Regulatory Basis — HIPAA Privacy Rule
HIPAA Privacy Rule — 45 CFR §164.520 (Notice of Privacy Practices) Right of access — 45 CFR §164.524 Amendment of PHI — 45 CFR §164.526 Accounting of disclosures — 45 CFR §164.528 Request restrictions & confidential communications — 45 CFR §164.522 Breach notification to individuals — 45 CFR §164.404 This Notice is a template drafted to the content requirements of 45 CFR §164.520(b). It is a starting point for a covered entity and is not legal or compliance advice. The entity must tailor it to its actual uses and disclosures, review it with counsel or a Privacy Officer, and satisfy the Rule's provision, availability, and posting obligations before adopting it.
MAPLE GROVE FAMILY MEDICINE, PLLC NOTICE OF PRIVACY PRACTICES Protected Health Information (PHI)
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Covered Entity Maple Grove Family Medicine, PLLC
Entity Type Health care provider
Effective Date [Effective Date]
Privacy Contact Dana Whitfield , Privacy Officer1. Our Commitment and the Scope of This Notice
Maple Grove Family Medicine, PLLC ("we," "us," or "our") is a health care provider and a covered entity under the Health Insurance Portability and Accountability Act (HIPAA). We are required by law to maintain the privacy of your protected health information (PHI), to give you this Notice of our legal duties and privacy practices regarding PHI, and to follow the terms of the Notice currently in effect. "Protected health information" means information, including demographic data, that relates to your past, present, or future physical or mental health, the care you receive, or payment for that care, and that can be used to identify you.
2. How We May Use and Disclose PHI for Treatment, Payment, and Health Care Operations
We are permitted under 45 CFR §164.506 to use and disclose your PHI, without your written authorization, for the following core purposes. (a) Treatment — we use and share your PHI to provide, coordinate, and manage your health care. For example, a physician treating you may share your records with a specialist to whom you are referred, or with a pharmacy to fill a prescription. (b) Payment — we use and disclose your PHI to obtain payment for the care you receive. For example, we may send claims and clinical details to your health plan to confirm coverage and receive reimbursement, or to determine eligibility and benefits. (c) Health Care Operations — we use and disclose your PHI for the business and quality functions that keep our organization running. For example, we may use PHI to review the quality of care, train staff and students, conduct internal audits, arrange legal and accounting services, or plan and improve our services.
3. Other Uses and Disclosures Permitted or Required Without Your Authorization
The HIPAA Privacy Rule permits or requires us to use or disclose your PHI without your authorization in certain other situations, subject to the conditions and limits the Rule sets. These include, as applicable: to remind you of appointments or tell you about treatment alternatives and health-related benefits and services; for public health activities such as reporting disease, injury, or vital events; to report suspected abuse, neglect, or domestic violence; for health oversight activities such as audits and investigations; in response to a court order, subpoena, or other lawful process; for law enforcement purposes as permitted by law; to coroners, medical examiners, and funeral directors; for organ, eye, or tissue donation; for research approved through the required privacy safeguards; to avert a serious and imminent threat to health or safety; for specialized government functions such as military and national security activities; and as authorized by and to the extent necessary to comply with workers' compensation laws. We are also required to disclose PHI to you or your personal representative when you exercise your right of access, and to the Secretary of the U.S. Department of Health and Human Services when required to investigate or determine our compliance.
4. Uses and Disclosures That Require Your Written Authorization
Uses and disclosures not described in this Notice will be made only with your written authorization. In particular, and except where the Privacy Rule provides otherwise, we will obtain your authorization before we use or disclose your PHI for marketing, before we make any disclosure that is a sale of PHI, and. You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it; a revocation stops future uses and disclosures under that authorization but does not undo those already made.
5. Your Right to Inspect and Obtain a Copy of Your PHI
Under 45 CFR §164.524 you have the right to inspect and obtain a copy of the PHI we maintain about you in a designated record set, including medical and billing records used to make decisions about your care, for as long as we maintain that information. To exercise this right, submit a written request to our Privacy Officer. We will act on your request within 30 days; where the Rule allows, we may extend this once by up to 30 additional days with written notice explaining the reason and the new deadline. If you request an electronic copy of PHI we maintain electronically, we will provide it in the electronic form and format you request if readily producible, or in a readable electronic form we agree to. We may charge a reasonable, cost-based fee for copies as permitted by the Rule. In limited circumstances we may deny access; where the denial is reviewable, you may request a review by a licensed health care professional who did not take part in the original decision.
6. Your Right to Request an Amendment
Under 45 CFR §164.526 you have the right to request that we amend PHI in a designated record set for as long as we maintain it, if you believe the information is incorrect or incomplete. Submit your request in writing to our Privacy Officer with a reason supporting the requested amendment. We may deny the request in the circumstances the Rule allows — for example, if the information was not created by us (unless the originator is no longer available to act), is not part of the designated record set, would not be available for inspection under the access rules, or is already accurate and complete. If we deny your request, we will explain the denial in writing and tell you how to submit a statement of disagreement, which we will include with the disputed information in future disclosures.
7. Your Right to an Accounting of Disclosures
Under 45 CFR §164.528 you have the right to request an accounting of certain disclosures of your PHI that we have made in the six years before the date of your request. The accounting does not include disclosures we made to carry out treatment, payment, and health care operations; disclosures made to you or your personal representative; disclosures you authorized; and certain other disclosures the Rule excludes. Submit your request in writing to our Privacy Officer and indicate the time period. We will provide one accounting free of charge in any twelve-month period; for additional requests within that period we may charge a reasonable, cost-based fee after telling you the cost in advance so you can withdraw or modify your request.
8. Your Right to Request Restrictions
Under 45 CFR §164.522(a) you have the right to request that we restrict how we use or disclose your PHI for treatment, payment, or health care operations, and disclosures we make to persons involved in your care. We are not required to agree to a requested restriction, except that we must agree to restrict a disclosure of PHI to a health plan for payment or health care operations when the PHI pertains solely to an item or service for which you (or someone other than the health plan on your behalf) have paid us in full out of pocket, unless the disclosure is otherwise required by law. If we agree to a restriction, we will honor it unless the information is needed to provide you emergency treatment. Submit restriction requests in writing to our Privacy Officer.
9. Your Right to Confidential Communications
Under 45 CFR §164.522(b) you have the right to request that we communicate with you about your health matters by alternative means or at an alternative location — for example, by mail to a post office box rather than to your home, or by contacting you only at your work number. As a health care provider, we will accommodate reasonable requests without requiring you to explain the reason. Your request must be in writing and must tell us how or where you wish to be contacted.
10. Your Right to a Paper Copy and to Be Notified of a Breach
You have the right to obtain a paper copy of this Notice on request, even if you have agreed to receive it electronically. You also have the right, under 45 CFR §164.404, to be notified following a breach of your unsecured PHI, and we will provide any such notification as required by the HIPAA Breach Notification Rule. To request a paper copy of this Notice, contact our Privacy Officer using the information below.
11. Our Legal Duties
We are required by law to: maintain the privacy and security of your PHI; provide you this Notice of our legal duties and privacy practices with respect to your PHI; abide by the terms of the Notice currently in effect; and notify you following a breach of your unsecured PHI. We reserve the right to change the terms of this Notice and to make the revised Notice effective for all PHI we maintain, including information created or received before the change. When we make a material change, we will promptly revise this Notice and make the new Notice available. As a provider with a physical service location, we will post the current Notice in a clear and prominent place, make copies available at our facility, and provide the Notice to each individual no later than the date of first service delivery. We may contact you to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you.
12. How to Complain
If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services. To complain to us, contact our Privacy Officer, Dana Whitfield , using the contact information in the section below; you may submit your complaint in writing, and we will not retaliate against you or take any adverse action for filing a complaint. To complain to the federal government, contact the Office for Civil Rights (OCR) of the U.S. Department of Health and Human Services at 200 Independence Avenue, S.W., Washington, D.C. 20201, by calling 1-877-696-6775, or through the OCR complaint portal at ocrportal.hhs.gov. A complaint to OCR must generally be filed within 180 days of when you knew or should have known that the act complained of occurred.
13. Contact Person and Effective Date
The contact person for this Notice, and for exercising any of the rights described above or asking questions about our privacy practices, is:
Dana Whitfield , Privacy Officer
Maple Grove Family Medicine, PLLC
1200 Elm Street, Suite 300, Springfield, IL 62704
Phone: (217) 555-0142
Email: privacy@maplegrovemed.com
This Notice of Privacy Practices is effective as of [Effective Date]. If you have any questions about this Notice or need it in an alternative format or language, please contact our Privacy Officer.
Acknowledgment: This section may be used to record that a copy of this Notice of Privacy Practices was provided to the individual. A good-faith effort to obtain a written acknowledgment of receipt is required of health care providers with a direct treatment relationship under 45 CFR §164.520(c)(2)(ii); if acknowledgment cannot be obtained, the reason should be documented.
Individual / Patient (received a copy)
___________________
______________________
Privacy Officer — on behalf of __GAP[npp_entity_name|Maple Grove Family Medicine, PLLC]__
Dana Whitfield
______________________