovery of a breach.

Other uses and disclosures of medical information not covered by this notice or by other laws that apply to us will be made only with your written permission. The following is a description of some situations, but not all, where our use and disclosure of your medical information will require your written permission:

Psychotherapy notes: Most uses and disclosures of your psychotherapy notes will require your written permission. Generally speaking, psychotherapy notes are notes that are made by a mental health professional documenting or analyzing the contents of his or her conversations with you during a counseling session and that are kept separate from the rest of your medical record.

Marketing purposes: Subject to limited exceptions, uses and disclosures of your medical information for marketing purposes will require your written permission.

Effective date: January 5, 2015