Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW PROTECTED HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
If you have any questions about this notice, please contact Randi Leigh RD [randil@randileighrd.com]
Pledge
I understand that health information about you and your health care is personal. I am committed to protecting health information about you. I create a record of the care and services you receive from me. I need this record to provide you with quality care and to comply with certain legal requirements. This notice applies to all of the records of your care generated by this practice. This notice will tell you about the ways in which I may use and disclose health information about you. I also describe your rights to the health information I keep about you, and describe certain obligations I have regarding the use and disclosure of your health information. I am required by law to give you this notice of my legal duties and privacy practices with respect to health information.
Notice of Privacy Practices
This Notice of Privacy Practices, referred to now as “Notice”, explains how we may use or disclose protected health information [PHI]. By law, we must protect your health information and provide you with a copy of this Notice. You have rights relating to PHI. This Notice describes those rights. Federal law requires:
Protected health information that identifies you is kept private;
Our business is required to notify you about how we secure protected health information;
Explain how, when, and why our business uses and discloses protected health information; and to
Follow the terms of the Notice that is currently in effect
We reserve the right to change our privacy practices described within this Notice and to make new Notice provisions. If our business makes a material change to our practices, we will:
Notify you of the change;
Post the new notice on our website; and
Provide you with a copy electronically or through the mail
We may apply revised practices to existing and new PHI.
Terms to Know
These terms will be used throughout this statement:
Protected health information (PHI)
Health information
Information
These words refer to information that our business collects, creates, maintains, or transmits about you. This information may, on its own or when used with other information, be used to identify you. It may relate to a past, present, or future health status or condition and mental health services. It may also describe payments for such services.
How We Use and Disclose Protected Health Information (PHI)
The following describes different ways that our business may use and disclose PHI without your written authorization. We collect, use, and disclose your information to administer health plans and provide services. We have the right to use or disclose your information for payment, treatment, and health care operations. We will not use or disclose any of your genetic information for any of the following functions.
Payment
We may use and disclose PHI so the treatment and services you receive may be billed to and payment may be collected from you, an insurance company, or a third party. The following is included within payment PHI:
Collecting premiums
Determining your coverage
Processing service claims
Coordinating benefits
Determining medical necessity
Pre-authorizing services
Determining whether a service is covered
Health coverage eligibility
Payment for health services
Health care operations
We may use and disclose PHI for health care operations, such as quality assessment and improvement activities, case management, coordination of care, business planning, customer service, and other activities. These uses and disclosures are necessary to run the facility, reduce health care costs, and make sure that all of our clients receive quality care. The following is included in health care operations PHI:
Quality improvement
Peer review
Business management
Accreditation and licensing
Utilization review
Enrollment
Underwriting
Reinsurance
Compliance
Auditing
Rating
Other functions related to your plan
Treatment
We may use PHI to provide you with, coordinate, or manage your medical treatment or services. We may disclose PHI to doctors, nurses, technicians, medical students, or other personnel, including persons outside of our office who are involved in your medical care. Our business may also share PHI in order to coordinate your care for prescriptions, lab work, and x-rays. We may use and disclose protected health information to contact you as a reminder that you have an appointment for treatment. We may use and disclose protected health information to tell you about or recommend possible treatment options, treatment alternatives, or health-related benefits or services that may be of interest to you. The following applies to treatment PHI:
Condition management
Wellness programs
Coordinating member benefits, care, and case management
Planning member benefits, care, and case management
Providing for continuity of member benefits, care, and case management
Referrals and consultations
Other Uses and Discloses for Protected Health Information (PHI)
Subject to applicable state law, the law allows or requires us to use or disclose your health information without your authorization in some limited situations for purposes beyond treatment, payment, and operations.
Required by Law
We may disclose protected health information when required to do so by federal, state, or local law. If an agency asks, we must share your records with them. The U.S. Department of Health and Human Services is one agency that may ask for our records.
Law Enforcement and Legal Proceedings
We may release protected health information as required by law, or in response to an order or warrant of a court, a subpoena, a search order, or an administrative request. We may disclose PHI with the police and other law enforcement agencies. We may disclose PHI in response to a request related to identification or location of an individual, a victim of crime, a decedent, or a crime on the premises.
Judicial and Administrative Proceedings
We may disclose your protected health information in response to a court or administrative order. We may also disclose PHI in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made, either by us or the requesting party, to tell you about the request or to obtain an order protecting the information requested.
Abuse or Neglect
We may also disclose PHI to a government authority if we reasonably believe that you are a victim of abuse, neglect, or domestic violence. We will only disclose this type of information to the extent required by law, and we will only disclose it if we believe it is necessary to prevent or lessen a serious and imminent threat to you or another person.
Serious Threat to Health or Safety
We may share your PHI to avoid a serious threat to you, another person, or the public. Your information would be given to health agencies, the police, or other law enforcement agencies. We may also share PHI if there is an emergency or natural disaster.
Correctional Institutions or Law Enforcement Officials
If you are in jail or in law enforcement custody, we may share PHI. This would happen only if it is needed to:
Provide you with health care;
Protect your health and safety;
Protect the health and safety of others; or
Keep the facility you are in safe
Health Oversight Activities
We may disclose protected health information to a health oversight agency for activities authorized by law. These activities include government audits, investigations, inspections, and accreditation as necessary for licensure and for the government to monitor the health care system, government programs, and compliance with civil rights laws.
Public Health
As required by law, we may disclose protected health information to public health or legal authorities charged with preventing or controlling disease, injury, or disability.
Specialized Government Functions
We may release protected health information for national security and intelligence purposes, a national crisis, protective services for the President, and medical suitability or determinations made by the Department of State. If you are a member of the armed forces, we may release protected health information if it relates to military and veterans activities. Our disclosure would result from a government request.
Coroners, Medical Examiners, and Funeral Directors
We may release protected health information to a coroner or medical examiner. This release may be necessary, for example, to identify a deceased person or determine the cause of death. We may also disclose protected health information to funeral directors, consistent with applicable laws, to enable them to carry out their duties.
Organ and Tissue Donation
If you are an organ donor, we may release PHI to an organ donation bank or to organizations that handle organ procurement or organ, eye, or tissue transplantation, as necessary to facilitate organ or tissue donation and transplantation.
Research
We may disclose protected health information to researchers when their research has been approved by an institutional review board or privacy board that has reviewed the research proposal and established protocols to ensure the privacy of your information. We may permit researchers to review records to help identify patients who may be included in their research projects or for similar purposes (i.e. disease or disability) as long as the researchers do not remove or take a copy of any health information.
Business Associates
Our business contracts with other entities to provide certain services or functions that may require them to use or access your PHI. We may disclose information to business associates who perform services on our behalf (such as billing companies). However, we require that these associates appropriately safeguard your information. Our business associates are obligated to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract.
Other Covered Entities
We may use or disclose PHI to health care providers to help them treat you, receive payment, or help them with health care operations.
Plan Sponsors
If your coverage is through a group health plan, we may disclose summary health information to the plan sponsor. We may also share enrollment and dis-enrollment information with them. We may disclose other PHI to the group for administrative use if the plan sponsor agrees to restrict use and disclosure. We may share the names of the members who have completed wellness program requirements to help provide rewards or incentives.
Worker’s Compensation
We may disclose protected health information as necessary to comply with laws relating to worker’s compensation (i.e. illness or work-related injury) or other similar programs established by law.
Food and Drug Administration (FDA)
We may disclose to the FDA, or persons under the jurisdiction of the FDA, protected health information relative to adverse events with respect to drugs, foods, supplements, products, and product defects, or post-marketing surveillance information to enable product recalls, repairs, or replacement.
Fundraising
We may also contact you as part of fundraising efforts. You have the right to opt out of receiving such communications.
Marketing Purposes
As a health care provider, I will not use or disclose your PHI for marketing purposes.
Sale of PHI
As a health care provider, I will not sell your PHI in the regular course of my business.
Data breach
We may use your contact information to provide notices of breach of your PHI as required by law. A breach can include unauthorized acquisition, access, or disclosure of your PHI. We may provide this notification directly to you or give notice to the employer or group that sponsors your health coverage.
Authorized Use
Except as described in this Notice, we will use or disclose your PHI only if you authorize us to do so in writing. Psychotherapy notes, health plan marketing, and sale of your information are some situations that would require your authorization. If you authorize us to share your PHI, we cannot guarantee that the person receiving the PHI will not disclose it. You may revoke your authorization at any time. However, please understand that any action already taken based upon your authorization cannot be reversed and your revocation will not affect those actions.
Required Disclosures
We are required to disclose your PHI:
To you or someone who has the legal right to act on your behalf (your personal representative). This is done in order to administer your rights as described in our Notice.
To the secretary of the Department of Health and Human Services, if necessary, to ensure that your privacy is protected.
Unless you object, or request that only a limited amount or type of information be shared, we may use or disclose protected health information about you in the following circumstances:
We may share with a family member, relative, friend or other person identified by you protected health information that is directly relevant to that person’s involvement in your care or payment for your care. We may also share information to notify these individuals of your location, general condition, or death.
We may share protected health information with a public or private agency (such as the American Red Cross) for disaster relief purposes. Even if you object, we may still share this information if necessary under emergency circumstances.
Using and Disclosing your PHI
We will obtain your written authorization before using or disclosing your protected health information for purposes other than those described in this Notice (or as otherwise permitted or required by law). You may revoke this authorization in writing at any time. Upon receipt of the written revocation, we will stop using or disclosing your information, except to the extent that we have already taken action in reliance on the authorization.
Individual Rights
You should be especially aware of several important rights that all health plans and providers involved in your care must honor. Your request to exercise these rights must be in writing and signed by you or your representative. Your individual rights are described below.
Right to Restriction
You have the right to ask us to restrict how we use or disclose your information for payment, treatment, and health care operations. We do not have to approve your request. However, we consider all reasonable requests. We have the right to end restrictions we have approved. We will notify you if we approve a restriction then reverse that approval. You have the right to end, orally or in writing, any restriction.
Right to Object
You have the right to object any disclosures of PHI in the above circumstances listed in this Notice. If you would like to object to use and disclosure of protected health information in these circumstances, please write to randil@randileighrd.com. We have the right to disapprove your objection.
Right to Amend
You have the right to ask to change information in your records. If you feel that your protected health information is incorrect or incomplete, you may ask us to amend or supplement the information. To request an amendment, your request must be made in writing and submitted to randil@randileighrd.com. In addition, you must provide a reason that supports your request. We will act on your request for an amendment no later than 60 days after we receive it. We may deny your request. In these circumstances, we will provide a written denial stating why we will not grant your request. If your request has been denied, you can put a statement in your file. The statement will show why you disagree with our denial.
Right to Accounting of Disclosures
You have the right to request an “accounting of disclosures.” This means, you have the right to ask us to tell you how many times we have disclosed your PHI, who we shared it with, and why. When you ask, tell us the time period you want to review. To request this list of disclosures, you must submit your request in writing to randil@randileighrd.com. You may ask for disclosures made within the six years before your request. We will not go back more than six years. Your right does not include disclosures related to
Payment
Treatment
Health care operations
Information requested by you
Right to Confidential Communications
You have the right to ask us to send you information in a confidential way. You may want information in a different manner. You may want information sent to a different address. If our standard approach could cause harm, we will consider reasonable requests to take a different approach. To request confidential communications, you must make your request in writing to randil@randileighrd.com.
Right to Inspect and Copy
You have the right to inspect and copy protected health information that may be used to make decisions about your care or payment for your care. If we maintain your protected health information electronically, you can request that we provide access in an electronic form and format that is readily producible, or in a form and format agreed to by our business. To inspect and copy protected health information that may be used to make decisions about you, you must submit your request to randil@randileighrd.com. If you request a copy of the information, we may charge a fee for the costs of copying, mailing, or supplies associated with your request. We may not charge you a fee if you need the information for a claim for benefits under the Social Security Act or any other state or federal needs-based benefit program. We will respond to your request no later than 30 days after we receive it. There are certain situations in which we are not required to comply with your request. In these circumstances, we will respond to you in writing, stating why we will not grant your request and describe any rights you may have to request a review of our denial.
Rights to Copies of this Notice
You may ask for a paper copy of this Notice, even if you already have an electronic copy.
We will promptly provide you with a paper copy. To receive a paper copy, contact randil@randileighrd.com.
Right to File a Complaint
If you believe your privacy rights have been violated, you may file a complaint with us at randil@randileighrd.com or file a written complaint with the Secretary of the Department of Health and Human Services. A complaint to the Secretary should be filed within180 days of the occurrence or action that is the subject of the complaint. If you file a complaint, we will not take any action against you or change our treatment of you in any way.
Right to Request Restrictions for Out-of-Pocket Expenses Paid for In Full
You have the right to request restrictions on disclosures of your PHI to health plans for payment or health care operations purposes if the PHI pertains solely to a health care item or a health care service that you have paid for out-of-pocket in full.
Changes to this Notice
We reserve the right to change this Notice and make the new Notice apply to health information we already have, as well as any information we receive in the future. We will post a copy of our current Notice on our website. The notice will have the effective date clearly marked.
Effective Date
Originally issued SEPTEMBER 10, 2022