Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN OBTAIN ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
If you have any questions about this notice, please contact the Privacy Official at Heuser Health, 2040 Metal Lane, Louisville, KY 40206, Phone 502-893-7833.
OUR COMMITMENT REGARDING MEDICAL INFORMATION
We understand that medical information about you and your health is personal and we are committed to maintaining the privacy of your individually identifiable health information (also known as protected health information, or PHI). We create a record of the care and services you receive at Heuser Health, hereafter known as the Practice. It is necessary to create and maintain this record to provide you with quality care and to comply with certain legal requirements. And we are required by law to maintain the confidentiality of health information that identifies you. This notice applies to all of the records of your care generated by our Practice.
This notice informs you of the ways in which we may use and disclose medical information about you. Your rights and certain obligations that we have regarding the use and disclosure of medical information are also described in this notice.
By law, we must:
- Ensure that medical information that identifies you is kept private;
- Provide you with this notice stating our legal duties and privacy practices concerning medical information about you; and
- Abide by the terms of the notice that is currently in effect.
HOW WE MAY USE AND DISCLOSE MEDICAL INFORMATION ABOUT YOU
We use and disclose medical information in several ways. All of the ways we are permitted to use and disclose information, including examples, fall within one of the following categories:
We may use your PHI to provide you with medical treatment or services. We may ask you to have laboratory tests (such as blood or urine tests) and we may use those results to help us reach a diagnosis. We might use your PHI in order to write a prescription for you or we might disclose your PHI to a pharmacy when we order a prescription for you. We may disclose your PHI to doctors, nurses, technicians, nursing and medical students or hospital personnel who are involved in taking care of you. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. We may also disclose your PHI to people who may be involved in your medical care such as family members, rehabilitation centers, etc.
Our Practice may use and disclose your PHI to bill and collect payment for the treatment and services you receive from us. For example, we may need to give your health plan information about testing that you received at our Practice so your health plan will pay us or reimburse you for those services. We may also tell your health plan about a treatment or service you are going to receive in order to obtain prior approval or to determine whether your plan will cover the treatment or service. We may also use and disclose your PHI bill you directly or to obtain payment from third parties, such as family members, who are responsible for such costs.
- Health Care Operations
We may use and disclose your PHI to operate our business. Such uses and disclosures are necessary to run our Practice and ensure all of our patients receive quality care. We may use medical information to review our treatment and services and to evaluate the performance of our staff in caring for you. We may also disclose information to doctors, nurses, technicians, nursing and medical students and other personnel for review and learning purposes.
- Appointment Reminders
Our Practice may use and disclose medical information to contact you and remind you that you have an appointment.
- Treatment Options
Our Practice may use and disclose your PHI to inform you of or recommend possible treatment options or alternatives that may be available to you.
- Health Related Benefits and Services
We may use and disclose your PHI to inform you of health-related benefits or services that you may find of interest.
- Release of Information to Family and/or Friends
We may release your PHI to a family member or friend who is involved in your medical care. For example, a parent or guardian may ask that a baby sitter take their child to the pediatrician’s office for treatment of a cold. In this example, the baby sitter may have access to this child’s medical information. We may also tell your family or friends your condition and that you have been seen in our office.
- Disclosures Required by Law
Our Practice will use and disclose your PHI when required to do so my federal, state and/or local law.
- Serious Threat to Health or Safety
We may use and disclose your PHI when necessary to prevent a serious threat to your health and safety or the health and safety of another person or the public. Any disclosure would only be made to someone able to help prevent the threat.
- Public Health Risks
We may disclose your PHI for public health activities that include the following:
- To prevent or control disease, injury or disability;
- To report births or deaths;
- To report child abuse or neglect;
- To report reactions to medications or problems with products;
- To notify people of recalls of products they may be using;
- To notify a person regarding potential exposure to a communicable disease
- To notify a person regarding a potential risk for spreading or contracting a disease or condition;
- To notify the appropriate government authority of our belief that a patient has been the victim of abuse, neglect or domestic violence. We will only make this disclosure if the patient agrees or we are required or authorized by law.
- Health Oversight Activities
Our Practice may disclose your PHI to a health oversight agency for activities authorized by law. Such oversight activities may include audits, investigations, inspections, surveys, licensure and disciplinary actions. These activities are necessary for the government to monitor the health care system, government programs and compliance with civil rights laws.
- Lawsuits and Similar Proceedings
We may use and disclose your PHI in response to a court or administrative order should you be involved in a lawsuit or similar proceeding. We may also disclose medical information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information the party has requested.
- Law Enforcement
We may release PHI if asked to do so by a law enforcement official:
- In response to a court order, subpoena, warrant, summons or similar process;
- To identify or locate a suspect, fugitive, material witness or missing person;
- Concerning a death we believe has resulted from criminal conduct;
- In an emergency situation to report a crime, the location of the crime or victims; or the identity, description or location of the person who committed the crime.
- Military and Veterans
Our Practice may disclose your PHI if you are a member of US or foreign military forces as required by military command authorities.
- Workers’ Compensation
We may release your PHI for workers’ compensation or similar programs that provide benefits for work-related injuries or illnesses.
- Coroners, Medical Examiners and Funeral Directors
We may disclose your PHI to a coroner or medical examiner to identify a deceased person or determine the cause of death. We may also release you PHI to funeral directors as necessary for them to carry out their duties.
- National Security and Intelligence Activities
Our Practice may release your PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
If you are an inmate of a correctional institution or under the custody of law enforcement, our Practice may disclose your PHI to the correctional institution or law enforcement official. This release would be necessary: (a) for the institution to provide you with health care; (b) to protect your health and safety or the health and safety of others; or (c) for the safety and security of the institution.
At times, we may use or release health information about you for research purposes. However, all research projects require a special approval process before they begin. This process may include asking for your authorization.
In some instances, your health information may be used, but your identity is protected.
USES AND DISCLOSURES REQUIRING YOUR WRITTEN PERMISSION
All other uses and disclosures of information not contained in this Notice of Privacy Practices will not be disclosed without your authorization. For example, the following uses and disclosures will only be made with your permission:
- Most uses and disclosures of highly confidential information, including any portion of your PHI that is:
- (1) kept in psychotherapy notes; (2) about mental health and developmental disabilities services; (3) about alcohol and drug abuse prevention, Treatment and referral; (4) about HIV/AIDS testing, diagnosis or Treatment; (5) about sexually transmitted disease(s); (6) about genetic testing; (7) about child abuse and neglect; (8) about domestic abuse of an adult with a disability; (9) about sexual assault; or (10) Invitro Fertilization (IVF). Before we share your Highly Confidential Information for a purpose other than those permitted by law, we must obtain your written permission.
Our Practice may contact you to raise funds. You have the right to opt out of receiving such communications. With each fundraising communication made to you, whether it is in writing or over the phone, we will provide you with a clear opportunity to elect not to receive any further fundraising communications, including any fundraising efforts may by us in the future. We may not base your treatment or payment on your choice to opt out of any fundraising communications.
We must also obtain your written permission (authorization) prior to using your PHI to send you any marketing materials. However, we may communicate with you about products or services related to your Treatment, case management, or care coordination, or alternative treatments, therapies, health care providers, or care settings without your permission. For example, we may not sell your PHI without your written authorization. We must also inform you if we are receiving payment for such activities.
YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION
You have the following rights regarding medical information we maintain about you:
- Right to Inspect and Copy
You have the right to inspect and obtain a copy of the PHI that may be used to make decisions about your care, including patient medical records and billing records, but not psychotherapy notes. You must submit your request in writing to the Practice Privacy Official. Kentucky law allows for one free copy of your medical record. We may charge a fee for the costs of copying, mailing or other supplies associated with requests for additional copies.
We may deny your request to inspect and copy in certain limited circumstances. If your request is denied, you may submit a written request to have the denial reviewed. Another licensed health care professional chosen by us will conduct the review. The person performing the review will not be the same person who denied the original request. We will comply with outcome of the review.
- Right to Request Confidential Communication
You have the right to request that we communication with you about your health and health related matters in a certain way or at a certain location. For example, you may ask that we contact you at home, rather than at work. To request confidential communication, you must submit your request in writing to our Privacy Official, specifying the requested method of contact or the location where you wish to be contacted. All reasonable requests will be accommodated. You do not need to give a justification for your request.
- Right to Request Restrictions
You have the right to request a limitation on the medical information we use or disclose about you for treatment, payment or health care operations. You have the right to request that we restrict our disclosure of your PHI to only certain individuals involved in your care or the payment of your care, such as family members or friends. WE ARE NOT REQUIRED TO AGREE TO YOUR REQUEST. If we do agree, we are bound by our agreement unless the information is needed to provide you treatment, in an emergency situation, or is otherwise required by law. To request restrictions, you must submit your request in riting to the Privacy Official and include: (a) the information you wish to have restricted; (b) whether you are requesting to limit our Practice’s use, disclosure or both; and (c) to whom you want the limits to apply.
- Right to Amend
If you believe your health information is incorrect or incomplete, you have the right to request that we amend add information to your medical record. You may request an amendment for as long as the information is kept by or for our Practice. Your request for an amendment must be made in writing and submitted to our Privacy Official and include a reason that supports your request. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. We may also deny your request if you ask us to amend information that:
- Is accurate and complete;
- Is not part of the PHI kept by or for our Practice;
- Is not part of the information which you would be permitted to inspect and copy; or
- Is not created by our Practice, unless the person or entity that created the information is no longer available to make the amendment.
- Right to an Accounting of Disclosures
You have the right to request an “accounting of disclosures,” or a list of certain non-routine disclosures our Practice has made of your PHI, excluding disclosures for the purpose of treatment, payment and healthcare operations. Use of your PHI as part of the routine patient care in our Practice, such as the doctor sharing information with the nurse, or the billing department using your information to file an insurance claim, is not required to be documented. To request this list, you must submit your request in writing to the Privacy Official. Your request must include a time period and may not be longer than six (6) years from the date of the disclosure. The first list you request within a 12 month period is free of charge; however, we may charge you for the cost of additional lists within the same 12 month period. We will provide you with the cost of the additional lists and you may withdraw or modify your request before any costs are incurred.
- Right to Restrict Release of Information for Certain Services
You have the right to restrict the disclosure of information regarding services that you have paid in full or on an out of pocket basis. This information can be released only upon your written authorization, except where we are required by law to make a disclosure.
- Right to a Paper Copy of this Notice
You are entitled to receive a paper copy of our Notice of Privacy Practices. To obtain a copy of this notice, ask any of our office staff or our Privacy Official or you may write to our Practice at Heuser Health, 2040 Metal Lane, Louisville, KY 40207.
- Right to Breach Notification
The Practice is required to notify you of unsecured PHI that has been, or is reasonably believed to have been, accessed, acquired or disclosed due to a breach.
CHANGES TO THIS NOTICE
We may change the terms of this Notice at any time. If we change this Notice, we may make the new notice terms effective for all Protected Health Information that we maintain, including any information created or received prior to issuing the new notice. If we change this Notice, we will post the new notice in the lobby of our clinic and on our Internet site at heuserhealth.com. You also may obtain any new notice by contacting the Privacy Official.
If you want more information about your privacy rights, are concerned that we have violated your privacy rights, or disagree with a decision that we made about access to your PHI, you may contact our Privacy Official. You may also file written complaints with the Office for Civil Rights (OCR) of the U.S. Department of Health and Human Services. When you ask, the Privacy Official will provide you with the correct address for the OCR. We will not take any action against you if you file a complaint with us or with the OCR.
OTHER USES OF MEDICAL INFORMATION
Other uses and disclosures of medical information not covered by this notice or the laws that apply to us will be made only with your written permission. If you provide us permission to use or disclose PHI, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose PHI for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided for you.
Notice of Privacy Practices
Effective Date: 4/1/2014