HIPAA Notice of Privacy Practices

Our Responsibilities

We are required by law to:

• Maintain the privacy and security of your Protected Health Information (PHI)
• Notify you following a breach of unsecured PHI
• Follow the terms of the Notice currently in effect
• Not use or share your information other than as described here unless you give us written permission

What is Protected Health Information (PHI)?

PHI is information about you, including demographic information, that may identify you and that relates to:

• Your past, present, or future physical or mental health or condition
• The provision of health care to you
• Your past, present, or future payment for the provision of health care

Examples include your medical history, diagnosis, treatment plans, medications, test results, insurance information, and billing records.

How We May Use and Disclose Your PHI

We may use and disclose your PHI without your written authorization for the following purposes:

1. Treatment

We may use and disclose your PHI to provide, coordinate, or manage your health care and related services.

Examples:

• Sharing your medical information with your physician to coordinate care
• Discussing your care plan with other health care providers involved in your treatment
• Contacting you to provide appointment reminders or information about treatment alternatives
• Communicating with pharmacies to coordinate medication delivery
• Consulting with specialists about your condition

2. Payment

We may use and disclose your PHI to obtain payment for services we provide.

Examples:

• Submitting claims to Medicare, Medicaid, or your insurance company
• Verifying your insurance coverage and eligibility
• Providing information to collection agencies (if necessary)
• Responding to insurance audits or reviews
• Determining medical necessity for services

3. Health Care Operations

We may use and disclose your PHI for our health care operations, which are necessary to run our organization and ensure quality care.

Examples:

• Quality assurance and improvement activities
• Staff training and competency evaluations
• Compliance audits and legal compliance activities
• Business planning and administrative functions
• Customer service activities (responding to complaints)

4. Required by Law

We will disclose your PHI when required to do so by federal, state, or local law.

5. Public Health Activities

We may disclose your PHI for public health activities such as:

• Reporting diseases, injuries, or vital events (e.g., births, deaths)
• Reporting suspected abuse, neglect, or domestic violence (as required by law)
• Notifying authorities about product recalls or adverse reactions to medications
• Preventing or controlling disease, injury, or disability

6. Health Oversight Activities

We may disclose PHI to health oversight agencies (e.g., California Department of Public Health) for activities such as audits, investigations, inspections, licensure, and disciplinary actions.

7. Judicial and Administrative Proceedings

We may disclose PHI in response to:

• Court orders or subpoenas
• Administrative tribunal orders
• Discovery requests (with appropriate safeguards)

8. Law Enforcement

We may disclose PHI to law enforcement officials for:

• Compliance with court orders, warrants, subpoenas, or summons
• Identifying or locating a suspect, fugitive, material witness, or missing person
• Reporting crimes on our premises
• Reporting crimes in emergencies

9. Coroners, Medical Examiners, and Funeral Directors

We may disclose PHI to coroners, medical examiners, or funeral directors for identification purposes, determining cause of death, or carrying out their duties.

10. Serious Threat to Health or Safety

We may use and disclose PHI when necessary to prevent a serious and imminent threat to your health or safety, or the health or safety of the public or another person.

11. Workers' Compensation

We may disclose PHI as authorized by and to the extent necessary to comply with workers' compensation laws or similar programs.

Uses and Disclosures That Require Your Authorization

For uses and disclosures beyond treatment, payment, and health care operations, we will obtain your written authorization unless otherwise permitted or required by law. You may revoke your authorization at any time by writing to us, but the revocation will not affect disclosures already made based on your authorization.

Specific Authorization Required For:

• Marketing: We will not use or disclose your PHI for marketing purposes without your written authorization
• Sale of PHI: We will not sell your PHI without your authorization (we do not sell PHI)
• Psychotherapy Notes: Most uses and disclosures of psychotherapy notes require your authorization (if applicable)
• Research: Uses and disclosures for research purposes require your authorization unless an exemption applies

Your Rights Regarding Your PHI

You have the following rights with respect to your PHI:

1. Right to Inspect and Copy

You have the right to inspect and obtain a copy of your PHI contained in a designated record set (medical records, billing records). To inspect and copy your PHI:

• Submit a written request to our Privacy Officer
• We may charge a reasonable, cost-based fee for copying, postage, and preparation
• We will respond within 30 days (or 60 days if stored off-site)
• We may deny your request in certain circumstances; if denied, you may request a review

2. Right to Amend

If you believe your PHI is incorrect or incomplete, you may request an amendment. To request an amendment:

• Submit a written request with a reason to support your request
• We will respond within 60 days
• We may deny your request if the PHI was not created by us, is not part of the records we keep, is not available for inspection, or is accurate and complete
• If denied, you may submit a statement of disagreement

3. Right to an Accounting of Disclosures

You have the right to request an "accounting of disclosures," which is a list of certain disclosures we have made of your PHI (excluding disclosures for treatment, payment, health care operations, and other exceptions).

• Submit a written request specifying the time period (up to 6 years, but not before April 14, 2003)
• The first accounting in a 12-month period is free; subsequent requests may incur a reasonable fee
• We will respond within 60 days

4. Right to Request Restrictions

You have the right to request restrictions on how we use and disclose your PHI for treatment, payment, or health care operations. We are not required to agree to your request, but if we do, we will comply with it except in emergency situations.

Special Rule: If you pay out-of-pocket in full for a service, you can request that we not disclose PHI related to that service to your health plan for payment or health care operations. We must agree to this request.

5. Right to Request Confidential Communications

You have the right to request that we communicate with you about your PHI by alternative means or at alternative locations.

Examples:

• Requesting we call you at work instead of home
• Requesting we send mail to a P.O. Box instead of your home address

We will accommodate reasonable requests without asking for an explanation.

6. Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice at any time, even if you have agreed to receive the Notice electronically. Contact us to request a paper copy.

7. Right to Notification of a Breach

You have the right to be notified in the event of a breach of your unsecured PHI.

How to Exercise Your Rights

To exercise any of your rights, contact our Privacy Officer:

Complaints

If you believe your privacy rights have been violated, you may file a complaint with:

Changes to This Notice

We reserve the right to change this Notice at any time. Any changes will apply to all PHI we maintain, including information created or received before the change. We will:

• Post the current Notice on our website with the effective date
• Make copies available at our office
• Provide you with a copy of the revised Notice upon request

Additional Privacy Protections

California Privacy Laws

As a California resident, you may have additional privacy rights under California law, including the California Confidentiality of Medical Information Act (CMIA). These rights may provide greater protection than HIPAA in certain circumstances.

Minors

Special rules may apply to the PHI of minors. In general, parents or legal guardians have the right to access a minor's PHI, but there are exceptions under California law for certain sensitive services (e.g., mental health, reproductive health).

Security Measures

We maintain physical, technical, and administrative safeguards to protect your PHI:

• Physical: Secured facilities, locked file cabinets, access controls
• Technical: Encrypted databases, secure networks, access authentication
• Administrative: Staff training, policies and procedures, workforce agreements

Business Associates

We may share your PHI with "business associates" (third parties that perform services on our behalf). Examples include:

• Billing companies
• IT service providers
• Legal and accounting services
• Medical equipment suppliers

We have written agreements with all business associates requiring them to safeguard your PHI.

Effective Date and Acknowledgment