HIPAA Notice of Privacy Practices

• Maintain the privacy of PHI about you;
• Inform you if a breach of your PHI occurs, we must inform you for each occurance;
• Give you this notice of our legal duties and privacy practices with respect to PHI; and
• Comply with the terms of our current Notice of Privacy Practices.

make changes to this Notice and to make such changes effective for all PHI we may already have about you. If and when this notice is changed, we will provide you with a copy of the revised notice upon your next appointment to our office. You will be asked to sign a form to show that you received a copy of the current notice. Even if you do not sign the form, we will still provide you with treatment.

We may use and disclose PHI so that we can bill and collect payment for the treatment and services provided to you. Before providing treatment or services, we may share details with your health plan concerning the services you are scheduled to receive. For example, we may ask for payment approval from your health plan before we provide care or services. We may use and disclose PHI to find out if your health plan will cover the cost of care and services we provide. We may use and disclose PHI to confirm you are receiving the appropriate amount of care to obtain payment for services. We may use and disclose PHI for billing, claims management, and collection activities. We may use and disclose PHI to insurance companies providing you with additional coverage. We may use and disclose limited PHI to consumer reporting agencies relating to collection of payments owed to us. We may also use and disclose PHI to another health care provider or to a company or health plan, as required to comply with the HIPAA Privacy Rule for the payment of activities to determine the insurance benefits to be paid for your care.

We may use and disclose PHI in performing business activities that are called health care operations. Health care operations include doing things that allow us to improve the quality of care we provide and to reduce health care costs. We may use and disclose PHI about you in the following health care operations:

• Reviewing and improving quality, efficiency, and cost of care that we provide to our patients. For example, we may use PHI about you to develop ways to assist our physicians and staff in deciding how we can improve the medical treatment we provide to others.

• Improving health care and lowering costs for groups of people who have similar health problems and helping to manage and coordinate for these groups of people. We may use PHI to identify groups of people with similar health problems to give them information, for instance, about treatment alternatives and educational classes.

• Reviewing and evaluation the skills, qualifications, and performance of health care providers taking care of you and our other patients.

• Providing training programs for students, trainees, health care providers, or non-health care professionals (for example billing personnel) to help them practice or improve their skills.

• Cooperating with outside organizations that assess the quality of the care that we provide.

• Cooperating with outside organizations that evaluate, certify, or license health care providers or staff in a particular field of specialty. For example, we may disclose PHI so that one of our providers may become certified as having expertise in a specific field of medicine.

• Cooperating with various people who review our activities. For example, PHI may be seen by doctors reviewing the services provided to you, and by accountants, lawyers, and others who assist us in complying with the law and managing our business.

• Assisting us in making plans for our practice’s future operations.

• Resolving grievances within our practice.

• Reviewing our activities and disclosing PHI in the event that we sell our practice to someone else or combine with another practice.

• Business planning and development, such as cost-management analyses.

• Business management and general administrative activities of our practice, including managing our activities related to complying with the HIPAA Privacy Rule and other legal requirements.

• Creating “de-identified” information that is not identifiable to any individual, and disclosing PHI to a business associate for the purpose of creating de-identified information, regardless of whether we will use the de-identified information.

• Creating a “limited data set” of information that does not contain information directly identifying a patient. Our ability to disclose this information to others under limited conditions is discussed later in this notice.

If another health care provider, company, or health plan that is required to comply with the HIPAA Privacy Rule also has, or once had, a relationship with you we may disclose PHI about you for certain health care operations of that health care provider or company. For example, such health care operations may include: reviewing and improving the quality, efficiency, and cost of care provided to you; reviewing and evaluating the skills, qualifications, and performance of health care providers; providing training programs for students or trainees, health care providers, or non-health care professionals; cooperating with outside organizations that evaluate, certify, or license, health care providers or staff in a particular field or specialty; and assisting with legal compliance activities of that health care provider or company. We may also disclose PHI for the health care operations of any “organized health care arrangement” in which we participate. An example of an organized health care arrangement is the joint care provided by a hospital and the physicians who see patients at the hospital.

Some of the services or activities in our organization are provided through contracts with business associates. For example, our medical record and practice management software vendor, management consultants, quality assurance reviewers, billing and collection services, and accountants. We may disclose your medical information to our business associates so that they can perform the service on our behalf. To protect your medical information, we require our business associates to sign a written privacy agreement.

We may contact you to remind you of appointments and we may leave messages on your voice mail or answering machine. We may contact you to tell you about treatment alternatives or other health-related benefits and services that may be of interest to you, or to assess your satisfaction with our services. Communication may be in writing, by telephone, by email or via our patient portal.

We may use and disclose PHI to public health authorities or other authorized persons to carry out certain activities related to public health, including the following activities:

• To prevent or control disease, injury, or disability;
• To report disease, injury, birth, or death;
• To report child abuse or neglect;
• To report reactions to medications or problems with products or devices regulated by the Federal Food and Drug Administration (FDA) or other activities related to quality, safety, or effectiveness of FDA regulated products or activities:
• To locate and notify persons of recalls of products they may be using;
• To locate and notify persons have been exposed to a communicable disease in order to control who may be at risk of contracting or spreading the disease; or
• To report to your employer, under limited circumstances, information related primarily to workplace injuries or illnesses, or workplace medical surveillance.

We may disclose PHI in certain cases to proper government authorities if we reasonably believe that a patient has been a victim of domestic violence, abuse, or neglect.

We may disclose PHI to a health oversight agency for oversight activities including, for example, audits, investigations, inspections, licensure and disciplinary activities, and other activities conducted by health oversight agencies to monitor the health care system, government health care programs, and compliance with certain laws.

We may use and disclose PHI when required by a court or administrative tribunal order. We may also disclose PHI in response to a subpoena, discovery requests, or other required legal process when efforts have been made to advise you of the request or to obtain an order protecting the information requested.

Under certain conditions, we may disclose PHI to law enforcement officials for the following purposes where the disclosure is:

• About a suspected crime victim if, under certain circumstances, we are unable to obtain a person’s agreement because of incapacity or emergency:
• To alert law enforcement of a death that we suspect was the result of criminal conduct;
• Required by law;
• In response to a court order, warrant, subpoena, summons, administrative agency request, or other authorized process;
• To identify or locate a suspect, fugitive, material witness, or missing person;
• About a crime or suspected crime committed at our office; or
• In response to a medical emergency not occurring at the office, if necessary to report a crime, including the nature of the crime, the location of the crime or the victim, and the identity of the person who committed the crime.

We may disclose PHI to a coroner or medical examiner to identify a deceased person and determine the cause of death. In addition, we may disclose PHI to funeral directors, as authorized by law so that they may carry out their jobs.

If you are an organ donor, we may use or disclose PHI to organizations that help procure, locate, and transplant organs in order to facilitate an organ, eye, or tissue donation and transplantation.

Your medical information may be important to further research efforts and the development of new knowledge. We may use and disclose information about our patients for research purposes, subject to the confidentiality provisions of state and federal law. Occasionally, patients are contacted regarding their interest in participating in certain research studies. Enrollment in those studies can only occur after you have been informed about the study, had an opportunity to ask questions, and indicate your willingness to participate by signing a consent form. When approved through a special process, other studies may be performed using your medical information without requiring your consent. These studies will not affect your treatment of welfare, and your medical information will continue to be protected. For example, a research study may involve a chart review to compare the outcomes of patient who received different types of treatment.

We may use and disclose PHI about you in limited circumstances when necessary to prevent a threat to the health or safety of a person or to the public. This disclosure can only be made to a person who is able to help prevent the threat.

Specialized Government Functions: Under certain conditions, we may disclose PHI:
• For certain military and veteran activities, including determination of eligibility for veterans benefits and where deemed necessary by military command authorities;
• For national security and intelligence activities;
• To help provide protective services for the President of the United States and others;
• For the health or safety of inmates and others at correctional institutions or other law enforcement custodial situations or for general safety and health related to correctional facilities.

We may disclose PHI as authorized by workers’ compensation laws or other similar programs that provide benefits for work-related injuries or illness.

We are required to disclose PHI to the Secretary of the United States Department of Health and Human Services when requested by the Secretary to review our compliance with the HIPAA Privacy Rule. We are also required in certain cases to disclose PHI to you upon your request to access PHI or for an accounting of certain disclosures of PHI about you (these requests are described in Section III of this notice).

We may use or disclose PHI incident to a use or disclosure permitted by the HIPAA Privacy Rule so long as we have reasonably safeguarded against such incidental uses and disclosures and have limited them to the minimum necessary information.

We may use or disclose a limited data set (PHI that has certain identifying information removed) for the purposes of research, public health, or health care operations. This information may only be disclosed for research, public health, and health care operations purposes. The person receiving the information must sign an agreement to protect the information.

PHI about you cannot be sold or used for marketing purposes without your prior written authorization.

All other uses and disclosures of PHI about you will only be made with your written authorization. If you have authorized us to use or disclose PHI about you, you may later revoke your authorization at any time, except to the extent that we have taken action based on the authorization.

You have the right to request that you receive communications regarding PHI in a certain manner or at a certain location. For example, you may request that we contact you at home, rather than at work. You must make your request in writing. You must specify how you would like to be contacted (for example, by regular mail to your post office box and not your home). We are required to accommodate only reasonable requests.

You have the right to request the opportunity to inspect and receive a copy of PHI about you in certain records that we maintain. This includes your medical and billing records but does not include psychotherapy notes or information gathered or prepared for a civil, criminal, or administrative proceeding. We may deny your request to inspect and copy PHI only in limited circumstances. To inspect and copy PHI, please contact our Privacy Officer. If you request a copy of PHI about you, we may charge you a reasonable fee for the copying, postage, labor, and supplies used in meeting your request.

You have the right to request that we amend PHI about you as long as such information is kept by our office. To make this type of request, you must submit your request in writing to our Privacy Officer. You must also give us a reason for your request. We may deny your request in certain cases, including if it is not in writing or if you do not give us a reason for the request.

You have the right to receive an “accounting” of certain disclosures that we have made of PHI about you. This is a list of disclosures made by us during a specified period of up to 6 years, other than disclosures made: for treatment, payment, and health care operations; for use in or related to a facility directory; to family members or friends involved in your care; to you directly; pursuant to an authorization of your or your personal representative; for certain notification purposes (including national security, intelligence, correctional, and law enforcement purposes); as incidental disclosures that occur as a result of otherwise permitted disclosures; as part of a limited data set of information that does not directly identify you; and before April 14, 2003. If you wish to make such a request, please contact our Privacy Officer identified on the last page of this notice. The first list that you request in a 12- month period will be free, but we may charge you for our reasonable costs of providing additional lists in the same 12-month period. We will tell you about these costs, and you may choose to cancel your request at any time before costs are incurred.

You have a right to receive a paper copy of this notice at any time. You’re entitled to a paper copy of this notice even if you have previously agreed to receive this notice electronically. To obtain a paper copy of this notice, please contact our Privacy Officer listed at the end of this notice.