Policies

THIS NOTICE (“Notice”) DESCRIBES HOW YOUR MEDICAL INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN OBTAIN ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: December 7, 2023

SUMMARY

This is a summary of how we may use and disclose your protected health information (“PHI”) and your rights and choices when it comes to your information. We will explain these in more detail on the following pages.

Your Rights. You have the right to:

  • Obtain a copy of your paper or electronic PHI.
  • Correct your PHI.
  • Ask us to limit the information we share, in some cases.
  • Obtain a list of those with whom we’ve shared your information.
  • Request confidential communication.
  • Obtain a copy of this notice.
  • Choose someone to act for you.
  • File a complaint if you believe we have violated your privacy rights.

Your Choices. You have some choices about how we use and share information as we communicate with you, provide care, and tell family and friends about your condition.

Our Uses and Disclosures. We may use and disclose your information as we:

  • Treat you.
  • Bill for services.
  • Run our organization.
  • Do research.
  • Comply with the law.
  • Work with a medical examiner or funeral director.
  • Address workers’ compensation, law enforcement, and other government requests
  • Respond to lawsuits and legal actions.

PURPOSE

We respect your privacy. We are also legally required to maintain the privacy of your PHI under the Health Insurance Portability and Accountability Act (“HIPAA”) and other federal and state laws. We follow state privacy laws when they are stricter or more protective of your PHI than federal law.

As part of our commitment and legal compliance, we are providing you with this Notice of Privacy Practices (this “Notice”). This Notice describes:

  • Our legal duties and privacy practices regarding your PHI, including our duty to notify you following a data breach of your unsecured PHI.
  • Our permitted uses and disclosures of your PHI.
  • Your rights regarding your PHI.

CONTACT

If you have any questions about this Notice, please contact Dr. Kate Lieberman.

PHI DEFINED

Your PHI:

  • Is health information about you which someone may use to identify you; and which we keep or transmit in electronic, oral, or written form.
  • Includes information such as your name; contact information; past, present, or future physical or mental health or medical conditions; payment for health care products or services; or prescriptions.

SCOPE

We create a record of the care and health services you receive, to provide your care, and to comply with certain legal requirements. This Notice applies to all the PHI that we generate. We follow the duties and privacy practices that this Notice describes and any other changes once they take effect.

CHANGES TO THIS NOTICE

We can change the terms of this Notice, and the changes will apply to all the information we have about you. The new notice will be available on request, in our office, and on our website.

DATA BREACH NOTIFICATION

We will promptly notify you if a data breach occurs that may have compromised the privacy or security of your PHI. Most of the time, we will notify you in writing, by mail, or we may email you if you have provided us with your current email address, and you have previously agreed to receive notices electronically. In limited circumstances when we have insufficient or out-of-date contact information, we may provide notice in a legally acceptable alternative form.

YOUR RIGHTS

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you. You have the right to:

Right to request restrictions: You have the right to request restrictions on certain uses and disclosures of your PHI. You can contact us and request us not to use or share certain PHI for treatment, payment, or operations or with certain persons involved in your care. We require that you submit this request in writing, including the following information: 1) what information you want to limit; 2) whether you want to limit use, disclosure, or both; and 3) to whom you want the limits to apply. For these requests, we are not required to agree. We may say “no” if it would affect your care; but we will agree not to disclose information to a health plan for purposes of payment or health care operations if the requested restriction concerns a health care item or service for which you or another person, other than the health plan, paid in full out-of-pocket, unless it is otherwise required by law.

Right to request confidential communications: You have the right to request that we communicate with you about health matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or at a specific address. For these requests: you must make your request in writing, specifying how or where you wish to be contacted, and we will accommodate reasonable requests.

Right to an accounting of disclosures: You generally have the right to receive an accounting of certain disclosures of PHI that we have made. On your written request, we will discuss with you the details of the accounting process.

Right to inspect and copy: In most cases, you have the right to inspect or obtain an electronic or paper copy of the PHI that we maintain about you. To do this, you must submit your request in writing. If you request a copy of the information, we may charge a fee for costs of copying and mailing. We may deny your request to inspect and copy in some circumstances. You may request that we provide a copy of your PHI to a family member, another person, or a designated entity. We require that you submit these requests in writing with your signature, and clearly identify the designated person and where to send the PHI. If you request a copy of your PHI, we will generally decide to provide or deny access within 30 days; however, if we cannot act within 30 days, we will give you a reason for the delay in writing and when you can expect us to act on your request. We may deny your request for access in certain limited circumstances; however, if we deny your access request, we will provide a written denial with the basis for our decision and explain your rights to appeal or file a complaint.

Right to amend: You may ask us to correct or amend PHI that we maintain about you that you think is incorrect or inaccurate. To request an amendment, your request must be made in writing, specify the incorrect or inaccurate PHI, and  provide a reason that supports your request. We will generally decide to grant or deny your request within 60 days. If we cannot act within 60 days, we will give you a reason for the delay in writing and include when you can expect us to complete our decision, which will be no longer than an additional 30 days. We may deny your request for an amendment if you ask us to amend PHI that: 1) was not created by us; 2) is not part of a designated record set; 3) is not part of our record; or 4) is accurate and complete.

Right to choose someone to act for you: If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI.

Right to a copy of this Notice: You have the right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. Changes to this Notice: We reserve the right to change our policies and/or to change this Notice, and to make the changed Notice effective for PHI we already have about you as well as any information we receive in the future. The new notice will contain the effective date. The new notice will be available on request, posted in the waiting room, or on our website.

Right to make a complaint: If you believe your privacy rights have been violated, you may file a complaint. We will not retaliate against you for filing a complaint. You may either file a complaint directly with us by submitting your request in writing, or you may file a complaint with the Office for Civil Rights at the U.S. Department of Health and Human Services. Send a complaint to: Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F HHH Bldg., Washington, D.C. 20201; call 1-800-368-1019; or visit www.hhs.gov/ocr/privacy/hipaa/complaints/.

YOUR CHOICES

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, please contact us and we will make reasonable efforts to follow your instructions.

In these cases, you have both the right and choice to tell us whether to:

  • Share information, such as your PHI, general condition, or location, with your family, close friends, or other involved in your care.
  • Share information in a disaster relief situation, such as to a relief organization to assist with locating or notifying your family, close friends, or others involved in your care.

We will not share your information unless you give us your written permission in the following cases: 

  • Most sharing of a mental health/psychotherapy notes.
  • Marketing purposes.
  • Selling or otherwise receiving compensation for disclosing your PHI.
  • Certain research activities.
  • Other uses and disclosures not described in this Notice.

You may revoke your authorization at any time, but it will not affect information that we already used and disclosed.

USES AND DISCLOSURES OF YOUR PHI

The law permits or requires us to use or disclose your PHI for various reasons, which we explain in this Notice. We have included some examples, but we have not listed every permissible use or disclosure. When using or disclosing PHI or requesting your PHI from another source, we will make reasonable efforts to limit our use, disclosure, or request about your PHI to the minimum we need to accomplish our intended purpose.

Uses and Disclosures for Treatment, Payment, or Health Care Operations

Treatment. We may use or disclosure your PHI and share it with other professionals who are treating you, including doctors, nurses, technicians, medical students, or hospital personnel involved in your care. For example, we might disclose information about your overall mental health condition to physicians who are treating you for a specific injury or condition.

Billing and payment. We may use and disclose your PHI to bill and get payment from health plans or others. For example, we share your PHI with your health insurance plan so it will reimburse you for the services you receive.

Running our organization. We may use and disclose your PHI to run our practice, improve your care, and contact you when necessary. For example, we may use your PHI to manage the services and treatment you receive or to monitor the quality of our services.

Other Uses and Disclosures

We may share your information in other ways, usually for public health or research purposes or to contribute to the public good. For more information on permitted uses and disclosures, see https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/permitted-uses/index.html. For example, these other uses and disclosures may involve:

Our business associates. We may use and disclose your PHI to outside persons or entities that perform services on our behalf, such as auditing, legal, or transcription. The law requires our business associates and their subcontractors to protect your PHI in the same way we do.

Complying with the law. For example, we will share your PHI if the Department of Health and Human Services requires it when investigating our compliance with privacy laws.

Helping with public health and safety issues. For example, we may share your PHI to:

  • Report injuries, births, and deaths;
  • Report suspected child neglect or abuse, or domestic violence;
  • Report suspected elderly or incapacitated adult neglect or abuse; or
  • Avert a serious threat to public health or safety.

Responding to legal actions. For example, we may share your PHI to respond to:

  • A court or administrative order or subpoena;
  • Discovery request; or
  • Another lawful process.

Research. For example, we may share your PHI for some types of health research that do not require your authorization, such as if an institutional review board has waived the written authorization requirement because the disclosure only involved minimal privacy risks.

Working with medical examiners or funeral directors. For example, we may share PHI with coroners, medical examiners, or funeral directors when an individual dies.

Addressing workers’ compensation, law enforcement, or other government requests. For example, we may use and disclose your PHI for:

    • Workers’ compensation claims;
    • Health oversight activities by federal or state agencies;
    • Law enforcement purposes or with a law enforcement official; or
    • Specialized government functions, such as military and veterans’ activities, national security and  intelligence, presidential protective services, or medical suitability.