EACC Privacy Statement - Human Resources

Notice of Health Information Practices

Effective Date: 10/16/2017
This notice applies to the UAB Employee Assistance Program. It describes how medical information about you may be used and disclosed by the UAB Employee Assistance Program and how you can get access to this information. Please review carefully.

Who Will Follow This Notice

This notice gives you information required by law about the privacy practices of the UAB Employee Assistance Program, a self-insured group health plan (“the EAP ”).

The EAP provides health benefits to you and receives and maintains your health information in the course of providing these benefits to you. The EAP may hire business associates to help it provide these benefits to you. These business associates will also receive and maintain your health information in the course of assisting the EAP and are also bound to protect your health information as described below. EAP and its business associates are referred to herein as “we” or “our.”

Our Pledge Regarding Medical Information

We understand that medical information about you and your health is personal. We are committed to protecting medical information about you. We create a record of the care and services you receive at EAP. We need this record to provide you with quality care and to comply with certain legal and regulatory requirements. This Notice applies to all of the records of your care generated by the EAP. This Notice will tell you about the ways in which we may use and disclose medical information about you. We also describe your rights and certain obligations we have regarding the use and disclosure of medical information.

We are required by law to:

Make sure that medical information that identifies you is kept private
Give you this notice of our legal duties and privacy practices with respect to medical information about you
Notify you in the case of a breach of your unsecured identifiable medical information
Follow the terms of the Notice that is currently in effect until it is replaced

How We May Use and Disclose Medical Information About You

The following categories describe different ways that we may, but are not required to, use and disclose medical information. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose your information will fall within one of the categories. All information disclosed in counseling sessions is strictly confidential and will be released ONLY with your prior written consent and/or authorization, except as otherwise required by law.

For Treatment and Treatment Alternatives: With your written consent, w e may use or disclose medical information about you to help your doctors and other health care providers coordinate or arrange your medical treatment or care. For example, your health care provider may request information regarding whether a service will be covered. In addition, we may help your health care provider coordinate or arrange medical services that you need, or help your health care provider find a safer prescription drug alternative. We may use and disclose your medical information to tell you about health-related benefits or services that may be of interest to you.
For Payment: We do not use and disclose medical information about you for payment purposes. Your employer pays a flat rate for your participation in the Plan.
For Routine Health Care Operations: We may use and disclose medical information about you for our routine EAP operations; however there is no disclosure to any third party, except as provided herein. These uses and disclosures are necessary for the EAP to operate and make sure that all its clients receive quality care. We may also combine medical information about many EAP clients to decide what additional services or benefits we should offer and what services or benefits are not needed. Examples of health care operations include, but are not limited to:
- Conducting quality assessment and improvement activities
- Engaging in care coordination or case management
- Detecting fraud, waste or abuse
- Providing customer service
- Business management and general administrative activities related to our organization and the services we provide

Note: We will not use or disclose genetic information about you for underwriting purposes.

Individuals Involved in Your Care or Payment for Your Care: With your written consent, we may release medical information about you to you, the individual receiving care, a friend or family member who is involved in your medical care or payment for your medical care, and/or to your personal representative(s) appointed by you or designated by applicable law. In certain circumstances, state and federal law may require us to secure permission from a minor, a person under the age of 19, prior to making certain disclosures of medical information to a parent. In addition, we may disclose medical information about you to an entity assisting in a disaster relief effort so that your family can be notified about your status and location.
Business Associates: There are some benefits and services the EAP provides through contracts with business associates. For example, we may contract with a third party to host the software network that houses your medical information. When these services are contracted, we may disclose your health information to these business associates so that they can perform the job we’ve asked them to do. To protect your health information, however, we require the business associate to appropriately safeguard your information.
Your Employer: With your written permission, we will disclose to your employer the fact that you attend the EAP. No other information about you will be disclosed.
As Required By Law: We will disclose medical information about you, without your consent or authorization, when required to do so by federal, state or local law. Examples include: suspected or known child, elder or disabled person abuse or neglect, mandatory reporting of health care providers experiencing psychiatric or substance abuse disorders that may present a danger to self or others to their licensing boards, threat of danger to another individual, imminent threat of suicide by the client, legal subpoena to present records to comply with a court order, mandatory state and federal requirements, and in any emergency medical circumstance that requires immediate medical attention.
More Stringent Laws: Some of your Protected Information may be subject to other laws and regulations and afforded greater protection than what is outlined in this Notice. For instance, HIV/AIDS, and patient-psychotherapist information are given more protection under Alabama law and substance abuse information is given more protection under federal law. In the event your medical information is afforded greater protection under federal or Alabama law, we will comply with the more stringent law.
Other Uses and Disclosures: Any uses and disclosures not described in this Notice will be made only with your written consent and/or authorization. For example, we will obtain your written authorization to use or disclose your medical information to an attorney who represents you.
Psychotherapy Notes: Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date. Psychotherapy notes are NOT a part of your medical record and access to these may be denied anyone, including you, without a court order.

Your Rights Regarding Medical Information About You

You have the following rights regarding medical information we maintain about you:

Right to Inspect and Copy: You have the right to inspect and copy medical information that may be used to make decisions about your care. Psychotherapy notes are not included. To inspect and copy medical information that may be used to make decisions about you, you must submit your request in writing to the EAP Entity Privacy Coordinator (see contact information later in this Notice). If you request a copy (paper or electronic) of the information, you will be charged a fee for the costs of copying, mailing or other supplies associated with your request. We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to medical information, you may request that the denial be reviewed. Another licensed health care professional will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.
Right to Amend: If you feel that medical information we have about you is incorrect or incomplete, you may ask us, in writing, to amend the information kept by us. To request an amendment, your request must be made in writing on the required form and submitted to the EAP Entity Privacy Coordinator (see contact information later in this Notice). In addition, you must provide a reason that supports your request. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:
- Was not created by us, unless the person or entity that created the information is no longer available to make the amendment
- Is not part of the medical information we keep
- Is not part of the information which you would be permitted to inspect and copy
- Is accurate and complete
Right to an Accounting of Disclosures: You have the right to request an "accounting of disclosures." This is a list of certain disclosures we made of medical information about you for reasons other than treatment, payment or health care operations. To request this list or accounting of disclosures, you must submit your request in writing on the required form to the EAP Entity Privacy Coordinator (see contact information later in this Notice). Your request must state a time period which may not be longer than six years. Your request should indicate in what form you want the list (for example, on paper, electronically). The first list you request within a 12 month period will be free. For additional lists, we may charge you for the cost of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
Right to Request Restrictions: You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not use or disclose information about a surgery you had. We are not required to agree to your request. If we do agree, we will comply with your request, unless the information is needed to provide you emergency treatment. To request restrictions, you must make your request in writing on the required form to the EAP Entity Privacy Coordinator (see contact information below). In your request, you must tell us: (1) what information you want to limit; (2) whether you want to limit the use, disclosure or both; and (3) to whom you want the limits to apply, for example, disclosures to your spouse.
Right to Request Confidential Communications: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. To request confidential communications, you must make your request in writing on the required form to the EAP Entity Privacy Coordinator (see contact information below). We will not ask you the reason for your request, but your request must clearly state that the disclosure of all or part of the information could endanger you. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.
Right to Revoke Authorization: You have the right to revoke your authorization to use or disclose your medical information except to the extent that action has already been taken in reliance on your authorization. Revocations must be made in writing to the EAP Entity Privacy Coordinator (see contact information below).
Right to Choose Someone to Act for You: If you have given someone power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.
Right to a Paper Copy of This Notice: You have the right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of this Notice.
- To download and print a copy of this notice, click here.
- To obtain a paper copy of this notice, call the UAB Employee Assistance & Counseling Center at 205-934-2281.

Your Responsibilities for Protecting Medical Information

As a member of the EAP, you are expected to help us safeguard your medical information. For example, you are responsible for letting us know if you have a change in your address or phone number. If you suspect someone has tried to access your records or those of another member without approval, you are responsible for letting us know as soon as possible so we can work with you to determine if additional precautions are needed.

Changes to this Notice

We reserve the right to change this Notice. We reserve the right to make the revised or changed Notice effective for medical information we already have about you as well as any information we receive in the future. We will also post the new Notice on the EAP’s website. The Notice will contain the effective date on the first page.

For More Information or to Report a Problem

If you have questions and would like additional information, you may contact the EAP Entity Privacy Coordinator (see contact information below). If you believe your privacy rights have been violated, you may file a complaint with UAB or with the Secretary of the Department of Health and Human Services. To file a complaint with UAB, contact the EAP Entity Privacy Coordinator (see contact information below). All complaints must be submitted in writing. You will not be penalized for filing a complaint.

EAP Entity Privacy Coordinator
Tami Mayes Long, 205-934-2281

For requests to inspect, copy, amend, restrict your medical information or for request for an accounting of disclosures of your medical information, contact the EAP Entity Privacy Coordinator.