Notice of Privacy Practices

I. OUR COMMITMENT TO YOUR PRIVACY

The University of Maryland is dedicated to maintaining the privacy of your health information. Protected health information (PHI) includes the health center's individually identifiable health information that relates to your past, present, or future physical or mental health or condition and/or related health care services. PHI does not include health information created or kept for occupational health (work-related) reasons, such as fitness-for-duty examinations, or student records. This NoPP provides you with the following important information: our obligations concerning your PHI; how we may use and disclose your PHI; and your rights in your PHI.

OUR OBLIGATIONS

Both federal and State law require that we maintain the privacy of your PHI. We are also required to provide you with this notice regarding our privacy practices, our legal duties, and your rights concerning your PHI. Except for certain records the University creates or receives in its role as an employer and student records, this NoPP applies to all records containing your PHI that are created or retained by the Health Center or other units in the University’s designated Health Care Component. This Notice takes effect on April 15, 2026, and will remain in effect until we revise or replace it. We must follow the privacy practices described in this Notice while it is in effect. A copy of the NoPP will always be posted in a visible location in the Health Center, and you may request a copy of the Notice at any time. A current notice is also posted on the Health Center’s website. We have the right to change our privacy practices and to revise or replace this NoPP at any time, so long as the changes are consistent with applicable law. Any revision or amendment to this Notice will be effective for all PHI that we created or maintained in the past, and for any PHI that we create or maintain in the future. Before making a significant change in our privacy practices, we will change this Notice, post the revised Notice in the Health Center and on our website, and make the new Notice available upon request.

If you have questions about our NoPP or would like to request additional copies of the Notice, please contact the University HIPAA Privacy Officer or the Health Center Privacy Coordinator at the addresses provided in Section VII.

II. UNIVERSITY STUDENTS 

(Patients who are not students at the University of Maryland, College Park should skip to Section III)

Although federal privacy requirements for protected health information generally exclude student health information, the confidentiality of such information is protected under the federal Family Education Rights and Privacy Act (FERPA), Maryland state law, and/or University Policy, as applicable. The University Health Center recognizes the need for confidentiality and privacy regarding student health information, and we will use, disclose, and otherwise handle your health information in accordance with applicable law and University policy. Both FERPA and Maryland law give you the right to control the release of your health information in most instances, and we will generally obtain your consent before we release such information, except under certain circumstances when your consent is not required under applicable law. Both FERPA and Maryland law (and University policy) also give you certain rights to inspect and correct your health information (see Section IV, below).
 

If you have questions about the privacy practices applicable to your records, please contact the Health Center Privacy Coordinator or the University HIPAA Privacy Officer at the addresses provided in Section VII.

III. NON-STUDENTS 

(This section does not apply to patients who are students at the University of Maryland, College Park. Those students should see Sections II and IV.B.)

WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION (PHI) IN THE FOLLOWING WAYS:

The following sections describe, in general terms, the different ways that we may use and disclose your PHI. Examples are provided to help you understand the various types of uses and disclosures; they do not cover all possible situations.

1. Treatment. The Health Center may use and disclose your PHI to provide health care and related services to you. For example, we may use or disclose your PHI to a physician or other health care provider to treat you or assist others in your treatment. Other examples include uses and disclosures for laboratory tests, prescriptions, and referrals to other health care providers for additional health care services.
2. Payment. We may use and disclose your PHI in order to bill and collect payment for the services and items you may receive and to determine your eligibility to participate in our services. For example, we may contact your health insurer to confirm your eligibility for benefits (and the range of benefits) and provide your insurer with details about your treatment to determine whether it will cover or pay for it. We may also use and disclose your PHI to obtain payment from you or from third parties who may be responsible for such costs, such as family members.
3. Health Care Operations. We may use and disclose your PHI in connection with our health care operations, including our administrative, financial, legal, and quality improvement activities. For example, we may use your PHI to evaluate the quality of care you received from us, as well as the competence, performance, or qualifications of our health care professionals and staff. Other examples include accreditation evaluations, training programs for medical students and other health care professionals, fraud and abuse detection, cost management, business planning, and the preparation of de-identified information and limited data sets.
4. Business Associates. We may share your PHI with third-party “business associates” that provide various services for us, such as billing, transcription, software maintenance, accreditation, and legal services. If an arrangement with a business associate involves the use or disclosure of your PHI, we will have a written contract in which the business associate agrees to maintain the confidentiality of your PHI.
5. Healthcare Professional Students. Medical students and other health care professional students may observe or participate in my care under the supervision of an attending physician or other health care professional as part of the University System of Maryland and other educational programs. Those students may have access to my health information.
6. Appointments and Other Reminders. The Health Center may use and disclose your PHI to contact you and remind you of an appointment. For example, Primary Care may contact you to confirm an appointment, or the Pharmacy may call to remind you to pick up your prescription.
7. Health Related Services. We may use and disclose your PHI to tell you of or recommend treatment alternatives and other health-related benefits and services that might be of interest to you.
8. Release of Information to Involved Individuals. Unless you object, the Health Center may release your PHI (except mental health records) to a friend or family member or other person who is involved in your care, or who assists in taking care of you or in paying for your health care. In addition, we may disclose your PHI to a public or private entity authorized by law or its charter to assist in disaster relief efforts. If you are not present or are incapacitated, or in an emergency situation, we will disclose your PHI based upon our professional judgment that disclosure is in your best interest. We will also use our professional judgment and experience with common practice to allow a person to pick up prescriptions, medical supplies, x-rays, or similar types of medical information. We will not, however, disclose any information in a way that conflicts with a previously agreed-upon preference or restriction.
9. Research. Under certain limited circumstances, we may use or disclose PHI for health research purposes in accordance with applicable laws and University policy. For example, we may use or disclose your PHI if we have your authorization or documentation that a special research review board has approved a waiver or alteration of authorization requirements. We may also use or disclose PHI for reviews preparatory to research (such as to design or assess the feasibility of conducting a study) or for research on decedents’ PHI, but only if the researcher provides appropriate assurances of confidentiality. In addition, PHI may be used or disclosed for research as part of a limited data set, with an appropriate data use agreement to protect confidentiality.
10. Photography, Videos, Audio Recordings. We may take photographs, video, or audio recordings of you during your care for purposes of clinical documentation, identification, diagnosis, and treatment. These images and recordings may constitute PHI and will be used and disclosed in accordance with applicable law. As permitted by law, we may also create and use such photographs or recordings for educational, quality improvement, research, and teaching purposes. When used for these additional purposes, we will apply appropriate safeguards to protect your privacy and confidentiality and will limit or de-identify your PHI as required.
11. Required or Allowed by Law. We may use and disclose your PHI when required or permitted by applicable federal, state, and/or local law. Such uses or disclosures may include, but are not necessarily limited to, those set forth below. The use or disclosure will be made in compliance with the applicable law, and, to the extent required by law, you will be notified of any such uses and disclosures.
    1. Required by Law. We may use or disclose your PHI when required by law.
    2.  Public Health. We may disclose your PHI for public health activities as required or permitted by law. These activities generally include the following:
       1. to report matters related to the quality, safety, or effectiveness of a product or service regulated by the Food and Drug Administration (FDA)
       2. to prevent or control disease, injury, or disability
       3. to report disease or injury
       4. to report births and deaths
       5. to report child abuse or neglect
       6. to report reactions to medications and food or problems with products
       7. to notify people of recalls or replacements of products they may be using
       8. to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition
       9. to notify the appropriate government authority if we believe a person has been the victim of abuse, neglect, or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.
    3. Health Oversight Activities. We may disclose your PHI to a health oversight agency for activities authorized by law. Such activities might include audits, investigations, inspections, licensure, or disciplinary actions. These activities are needed to monitor the health care system, government programs, and compliance with civil rights laws.
    4. Serious Threats to Health or Safety. We may use and disclose your PHI when we believe it is necessary to reduce or prevent a serious threat to your health or safety, or the health or safety of another person, or the public. Any such disclosures would be made to persons or organizations capable of helping prevent or lessen the threat.
    5. Lawsuits and Similar Proceedings. We may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process, under certain circumstances.
    6. Law Enforcement. We may disclose PHI if asked to do so by a law enforcement official under certain circumstances, including:
       1. In response to a court order, subpoena, warrant, summons, or similar process
       2. to identify or locate certain persons
       3. to provide information about a crime victim, criminal conduct at our premises, or a death we believe may be the result of criminal conduct
       4. in an emergency, to report a crime (including the locations of the crime or victims and/or the identity, description, or location of the person who committed the crime)
       5. to authorized federal officials so they may provide protection for the President and other authorized persons or to conduct special investigations.
    7. Organ and Tissue Donation. We may release PHI to authorized organizations for organ, eye, or tissue donation or transplantation.
    8. Military and Veterans. If you are a member of the armed forces of the United States or another country (including veterans), we may release your PHI as required by military command authorities.
    9. Workers' Compensation. We may disclose your PHI to comply with workers' compensation laws or similar programs that provide benefits for work-related injuries or illnesses.
    10. Coroners, Medical Examiners, and Funeral Directors. We may disclose PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also disclose PHI to funeral directors to carry out their duties.
    11. National Security and Intelligence Activities. We may disclose your PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
    12. In Legal Custody. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose health information about you to the correctional institution or law enforcement official.
12. With Authorization. We will not share information unless you give us written permission for the purposes of marketing, sale of information, or sharing of psychotherapy notes. For any purposes other than those described above, we will use or disclose your PHI only with your written Authorization. You may give us written Authorization to use or disclose your PHI for any purpose. If you give us an Authorization, you may revoke it in writing at any time, but your revocation will not be effective to the extent we have already acted in reliance on the Authorization.
13. Other Legal Restrictions. Federal and/or applicable Maryland laws may limit how we may use or disclose your PHI or require different privacy protections for certain types of information considered highly confidential. Such highly confidential information may include health information pertaining to drug or alcohol abuse treatment, mental health care, HIV/AIDS, developmental disabilities, or genetic testing. We will not use or disclose your PHI in a manner prohibited by any applicable law.

IV. YOUR RIGHTS REGARDING YOUR PHI

1. NON-STUDENTS. You have the following rights regarding the PHI that we maintain about you.
   1. Confidential Communications. You have the right to request that we communicate with you about your health care and related issues in a particular manner or at a certain location. For instance, you may ask that we contact you at home, rather than at work. To request a type of confidential communication, you must make a written request to the Medical Records Supervisor at the Health Center at the address provided in Section VII. The request must clearly specify the requested method of contact and/or the location where you wish to be contacted. Reasonable requests will be accommodated. You do not need to give a reason for your request.
   2. Requesting Restrictions. You have the right to request certain restrictions regarding our use or disclosure of your PHI. This means that you may ask us not to use or disclose part of your PHI for certain treatment, payment, or health care operations purposes. You may also request that we not disclose all or part of your PHI to individuals (such as family members and friends) involved in your health care or the payment for your care. We are not required to agree to your request; however, if we do, we are bound by our agreement, except in emergency situations or when otherwise required by law. A restriction may be terminated by you or by us. Before we terminate, we will notify you. If you do not agree, the termination will only affect PHI we create or receive after we notify you. If you pay out of pocket for a service or health care item, you may also request that we do not disclose information about your treatment to your health insurer.
      In order to request a restriction in our use or disclosure of your PHI, or to request termination of a restriction to which we have agreed, you must make your request in writing to the Medical Records Supervisor at the Health Center at the address provided in Section VII. Your request must clearly describe the specific restriction you are requesting and to whom it should apply.
   3. Inspection and Copies. You have the right to look at and obtain a copy of the PHI we maintain that may be used to make decisions about you. This generally includes patient medical and billing records, but does not include psychotherapy notes or certain legal and other materials as permitted by law. In some limited circumstances, we may deny your request to see or copy your PHI. If this occurs, you may have the right to request a review of our denial, depending on the circumstances.
      Because our Health Center maintains PHI electronically, you also have the right to request that we transmit an electronic copy of your health information directly to you or a third party in an encrypted format.
      To inspect and/or obtain a copy of your PHI, you must submit your request in writing to the Medical Records Supervisor at the Health Center at the address provided in Section VII. We may charge a fee for the costs of copying, mailing, and supplies associated with your request. We will inform you of the fee amount in advance.
   4. Amendment. You may ask us to amend your PHI if you believe it is incorrect or incomplete. To request an amendment, your request must be made in writing and submitted to the Health Center’s Clinical Director at the address provided in Section VII. You must clearly describe the change(s) you are requesting, and you must explain why the information should be amended. We may deny your request if we believe the information to be amended is already accurate and complete, or if other special circumstances apply. If we deny your request, we will provide you with a written explanation of the denial and your right to submit a statement disagreeing with the denial. If we approve the amendment request, we will inform you, update the health information, and notify others who need to know of the change.

   5. Accounting of Disclosures. You have the right to request a list of the disclosures we have made of your PHI after April 13, 2003. The list does not have to include disclosures made to you or with your Authorization, for treatment, payment, and health care operations purposes, or in connection with certain other activities.

      In order to obtain an accounting of disclosures, you must submit your request in writing to the Health Center’s Medical Records Supervisor at the address provided in Section VII. All requests for an accounting must specify a time period that may not exceed six (6) years from the date of disclosure. If you request an accounting more than once in a 12-month period, we may charge a reasonable cost-based fee, for which you will be notified in advance.

   6. Right to a Copy of this Notice. You are entitled to receive a paper copy of our NoPP. You may ask us for a copy of the Notice at any time. To obtain a paper copy, contact the Health Center’s Privacy Coordinator or the University’s HIPAA Privacy Officer at the addresses provided in Section VII. The Notice is also posted on the Health Center’s website.
   7. Right to be notified of a Breach. You have the right to be notified if we (or one of our Business Associates) discover a breach of unsecured PHI. Notice of any such breach will be made in accordance with federal requirements.
2. STUDENTS. We generally provide University students with similar rights regarding their health information, including the rights to request: confidential communications; restrictions on use or disclosure; inspection and copies; amendment; accounting of disclosures; and copies of this Notice.
   Those rights may, however, be implemented in different ways under FERPA, Maryland law, and/or University policy, as applicable. If you have questions about your rights regarding your health information, please contact the University HIPAA Privacy Officer or the Health Center Privacy Coordinator at the addresses provided in Section VII.

V. IMPLEMENTATION, QUESTIONS, AND COMPLAINTS

1. IMPLEMENTATION. This Notice provides a general overview of our privacy practices. This Notice and our privacy practices are implemented in accordance with applicable University policies and procedures and the requirements of HIPAA and other federal and Maryland laws, as applicable.
2. QUESTIONS. If you want more information about our privacy practices or have any questions or concerns, please contact the Health Center’s Privacy Coordinator or the University’s HIPAA Privacy Officer at the addresses provided in Section VII.
3. COMPLAINTS. If you believe your privacy rights have been violated, you may file a complaint with the Health Center’s Privacy Coordinator or the University’s HIPAA Privacy Officer at the addresses provided in Section VII. A complaint may also be filed with the U.S. Department of Health and Human Services(HHS). We will not retaliate against you in any way if you file a complaint with us or with HHS.

VI. CHESAPEAKE REGIONAL INFORMATION SYSTEM FOR OUR PATIENTS
We have chosen to participate in the Chesapeake Regional Information System for our Patients (CRISP), a regional health information exchange serving Maryland and D.C. As permitted by law, your health information will be shared with this exchange to provide faster access, better coordination of care, and to assist providers and public health officials in making more informed decisions. You may “opt-out” and disable access to your health information available through CRISP by calling 1-877-952-7477 or completing and submitting an Opt-Out form to CRISP by mail, fax, or through their website. Public health reporting and Controlled Dangerous Substances information, as part of the Maryland Prescription Drug Monitoring Program (PDMP), is available to providers.

We may access and use information from prescription monitoring programs and from prescription histories obtained from pharmacies for medical purposes such as treatment, care coordination, and patient safety.

VII. CONTACT INFORMATION
If you have any questions regarding this Notice or our health information privacy practices, please contact the:

University Chief Data Privacy Officer:
Division of Information Technology (DIT)
Manokin Building
5801 University Research Court, College Park, MD 20740
301-405-2812

Health Center Privacy Coordinator:
Associate Director of Administrative Services and Health Center Operations
University Health Center, Bldg. 140
3983 Campus Drive, College Park, MD 20742
301-314-8154

Other Health Center personnel may be contacted as follows:
Medical Records Supervisor
University Health Center, Bldg. 140
3983 Campus Drive, College Park, MD 20742
301-314-8120

Associate Director of Medical Services
University Health Center, Bldg. 140
3983 Campus Drive, College Park, MD 20742
301-314-2549

This Notice is effective April 14, 2026.

University of Maryland Compliance with HIPAA