Effective Date: July 1, 2025
Issuing Authority: Senior Vice President for Finance and Administration
Policy Contact: University HIPAA Officer, 478-301-2300
Purpose
The purpose of Notice of Privacy Practices Policy is to explain how Mercer University (“Mercer”) may use and disclose protected health information to carry out treatment, payment or health care operations and for other purposes that are permitted or required by law. Mercer University is required by law to maintain the privacy of protected health information and provide individuals a notice of its legal duties and privacy practices with respect to protected health information.
The policy also describes the individual’s rights to access and control protected health information. “Protected Health Information” is information about the individual, including demographic information that may identify the individual and relates to the individual’s past, present or future physical or mental health or condition and related health care services.
Mercer University is required to abide by the terms of the Notice of Privacy Practices currently in effect. Mercer may change the terms of the notice at any time. Upon the individual’s request, Mercer University will provide the individual with any revised Notice of Privacy Practices by contacting the HIPAA Privacy Officer.
Scope
This policy applies to all employees, students, and patients of Mercer University.
Exclusions
None
Policy Statement
Uses and Disclosures of Protected Health Information
The patient’s protected health information may be used and disclosed by Mercer faculty or staff and others outside of the office who are involved in the patient’s care and treatment for the purpose of providing health care services. The patient’s protected health information may also be used and disclosed to pay related health care bills and to support the operation of Mercer’s healthcare and student services. The following are examples of the types of uses and disclosures of your protected healthcare information that Mercer University is permitted to make once the patient has consented.
These examples represent the types of uses and disclosures that may be made by Mercer University once the patient has provided consent.
Treatment: Mercer University will use and disclose the patient’s protected health information to provide, coordinate, or manage the patient’s healthcare and any related services. This includes the coordination or management of the patient’s healthcare with a third party that has already obtained the patient’s permission to have access to the patient’s protected health information. In addition, the patient’s protected health information may be provided to a physician to whom the patient has been referred to ensure that the physician has the necessary information to diagnose or treat the patient.
As well, Mercer University may disclose the patient’s protected health information from time to time to another physician or healthcare provider (e.g., a specialist or laboratory) who, at the request of the patient’s physician, becomes involved in the patient’s care by providing assistance with the patient’s healthcare diagnosis or treatment to the patient’s physician.
Healthcare Operations: Mercer University may use or disclose the patient’s protected health information, as needed, in order to support the business activities of Mercer University. These activities include, but are not limited to, quality assessment activities, employee review activities, training of medical students, licensing, marketing, and conducting or arranging for other business activities.
Mercer University will share the patient’s protected health information with third party “Business Associates” that perform various activities (e.g., counseling, student employment, etc.) for Mercer University. Whenever an arrangement between Mercer and a business associate involves the use or disclosure of the patient’s protected health information, Mercer will have a written contract that contains terms that will protect the privacy of the patient’s protected health information.
Mercer University may use or disclose the patient’s protected health information, as necessary, to provide the patient with appointment reminders or to provide the patient with information about treatment alternatives or other health-related benefits and services that may be of interest to the patient. Mercer may also use and disclose the patient’s protected health information for other marketing activities. For example, the patient’s name and address may be used to send a newsletter about te services Mercer University offers. Mercer may also send the patient information about products or services that Mercer University believes may be beneficial to the patient.
Uses and Disclosures of Protected Health Information with the Patient’s Written Authorization
Other uses and disclosures of the patient’s protected health information will be made only with the patient’s written authorization, unless otherwise permitted or required by law as described below. The patient may revoke this authorization, at any time, in writing, except to the extent that Mercer University has already taken an action in reliance on the use or disclosure indicated in the authorization.
Other Permitted and Required Uses and Disclosures with the Patient’s Consent, Authorization, or Opportunity to Object
Mercer University may use and disclose the patient’s protected health information in the following instances, including but not limited to disclosure to the sponsor of the Mercer University group health plan. The patient has the opportunity to agree or object to the use or disclosure of all or part of the patient’s protected health information. If the patient is not present or able to agree or object to the use or disclosure of the protected health information, then Mercer University may, using professional judgment, determine whether the disclosure is in the patient’s best interest. In this case, only the protected health information that is relevant to the patient’s healthcare will be disclosed.
Others Involved in Healthcare Issues
Unless the patient objects, Mercer University may disclose to a patient’s family member or any person the patient identifies the patient’s protected health information that directly relates to that person’s involvement in the patient’s healthcare. If the patient is unable to agree or object to such a disclosure, Mercer University may disclose such information as necessary if Mercer determines that it is in the patient’s best interest based on Mercer’s professional judgment and in compliance with Georgia law. Mercer University may use or disclose protected health information to notify or assist in notifying a family member, personal representative or any other person that is responsible for the care of the patient’s general condition or death. Finally, Mercer University may use or disclose the patient’s protected health information to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in the patient’s healthcare.
Emergencies. Mercer University may use or disclose the patient’s protected health information in an emergency treatment situation. If this happens, Mercer University shall try to obtain the patient’s consent as soon as reasonably practicable after the delivery of treatment. If a physician is required by law to treat the patient and the physician has attempted to obtain the patient’s consent but is unable to obtain the patient’s consent, the physician may still use or disclose the patient’s protected health information to treat the patient.
Communication Problems. Mercer University may use and disclose the patient’s protected health information if Mercer University attempts to obtain consent from the patient but is unable to do so due to substantial communication barriers and a physician determines, using professional judgment, that the patient intends to consent to use or disclosure under the circumstances.
Other Permitted and Required Uses and Disclosures That May Be Made Without the Patient’s Consent, Authorization, or Opportunity to Object
Mercer University may use or disclose the patient’s protected health information in the following situations without the patient’s consent or authorization. These situations include:
Required by Law. Mercer University may use or disclose the patient’s protected health information to the extent that law requires the use or disclosure. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. The patient will be notified, as required by law, of any such uses or disclosures.
Public Health. Mercer University may disclose the patient’s protected health information for public health activities and purposes to a public health authority that is permitted by law to collect or receive the information. The disclosure will be made for the purpose of controlling disease, injury, or disability. Mercer University may also disclose the patient’s protected health information, if directed by the public health authority, to a foreign government agency that is collaborating with the public health authority.
Communicable Diseases: Mercer University may disclose the patient’s protected health information, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.
Health Oversight. Mercer University may disclose protected health information to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies seeking this information include government agencies that oversee the healthcare system, government benefit programs, other government regulatory programs and civil rights laws.
Military Activity and National Security. When the appropriate conditions apply, Mercer University may use or disclose protected health information of individuals who are armed forces personnel (1) for activities deemed necessary by appropriate military command authorities, (2) for the purpose of a determination by the Department of Veterans Affairs of the patient’s eligibility for benefits, or (3) to foreign military authority if the patient is a member of that foreign military service. Mercer University may also disclose the patient’s protected health information to authorized federal officials for conducting national security and intelligence activities, including for the provision of protective services to the President or others legally authorized.
Worker’s Compensation. Mercer University may disclose the patient’s protected health information as authorized to comply with workers’ compensation laws and other similar legally established programs.
Individual Rights
The following is a statement of the patient’s rights with respect to protected health information and a brief description of how the patient may exercise these rights.
The patient has the right to inspect and copy his/her protected health information.
This means the patient may inspect and obtain a copy of protected health information about him/her that is contained in a designated record set for as long as Mercer University maintains the protected health information. A “designated record set” contains medical and billing records and any other records Mercer University may use for making decisions about the patient. The patient has the right to receive confidential communications of protected health information by alternate means and at alternative locations, as provided by law. The patient also has the right to amend protected health information for as long as the protected health information is maintained in the designated record set, as set forth in the HIPAA regulations.
Under federal law, however, the patient may not inspect or copy the following records: psychotherapy notes; information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding; and protected health information that is subject to law that prohibits access to protected health information. Depending on the circumstances, a decision to deny access may be reviewed. In some circumstances, the patient may have a right to have this decision reviewed. Please contact Mercer’s HIPAA Privacy Officer with questions about access to medical records.
The patient has the right to request a restriction of his/her protected health information.
This means the patient may ask Mercer University not to use or disclose any part of the patient’s protected health information for the purposes of treatment, payment or healthcare operations. The patient may also request that any part of the patient’s protected health information not be disclosed to family members or friends who may be involved in the patient’s care or for notification purposes as described in this Notice of Privacy Practices. The patient’s request must state the specific restriction requested and to whom the patient wants the restriction to apply.
Mercer University is not required to agree to a restriction that the patient may request. If, Mercer University believes it is in the patient’s best interest to permit use and disclosure of the protected health information, the patient’s protected health information will not be restricted. If Mercer University does agree to the requested restriction, Mercer may not use or disclose the patient’s protected health information in violation of that restriction unless it is needed to provide emergency treatment. With this in mind, the patient should discuss any restrictions with his/her physician.
The patient has the right to receive an accounting of certain disclosures Mercer University has made, if any, of his/her protected health information.
This right applies to disclosures for purposes other than treatment, payment or healthcare operations as described in this Notice of Privacy Practices. It excludes disclosures Mercer University may have made to the patient, for a facility directory, to family members or friends involved in the patient’s care, or for notification purposes. The patient has the right to receive specific information regarding these disclosures that occurred after April 14, 2003. The patient may request a shorter time frame. The right to receive this information is subject to certain exceptions, restrictions and limitations.
The patient has the right to obtain a paper copy of this notice, upon request, even if the patient has agreed to accept this notice electronically.
Filing a Complaint
The patient may complain to Mercer University r to the Secretary of Health and Human Services if the patient believes his/her privacy rights have been violated. The patient may file a complaint with Mercer University by submitting written notification to the Mercer HIPAA Privacy Officer regarding the complaint. Send all correspondence to:
HIPAA Privacy Officer
Mercer University
1501 Mercer University Drive
Macon, GA 31207-0001
The patient may contact Mercer HIPAA Privacy Officer Jim Calhoun at (478) 301-2325 for further information about the complaint process. The patient will not be retaliated against for filing a complaint.
Additional Resources
Acknowledgment of Notice of Privacy Practices: https://hipaa.mercer.edu/www/mu-hipaa/forms/upload/Acknowledgment-of-Notice-of-Privacy-Practices-revised-May-2003.pdf
History
Revised March 2003
Revised July 1, 2025