Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW YOUR PROTECTED HEALTH INFORMATION (PHI) MAY BE USED AND DISCLOSED BY THE U.S. DEPARTMENT OF STATE (DOS) BUREAU OF MEDICAL SERVICES (MED) AND HOW TO OBTAIN ACCESS TO YOUR PHI.

This Notice of Privacy Practices is provided to you consistent with the Privacy Act of 1974, as amended, 5 U.SC. § 552a. MED is authorized to collect certain health information from you pursuant to section 904 of the Foreign Service Act, 22 U.S.C. § 4084. This notice describes how MED may use or disclose your PHI and with whom that information may be shared. This notice also describes your rights to access and amend your PHI.

Please also see the U.S. Department of State’s System of Records Notice for its Medical Records system (STATE-24) at https://www.state.gov/system-of-records-notices-privacy-office/ for a description of what type of personal information MED maintains about individuals in systems of record, for what purpose(s) the information is used, to whom it may be disclosed, and how individuals may request access or seek redress of their information.

HOW WE MAY USE OR DISCLOSE YOUR PROTECTED HEALTH INFORMATION

The following are examples of permitted uses and disclosures of your PHI. Additional information about the Routine Uses of your medical information can be found in the System of Records Notice State-24, Medical Records.

Required Uses and Disclosures

Treatment – MED will use and disclose your PHI to provide, coordinate, or manage your health care and related services in a DOS health unit/clinic. This may also include other health care provider(s) who, at your request, become involved with the management of your care or related services. This can include pharmacists when PHI necessitates the information on other drugs which have been prescribed to identify potential interactions.

In emergencies, we will use and disclose your PHI to provide the treatment you require.

Payment – Your PHI will be used, as needed, to obtain payment for your health care services, including services recommended for determining eligibility for benefits, and utilization reviews. For example, a hospital stay might require that some PHI be disclosed to obtain approval for the hospital admission.

Health Care Operations/Oversight – MED may use or disclose your PHI to support the daily activities related to health care. These activities include, but are not limited to, quality assessment activities, investigations of adverse events or complaints, medical suitability determinations for medical and security clearances, medical clearance of an individual for a specific post, oversight of staff performance, and conducting or arranging for other health care related activities.

MED may disclose PHI to a health oversight agency for activities such as audits, investigations, and inspections. These health oversight agencies might include government agencies that oversee a health care system, government benefit programs, other government regulatory programs, and/or civil rights laws.

Required by Law – MED may use or disclose your PHI if law or regulation requires the use or disclosure. These include the following:

• In a judicial or administrative proceeding in response to a court order or administrative tribunal and in certain conditions in response to a subpoena or similar document.
• Information requests from law enforcement officials for identification and location of certain types of individuals.
• Circumstances pertaining to victims of a possible crime.
• Deaths or injuries suspected from criminal conduct.
• Crimes occurring at a DOS facility.
• Medical emergencies (not on DOS premises) believed to result from criminal conduct.
• If it is believed that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety or that of another person or the public.

Public Health – MED may disclose PHI to a public health authority that is permitted by law to collect or receive the information. The disclosure may be necessary to do the following:

• Prevent or control disease, injury, or disability.
• Report births and deaths.
• Report reactions to medications or problems with products.
• Notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.
• Notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect, or domestic violence.
• Notify a person who might have been exposed to a communicable disease or might otherwise be at risk of contracting or spreading the disease or condition.

U.S. Food and Drug Administration (FDA) – MED may disclose your PHI to a person or company required by the FDA to do the following:

• Report adverse events, product defects or problems, and/or biologic product deviations
• Track products
• Enable product recalls
• Make repairs or replacements.

Coroners, Funeral Directors, and Organ Donations – MED may disclose PHI to coroners or medical examiners for identification, to determine the cause of death, or for the performance of other duties authorized by law. MED may also disclose PHI to funeral directors as authorized by law.

National Security – MED may disclose your PHI to authorized Federal officials for conducting national security, intelligence activities, and protective services to the President or others.

Workers’ Compensation – MED may disclose your PHI to comply with workers’ compensation laws and other similar legally established programs.

Parental Access – Some state laws concerning minors permit or require disclosure of PHI to parents, guardians, and/or persons acting in a similar legal status. When care occurs in the U.S., MED will act in accordance with the law of the state where the treatment was provided. MED has the right to refuse to disclose information to a parent when it is felt such disclosure might be harmful to the child.

CONSEQUENCES OF NON-DISCLOSURE OF YOUR PROTECTED HEALTH INFORMATION

Providing your PHI to MED is voluntary: however, failure to disclose medical information required from you by MED may affect MED’s ability to provide treatment or, in the case of medical clearance adjudications, may result in denial of medical clearance.

YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION

By law, we must provide access to your health information to you, with limited exceptions.

Under the privacy rules, you have the right to access your standard PHI by utilizing the Authorization to Release Medical Records document, which can be requested from MED by emailing MEDMR@state.gov or using this link:  F23005 – Authorization for Release [52 KB]. Certain types of records, such as Family Advocacy Case records, must be requested from the Department of State by submitting a Personal Records Request following instructions at  https://foia.state.gov/Request/PersonalRecords.aspx. Please be aware that the Department may deny your request in certain cases, and that you may seek a review of any such denial.

Inspections and Copies – You have the right to inspect and obtain a copy of the PHI that may be used to make decisions about you, including patient medical records and billing records.

This right does not include the inspection and copying of information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding, and PHI that is subject to law prohibiting access to protected health information.

Requesting Restrictions – You may ask MED not to use or disclose any part of your PHI. The request must be made in writing by emailing MEDPrivacyOfficer@state.gov. In your request, you must clearly describe (1) what information you want restricted; (2) whether you want to restrict use, disclosure, or both; (3) to whom you want the restriction to apply, and (4) an expiration date for the restriction.

MED is not required to agree to a requested restriction but will give due consideration to such requests.

Confidential Communications – You may request that MED communicate with you using alternative means or at an alternative location to further protect your privacy. You do not need to give the reason for your request. We will accommodate reasonable requests, when possible.

Amendment – You may ask MED to amend your health information if you believe it to be incorrect or incomplete, and you may request an amendment for as long as the information is kept by MED. Please submit your detailed request to MEDPrivacyOfficer@state.gov. You must provide a reason that supports your request for amendment. If there are factual errors (wrong birth date, wrong blood type, etc.), MED will correct these.

MED may not agree to the amendment and could deny your request if it is determined that the current information is a) accurate and complete or b) the information was not created by MED. If you disagree with the statement in the record, MED will append/add your statement to the record; however, the original document will not be changed.

Inspection and Copies – You may obtain a paper copy of this notice from MED or view it electronically on MED’s website at Notice of Privacy Practice.

ACKNOWLEDGMENT OF RECEIPT OF THIS NOTICE

You will be asked to provide a signed acknowledgment of receipt of this notice: F23006 – MED Privacy Policy Acknowledgment [113 KB]. The intent is to create awareness of possible uses and disclosures of your PHI and privacy rights. The delivery of your health care services will in no way be conditioned upon your signed acknowledgment. If you decline to provide a signed acknowledgment, MED will continue to provide treatment, and MED will use and disclose your protected health information for treatment, payment, and health care operations consistent with STATE-24 and this Notice of Privacy Practices.

MED will abide by the terms of this privacy notice but may revise it to conform to any changes in System of Records Notice STATE-24, Medical Records at which time MED will issue an updated Notice of Privacy Practices.

Any changes to this notice will be made available on the MED website.

COMPLAINTS

If you believe your privacy rights have been violated, you may file a written complaint with the MED Privacy Officer. Please address your signed letter or email to:

MED Privacy Officer
U.S. Department of State
M/MED/CP/QM, SA-1
Washington DC. 20522-0102
MEDPrivacyOfficer@state.gov