Privacy RuleThis Notice Describes How Medical Information About You May Be Used and Disclosed and How you can get Access to This Information. Please Review it Carefully.
A federal regulation, known as the “HIPAA Privacy Rule,” requires that we provide detailed notice in writing of our privacy practices. This Notice is long. The HIPAA Privacy Rule requires us to provide you with information on many things.p
In this Notice, we describe the ways that we may use and disclose health information about our patients. The HIPAA Privacy Rule requires that we protect the privacy of health information about you that can be used to identify you. This information is called “protected health information” or “PHI.” In addition to the protections under HIPAA, North Carolina Law and other Federal law may also provide additional protections of health information in some circumstances. This Notice describes your rights as our patient and our obligations regarding the use and disclosure of PHI under HIPAA and other applicable laws.
We are required by law to:
As permitted by the HIPAA Privacy Rule, we reserve the right to make changes to this Notice and to make such changes effective for all PHI we may already have about you. If and when this Notice is changed, we will post a copy in our office in a prominent location or you may obtain a copy on our website at www.pinehurstmedical.com. We will also provide you with a copy of the revised Notice upon your request made to our Privacy Official.
You will be asked to sign a form that you received this Notice. Even if you do not sign this form, we will still provide you treatment.
A. Uses and Disclosures to You, to Your Personal Representative, and for Treatment, Payment, and Health Care Operations
Subject to other laws that we discuss later in this Notice, the following categories describe the different ways we may use and disclose PHI to you, to your personal representative, and for treatment, payment, or health care operations without your authorization. The examples included in each category do not list every type of use or disclosure that may fall within that category.
Disclosures to You: We may disclose to you PHI about you.
Disclosures to Your Personal Representative: We may make disclosures to your personal representative. Your personal representative is someone who has the authority under state law to act on your behalf in making decisions related to your health care. For example, if you are deceased, your personal representative would be the person who has the authority under state law to act on your behalf or on behalf of your estate.
If you are a minor, your personal representative will be a parent, guardian, or person acting in the place of a parent who has the authority under state law to make decisions related to your healthcare. However, we may only disclose to a parent, guardian, or person acting in the place of a parent where disclosure is permitted or required by state law. For example, under North Carolina law, we generally cannot disclose to the parent of a minor information related to the treatment of the minor that was provided on the minor’s own consent.
Treatment: We may use and disclose PHI about you to provide, coordinate or manage your health care and related services. We may consult with other health care providers regarding your treatment and coordinate and manage your health care with others. For example, we may use and disclose PHI when you need a prescription, lab work, an X-ray, or other health care services. In addition, we may use and disclose PHI about you when referring you to another health care provider. For example, if you are referred to another physician, we may disclose PHI to your new physician regarding whether you are allergic to any medications. In emergencies, we may use and disclose PHI to provide the treatment you need.
We may also disclose PHI about you for the treatment activities of another health care provider. For example, we may send a report about you to a physician that we refer you to so that the other physician may treat you.
We may use and disclose PHI so that we can bill and collect payment for the treatment and services provided to you. Before providing treatment or services, we may share details with your health plan concerning the services you are scheduled to receive. For example, we may ask for payment approval from your health plan before we provide care or services. We may use and disclose PHI to find out if your health plan will cover the cost of care and services we provide. We may use and disclose PHI to confirm you are receiving the appropriate amount of care to obtain payment for services. We may use and disclose PHI for billing, claims management, and collection activities. We may disclose PHI to insurance companies providing you with additional coverage. We may disclose limited PHI to consumer reporting agencies relating to collection of payments owed to us.
We may also disclose PHI to another health care provider or to a company or health plan required to comply with the HIPAA Privacy Rule for the payment activities of that health care provider, company, or health plan. For example, we may allow a health insurance company to review PHI for the insurance company’s activities to determine the insurance benefits to be paid for your care.
Health Care Operations:
We may use and disclose PHI in performing business activities that are called health care operations. Health care operations include doing things that allow us to improve the quality of care we provide. Health care operations also include things that we do to reduce costs. For example, we may use and disclose PHI about you in health care operations to do the following things:
If another health care provider, company, or health plan that is required to comply with the HIPAA Privacy Rule also has or once had a relationship with you, we may disclose PHI about you for certain health care operations of that health care provider or company. For example, we may use and disclose PHI to do the following things: review and improve the quality, efficiency, and cost of care provided to you; review and evaluate the skills, qualifications, and performance of health care providers; provide training programs for students, trainees, health care providers, or non-health care professionals; cooperate with outside organizations that evaluate, certify, or license health care providers or staff in a particular field or specialty; and assist with legal compliance activities of that health care provider or company.
We may also disclose PHI for the health care operations of any organized health care arrangement in which we participate. An example of an organized health care arrangement is the joint care provided by a hospital and the physicians who see patients at the hospital.
Communication From Our Office:
We may contact you to remind you of appointments and to provide you with information about treatment alternatives or other health related benefits and services that may be of interest to you.
B. Other Uses and Disclosures We Can Make Without Your Written Authorization for Which You Have the Opportunity to Agree or Object
Individuals Involved in Your Care or Payment for Your Care:
We may use and disclose PHI about you in some situations where you have the opportunity to agree or object to certain uses and disclosures of PHI about you. If you do not object, we may make these types of uses and disclosures of PHI.
C. Other Uses and Disclosures We Can Make Without Your Written Authorization or Opportunity to Agree or Object
We may use and disclose PHI about you in the following circumstances without your authorization or opportunity to agree or object, provided that we comply with certain conditions that may apply.
Required By Law:
We may use and disclose PHI as required by federal, state, or local law to the extent that the use or disclosure complies with the law and is limited to the requirements of the law.
Public Health Activities:
We may use and disclose PHI to public health authorities or other authorized persons to carry out certain activities related to public health, including the following activities:
Abuse, Neglect, or Domestic Violence:
We may disclose PHI in certain cases to proper government authorities if we reasonably believe that a patient has been a victim of domestic violence, abuse, or neglect.
Health Oversight Activities:
We may disclose PHI to a health oversight agency for oversight activities including, for example, audits, investigations, inspections, licensure and disciplinary activities, and other activities conducted by health oversight agencies to monitor the health care system, government health care programs, and compliance with certain laws.
Lawsuits and Other Legal Proceedings: We may use or disclose PHI when required by a court or administrative tribunal order. We may also disclose PHI in response to subpoenas, discovery requests, or other required legal process when efforts have been made to advise you of the request or to obtain an order protecting the information requested.
Under certain conditions, we may disclose PHI to law enforcement officials for the following purposes where the disclosure is:
We may not, however, disclose the fact that you have sought treatment for drug dependence to law enforcement.
Coroners, Medical Examiners, Funeral Directors:
We may disclose PHI to a coroner or medical examiner to identify a deceased person and determine the cause of death. In addition, we may disclose PHI to funeral directors, as authorized by law, so that they may carry out their jobs.
Organ and Tissue Donation:
If you are an organ donor, we may use or disclose PHI to organizations that help procure, locate, and transplant organs in order to facilitate an organ, eye, or tissue donation and transplantation.
We may use and disclose PHI about you for research purposes under certain limited circumstances. We must obtain a written authorization to use and disclose PHI about you for research purposes, except in situations where a research project meets specific, detailed criteria established by the HIPAA Privacy Rule to ensure the privacy of PHI. We may also allow a researcher, who is preparing for a research project, to review PHI on our site to look for persons who may be able to participate in a research project. We will not allow the PHI reviewed by the researcher for this reason to leave our offices.
To Avert a Serious Threat to Health or Safety:
We may use and disclose PHI about you in limited circumstances when necessary to prevent a threat to the health or safety of a person or to the public. This disclosure can only be made to a person who is able to help prevent the threat.
Specialized Government Functions:
Under certain conditions, we may disclose PHI:
We may disclose PHI as authorized by workers’ compensation laws or other similar programs that provide benefits for work-related injuries or illness.
Disclosures Required by HIPAA Privacy Rule:
We are required to disclose PHI to the Secretary of the United States Department of Health and Human Services when requested by the Secretary to review our compliance with the HIPAA Privacy Rule. We are also required in certain cases to disclose PHI to you, or to someone who has the legal right to act for you, when you request access to PHI or request an accounting of certain disclosures of PHI about you (these requests are described in Section III of this Notice).
We may use or disclose PHI incident to or naturally arise out of a use or disclosure permitted by the HIPAA Privacy Rule so long as we have reasonably safeguarded against such incidental uses and disclosures and have limited them to the minimum necessary information.
Limited Data Set Disclosures:
We may use or disclose a limited data set (PHI that has certain identifying information removed) for the purposes of research, public health, or health care operations. This information may only be disclosed for research, public health, and health care operations purposes. The person receiving the information must sign an agreement to protect the information.
We may share PHI with other parties called “business associates” who help us with providing services to you. We are required to sign contracts with these business associates that require them to protect PHI.
D. Other Uses and Disclosures of Protected Health Information Require Your Authorization
All other uses and disclosures of PHI about you will be made with your written authorization. If you have authorized us to use or disclose PHI about you, you may later revoke your authorization at any time, except to the extent we have taken action based on the authorization.
E. Additional Protections of Protected Health Information That Are Provided Under North Carolina Law or Other Law
Up to this place in this Notice, we have been describing the uses and disclosure of PHI that we may make under the HIPAA Privacy Rule. However, HIPAA does not change some North Carolina laws or other laws that are more protective of patient privacy. This section describes these other laws that give you more protection in certain circumstances or with respect to certain kinds of PHI. Aside from these laws, we believe that HIPAA generally is consistent with North Carolina and other privacy laws and requirements. As government agencies offer more guidance on HIPAA, state, and other laws, we will make appropriate changes to our privacy practices and this Notice.
State law limits when communicable disease information may be disclosed. In certain situations, state law permits disclosure of communicable disease information that relates to you without your authorization. “Communicable diseases” are generally illnesses that can be transmitted from one person to another, such as HIV/AIDS, tuberculosis, hepatitis, and syphilis. North Carolina law allows disclosures of communicable disease information in the following circumstances:
We must disclose your HIV status to the physician treating a health care worker who was exposed to your blood or body fluids. We must notify the local health director if we have reason to believe that you are HIV positive and are not following any of the control measures that have been given to you by the local health director.
Mental Health, Developmental Disability, and Substance Abuse
Under North Carolina law, there are limitations on the disclosure of information about you that relates to your being served by a facility that provides services for the care treatment, habilitation, or rehabilitation of the mentally ill, the developmentally disabled, or substance abusers without your authorization. While mental health/developmental disability/substance abuse facilities and health professionals treating you in these facilities may be permitted to disclose this information under specific circumstances, we would not be permitted to disclose this information to the extent that we have it.
Under the HIPAA Privacy Rule law, you have the following rights regarding PHI about you:
Right to Request Restrictions: You have the right to request additional restrictions on the PHI that we may use or disclose for treatment, payment and health care operations. You may also request additional restrictions on our disclosure of PHI to certain individuals involved in your care that otherwise are permitted by the Privacy Rule. We are not required to agree to your request. If we do agree to your request, we are required to comply with our agreement except in certain cases, including where the information is needed to treat you in the case of an emergency. To request restrictions, you must make your request in writing to our Privacy Official. In your request, please include
Right to Receive Confidential Communications:
"You have the right to request that you receive communications regarding PHI in a certain manner or at a certain location. For example, you may request that we contact you at home, rather than at work. You must make your request in writing. You must specify how you would like to be contacted (for example, by regular mail to your post office box and not your home). We are required to accommodate only reasonable requests.
Right to Inspect and Copy:
You have the right to request the opportunity to inspect and receive a copy of PHI about you in certain records that we maintain. This includes medical and billing records but does not include psychotherapy notes or information gathered or prepared for a civil, criminal, or administrative proceeding. We may deny your request to inspect and copy PHI only in limited circumstances. To inspect and copy PHI, please contact our Privacy Official. If you request a copy of PHI about you, we may charge you a reasonable fee for the copying, postage, labor and supplies used in meeting your request.
Right to Amend:
You have the right to request that we amend PHI about you as long as such information is kept by or for our office. To make this type of request, you must submit your request in writing to our Privacy Official. You must also give us a reason for your request. We may deny your request in certain cases, including if it is not in writing or if you do not give us a reason for the request.
Right to Receive an Accounting of Disclosures:
You have the right to request an “accounting” of certain disclosures that we have made of PHI about you. This is a list of disclosures made by us during a specified period of up to 6 years, but these do not include disclosures made: for treatment, payment, and health care operations; for use in or related to a facility directory; to family members or friends involved in your care; to you directly; pursuant to an authorization of you or your personal representative; for certain notification purposes (including national security, intelligence, correctional, and law enforcement purposes); as incidental disclosures that occur as a result of otherwise permitted disclosures; as part of a limited data set of information that does not directly identify you; and disclosures made before April 14, 2003. If you wish to make such a request, please contact our Privacy Official identified on the last page of this Notice. The first list that you request in a 12-month period will be free, but we may charge you for our reasonable costs of providing additional lists in the same 12-month period. We will tell you about these costs, and you may choose to cancel your request at any time before costs are incurred.
Right to a Paper Copy of this Notice:
You have a right to receive a paper copy of this Notice at any time. You are entitled to a paper copy of this Notice even if you have previously agreed to receive this Notice electronically. To obtain a paper copy of this Notice, please contact our Privacy Official listed in this Notice.