Under HIPAA, you have several specific rights regarding your health information.  Some of these rights require you to contact HCPH in writing in order to exercise them.  If you are required to contact HCPH in order to exercise your rights, please submit your written request to the Health Information Management Office, Harris County Public Health Services, 2223 West Loop South, Houston, Texas 77027. You have the right to:

• Authorize the use or disclosure of your health information or any health information from which you could be identified.  You may revoke your authorization at any time except to the extent that action has already been taken on your previously authorized use or disclosure.  All revocations must be in writing and must be received by HCPH in order to be effective.
• Request a restriction on how HCPH may use or disclosure your health information.  However, HCPH is not required to agree to a requested restriction.
• Receive confidential communications of your health information from HCPH by asking that HCPH send those communications to you at a location other than the one HCPH has on file for you or by asking that HCPH communicate with you a different way.  For example, you might ask that HCPH contact you by mail rather than by telephone, or ask that HCPH contact you at work rather than at home.
• Inspect and obtain a copy of the health information about you that HCPH uses or stores.  HCPH must respond to your request for a copy of your health information within fifteen (15) days after HCPH receives your request unless HCPH is unable to respond within that timeframe and has advised you of the estimated date by which HCPH will respond.  Additionally, HCPH may charge a reasonable fee to cover the costs of copying, mailing, labor, and supplies associated with your request.
• Request an electronic copy of your health information.  HCPH will make every effort to produce your health information in the electronic form or format you request.  HCPH may charge you a reasonable cost-based fee for the labor costs associated with providing you the electronic copy of your health information.
• Request that HCPH change your health information if you believe your health information is incorrect or incomplete.  All requests for changes to your health information must be in writing and must include the reason(s) you believe your health information is incorrect or incomplete.  If you do not submit your request for a change in writing along with the proper documentation, HCPH will deny your request.  In addition, your request will also be denied if you ask HCPH to change information that is:
  • Accurate and complete;
  • Not a part of the health information that is kept by or for HCPH; or
  • Not created by HCPH.

• Obtain an accounting of the disclosures of your health information that have been made by HCPH.  This accounting of disclosures will not include any disclosures you have authorized or that are made for your treatment or payment or for HCPH’s healthcare operations.  You must submit your request for an accounting of disclosures in writing, and it cannot ask for disclosures that were made more than three (3) years before the date of your request.  The first accounting of disclosures that you request in a twelve-month period will be provided to you free of charge.  There will be an additional charge for any additional accountings of disclosures that you request within the same twelve-month period.  HCPH will notify you of the costs associated with any additional request that you make, and you may withdraw your request before you incur any costs.
• Be notified in the event of a breach of your health information.  If a breach of your health information occurs, and if that information is unsecured (for example, the information is on a computer that is not encrypted), HCPH will notify you promptly with the following information:
  • A brief description of what happened;
  • A description of the health information that was involved;
  • Recommended steps you can take to protect yourself from harm that might occur as the result of the breach;
  • The steps HCPH is taking in response to the breach, including what HCPH is doing to reduce the harm to you that might have been caused by the breach;
  • What HCPH is doing to prevent other similar breaches from occurring in the future; and
  • Contact information and procedures so you can obtain further information about the breach.
• Receive a paper copy of this Notice the first time you come to HCPH.  However, you may ask for and HCPH will provide you with a copy of this Notice at any time.  You may download a copy of this Notice from the HCPH website at: http://publichealth.harriscountytx.gov/Services-Programs/Services/RecordsRequest.

* HCPH is required by both Texas law and HIPAA to protect the privacy of your health information.  This means that unless a use or disclosure of your health information is specifically allowed for under either Texas law or HIPAA (which we will explain to you in this Notice), HCPH may not use or disclose your health information or any health information from which you could be identified without first obtaining your written permission to do so.  If HCPH wants to use or disclose your health information we will contact you to ask you to sign an “Authorization to Release Protected Health Information (PHI)” which is described later in this Notice.  Similarly, if you contact HCPH to ask HCPH to disclose your health information to a specific individual or entity, we will ask you to sign the Authorization to Release Protected Health Information (PHI) before we disclose your health information.

* HCPH will ask you for written permission before HCPH uses or discloses your health information in ways other than those stated in this Notice.  If you give HCPH permission to use or disclose your health information, you may revoke it at any time, but HCPH will not be liable for uses or disclosures already made in accordance with your written permission.

* HCPH may change this Notice in the future.  You can always request the most current version of this Notice, and the most current version will be available at HCPH facilities and on the HCPH website.  If you come to our facilities after we change our Notice, HCPH will offer to provide you with the updated version.  HCPH will honor the terms of the Notice that is currently in effect.

The following categories describe the different ways in which HIPAA allows HCPH to use and/or disclose your health information without your authorization.  This is not an exhaustive list of every type of use or disclosure that HCPH is permitted to make, but the different ways HCPH is permitted to use and disclose your health information do fall within one of the following categories.

1. Treatment
   HCPH will use and disclose your health information as necessary to provide, coordinate, or manage healthcare or related services.  This includes providing care to you, consulting with another healthcare provider about you, and referring you to another healthcare provider.  For example, HCPH may disclose your health information to refer you to a high-risk clinic or a hospital for additional healthcare services.  HCPH may also contact you to remind you of an appointment or to tell you about other health-related information that may be of interest to you.
2. Payment
   HCPH may use or disclose your health information to pay or to collect payment for your healthcare.  For example, HCPH can use or disclose your health information to bill your insurance company, Medicaid, or other funding sources such as the Texas Department of State Health Services for the healthcare services that HCPH provided to you.
3. Health Care Operations
   HCPH may use or disclose your health information for healthcare operations.  Examples of healthcare operations include:
   1. Conducting quality assessment, improvement activities, training healthcare professionals; 
   2. Coordinating and managing care; and 
   3. Performing HCPH’s general administrative activities.
4. Family Member, Other Relative, Personal Representative, or Close Personal Friend
   HCPH may disclose your health information to your family members, other relatives, your personal representative, or a close personal friend.  A personal representative is a person who has legal authority to act on your behalf regarding your healthcare.  However, HCPH will only disclose your health information to your family members, other relatives, your personal representative, or a close personal friend when the health information being disclosed is related to that person’s involvement with your care or payment for your care and you have been given an opportunity to stop or limit the disclosure before it happens.
5. Business Associates
   HCPH may disclose your health information to a business associate of HCPH.  HCPH business associates are individuals or entities that are not employees of HCPH but they perform certain functions for HCPH or provide certain services to HCPH.  HCPH has a contract with each of its business associates and this contract prohibits the business associate from using or disclosing any health information that they receive from HCPH or that the business associate creates for HCPH for reasons other than those specified in the contract.  In other words, your health information might be used by, created by, stored at, or disclosed to a business associate, but the business associate can use it only on HCPH’s behalf.  For example, HCPH entered into a contract with Harris Health System (HHS) to allow HCPH to use HHS’s Electronic Medical Record System.  All of HCPH’s patients’ medical records are disclosed to HHS and are stored on HHS computers, but the contract prohibits HHS employees from accessing or using any of HCPH’s patients’ medical records unless the patient is a patient of both HCPH and HHS.
6. As Required by Law
   HCPH will use or disclose your health information when required to do so by federal, state, local, or any other applicable law.  For example, HCPH must disclose your health information to the U.S. Department of Health and Human Services when the Department wants to determine whether HCPH is in compliance with HIPAA.
7. Public Health
   HCPH may disclose your health information for purposes of preventing or controlling disease, injury, or disability, or to report vital statistics, or to report problems with FDA-regulated products or activities.
8. Victims of Abuse, Neglect, or Domestic Violence
   If HCPH believes that you are or that you have been the victim of abuse, neglect, or domestic violence HCPH will disclose your health information to the appropriate government authority but only to the extent such a disclosure is required or expressly authorized by Texas law or when you agree to HCPH making the disclosure.
9. To Avert a Serious Threat to Health or Safety
   HCPH may use or disclose your health information if HCPH believes the use or disclosure is necessary in order to prevent or lessen a serious and immediate threat to your health and safety or to the health and safety of the public or another person.
10. Health Oversight Activities
    HCPH may sometimes use or disclose your health information for health oversight activities.  Health oversight activities include audits, inspections, and investigations that are authorized by law or are necessary for governmental oversight of the healthcare system.  For example, HCPH may disclose your health information to the Centers for Medicare and Medicaid Services (CMS) if CMS is investigating a physician who is suspected of engaging in Medicare or Medicaid fraud.
11. Research
    HCPH may use or disclose your health information for research purposes, but only if the HCPH Institutional Review Board has approved the research study.  HCPH will only disclose information that can be used to identify you when the research that is being conducted could not be conducted without the identifying information.
12. Purposes Relating to Death
    HCPH may disclose your health information to (1) hospitals for the purpose of organ transplants, (2) coroners or medical examiners to identify a deceased person or to determine the person’s cause of death, and (3) funeral directors as necessary for their duties.
13. Eye, Organ, or Tissue Donation
    HCPH may disclose your health information to organizations that handle organ and tissue procurement, banking, or transplantation if your information is needed because you are listed as an organ donor.
14. Judicial and Administrative Proceedings
    HCPH may disclose your health information in response to a valid subpoena, discovery request, or other lawful process by someone else involved in a lawsuit in which your health information is at issue, but HCPS will only do so after HCPH makes reasonable efforts to tell you about the request or if we obtain a court order protecting the health information that is requested by the subpoena, discovery request, or other lawful process.
15. Law Enforcement Purposes
    HCPH will not disclose your health information to a law enforcement official unless the law enforcement official provides HCPH with: (1) a court order or court-ordered warrant, or a subpoena or summons issued by a judicial officer; (2) a grand jury subpoena; or (3) a request, subpoena, investigative demand, or similar process that shows that (a) the information sought is relevant and material to a legitimate law enforcement inquiry; (b) the request is specific and limited in scope to the purpose for which it is requested; and (c) de-identified health information could not be used.  HCPH may disclose health information if asked to do so by a law enforcement official (1) to identify or locate a suspect, fugitive, material witness, or missing person; (2) about an individual who is or is suspected to be a victim of a crime; (3) about a death HCPH believes may be the result of criminal conduct; and (4) about criminal conduct that occurred on HCPH premises.
16. Military and Veterans, National Security and Intelligence Activities, and Protective Services for the President and Others
    If you are a member of the armed forces, HCPH may disclose your health information as required by military command authorities.  HCPH may also disclose your health information to authorized federal officials (1) for intelligence, counter-intelligence, and other national security activities authorized by law and (2) to provide protection to and conduct special investigations of threats against the President or other authorized persons.
17. Workers’ Compensation
    HCPH may disclose your health information to comply with laws relating to workers’ compensation or other similar programs (that provide benefits for work-related injuries or illnesses).

Other than the uses and disclosures described above, HCPH will not use or disclose health information about you without first obtaining an “Authorization to Release Protected Health Information (PHI)” that is signed by you or, if you are unable to sign the Authorization, by your personal representative.  For example, if HCPH receives a request for your health information from an individual or a company, HCPH will ask the requestor to provide us with an Authorization that is signed by you before HCPH releases any of your health information to the requestor.  Unless or until HCPH receives that signed Authorization (giving HCPH permission to release the requested health information), HCPH will not use or disclose your health information in response to the request from the individual or company.

HCPH will never disclose your health information for marketing purposes nor will HCPH sell your health information.  In addition, certain types of health information about you cannot be released unless they are specifically identified on the Authorization and you specifically designate them for disclosure (or unless their release is required by law).  Those “special” categories of health information include: (1) HIV/AIDS information; (2) mental health information; (3) substance use disorder information; and (4) psychotherapy notes.

If you sign an Authorization allowing HCPH to disclose your health information, you may later revoke (or cancel) that Authorization provided you do so in writing.  If you would like to revoke your authorization, you need to send a letter to the Health Information Management Office in which you tell HCPH the Authorization(s) you want to revoke.  If you revoke your Authorization, we will follow your instructions except to the extent that we have already relied on your prior Authorization and taken some action.