1. Purpose

1.1. East Carolina University's Health Care Components ("ECU's Health Care Components") have a legal duty to protect the privacy of protected health information ("PHI"). Notice of this requirement, including certain rights of individuals regarding their health information maintained by ECU's Health Care Components, must be provided to each individual with whom a Direct Treatment Relationship exists. This Notice of Privacy Practices ("NPP") must also be clearly labeled and prominently displayed at all service delivery sites. The purpose of this regulation is to define how ECU's Health Care Components will implement this requirement.

2. Definitions

2.1. Direct Treatment Relationship means a treatment relationship between an individual and a health care provider in which the provider delivers health care services or products, or reports diagnoses or results from that health care, directly to that individual, under the provider's own orders and with no other provider intervening.

2.2. Indirect Treatment Relationship means a relationship between an individual and a health care provider in which:

2.2.1. The health care provider delivers health care service to the individual based on the orders of another provider; and

2.2.2. The health care provider typically provides services or products, or reports the diagnosis or results associated with the health care, directly to another health care provider, who provides the services or products or reports to the individual.

3. Regulation

3.1. It is the policy of East Carolina University to provide each individual, with whom a Direct Treatment Relationship exists or is established from interactions with ECU's Health Care Components, with its Notice of Privacy Practices at the first date of delivery of service or at any other time if requested by an individual. This notice shall adequately explain ECU's legal duties and certain rights associated with each individual's health information. This notice will be clearly labeled and prominently displayed in all delivery sites within ECU's Health Care Components. Additionally, an electronic version will be located on the privacy forms section of the ECU HIPAA Privacy website.

4. Exceptions

4.1. Emergency Situations.

ECU Health Care Components are not required to obtain written acknowledgement of receipt of the Notice of Privacy Practices in emergency situations. However, as soon as reasonably practicable after the emergency situation, efforts should be made to obtain a written acknowledgement. If not obtained, the ECU Health Care Component must document, in the Component's medical record or appropriate systems, its good faith efforts to obtain such acknowledgement and the reasons why the acknowledgement was not obtained.

4.2. Health Care Services Provided Outside of ECU's Health Care Components. ECU Providers, including students, who provide professional health care services to other institutions at their physical facilities/locations, under contract or some other legally binding agreement, are not required to present ECU's Notice of Privacy Practices. In certain cases, there may still be a requirement that other ECU documents be obtained as a result of services provided.

5. Procedure

5.1. Provision of NPP.

Subject to the exceptions in section 4 of this regulation, all ECU Health Care Components shall provide individuals with whom a Direct Treatment Relationship exists with a NPP no later than the date of the first delivery of health care service including health care services delivered electronically.

5.1.1. Subject to paragraph 5.6.1, ECU Health Care Components are only required to provide the NPP and obtain the individual's written acknowledgement of receipt upon the individual's initial interaction with an ECU Health Care Component that will result in a direct treatment relationship being established.

5.2. Written Acknowledgement.

The individual or their legally accepted representative shall provide written acknowledgement of receipt of the NPP.

5.2.1. A copy will be provided to the individual and the original shall be maintained in the Component's medical record.

5.2.2. A good faith effort must be made to obtain a written acknowledgement of receipt of the NPP, and if not obtained, the ECU Health Care Component must document its good faith efforts to obtain such acknowledgement and the reason why the acknowledgement was not obtained in the medical record or appropriate system.

5.2.2.1. Examples of situations when a written acknowledgement may not be obtained may include: where the patient or legal representative either refuse to provide written acknowledgement or when a patient is not physically present, i.e., medical services provided over the telephone.

5.3. Documentation.

Each ECU Health Care Component should develop the appropriate tracking mechanism to ensure that acknowledgement of receipt is obtained in order to prevent repeated acknowledgment on subsequent interactions across multiple Components. If feasible, cross Component tracking should occur.

5.4. Requests.

Individuals may at any time request and obtain a copy of the NPP. Written acknowledgment is not required on such individual requests.

5.5. Posting of NPP.

ECU Health Care Components will prominently post the NPP within all their physical delivery sites where it is reasonable to expect that individuals could read the NPP.

5.6. Revision of NPP.

ECU Health Care Components will make the notice available upon request on or after the effective date of the revision and promptly comply with the requirements of paragraphs 5.4 and 5.5.

5.6.1. In certain circumstances, redistribution to all individuals may be necessary. The ECU HIPAA Privacy office will notify ECU Health Care Components when such redistribution is necessary.