HIPAA Privacy Policy

We may use or disclose your PROTECTED HEALTH INFORMATION ("PHI") for treatment, payment, or health care operations. For your convenience, we have provided the following examples of such potential uses or disclosures:

We may use your PHI to provide, coordinate, or manage your healthcare and any related services. For example, your physician may share your allergy test results with a specialist or refer you to another provider. We may also disclose PHI to other healthcare providers involved in your care, including pharmacies, laboratories, and hospitals.

We may use and disclose PHI so that we can receive payment for services provided to you. For example, we may send your insurance company information about your visit so your insurer can pay for the services rendered, or we may contact you to collect outstanding balances.

Your PHI may be used or disclosed as part of our internal health care operations. Such health care operations may include, among other things, quality of care audits of our staff and affiliates, conducting training programs, accreditation, certification, licensing, or credentialing activities.

We will not use or disclose your medical information for any reason except those described in this Notice, unless you provide us with a written authorization to do so. We may request such an authorization to use or disclose your PHI for any purpose. But you are not required to give us such authorization as a condition of your treatment. You may revoke any written authorization given by you in writing at any time, but such revocation will not affect any prior authorized uses or disclosures.

We will provide you with access to your PHI, as described below in the Individual Rights section of this Notice. With your permission, or in some emergencies, we may disclose your PHI to your family members, friends, or others in order to aid in your treatment or the collection of payment. A disclosure of your PHI may also be made if we determine it is reasonably necessary or in your best interests for such purposes as allowing a person acting on your behalf to receive filled prescriptions, medical supplies, X-rays, etc.

Your PHI may be disclosed in order to locate, identify, or notify a family member, your personal representative, or other person responsible for your care. If we determine in our reasonable professional judgment that you are capable of doing so, you will be given the opportunity to consent to or to prohibit or restrict the extent or recipients of such disclosure. If we determine that you are unable to provide such consent, we will limit the PHI disclosed to the minimum necessary.

We may use or disclose your PHI to any public or private entity authorized by law or by its charter to assist in disaster/relief efforts.

We may use and disclose PHI for our healthcare operations, which include activities such as quality assessment, training of medical students and staff, accreditation, licensing, and conducting business planning. These activities are necessary to operate our practice and ensure that all patients receive quality care.

• As required by law: We will disclose PHI when required by federal, state, or local law.
• Deceased Person: After your death, we may disclose your PHI to a coroner, medical examiner, funeral director, or organ procurement organization in limited circumstances.
• Military and National Security: We may disclose to military authorities the medical information of Armed Forces personnel under certain circumstances. When required by law, we may disclose your PHI for intelligence, counterintelligence, and other national security activities.
• Public health activities: Reporting communicable diseases, adverse events, or product defects to public health authorities.
• Health oversight activities: Audits, inspections, and investigations by government agencies.
• Judicial and administrative proceedings: In response to a court order or subpoena.
• Law enforcement: In limited circumstances as required or permitted by law.
• Workers' compensation: To comply with workers' compensation laws.
• Serious threats: To prevent a serious and imminent threat to the health or safety of a person or the public.
• Research: Under strict conditions approved by an Institutional Review Board.
• Organ and tissue donation: To organ procurement organizations.
• Military and veterans: As required by military command authorities.

You have the right to inspect and obtain a copy of your PHI that we maintain in a designated record set, which includes your medical and billing records. We may charge a reasonable, cost-based fee for providing copies. We must respond to your request within 30 days. In limited circumstances, we may deny your request.

You have the right to request an amendment of PHI in your designated record set if you believe the information is incorrect or incomplete. We will act on your request within 60 days. We may deny your request under certain circumstances; if so, we will provide a written explanation.

You have the right to receive an accounting of disclosures of your PHI that we have made for purposes other than treatment, payment, healthcare operations, or disclosures you authorized. You may request one free accounting per 12-month period; additional requests may be subject to a reasonable fee.

You have the right to request restrictions on the use or disclosure of your PHI for treatment, payment, or healthcare operations. We are not required to agree to your requested restriction, except: if you pay out-of-pocket in full for a service, we must agree to restrict disclosure of that service to your health plan.

You have the right to request that we communicate with you in a specific way or at a specific location. For example, you may ask that we contact you only at your work phone number or by mail to a different address. We will accommodate all reasonable requests.

You have the right to obtain a paper copy of this Notice at any time, even if you have agreed to receive this Notice electronically. Please contact our office to request a copy.

You have the right to be notified if your unsecured PHI is involved in a breach. We will notify you without unreasonable delay and within 60 days of discovering a breach, as required by the HIPAA Breach Notification Rule.

• Designated Privacy Officer responsible for HIPAA compliance
• Regular workforce training on privacy and security policies
• Annual security risk assessments to identify and mitigate vulnerabilities
• Written policies and procedures governing access to PHI
• Sanction policy for workforce members who violate privacy policies

• Access controls limiting electronic PHI to authorized workforce members
• Audit logs tracking who accesses electronic health records
• Encryption of PHI transmitted over electronic networks
• Automatic log-off for workstations left idle
• Secure patient portal with multi-factor authentication

• Restricted facility access with secure entry controls
• Workstation use policies and screen privacy filters
• Secure disposal of paper records containing PHI
• Device and media controls for all equipment containing PHI

Our website also gives you the ability to opt out of receiving future communications from us, such as our monthly newsletter. If you wish to stop receiving these communications, simply reply with the word "unsubscribe" in the subject line by email to [email protected].