What is a privacy incident?
A privacy incident involves any potential breach, which is any unauthorized access to, including use or disclosure of patient information, that compromise the security or privacy of the PHI.
How do I Report a Privacy Incident?
Report suspected privacy incidents as soon as possible through the organization’s privacy incident reporting system or by promptly reporting to the Privacy Office directly.
How do I Submit a Compliance Question or Complaint?
To submit a compliance question or complaint, contact the Compliance Office by email at compliance@med.cornell.edu or by telephone at 646-962-7539.You may also report a concern anonymously through the Cornell University Ethical Conduct and Compliance Hotline at 866-293-3077 or through the online reporting tool at hotline.cornell.edu. Reports made in good faith may be submitted without fear of retaliation.
How Do I Obtain a Copy of My Medical Records?
You may view and request copies of your outpatient medical records through your Weill Cornell Connect account.You may also complete an Authorization to Release Health Information form and submit it using one of the following methods:Email: medicalrecords@med.cornell.edu. For assistance, contact the Release of Information Unit at 646-692-9820.
My Medical Records are Incorrect. What Do I Do?
If you believe information in your medical record is incorrect or incomplete, you may request an amendment by contacting the Privacy Office at 646-962-6930 or privacy@med.cornell.edu. The Privacy Office will provide an Amendment Request Form for you to complete and return.Your request will be reviewed and processed within 30 days of receipt. Please note that submitting a request does not guarantee that the record will be changed. If your request is denied, you will receive information about the decision and your available options.
What is Care Everywhere?
Care Everywhere is an Epic feature that allows participating healthcare organizations using Epic to electronically exchange patient health information for permitted purposes, such as treatment. It may allow an authorized provider to view relevant records from another participating healthcare organization, including test results, medications, allergies, diagnoses, and visit information.
Patients who have questions about their HIE participation or consent status should contact privacy@med.cornell.edu.
What is Health Information Exchange (HIE)?
A Health Information Exchange (HIE) is a broader electronic network that enables participating healthcare providers and organizations to securely share patient health information. An HIE may connect organizations that use different electronic health record systems.Patients who have questions about their HIE participation, consent status, opting out and breaking links should contact privacy@med.cornell.edu.
I No Longer Want to Participate in the Health Information Exchange (HIE). What Do I Do?
You may change your HIE authorization choice at any time. Contact the Privacy Office at 646-962-6930, Monday through Friday from 9:00 a.m. to 5:00 p.m., or email privacy@med.cornell.edu for assistance.After your current authorization status is updated, you may be asked to complete the Care Everywhere and HIE authorization form again at your next visit to document your new choice.
What is PHI and its 18 identifiers?
Protected Health Information (PHI) is any individually identifiable health information created or received by the University. Such information may relate to past, present, or future physical or mental health of a patient or research study participant. PHI is information that is used to identify the individual. PHI can be transmitted electronically, orally, or in writing.
- Patient Names
- Geographical Elements
- Dates
- Phone numbers
- Fax numbers
- Email addresses
- Social Security numbers
- Medical record numbers
- Health insurance beneficiary numbers
- Account numbers
- Certificate/license numbers
- Vehicle identifiers
- Device identifiers
- URLs
- IP address numbers
- Biometric identifiers
- Facial images
- Any other unique identifying number, characteristic, or code
What is HIPAA and its purpose?
HIPAA is an acronym for the Health Insurance Portability and Accountability Act of 1996. It is a federal law designed to help protect patient’s health information. HIPAA protects the privacy and security of patient medical information in written, verbal, and electronic form.
Is WCM required to comply with HIPAA?
Yes. The University is a covered entity and HIPAA applies to all covered entities— Healthcare providers, Health plans, and healthcare clearinghouses. Often, contractors, subcontractors, third party service providers (vendors) and other outside persons that are not employees of the covered entity will need to have access to patients’ health information when providing services to the covered entity. These entities are called “Business Associates” and are required to comply with HIPAA.