Privacy Policy
NOTICE OF PRIVACY PRACTICES UNIVERSITY OF CALIFORNIA BERKELEY HEALTH SYSTEM
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION
PLEASE REVIEW IT CAREFULLY
UC Berkeley Health
UC Berkeley Health is one of the health care components of the University of California. The University of California health care components consist of the UC medical centers, the UC student health and counseling centers, the UC medical groups, clinics and physician offices, the UC schools of medicine and other UC health professional schools. The administrative and operational units supporting the provision of care at all locations listed, and the Sports Medicine programs at some of the campuses, are also health care components of the University of California.
Our Pledge Regarding Your Health information
UC Berkeley Health is committed to protecting the privacy of your medical, mental health and personal information. We are required by law to maintain the privacy of your health information. We will follow the legal duties and privacy practices described in this notice (“Notice”).
Your Rights Regarding Your Health information
You have the following rights regarding the health information we maintain about you:
Right to See and Copy. You have the right to see or get a copy of your health information, with certain exceptions. If we have the information in electronic format, you have the right to obtain your health information in an electronic format if possible. If not, we will work with you to find a way for you to receive the information electronically or as a paper copy. If you request a copy of the information, there may be a reasonable, cost-based fee for these services. You may also request that a copy of your health information be released to a third party that you choose.
To make this request, complete the Authorization to Release Form and send it through one of the ways listed below.
UC Berkeley Health is one of the health care components of the University of California. The University of California health care components consist of the UC medical centers, the UC student health and counseling centers, the UC medical groups, clinics and physician offices, the UC schools of medicine and other UC health professional schools. The administrative and operational units supporting the provision of care at all locations listed, and the Sports Medicine programs at some of the campuses, are also health care components of the University of California.
Our Pledge Regarding Your Health information
UC Berkeley Health is committed to protecting the privacy of your medical, mental health and personal information. We are required by law to maintain the privacy of your health information. We will follow the legal duties and privacy practices described in this notice (“Notice”).
Your Rights Regarding Your Health information
You have the following rights regarding the health information we maintain about you:
Right to See and Copy. You have the right to see or get a copy of your health information, with certain exceptions. If we have the information in electronic format, you have the right to obtain your health information in an electronic format if possible. If not, we will work with you to find a way for you to receive the information electronically or as a paper copy. If you request a copy of the information, there may be a reasonable, cost-based fee for these services. You may also request that a copy of your health information be released to a third party that you choose.
To make this request, complete the Authorization to Release Form and send it through one of the ways listed below.
Right to Ask for a Correction. If you feel that your health information is incorrect or incomplete, you may ask us to change or add more information to complete your record. We may say “no” to your request, but we’ll tell you why in writing.
To make this request, complete the Request to Amend Protected Health Information Form and send it through one of the ways listed below.
To make this request, complete the Request to Amend Protected Health Information Form and send it through one of the ways listed below.
Right to Know How We Have Shared Your Health Information. You have the right to request a list (accounting) of the times UC Berkeley Health has shared your health information with others, such as to government agencies. The list will not include any disclosures made for treatment, payment, health care operations, or any disclosure you asked us to make. The request may be for a period covering up to six years before the date you ask for the list. If you request an accounting more than once during a 12-month period, we may charge you a reasonable, cost-based fee.
To make this request, complete the Accounting of Disclosures of Protected Health Information and send it through one of the ways listed below.
To make this request, complete the Request for Special Restriction on Use or Disclosure of Protected Health Information Form
and send it through one of the ways listed below.
Right to Ask for Preferred Communications. You have the right to ask that we communicate with you about your health information in a certain way or at a certain location. For example, you may ask that we contact you only at home or only by mail. We will agree to all reasonable requests.
To make this request, complete the Preferred Communication Request Form and send it through one of the ways listed below.
Right to a Paper Copy of This Notice. You can ask for a paper copy of this Notice at any time, even if you have agreed to receive this Notice electronically. Copies of this Notice are available throughout UC Berkeley Health locations, or you may obtain a copy at our website, uhs.berkeley.edu.
Right to be Notified of a Breach. You have the right to be notified if we discover a breach that may have compromised the privacy or security of your information.
How We May Use and Disclose Your Health information
We typically use and disclose your health information in the following ways.
For Treatment. We use your health information to provide you with medical and/or mental health treatment or services. We disclose your health information to medical and mental health professionals, technicians, medical and health sciences students, or other health system personnel involved in your care. We may also share your health information with other non-UC Berkeley Health providers for care or treatment. For example, we may share your health information if you are being referred to another provider at a non-UC Health institution.
For Payment. We use and share your health information to bill or get payment from health plans or other entities. For example, we give information to your health plan so it will pay us for your services.
For Health Care Operations. We use and share your health information to manage your treatment and services, run our business and teaching institution operations, improve your care, and contact you when necessary. For example, your health information may be used to review the quality and safety of our services, or for business planning, management and administrative services. We may also share your health information with an outside company performing services for us such as accreditation, legal, or auditing services. These companies are required by law to keep your health information confidential.
Other Ways We Share Your Health Information
We are permitted or required by law to share your health information in other ways – usually in ways that help the public, such as public health and research. We have to meet many conditions in the law before we can share your information for these reasons.
Hospital Directory. If you are hospitalized, we may include certain information about you in the hospital directory. This is so your family, friends, and clergy can visit you in the hospital and generally know how you are doing. You have the right to object to the release of directory information. [Note: this section does not apply to UC Berkeley as it does not currently operate an admitting hospital].
Individuals Involved in Your Care or Payment for Your Care. We may share health information with your family, close friends, or others involved in your care or payment for your care.
Health Information Exchanges. UC Berkeley Health may participate in one or more health information exchanges (HIE), where we may share your health information, as allowed by law, to other health care providers or entities for coordination of your care. This allows health care providers at different facilities participating in your treatment to have the information needed to treat you. For a list of current participation in HIEs, please contact uhsprivacyoffice@lists.berkeley.edu or call 510-642-1804.
If you do not want UC Berkeley Health to share your information in an HIE, you can opt out by completing an opt-out form in eTang. UC Berkeley Health will agree withyour opt-out request as needed to comply with the laws that apply to us. Opting out stops UC Berkeley Health from sharing your information with other health care providers through the HIE; it does not stop other health care providers from sharing your information with UC Berkeley Health, and it does not stop a health care provider that already received your information from keeping it.
To stop other health care providers from sharing your information with UC Berkeley Health, you must contact those providers directly.
To make this request, complete the Health Records opt out of HIE, Research, Fundraising Form and send it through one of the ways listed below.
Research. UC Berkeley Health is a research institution. In certain circumstances, we can use or share your information for research without obtaining your authorization. For example, we may use your health information without your authorization for certain research when the research goes through a special review process to protect patient safety, welfare, and confidentiality.
University of California researchers may contact you about your interest in participating in certain research studies. Researchers may only contact you if they have approval to do so under a special review process. If you would like to opt out of receiving information related to research opportunities, please complete the opt-out form in eTang with your request for a restriction.
To make this request, complete the Health Records opt out of HIE, Research, Fundraising Form and send it through one of the ways listed below.
Organ and Tissue Donation. If you are an organ donor, we may share your health information with organ procurement organizations.
Coroners, Medical Examiners and Funeral Directors. We may share health information with a coroner, medical examiner, or funeral director when an individual dies. This may be necessary, for example, to identify a deceased person or determine cause of death.
Disaster Relief Efforts. We may share your health information to
an entity assisting in a disaster relief effort so that others can be notified about your condition, status and location.
Fundraising Activities. We may use information you provided us to contact you about fundraising programs and events. You can opt out of receiving fundraising information for UC Berkeley Health by completing the opt-out form in eTang.
To make this request, complete the Health Records opt out of HIE, Research, Fundraising Form and send it through one of the ways listed below.
As Required By Law. We will disclose your health information when required to do so by federal or state law. For example, we may share your health information with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.
Respond to lawsuits and legal actions. We can share health information about you in response to a court or administrative order, or in response to a subpoena.
Military and Veterans. If you are or were a member of the armed forces, we may release your health information to military authorities as allowed or required by law.
Inmates. If you are an inmate of a correctional institution or under the custody of law enforcement officials, we may release your health information to the correctional institution as allowed or required by law.
Workers’ Compensation. We may use or share your health information for Workers’ Compensation or similar programs as allowed or required by law. These programs provide benefits for work-related injuries or illness.
Public Health and Safety. We may disclose your health information for certain situations such as:
- preventing or controlling disease (such as cancer and tuberculosis), injury or disability
- reporting vital events such as births and deaths
- reporting suspected abuse, neglect, or domestic violence
- preventing or reducing a serious threat to anyone’s health or safety
- reporting adverse events or surveillance related to food, medications or defects or problems with products
- notifying people of recalls, repairs or replacements of products they may be using
- notifying a person who may have been exposed to a disease or may be at risk of contracting or spreading a disease or condition
- providing limited information to your employer for legally required reporting of an employee’s serious injury or death that occurs in the workplace
- providing limited information to your employer for legally required reporting related to medical surveillance of the workplace or work-related illness or injury, including infectious disease prevention and control
Health Oversight Activities. We may share your health information with governmental, licensing, auditing, and other agencies as allowed or required by law.
Law Enforcement. As allowed or required by law, when certain conditions are met, we may release your health information to law enforcement.
National Security and Intelligence Activities. As required by law, we may share your health information for special government functions such as national security and presidential protective services.
Marketing or Sale of Health information. Most uses and sharing of your health information for marketing purposes or any sale of your health Information are strictly limited and require your written authorization.
Psychotherapy notes. Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during individual, group, joint, or family counseling sessions. Psychotherapy notes have additional protections under federal law and most uses or disclosures of psychotherapy notes require your written authorization.
Other Uses and Disclosures of Health Information. Other ways we share and use your health information not covered by this Notice will be made only with your written authorization. If you authorize us to use or disclose your health information, you may cancel that authorization, in writing, at any time. However, the cancellation will not apply to information we have already used and disclosed based on the earlier authorization. If you wish to cancel, see below for the appropriate form and how to submit.
Special laws apply to certain kinds of health information considered particularly private or sensitive to a patient. This sensitive information includes psychotherapy notes, sexually transmitted diseases, drug and alcohol abuse treatment records, mental health records, and HIV/AIDS information. When required by law, we will not share this type of information without your written permission. In certain circumstances, a minor’s health information may receive additional protections.
All the forms mentioned above can be downloaded from the eTang Patient Portal or through links below:
Authorization Release of Information:
Authorization Release of Information:
Revocation of Release of Information:
Request to Amend Protected Health Information Form:
Accounting of Disclosures of Protected Health Information:
Request for Special Restriction on Use or Disclosure of Protected Health Information Form: https://uhs.berkeley.edu/sites/default/files/request_for_special_restriction.pdf
Preferred Communications Request Form:
Health Records opt out of HIE, Research, Fundraising Form:
Completed forms can be submitted through:
eTang Patient Portal:
Complete the forms online form through a secure message to Health Records
https://etang.berkeley.edu
Or submit:
In person:
UHS Health Records
2222 Bancroft Way - 2nd Floor Atrium Berkeley, CA 94720-4300
Via Mail:
UHS Health Records 2222 Bancroft Way Berkeley, CA 94720-4300
Via Fax:
(510) 642-1801
Changes to UC Berkeley Health’s Privacy Practice and This Notice We may change the terms of this Notice at any time, and the
changes will apply to all health information we have about you. The current Notice will be available upon request, at our locations, and on our website.
Questions or Complaints
If you have questions or concerns about this Notice, please contact the UC Berkeley University Health Services Privacy Official at (510) 642-9250; or uhsprivacyoffice@lists.berkeley.edu
If you believe your rights have been violated, you may file a complaint with University Health Services or with the Secretary of the Department of Health and Human Services, Office for Civil Rights. To file a written complaint with University Health Services contact: Privacy Officer, University Health Services, 2222 Bancroft Way Rm. 3200, Berkeley CA 94720-4300. You will not be penalized for filing a complaint.
The Board of Behavioral Sciences also receives and responds to complaints regarding services provided within the scope of practice of marriage and family therapists, licensed educational psychologists, clinical social workers, or professional clinical counselors. The Board may be contacted online at www.bbs.ca.gov or by calling (916) 574-7830.
Additional information on how to file a complaint can be found here: https://uhs.berkeley.edu/how-offer-feedback-or-file-complaint
UCOP 4/6/20 – UC Berkeley 8/1/2022
The University of California
Statement of Privacy Practices– General Data Protection Regulation Berkeley SHIP
This statement is supplemental privacy information for individuals who are physically located in the European Economic Area (“EEA”) at the time of receiving services through the UC Berkeley Student Health Insurance Plan (Berkeley SHIP).
1. Transparency Regarding the Use of Your Personal Data
As part of our commitment to protecting your privacy, this statement is designed to provide you with information regarding how the University of California Berkeley Student Health Insurance Plan (Berkeley SHIP), collects and processes the information you share when you use UHS services such as the eTang patient portal and its associated domains (together, the "Sites"), utilize the services of ours which include the provision of health insurance to UCB’s students, or when you otherwise communicate with Berkeley SHIP (“Berkeley SHIP Services”)]. This statement is applicable to individuals using Berkeley SHIP Services who are located in the European Economic Area (“EEA”).
For purposes of the General Data Protection Regulation (“GDPR”), the data controller is UC Berkeley University Health Services (UHS), with a location at 2222 Bancroft Way, Berkeley, CA 94720.
2. Your Personal Data We Use
As part of our commitment to protecting your privacy, this statement is designed to provide you with information regarding how the University of California Berkeley Student Health Insurance Plan (Berkeley SHIP), collects and processes the information you share when you use UHS services such as the eTang patient portal and its associated domains (together, the "Sites"), utilize the services of ours which include the provision of health insurance to UCB’s students, or when you otherwise communicate with Berkeley SHIP (“Berkeley SHIP Services”)]. This statement is applicable to individuals using Berkeley SHIP Services who are located in the European Economic Area (“EEA”).
For purposes of the General Data Protection Regulation (“GDPR”), the data controller is UC Berkeley University Health Services (UHS), with a location at 2222 Bancroft Way, Berkeley, CA 94720.
2. Your Personal Data We Use
Information you provide directly to UC: Berkeley SHIP collects personal information about you called Personal Data through the enrollment process. The information you gave us included your name, address and telephone number and e-mail address, UC student identification number, and date of birth, as well as any information about you that is associated with or linked to, or could be linked to, any of the foregoing data.
Information from Other Sources: The information you give or we collect also includes more sensitive information, such as information relating to a medical condition or a medical diagnosis, biometric information about you, or demographic information relating to you. This information is collected for purposes of preventive medicine, or to provide medical treatment to you pursuant to a contract with a health professional bound by ethical requirements to maintain the confidentiality of your information.
3. How We Use Your Personal Data and the Lawful Basis for Such Processing
Berkeley SHIP processes your Personal Data for the following purposes and bases:
- Administering your participation in Berkeley SHIP. This is generally required under the contract we have with you as a Berkeley SHIP enrollee.
- Assessing/appraising provision of student health insurance. It is in our legitimate interest as a health insurance provider to understand and improve our processes.
- Providing you with information regarding Berkeley SHIP events and initiatives. We will generally only do this where it is in our legitimate interest and where you have not objected or withdrawn any prior consent given.
- Processing and dealing with any complaints or inquiries made by you or legally on your behalf. We do this because it is in our legitimate interest as part of the services Berkeley SHIP offers to you.
- UC may also be required to disclose your Personal Data to authorities who can request this information by law that is binding on UC.
- Utilizing sensitive personal data in connection with our Services, with your consent.
4. Recipients of Your Personal Data
Berkeley SHIP may share your Personal Data with the following recipients:- Service Providers: Vendors that need access to your Personal Data in order to provide Berkeley SHIP Services. These include vendors to evaluate requests for waiver of enrollment in Berkeley SHIP, and claims administrators and Berkeley SHIP insurance carriers and brokers who administer Berkeley SHIP. Where Berkeley SHIP analyzes your Personal Data in order for UC to improve its provision and administration of its Services, it will share your Personal Data with data analytics vendors, and where consent is required, will only do so with your consent.
If your Personal Data is shared with a third party, UC will require that the third party use appropriate measures to protect the confidentiality and security of your Personal Data.
We may also need to share your Personal Data as required to respond to lawful requests and legal process; to protect our rights and property and those of our agents, customers and others, including to enforce our agreements and policies; and in an emergency, to protect UC and the safety of our students, faculty and staff or any third party.
5. Security
UC takes appropriate physical, administrative and technical measures to protect Personal Data that are consistent with applicable privacy and data security laws and regulations. For more information about how UC protects data, refer to Systemwide Information Security Policies and Standards .
6. Retaining and Deleting Your Personal Data
UC will only retain your Personal Data for the duration necessary for seven years from the date of enrollment in Berkeley SHIP, unless there is a legal requirement to maintain it for a longer period.
7. International Transfer of Your Personal Data
In order to fulfill the intended processing purposes described above, your Personal Data will be transferred outside of the European Economic Area (EEA), specifically to the United States, which does not protect Personal Data in the same way that it is protected in the EEA. UC will undertake appropriate measures to ensure adequate protection of Personal Data, including utilizing appropriate physical, administrative, and technical safeguards to protect Personal Data, as well as executing standard contractual clauses approved by the European Commission or a supervisory authority under GDPR, or obtaining your consent, where appropriate.
8. Your Rights
As required by the General Data Protection Regulation and applicable EU Member State and EEAstate law, if you are located in the European Economic Area, you have a right to:- Access your Personal Data, as well as information relating to the recipients of your Personal Data, the purposes of processing your Personal Data, the duration for which the Personal Data will be stored, and the source of Personal Data that has not been provided by you;
- Rectify or correct inaccurate or incomplete Personal Data concerning you, taking into account the purposes of the processing, and the right to have incomplete Personal Data completed;
- Move your Personal Data to another controller or processor. UC will facilitate the lawful transfer of your data to the extent possible;
- Have your Personal Data erased in certain circumstances;
- Restrict the processing of your Personal Data in certain circumstances;
- Object to the processing of Personal Data in certain circumstances;
- Withdraw your consent to the processing of your Personal Data, should UC ask for your consent for the processing of your Personal Data. The withdrawal does not affect the lawfulness of Processing based on your consent before its withdrawal.
- Know whether your Personal Data is being used for automated decision-making, including profiling. In those cases, UC will give you meaningful information about the logic involved, the significance and the envisaged consequences of such processing for your data, and the right to request human intervention;
- Lodge a complaint with a supervisory authority.
UC may be obligated to retain your Personal Data as required by U.S. federal or state law.
If you wish to exercise your rights, you can contact the UC Privacy Official identified below.
9. Questions and Complaints; UC Privacy Official
If you have questions or complaints about our treatment of your Personal Data, or about our privacy practices more generally, please feel free to contact the UC Berkeley University
Health Services Privacy Line: (510) 642-9250; or the UC Berkeley Privacy Office: privacyoffice@berkeley.edu
Effective Date: This GDPR statement is effective as of July 1, 2018