Welcome to the HIPAA Privacy Patient Resource Center for UT Southwestern Medical Center at Dallas.  This page has been provided so that our patients may have access to information related to the federal HIPAA Privacy Rule and its effect on how protected health information (PHI) is protected and shared among providers both within and outside of the medical center.

What is HIPAA and why did it come about?
The Health Insurance Portability and Accountability Act (HIPAA) was enacted by Congress in 1996 to:

• Allow employees to take their health insurance coverage with them when moving from one employer with a group health plan to another;
• Ensure provisions are in place to safeguard the privacy and security of protected health information provided during healthcare activities;
• Establish a unique national provider identifier (NPI) to assist in identifying healthcare providers, and;
• Enact provisions which health with electronic transmission of financial transactions and code-sets that identify them. 

In an effort to increase awareness of our privacy practices among our patients, and to comply with the HIPAA Privacy Rule, UT Southwestern provides a Notice of Privacy Practices (NPP) to patients when a treating relationship is established between the patient and one of our healthcare providers.  

This NPP brochure outlines the rights and responsibilities of UT Southwestern (hospitals, healthcare providers, research laboratories and pharmacies) and the patient when dealing with the provision of protected health information related to care you receive from us.  

After presenting the patient with the brochure, our staff members must make a good faith effort to collect a signature from the patient acknowledging receipt of the NPP brochure.

The Notice of Privacy Practices can be obtained in English, and in español.

As stated above, the Notice of Privacy Practices contains information about a standardized set of patient rights, applicable to all patients, regardless of where they seek medical care.  These rights include the following:

• The right to receive a facility-specific Notice of Privacy Practices (NPP);
• The right to confidential communications (to call you at a certain number or use a specific mailing address when communicating about your care);
• The right to an accounting of disclosures (to whom UT Southwestern provides information about you);
• The right to amend medical records (to correct erroneous information);
• The right to file a complaint alleging a violation of patient privacy with the Office of Civil Rights in the U.S. Department of Health & Human Services, and;
• The right to request restrictions (access to your protected health information).

Frequently Asked Questions about HIPAA

Use the following question/answer session to answer your questions about UT Southwestern’s privacy practices.

What is protected health information (PHI)?
Protected health information (PHI) is individually identifiable health information that is transmitted by, or maintained in, electronic media or any other form or medium. This information must relate to

• The past, present, or future physical or mental health, or condition of an individual;
• Provision of health care to an individual, or;
• Payment for the provision of health care to an individual.

If the information identifies or provides a reasonable basis to believe it can be used to identify an individual, it is considered individually identifiable health information.

When can UT Southwestern release my protected health information to other entities?
Under HIPAA's Privacy Rule, uses and disclosures of protected health information (PHI) by covered entities can be divided into four categories:

• Core uses and disclosures, for which no permission is required -- although an optional consent can be employed -- which includes routine treatment, payment and other health care operations;
• Those requiring a supplemental authorization -- such as most kinds of research, and some kinds or marketing and fundraising;
• Those requiring an opportunity to agree or object, but no written authorization, and:
• Those not requiring even an opportunity to agree or object.

I have been asked to sign an acknowledgment form. I don't like to sign anything until I have read the entire document. Are you going to make me sign the acknowledgment form before I can see my doctor?
No. Your signature simply indicates that you were given the notice (NPP). If you choose not to read the NPP or sign the form, there will be no impact on the care or service you receive.

Why do I have to sign the acknowledgment?
You don't have to sign anything. The HIPAA law requires that we, as your health care provider, give you this notice (NPP) and make a good faith effort to document that you have received it.

What if I refuse to sign the acknowledgment?
If you choose not to sign, it will have no impact on your care or service.

Who can I talk with to explain some of the things in the NPP?
Clinic staff will be happy to answer any basic questions you have. If you have questions that they cannot answer, you can contact the UT Southwestern Privacy Officer at (214) 648-6080.

What is HIPAA anyway? Why do I need to care about it?
HIPAA is the Health Insurance Portability and Accountability Act, a federal law, enacted in 1996, that requires that health providers take certain steps to protect the privacy and security of patient health information. The privacy part of the law went into effect on April 14, 2003. The NPP document and the one page NPP summary describe how UT Southwestern protects your health information.

What does this have to do with my doctor and my care?
Your care will not change. The law formalizes many patient privacy practices that UT Southwestern has routinely followed for some time.

Will I have to sign this same acknowledgment at other clinics?
The UT Southwestern University Hospitals (St. Paul and Zale Lipshy) are managing the compliance of this process separately from the UT Southwestern Ambulatory Services clinics.  If you are a patient at either hospital, the admissions staff will ask that you sign a form which combines the NPP with the consent for admission. It is possible that you will be asked to sign a separate acknowledgment form if you are later seen at a UT Southwestern Ambulatory Services clinic. You may either sign the acknowledgment form again or you may simply inform them that you previously signed the form at another clinic. If you receive care at other clinics or hospitals that are not affiliated with UT Southwestern, expect that they will ask you to accept their Notice of Privacy Practices and sign their acknowledgment form.

What did you do with my medical information before HIPAA came along?
UT Southwestern has always protected the privacy and confidentiality of your health care, and has treated your health information accordingly. The new HIPAA law formalizes these privacy requirements, so that in addition to a being good practice, they are now spelled out as law.

Who can sign for my minor children or elderly parents? Who will explain it to them?
This is not a legal document, but you will need to sign the form for your minor children or elderly parents, if you are the designated legal representative. Should you or your child or elderly parent have questions or need help understanding the notice, you may contact UT Southwestern’s Privacy Officer at (214) 648-6080.

Do you have an NPP document available in other languages?
The NPP is also readily available in Spanish.  This version can be found at all Ambulatory Services clinics and at many locations throughout both St. Paul and Zale Lipshy.

What is the difference between the acknowledgment form and the other forms I need to sign?
This form is a statement that you received a notice regarding UT Southwestern’s privacy and confidentiality practices. It has nothing to do with how we handle your billing, registration or treatment.

Who can I contact if I have further questions about the Notice of Privacy Practices, the federal HIPAA law or would like to file a complaint?
Please contact the UT Southwestern Privacy Officer at (214) 648-6080.