HIPAA Notice of Privacy Practices

PHI may be used or disclosed to provide, coordinate, or manage healthcare and related services.

This may include communications among licensed healthcare providers, pharmacies, laboratories, and other authorized healthcare professionals or organizations involved in your treatment or care coordination.

PHI may be used or disclosed for payment-related activities associated with healthcare services.

This may include billing and collection activities, determining eligibility or coverage where applicable, processing healthcare-related payments, and communicating with healthcare providers, pharmacies, health plans, or other authorized parties as permitted by law.

PHI may be used or disclosed for permitted healthcare operations, including:

• Quality assessment and improvement
• Patient safety activities
• Case management and care coordination
• Accreditation
• Licensing
• Credentialing
• Compliance activities
• Medical reviews
• Audits
• Training
• Legal and administrative services

PHI may be used or disclosed when required by applicable federal, state, or local law.

PHI may be used or disclosed for legally authorized public health and safety purposes, including:

• Preventing or controlling disease, injury, or disability
• Reporting certain communicable diseases
• Reporting abuse or neglect where required or permitted by law
• Reporting adverse reactions to medications
• Reporting problems involving medications, medical products, or devices
• Notifying persons who may have been exposed to certain communicable diseases
• Preventing or reducing a serious and imminent threat to health or safety

PHI may be disclosed to authorized health oversight agencies for activities permitted by law, including:

• Audits
• Investigations
• Inspections
• Licensing and disciplinary proceedings
• Regulatory compliance activities
• Government oversight activities

PHI may be disclosed in response to a valid court or administrative order or, where permitted by law, in response to a subpoena, discovery request, or other lawful process.

Additional protections may apply to certain categories of sensitive health information.

PHI may be disclosed for certain law enforcement purposes where permitted or required by law, including responding to:

• Court orders
• Warrants
• Subpoenas
• Summonses
• Administrative requests
• Other legally authorized processes

PHI may also be disclosed in other circumstances specifically authorized by applicable law.

PHI may be used or disclosed for research where permitted by HIPAA and other applicable laws.

Depending on the circumstances, this may require your authorization, approval or waiver by an Institutional Review Board (“IRB”) or Privacy Board, or another legally permitted basis for the use or disclosure.

Where applicable, PHI may be disclosed to organizations involved in organ, eye, or tissue procurement, transplantation, banking, or donation as permitted by law.

PHI may be disclosed as authorized by and to the extent necessary to comply with workers’ compensation laws or similar programs providing benefits for work-related injuries or illnesses.

If you are a member of the armed forces, PHI may be disclosed as required or permitted by applicable military authorities and law.

If you are an inmate or otherwise in the custody of a correctional institution or law enforcement agency, PHI may be disclosed to the applicable institution or official where permitted by law for healthcare, safety, security, or other authorized purposes.

You may have the right to inspect and obtain a copy of PHI maintained about you in a designated record set, subject to certain exceptions.

Where required by law, you may request that records maintained electronically be provided in an electronic format.

Reasonable, cost-based fees may apply where permitted by law.

If you believe PHI maintained about you is incorrect or incomplete, you may request an amendment.

The applicable entity may deny the request in circumstances permitted by law, including where it determines that the information is accurate and complete or where it did not create the information and the original creator remains available to act on the request.

You may have the right to request an accounting of certain disclosures of your PHI during the period permitted by applicable law.

An accounting generally does not include every disclosure. Certain disclosures, including many disclosures for treatment, payment, or healthcare operations, may be excluded as permitted by HIPAA.

You may request restrictions on certain uses or disclosures of your PHI for treatment, payment, or healthcare operations.

The applicable covered entity generally is not required to agree to all requested restrictions.

However, HIPAA requires a covered entity to agree to certain requests to restrict disclosure to a health plan when the disclosure is for payment or healthcare operations and relates solely to a healthcare item or service for which you, or someone other than the health plan on your behalf, paid the covered entity in full out of pocket.

You may request that communications regarding PHI be sent to you through an alternative method or at an alternative location.

Reasonable requests will be accommodated where required by applicable law.

You may request a paper copy of an applicable Notice of Privacy Practices even if you previously agreed to receive the Notice electronically.

You have the right to receive notification following a breach of unsecured PHI when notification is required under applicable law.