It is the policy of Marquette to implement the following policies and procedures for its designated covered components that will ensure patient privacy rights in accordance with the HIPAA Privacy Rules:

1. Availability of privacy notice. The patient has the right to receive the applicable unit privacy notice in a timely manner. Upon request, the patient may at any time receive a paper copy of the unit's privacy notice, even if he or she earlier agreed to receive the notice electronically. Each unit must also post its privacy notice in a prominent location. The privacy notice describes how that unit may use or disclose patient health information.
2. Requesting restrictions on certain uses and disclosures. The patient has the right to object to, and ask for restrictions on, how his or her health information is used or to whom the information is disclosed, even if the restriction affects the patient's treatment or our payment or health care operation activities. The patient may want to limit the health information that is included in patient directories, or provided to family or friends involved in his or her care or payment of medical bills. The patient may also want to limit the health information provided to authorities involved with disaster relief efforts. However, we are not required to agree in all circumstances to the patient's requested restriction.
3. Receiving confidential communication of health information. The patient has the right to ask that we communicate his or her health information to them in different ways or places. For example, the patient may wish to receive information about their health status in a special, private room or through a written letter sent to a private address. We must accommodate requests that are reasonable in terms of administrative burden. We may not require the patient to give a reason for the request.
4. Access, inspection and copying of health information. With a few exceptions, patients have the right to inspect and obtain a copy of their health information. However, this right does not apply to psychotherapy notes or information gathered for judicial proceedings, for example. In addition, we may charge the patient a reasonable fee for copies of their health information.
5. Requesting amendments or corrections to health information. If the patient believes their health information is incomplete or incorrect, they may ask us to correct the information. The patient may be asked to make such requests in writing and to give a reason as to why his or her health information should be changed. However, if we did not create the health information that the patient believes is incorrect, or if we disagree with the patient and believe his or her health information is correct, we may deny the request. We must generally act on the request within 30 days after we receive it.
6. Receiving an accounting of disclosures of health information. In some limited instances, the patient has the right to ask for a list of the disclosures of their health information that we have made during the previous six years, but the request cannot include dates before April 14, 2003. This list must include the date of each disclosure, who received the disclosed health information, a brief description of the health information disclosed, and why the disclosure was made. We must furnish the patient with a list within 60 days of the request, unless we inform the patient of our need for a one-time 30-day extension, and we may not charge the patient for the list, unless the patient requests such list more than once in a 12 month period. In addition, we will not include in the list disclosures made to the patient, or for purposes of treatment, payment, health care operations, our directory, national security, law enforcement/corrections, and certain health oversight activities.
7. Complaints. Patients have the right to file a complaint with us and with the federal Department of Health and Human Services if they believe their privacy rights have been violated. We will not retaliate against the patient for filing such a complaint. To file a complaint with either entity, the patient should contact the person identified in the unit's privacy notice or Claudia Paetsch, Vice President for Human Resources, P.O. Box 1881, Milwaukee, WI 53201-1881, phone (414) 288-7305, who will provide the patient with the necessary assistance and paperwork.

Procedures

1. Should the law regarding patient privacy rights under HIPAA change, we will update our organization's policies and procedures regarding those rights, if applicable. We reserve the right to change our practices and to make the new provisions effective for all protected health information we maintain.
2. All new covered staff of Marquette shall receive a copy of this document at employee orientation and be directed at orientation as to how to access more detailed privacy policy and procedure documents.
3. More detailed policies and procedures are set forth for each unit. In the event of any discrepancy, the University will follow the policy or procedure most protective of patient privacy.
4. All current covered staff of Marquette shall receive a copy of their unit policies as part of our HIPAA compliance training session, and this document upon request.