NOTICE OF HIPAA PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.

After you have read this notice, you will be asked to sign an acknowledgement of this notice and consent to these privacy practices.  Individual information about your past, present, or future health, the health care you receive, or the payment for the health care is called “PHI”, which is the abbreviation for “Protected Health Information”.

This information is provided according to federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its amendments.

USE AND DISCLOSURE OF PHI.

I may use and disclose your PHI for many different reasons.  Some of the uses or disclosures will require your prior written authorization; others, however, will not. Below you will find the different categories of my uses and disclosures, with some examples. 

USES AND DISCLOSURES RELATED TO TREATMENT, PAYMENT, OR HEALTH CARE OPERATIONS DO NOT REQUIRE YOUR PRIOR WRITTEN CONSENT.

I may use and disclose your PHI without your consent for the reasons that follow.

For treatment.  I can use your PHI within my practice to provide you with mental health treatment, including discussing or sharing your PHI with my trainees and interns.  I may disclose your PHI to physicians, psychiatrists, psychologists, and other licensed health care providers who provide you with health care services or are otherwise involved in your care. For example, if a psychiatrist is treating you, I may disclose your PHI to her/him in order to coordinate your care.

For health care operations.  I may disclose your PHI to facilitate the efficient and correct operation of my practice.  For example, I may provide PHI to bookkeepers, accountants, consultants, attorneys, and/or others to make sure that procedures and practice are  in compliance with applicable rules or laws.

To obtain payment for treatment. I may use and disclose your PHI to bill and collect payment for the treatment and services I provided you. For example, I might send your PHI to your insurance company or health plan in order to get payment for provided health care services. I could also provide your PHI to business associates, such as billing companies, claims processing companies, and others that process health care claims for my office.

Other disclosures.  Your consent isn’t required if you need emergency treatment provided that I attempt to get your consent after treatment is rendered.  For example, if I try to get your consent but you cannot communicate with me because you are unconscious and I think that you would consent to such treatment if you could communicate, I may disclose your PHI.

CERTAIN OTHER USES AND DISCLOSURES DO NOT REQUIRE YOUR CONSENT.

I may use and/or disclose your PHI without your consent or authorization for the following reasons:

1.   When disclosure is required by federal, state, or local law; judicial, board, or administrative proceedings; or, law enforcement.  I may make a disclosure to the appropriate officials when a law requires me to report information to government agencies, law enforcement personnel and/or in an administrative proceeding.

2.   If disclosure is compelled by a party to a proceeding before a court of an administrative agency pursuant to its lawful authority.

3.   If disclosure is required by a search warrant lawfully issued to a governmental law enforcement agency.

4.   If disclosure is compelled by the patient pursuant to state or corresponding federal statutes of regulations, such as the Privacy Rule that requires this Notice.

5.   To avoid harm. I may provide PHI to law enforcement personnel or persons able to prevent or mitigate a serious threat to the health or safety of person(s) or the public.

6.   If disclosure is compelled or permitted by the fact that you are in such mental or emotional condition as to be dangerous to yourself or others, and if I determine that disclosure is necessary to prevent the threatened danger.

7.   If disclosure is mandated by Child Abuse and Neglect Reporting law. For example, if I have a reasonable suspicion of child abuse or neglect.

8.   If disclosure is mandated by Vulnerable Adult Abuse Reporting law. For example, if I have a reasonable suspicion of abuse or neglect of a vulnerable adult.

9.   If disclosure is compelled or permitted by the fact that you tell me of a serious/imminent threat of physical violence by you against a reasonably identifiable victim or victims.

10.For public health activities.  In the event of your death, if a disclosure is permitted or compelled, I may need to give a coroner information about you. 

11.For health oversight activities.  I may be required to provide information to assist the government in the course of an investigation or inspection of a health care organization or provider.

12.For specific government functions.  I may disclose PHI of military personnel and veterans under certain circumstances.  Also, I may disclose PHI in the interests of national security, such as protecting the President of the United States or assisting with intelligence operations.

13.For research purposes. In certain circumstances, I may provide PHI in order to conduct medical research.

14.For Workers’ Compensation purposes. I may provide PHI in order to comply with Workers’ Compensation laws.

15.Appointment reminders and health related benefits or services. Examples: I may use PHI to provide appointment reminders. I may use PHI to give you information about alternative treatment options, or other health care services or benefits I offer.

16.If an arbitrator or arbitration panel compels disclosure, when arbitration is lawfully requested by either party, pursuant to subpoena for mental health records, or any other provision authorizing disclosure in a proceeding before an arbitrator or arbitration panel.

17.If disclosure is required or permitted to a health oversight agency for oversight activities authorized by law.  Example: When compelled by U.S. Secretary of Health and Human Services to investigate or assess my compliance with HIPAA regulations.

18.If disclosure is otherwise specifically required by law.

CERTAIN USES AND DISCLOSURES WITH OPPORTUNITY TO OBJECT.

Disclosures to care givers.  I may provide your PHI to an individual who you indicate is involved in your care or payment for your health care, unless you object in whole or in part.  Retroactive consent may be obtained in emergency situations.

OTHER USES AND DISCLOSURES REQUIRE YOUR PRIOR WRITTEN AUTHORIZATION.

In situations not described above, I will request your written authorization before using or disclosing your PHI. Even if you have signed an authorization to disclose your PHI, you may later revoke that authorization in writing to stop any future uses and disclosures.

RIGHTS REGARDING YOUR PHI. 

You have rights with respect to your PHI.

The Right to See and Get Copies of Your PHI. In general, you have the right to see your PHI that is in my possession, or to get copies of it. That request must be in writing. If I do not have your PHI, but I know who does, I will advise you how you can get it.  Usually, I will respond within 30 days of my receiving your written request.  Under certain circumstances, I may feel I must deny your request, but if I do, I will give you written reasons for the denial.  I will also explain your right to have my denial reviewed.  If you ask for copies of your PHI, I can charge you a reasonable sum based on the current rate for copies.  I may see fit to provide you with a summary or explanation of the PHI, but only if you agree to it, as well as to the cost, in advance.

The Right to Request Limits on Uses and Disclosures of Your PHI.  You may ask that I limit how I use and disclose your PHI.  While I will consider your request, I am not legally bound to agree. If I do agree to your request, I will put those limits in writing and follow that except in emergency situations. You do not have the right to limit the uses and disclosures that I am legally required or permitted to make.

The Right to Choose How I Send Your PHI to You. You may ask that your PHI be sent to you at an alternate address (for example, sending information to your work address rather than your home address) or by an alternate method (for example, email instead of by postal service).  I will agree to your request provided that I can give you the PHI, in the format you requested, without undue inconvenience.  I won’t require an explanation from you as to the basis of your request as a condition of providing communications on a confidential basis.

The Right to Get a List of the Disclosures I Have Made.  You may request a list of disclosures of your PHI that I have made. The list will not include uses or disclosures to which you have already consented [for treatment, payment, or health care operations, sent directly to you, or to a care giver] nor will the list include disclosures made for national security purposes, to corrections or law enforcement personnel, or disclosures made before April 15, 2003.  After April 15, 2003, disclosure records will be held for six years.

I will respond to your request for an accounting of disclosures within 60 days of receiving your request.  The list I give you will include disclosures made in the previous six years unless you indicate a shorter period.  The list will include the date of the disclosure, to whom PHI was disclosed (including their address, if known), a description of the information disclosed, and the reason for the disclosure.  I will provide the list to you at no cost, unless you make more than one request in the same year, in which case I will charge you a reasonable sum based on the current rate for each additional request.

The Right to Amend Your PHI.  If you believe that there is some error in your PHI or that important information has been omitted, it is you may request that I correct the existing information or add the missing information.  Your request and the reason for the request must be made in writing.  You will receive a response within 60 days of my receipt of your request.  I may deny your request, in writing, if I find that: the PHI is (a) correct and complete, (b) forbidden to be disclosed, (c) not part of my records, or (d) written by someone other than me.  My denial will be in writing and must state the reasons for the denial.  It will also explain your right to file a written statement objecting to the denial.  If you do not file a written objection, you still have the right to ask that your request and my denial be attached to any future disclosures of your PHI.  If I approve your request, I will make the change(s) to your PHI.  Additionally, I will tell you that the changes have been made, and I will advise all others who need to know about the change(s) to your PHI.

The Right to Get This Notice by Email. You may request this notice by email. You may request a paper copy of it, as well.

SAFEGUARDING YOUR PROTECTED HEALTH INFORMATION (PHI).

By law I am required to keep your PHI private. The PHI constitutes information created or noted by me that can be used to identify you.  It contains data about your past, present, or future health or condition, the provision of health care services to you, or the payment for such health care.  I am required to provide you with this Notice about my privacy procedures. This Notice must explain when, why, and how I would use and/or disclose your PHI. Use of PHI means when I share, apply, utilize, examine, or analyze information within my practice; PHI is disclosed when I release, transfer, give, or otherwise reveal it to a third party outside my practice.  With some exceptions, I may not use or disclose more of your PHI than is necessary to accomplish the purpose for which the use or disclosure is made.

I am required to follow the privacy practices described in this Notice.  However, I reserve the right to change the terms of this Notice and my privacy policies at any time as permitted by law.  Any changes will apply to PHI already on file with me.  Before I make any important changes to my policies, I will immediately change this Notice and post a new copy of it in my office.  You may also request a copy of this Notice from me, or you can view a copy of it in my office.

COMPLAINTS ABOUT PRIVACY PRACTICES.

If, in your opinion, I may have violated your privacy rights, or if you object to a decision I made about access to your PHI, you are entitled to file a complaint with me. You may also send a written complaint to the Secretary of the Department of Health and Human Services, 200 Independence Avenue S.W., Washington, D.C. 20201.  If you file a complaint about my privacy practices, I will take no retaliatory action against you.

PERSON TO CONTACT FOR INFORMATION ABOUT THIS NOTICE OR TO COMPLAIN ABOUT PRIVACY PRACTICES.

If you have any questions about this notice or any complaints about my privacy practices, or would like to know how to file a complaint with the Secretary of the Department of Health and Human Services, please contact me as follows.

Title/Name:  Laura Walton, LMFT

Telephone Number:  480.828.5025

NOTIFICATIONS OF BREACHES.

In the case of a breach of privacy, my office or agent will notify affected individuals whose unsecured PHI has been compromised.  If such a breach was caused by a business associate, notification will be provided directly or via the business associate.  If the breach involves more than 500 persons, OCR must be notified in accordance with instructions posted on its website.

PHI AFTER DEATH.

I may disclose a deceased individuals’ PHI to care givers or payers of healthcare for the decedent prior to death; however, the disclosure must be limited to PHI relevant to such care or payment and not be inconsistent with prior expressed preference of the deceased individual.

RESTRICTING DISCLOSURES AND ACCESS.

To implement the 2013 HITECH Act, the Privacy Rule was amended.

You may restrict disclosure of PHI to your health plan regarding a service or healthcare item that you have paid the covered entity for in full.  If you request such restriction in writing, your records will be flagged to avoid inadvertent health plan access.  Such request may not apply to a disclosure otherwise required by law.

Amendments allow a patient to request an electronic copy of their PHI, if it is readily producible.  An electronic copy of PHI will not provide direct access to any electronic health record systems.  You may direct transmission of an electronic copy of PHI to an entity or person designated by you.  Fees for handling and reproduction of PHI are restricted to those that are reasonable, cost-based and separately identify any labor for copying PHI.  The amendments modify the timeliness requirement for right of access, from up to 90 days currently permitted, to 30 days, with a one-time extension of 30 additional days.

NOTICE EFFECTIVE DATE:  11/11/19