Notice of Patients' Privacy Rights

Confidential Communication.

You have the right to request that our practice communicate with you about your health and related issues in a particular manner or at a certain location. For instance, you may ask that we contact you at home, rather than work. In order to request a type of confidential communication, you must make a written request to the office specifying the requested method of contact and/or the location where you wish to be contacted. Our practice will accommodate reasonable requests. You do not need to give a reason for your request.

Requesting Restrictions.

You have the right to request a restriction in our use or disclosure of your PHI for treatment, payment, or health care operations. "Health care operations" consist of activities that are necessary to carry out the operations of the provider, such as quality assurance and peer review. The right to request restriction does not extend to uses or disclosures permitted or required under the following sections of the federal privacy regulations: § 164.502(a)(2)(i) (disclosures to you), § 164.510(a) (for facility directories, but note that you have the right to object to such uses), or § 164.512 (uses and disclosures not requiring a consent or authorization). The latter uses and disclosures include, for example, those required by law, such as Mandatory communicable disease reporting. In those cases, you do not have a right to request restriction.

The consent to use and disclose your individually identifiable health information provides the ability to request restriction. We do not, however, have to agree to the restriction, except in the situation explained below. If we do, we will adhere to it unless you request otherwise or we give you advance notice. You may request restriction or alternate communications on the consent form for treatment, payment, and health care operations. If, however, you request restriction on a disclosure to a health plan for purposes of payment or health care operations (not for treatment), we must grant the request if the health information pertains solely to an item or a service for which we have been paid in full.

Obtaining a copy of this notice.

Although we have posted a copy in prominent locations throughout the facility and on our website, you have a right to a hard copy upon request.

Inspect and copy your health information.

Again, this right is not absolute. In certain situations, such as if access would cause harm, we can deny access. You do not have a right of access to the following:

• Psychotherapy notes. Such notes consist of those notes that are recorded in any medium by a health care provider who is a mental health professional documenting or analyzing a conversation during a private, group, joint, or family counseling session and that are separated from the rest of your medical record.
• Information compiled in reasonable anticipation of or for use in civil, criminal or administrative actions or proceedings.
• Protected health information ("PHI") that is subject to the Clinical Laboratory Improvement Amendments of 1988 ("CLIA"), 42 U.S.A. § 263a, to the extent that giving you access would be prohibited by law.
• Information that was obtained from someone other than a health care provider under a promise of confidentiality and the requested access would be reasonable likely to reveal the source of information.

In other situations, we may deny you access, but if we do, we must provide you a review of our decision denying access. These "reviewable" grounds for denial include the following:

• A licensed health care professional, such as your attending physician, has determined, in the exercise of professional judgment, that the access is reasonably likely to endanger the life or physical safety of yourself or another person.
• PHI makes reference to another person (other than a health care provider) and a licensed health care provider has determined, in the exercise of professional judgment, that the access is reasonably likely to cause substantial harm to such other person.
• The request is made by your personal representative and a licensed health care professional has determined, in the exercise of professional judgment, that giving access to such personal representative is reasonably likely to cause substantial harm to you or another person.

For these reviewable grounds, another licensed professional must review the decision of the provider denying access within 60 days. If we deny access, we will explain why and what your rights are, including how to seek review. If we grant access, we will tell you what, if anything, you have to do to get access. We reserve the right to charge a reasonable, cost – based fee for making copies.

Request amendment / correction of your health information.

We do not have to grant the request if the following conditions exist:

• We did not create the record. If, as in the case of a consultation report from another provider, we did not create the record, we cannot know whether it is accurate or not. Thus, in such cases, you must seek amendment / correction from the party creating the record. If the party amends the record, then we will put the corrected record into our records.
• The records are not available to you as discussed immediately above.
• The record is accurate and complete.

If we deny your request for amendment / correction we will notify you why, how you can attach a statement of disagreement to your records (which we may rebut), and how you can complain. If we grant the request, we will make the correction and distribute the correction to those who need it and those whom you identify to us that you want to receive the corrected information.

Obtain an accounting of nonroutine uses and disclosures.

After January 1, 2011 a date that was set by the federal Department of Health and Human Services, we will provide an accounting to you upon request for uses and disclosures for treatment, payment, and healthcare operations. We do not need to provide an accounting for the following disclosures.

• To you for disclosures of protected health information to you.
• For the facility directory or to persons involved in your care or for other notification purposes as provided in § 164.510 of the federal privacy regulations (uses and disclosures requiring an opportunity for the individual to agree or to object, including notification to family members, personal representatives, or other persons responsible for your care, of the your location, general condition, or death).
• For national security or intelligence purposes under § 164.512(k)(2) of the federal privacy regulations (disclosures not requiring consent, authorization, or an opportunity to object).
• To correctional institutions or law enforcement officials under § 164.512(k)(5) of the federal privacy regulations (disclosures not requiring consent, authorization, or an opportunity to object).
• That occurred before April 14, 2003.

We must provide the accounting within 60 days. The accounting must include the following information:

• Date of each disclosure.
• Name and address of the organization or person who received the protected health information.
• Brief description of the information disclosed.
• Brief statement of the purpose of the disclosure that reasonably informs you of the basis for the disclosure or, in lieu of such statement, a copy of your written authorization or a copy of the written request for disclosure.

The first accounting in any 12 month period is free. Thereafter, we reserve the right to charge a reasonable, cost based fee.

Revoke your consent or authorization to use or disclose health information except to the extent that we have taken action in reliance on the consent or authorization.

Treatment.

Our practice may use your PHI to treat you. For example, we may ask you to have laboratory tests (such as blood or urine tests), and we may use the results to help us reach a diagnosis. We might use your PHI in order to write a prescription for you, or we might disclose your PHI to a pharmacy when we order a prescription for you. Many of the people who work for our practice — including, but not limited to, our doctors and nurses — may use or disclose your PHI in order to treat you or to assist others in your treatment. Additionally, we may disclose your PHI to others who may assist in your care, such as your spouse, children, or parents. Finally, we may also disclose your PHI to other healthcare providers for purposes related to your treatment.

Payment.

Our practice may use and disclose your PHI in order to bill and collect payment for the services and items you may receive from us. For example, we may contact your health insurer to certify that you are eligible for benefits (and for what range of benefits), and we may provide your insurer with details regarding your treatment to determine if your insurer will cover, or pay for, your treatment. We also may use and disclose your PHI to obtain payment from third parties that may be responsible for such service costs, such as family members. Also, we may use your PHI to bill you directly for service and items. We may disclose your PHI to other healthcare providers and entities to assist in their billing and collection efforts.

Healthcare Operations.

Our practice may use and disclose your PHI to operate our business. As examples of the way in which we may use and disclose your information for operations, our practice may use your PHI to evaluate the quality of care you receive from us, or to conduct cost-management and business planning activities for our practice. We may disclose your PHI to other healthcare providers and entities to assist in their healthcare operations.

Appointment Reminders.

Our practice may use and disclose your PHI to contact you and remind you of an appointment.

Treatment Options.

Our practice may use and disclose your PHI to inform you of potential treatment options or alternatives.

Health-Related Benefits and Services.

Our practice may use and disclose your PHI to inform you of health-related benefits or services that may be of interest to you.

Release of Information to Family/Friends.

Our practice may release your PHI to a friend or family member that is involved in your care, or who assists in taking care of you. For example, a parent or guardian may ask that a babysitter take their child to the pediatricians' office for treatment of a cold. In this example, the babysitter may have access to this child's medical information.

Disclosures Required by Law.

Our practice will use and disclose your PHI when we are required to do so by federal, state, or local law.

Public Health Risks.

Our practice may disclose your PHI to public health authorities that are authorized by law to collect information for the purpose of:

• Maintaining vital records, such as births and deaths;
• Reporting child abuse or neglect;
• Notifying a person regarding potential exposure to a communicable disease;
• Notifying a person regarding a potential risk for spreading or contracting a disease or condition;
• Reporting reactions to drugs or problems with products or devices;
• Notifying individuals if a product or device they may be using has been recalled;
• Notifying appropriate governmental agency(ies) and authority(ies) regarding the potential abuse or neglect of an adult patient (including domestic violence); however, we will only disclose this information if the patient agrees or we are required or authorized by law to disclose this information; or
• Notifying your employer under limited circumstances related primarily to workplace injury or illness or medical surveillance.

Health Oversight Activities.

Our practice may disclose your PHI to a health oversight agency for activities authorized by law. Oversight activities can include, for example, investigations, inspections, audits, surveys, licensure, and disciplinary actions; civil, administrative, and criminal procedures or actions; or other activities necessary for the government to monitor government programs, compliance with civil rights laws, and the healthcare system in general.

Lawsuits and Similar Proceedings.

Our practice may use and disclose your PHI in response to a court or administrative order, if you are involved in a lawsuit or similar proceeding. We also may disclose your PHI in response to a discovery request, subpoena, or other lawful process by another party involved in the dispute, but only if we have made an effort to inform you of the request or to obtain an order protecting the information the party has requested.

Law Enforcement.

We may release PHI if asked to do so by a law enforcement official:

• Regarding a crime victim in certain situations, if we are unable to obtain the person's agreement;
• Concerning a death we believe has resulted from criminal conduct;
• Regarding criminal conduct at our offices;
• In response to a warrant, summons, court order, subpoena, or similar legal process;
• To identify/locate a suspect, material witness, fugitive, or missing person; and
• In an emergency, to report a crime (including the location or victim[s] of the crime, or the description, identity, or location of the perpetrator).

Deceased Patients.

Our practice may release PHI to a medical examiner or coroner to identify a deceased individual or to identify the cause of death. If necessary, we also may release information in order for funeral directors to perform their jobs.

Organ and Tissue Donation.

Our practice may release your PHI to organizations that handle organ, eye, or tissue procurement or transplantation, including organ donation banks, as necessary to facilitate organ or tissue donation and transplantation if you are an organ donor.

Research.

Our practice may use and disclose your PHI for research purposes in certain limited circumstances. We will obtain written authorization to use your PHI for research purposes except when the Practice's Internal Review Board or Privacy Board has determined that the waiver of your authorization satisfies the following:

(i) The use or disclosure involves no more than a minimal risk to your privacy based on the following:

• An adequate plan to protect the identifiers from improper use and disclosure;
• An adequate plan to destroy the identifiers at the earliest opportunity consistent with the research (unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law); and
• Adequate written assurances that the PHI will not be re-used or disclosed to any other person or entity (except as required by law) for authorized oversight of the research study, or for other research for which the use or disclosure would otherwise be permitted.

(ii) The research could not practicably be conducted without the waiver.

(iii) The research could not practicably be conducted without access to and use of the PHI.

Serious Threats to Health or Safety.

Our practice may use and disclose your PHI when necessary to reduce or prevent a serious threat to your health and safety or the health and safety of another individual or the public. Under these circumstances, we will only make disclosures to a person or organization able to help prevent the threat.

Military.

Our practice may disclose your PHI if you are a member of U.S. or foreign military forces (including veterans) and if required by the appropriate authorities.

National Security.

Our practice may disclose your PHI to federal officials for intelligence and national security activities authorized by law. We also may disclose your PHI to federal officials in order to protect the President, other officials, or foreign heads of state, or to conduct investigations.

Inmates.

Our practice may disclose your PHI to correctional institutions or law enforcement officials if you are an inmate or under the custody of a law enforcement official. Disclosure for these purposes would be necessary: (1) for the institution to provide healthcare services to you; (2) for the safety and security of the institution; and/or (3) to protect your health and safety or the health and safety of other individuals.

Workers' Compensation.

Our practice may release your PHI for workers' compensation and similar programs.