Notice of Privacy Practices
This Notice of Privacy Practices (“Notice”) is provided to you pursuant to the privacy regulations enacted as a result of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). This Notice privacy practices describes how your health information may be used and disclosed and how you can get access to your information. This Notice applies to all your health information created or maintained by Messiah Medical PLLC and its affiliated professionals and entities (collectively, the “Practice”). PLEASE REVIEW THIS NOTICE CAREFULLY.
A. Our Commitment to Your Privacy
The Practice is committed to maintaining the privacy of your health information. We are required by law to (i) maintain the privacy of your health information; (ii) provide you with this Notice of our legal duties and privacy practices with respect to your health information; (iii) follow the terms of the Notice currently in effect; and (iv) notify you if there is a breach of your health information. We must also provide you with the following important information: (a) how we may use and disclose your health information; (b) your privacy rights; and (c) our obligations concerning the use and disclosure of your health information.
This Notice is NOT an authorization; rather it describes how we, our Business Associates, and their subcontractors may use and disclose your Protected Health Information to carry out treatment, payment, or healthcare operations, and for other purposes as permitted or required by law. It also describes your rights to access and control your Protected Health Information.
“Protected Health Information” (“PHI”) means information that identifies you individually; including demographic information, and information that relates to your past, present, or future physical or mental health condition and/or related healthcare services.
The terms of this notice apply to all your PHI created or maintained by The Practice. We reserve the right to revise or amend this Notice at any time. Any revision or amendment to this Notice will be effective for all of your records that we created or maintained in the past and for any of your records that we may create or maintain in the future. You may request a copy of our most current Notice at any time.
B. Use and Disclosure of Your Individually Identifiable Health Information (“PHI”)
1. Treatment. The Practice may use or share your PHI to provide health services for you and manage and coordinate your care. For example, PHI may be provided to another health care provider to whom you have been referred to ensure that the provider has the necessary information to diagnose or treat you. If you participate in a virtual visit (telehealth), your information will be shared electronically via a secure transmission to facilitate the virtual visit.
2. Payment. The Practice may use and disclose your PHI in order to bill for services provided and collect payment from health plans or other entities.
3. Health Care Operations. The Practice may use and disclose your PHI to run our businesses, improve your care, and contact you when necessary. For example, we may use or disclose your PHI, as necessary, to contact you to remind you of your appointment, and inform you about treatment alternatives or other health related benefits and services that may be of interest to you.
4. Disclosures to Family or Friends. The Practice may disclose your PHI to individuals involved in your care or treatment or responsible for payment of your care or treatment.
5. Disclosures Required by Law. The Practice will use and disclose your PHI to a public health authority that is authorized by law to receive reports of child abuse or neglect. In addition, The Practice may disclose your PHI to report a victim of abuse, neglect or domestic violence to the governmental entity or agency authorized to receive such information. In this case, the disclosure will be made consistent with the requirements of applicable federal and state laws.
C. Use and of Your PHI in Certain Special Circumstance
1. Public Health Reporting. The Practice may disclose and may be required by law to disclose your PHI for certain public health purposes. For example, a disclosure may be made for the purpose of preventing or controlling disease, injury, or disability.
2. Health Oversight Activities. The Practice may disclose your PHI to a health oversight agency for investigations, inspections, audits, surveys, licensure and disciplinary actions, and in certain civil, administrative, and criminal procedures or actions, or other health oversight activities as authorized by law.
3. Lawsuits and Disputes. The Practice may disclose your PHI in response to a court or administrative order, subpoena, request for discovery, or other legal processes. However, absent a court order, The Practice will generally only disclose your PHI if you have authorized the disclosure or efforts have been made to inform you of the request or obtain an order protecting the information requested. Your information may also be disclosed if required for our legal defense in the event of a lawsuit.
4. Law Enforcement. The Practice may disclose your PHI if requested by a law enforcement official: (a) regarding a crime victim in certain situations, if we are unable to obtain the person’s agreement; (b) about a death we believe resulted from criminal conduct; (c) regarding criminal conduct on our premises; (d) in response to a warrant, summons, court order, subpoena or similar legal process; (e) to identify/locate a suspect, material witness, fugitive or missing person; or (f) in an emergency, to report a crime (including the location or victim(s) of the crime, or the description, identity or location of the perpetrator).
5. Deceased Patients. The Practice may disclose your PHI to a medical examiner or coroner to identify a deceased individual or to identify the cause of death. In addition, we may disclose PHI necessary for funeral directors to fulfill their responsibilities.
6. Research. The Practice may use and disclose your PHI to researchers for the purpose of conducting research with your written authorization or when the research has been approved by an Institutional Review Board and is in compliance with law governing research. In certain situations, the need for your individual consent may be waived by a Privacy Board.
7. Serious Threats to Health or Safety. The Practice may use and disclose your PHI when necessary to reduce or prevent a serious threat to your health and safety or the health and safety of another individual or the public. Under these circumstances, we will only make disclosures to a person or organization able to help prevent the threat.
D. Your Privacy Rights Regarding Your PHI
1. Inspection and Copies. You may request a copy of, or request to inspect, the PHI that is used to make decisions about you, including health and billing records. You have the right to obtain an electronic copy if it is readily producible by us in the form and format requested, or you may request that we provide a paper copy of your record. You may also request a summary of your record. We will provide your health information, to you or whomever you designate to receive it, usually within thirty (30) days of your request. The Practice may charge a reasonable cost-based fee to cover the costs of copying, mailing, labor and supplies associated with your request. The Practice may deny your request to inspect and/or copy in certain limited circumstances; however, you may request a review of our denial.
2. Confidential Communications. You may request in writing that we communicate with you in a specific way or send mail to a different address. For example, you may request that we contact you at home, rather than work or by mail. The Practice will accommodate all reasonable requests. You do not need to give a reason for your request. We will comply with your request if we are reasonably able to do so.
3. Amendment. You may request a correction or amendment of your PHI if you believe it is incorrect or incomplete. You may make a written request for a correction or amendment for as long as your PHI is maintained by or for The Practice. Requests must provide a reason or explanation that supports the request. The Practice will deny your request if it is not in writing or if, in the provider’s opinion, the information is: (a) accurate and complete; (b) not part of the PHI maintained by or for The Practice; (c) not part of the PHI that you have the right to inspect and copy; or (d) not created by The Practice, unless the individual or entity that created the information is not available to amend the information. The Practice will notify you in writing within sixty (60) days if we cannot fulfill your request.
4. Accounting of Disclosures. You may request an accounting of certain disclosures that The Practice has made of your PHI. This accounting will list the disclosures that we have made of your PHI but will not include disclosures made for the purposes of treatment, payment, health care operations, disclosures required by law, and certain other disclosures (such as any you asked us to make). Your request must be in writing and state the time period for which you want the accounting (not to exceed six (6) years prior to the date you make the request). The Practice will provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within twelve (12) months. The Practice will notify you of the costs involved with any additional request and you may withdraw your request before you incur any costs.
5. Requests for Restrictions. You have the right to request in writing that The Practice not use or share your PHI for treatment, payment, or health care operations. We are not required to agree to your request, and we may say “no” if we believe it might affect your care. If you pay for a service or health care item out-of-pocket in full, you may ask us not to share information about that service or health care item for the purpose of payment or our operations with your health insurer. In that case, we will approve your request unless a law specifically requires us to share that information.
6. Right to Receive a Notice of a Breach. You have the right to receive prompt notice in writing of a breach of your PHI that may have compromised the privacy or security of your information.
7. Right to a Paper Copy of This Notice. You have the right to receive a paper copy of this Notice at any time even if you have agreed to receive the Notice electronically.
8. Right to File a Complaint. If you believe your rights have been violated, you may file a complaint with us or with the Secretary of the Department of Health and Human Services.