Notice of Privacy Practices

We understand that medical information about you and your health is personal. We are committed to protecting medical information about you. We create a record of the care and services you receive at our facilities. We need this record to provide you with quality care and to comply with certain legal requirements. This Notice applies to all of the records of your care generated by us. Your hospital or other physicians may have different policies or notices regarding the use and disclosure of medical information they create.

This Notice will tell you about the ways in which we may use and disclose medical information about you. It also describes your rights, and certain obligations we have regarding the use and disclosure of medical information.

We are required by law to:

• Make sure that medical information that identifies you is kept private;
• Make available to you this Notice of our legal duties and privacy practices with respect to medical information about you; and
• Follow the terms of the Notice that is currently in effect. This Notice may change, in the manner described below under “Changes To This Notice.”

The following categories describe different ways that we use and disclose your your medical information (also known as Individually Identifiable Health Information (IIHI) and/or Protected Health Information (PHI)). For each category of use or disclosure, we provide examples, but not every use or disclosure in a category is listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

• For Treatment
  We may use medical information about you to provide you with medical treatment or services. We may disclose medical information about you to doctors, nurses, technicians, medical students, or other personnel who are involved in taking care of you. For example, we may forward your records to another specialist to assure that you receive proper care. Also, if you were referred to us by another health care provider, it is likely that we will report back to that provider with information about our diagnosis and plan for treatment.
  We may disclose medical information about you to people outside the Department who may be involved in your medical care, such as family members, close friends, clergy or others we use to provide services that are a part of your care. For instance, from time-to-time we may receive calls from concerned family members or close friends to determine if a patient has completed his or her appointment. Unless you have advised us otherwise, in writing, we will let them know your current status with our office. In addition, at some time, it may be necessary for our staff to reach you by telephone in regard to your appointment. Unless otherwise notified by you in writing, we will contact you using numbers you have provided and we may have to leave a voicemail message for you. In certain circumstances, care givers from nursing homes, assisted living centers, etc. will bring a patient to our facility. Often these care givers are exposed to that patient’s personal health information.
• For Payment
  We may use and disclose medical information about you so that the treatment and services you receive from us may be billed to and collected from you, an insurance company or health plan or other third party. For example, we may need to give your health plan specific information about treatment you received at our office so your health plan will pay us or reimburse you for the treatment. In addition, we, or our representatives, may discuss payment issues with family members or others involved in the process of paying for medical treatment you have received. We may also tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment. We may have our bills and payment arrangements outsourced to one or more third‐party service providers who issue, process and collect bills on our behalf. Each of these is governed by the same health care information disclosure and confidentiality laws that we must follow.
• For Health Care Operations
  We may use and disclose medical information about you for our Department operations. These uses and disclosures are necessary to run our Department and make sure that all our patients receive quality care. For example, we may use medical information to review our treatment and services, and to evaluate the performance of our staff in caring for you. We may also combine medical information about many of our patients to decide what additional services we should offer, what services are not needed, and whether certain new treatments are effective. We may also disclose information to doctors, nurses, technologists, medical students, and other members of our staff for review and learning purposes.
• Treatment Alternatives
  We may use and disclose medical information to tell you about health-related benefits or services that may be of interest to you.
• Business Associates
  On occasion the Department may use outside organizations to provide business services. Business Associates that will be exposed to your health information are required to comply with all the same HIPAA administrative, physical and technical safeguard requirements that apply to the Department. Also, if the business associate contracts with a third party, they too must comply with all HIPAA rules.
• As Required By Law
  We will disclose medical information about you when required to do so by federal, state or local law.
• To Avert A Serious Threat To Health Or Safety
  We may use and disclose medical information about you when necessary to prevent a serious threat to your health and safety, or the health and safety of the public, or another person. Any disclosure, however, would only be to someone able to help prevent the threat.
• Special Situations
  We may also use and disclose medical information about you in the situations described under "Special Situations," below.

Other uses and disclosures of medical information not covered by this Notice, or the laws that apply to us, will be made only with your written authorization. A form for such authorizations, both those that you request and those that we request, is available from our office. If you give us an authorization, you may later revoke that permission in writing at any time. If you revoke your permission, we will no longer use or disclose medical information about you for the reasons covered by your written authorization. In that case, however, we will be unable to take back any disclosures we have already made with your permission, and we will still be required to retain our records of the care that we provided to you.

Military and Veterans

If you are a member of the armed forces, we may release medical information about you as required by military command authorities, or in some cases, if needed to determine benefits to the Department of Veterans Affairs.

Public Health Risks

We may disclose medical information about you for public health activities. These activities generally include the following:

• To prevent or control disease, injury or disability;
• To report births and deaths;
• To report child abuse or neglect;
• To report reactions to medications or problems with products;
• To notify people of recalls of products they may be using;
• To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; and/or
• To notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence. We will only make this disclosure when required or authorized by law.

Health Oversight Activities

We may disclose medical information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Immunization Reporting

The Department may disclose proof of immunization to a school where law requires a school to have such information. Written authorization for this disclosure is not required, however, the Department will obtain agreement to this release, which may be oral, from a parent, guardian or other person acting in loco parentis for the individual, or from the individual himself or herself, if the individual is an adult or emancipated minor.

Outside Use

It is a violation of Department Policy to use patient PHI for Marketing, Research or to sell PHI in any way. Under no circumstances will the Department engage in these activities.

Fundraising

It is a violation of Department Policy to use patient PHI for fundraising purposes. The Department will not contact patients to conduct fundraising activities using PHI as a source of identification.

Lawsuits and Disputes

If you are involved in a lawsuit or a dispute, we may disclose medical information about you in response to a court or administrative order. We may also disclose medical information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.

Law Enforcement

We may release medical information if asked to do so by a law enforcement official:

• In response to a court order, subpoena, warrant, summons or similar process;
• To identify or locate a suspect, fugitive, material witness, or missing person;
• About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement;
• About a death we believe may be the result of criminal conduct;
• About criminal conduct at our practice; and
• In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.

Coroners, Medical Examiners and Funeral Directors

We may release medical information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death.

Decedents

A decedent’s PHI is protected for 50 years after the individual’s death. After that point, the information is no longer considered PHI.

National Security, Intelligence and Federal Protective Service Activities

We may release medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law, and to authorized federal officials where required to provide protection to the President of the United States, other authorized persons or foreign heads of state or conduct special investigations.

Inmates

If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release medical information about you to the correctional institution or law enforcement official where necessary for the institution to provide you with health care; to protect your health and safety or the health and safety of others; or for the safety and security of the correctional institution.

You have the following rights regarding medical information we maintain about you:

Right to Inspect and Copy
You have the right to inspect and request a copy of medical information that may be used to make decisions about your care. Usually, this includes medical and billing records, but does not include psychotherapy notes. You may request an electronic copy of your PHI that is maintained electronically. The Department will provide an electronic copy in the form requested, if readily producible, or if not, in a readable electronic form and format as agreed by you and the Department.
You must submit any request to inspect and copy your medical records to our staff, in writing. (A form for that request is available from our office.) If you request a copy of your information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request.
We may deny your request in certain very limited circumstances. If you are denied access to medical information, you may request that the denial be reviewed. Another health care professional chosen by our staff will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of that review.

Right to Amend
If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for our Department. You must submit any request for an amendment to our staff, in writing. (A form for that request is available from our office.) Your written request must provide a reason that supports your request.
We may deny your request for an amendment if it is not in writing, or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

• Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
• Is not part of the medical information kept by or for our Department.
• Is not part of the information which you are permitted to inspect and copy; or
• Is accurate and complete.

Right to an Accounting of Disclosures
You have the right to request an “accounting of disclosures.” This is a list of the disclosures we have made of medical information about you, with some exceptions. The exceptions are governed by federal health privacy law, and may include:  You must submit any request for an accounting of disclosures to our office, in writing. (A form for that request is available from our office.) Your written request must state a time period, which may not be longer than six years. The first report you request within a 12-month period will be free. For additional reports, we may charge you for the costs of providing the report. We will notify you of the cost involved, and you may choose to withdraw or modify your request at that time before any costs are incurred.

• May routine disclosures for treatment, payment and operations; and
• Disclosures to you.

Right to Request Restrictions
You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you could ask that we not use or disclose information about a medical service you received. Also, you have the right to designate a personal representative who will then have the ability to access your personal health information, just as you do. You may also ask us to be selective in the way we communicate personal health information to you. For example, you may request that we not contact you by telephone at your office or you may designate a mailing address other than your home. Such requests must be made in writing. (A form for such requests is available from our office.) Please note that we are not required to agree to your requests. However, if we do agree, we will comply with your request unless the information is needed to provide you emergency treatment.
You have the right to restrict the disclosure of PHI (for payment or health care operations) to a health plan when you pay out‐of‐pocket, in full, and request such a restriction. The Department must honor such a request unless otherwise required by law. This restriction does not apply to follow‐up visits if they are not paid for in full out of pocket.
You must submit any request for restrictions to our staff, in writing. (A form for each request is available from our office.) Your written request must tell us:

• What information you want to limit;
• Whether you want to limit our use, disclosure or both; and
• To whom you want the limits to apply, for example, disclosures to your spouse.

Right to a Paper Copy of This Notice
You may ask us to give you a paper copy of this “Notice of Privacy Practices” at any time by contacting our office.

Right to Receive a Breach Notice
Should the Department experience an impermissible use or disclosure of PHI and that exposure poses a significant risk of financial, reputational, or other harm to an individual, the Department will provide individual notice to all persons affected by the breach.

Complaints
If you believe your privacy rights have been violated, you may file a complaint with our office or with the Secretary of the Department of Health and Human Services. To file a complaint with our office, contact our office. (A form for this purpose is available from our office.) You will not be penalized for filing a complaint.