HIPAA Notice of Privacy Practices | hp

This Notice of Privacy Practices ("Notice") is provided by Heather Pisano NP in Family Health and Psychiatry, PLLC, doing business as hp | np Health ("Practice," "we," "our," or "I"). We are required by law to maintain the privacy of your protected health information ("PHI"), to provide you with this Notice of our legal duties and privacy practices with respect to your PHI, and to abide by the terms of the Notice currently in effect.

Protected Health Information (PHI) means individually identifiable health information — including demographic data — that relates to your past, present, or future physical or mental health condition, the provision of health care to you, or payment for the provision of health care.

1. How We May Use and Disclose Your Health Information

The following categories describe the ways we may use and disclose your PHI. Not every use or disclosure in a category will be listed; however, all of the ways we are permitted to use and disclose information will fall within one of the categories.

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your health care and related services. For example, we may share your PHI with other health care providers involved in your care (e.g., your primary care physician, therapist, or specialist) to ensure continuity of treatment.

Payment

We may use and disclose your PHI to obtain payment for services we provide to you. For example, we may provide your PHI to your health plan to obtain reimbursement for services rendered, or to determine eligibility or coverage.

Health Care Operations

We may use and disclose your PHI in connection with our health care operations, including quality assessment and improvement activities, training, accreditation, and business management activities necessary to operate the practice.

Appointment Reminders and Health-Related Communications

We may use and disclose your PHI to contact you as a reminder that you have an appointment for treatment or medical care, or to provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you.

2. Uses and Disclosures Requiring Your Authorization

Other uses and disclosures of your PHI not described in this Notice will be made only with your written authorization, unless otherwise permitted or required by law. You may revoke your authorization in writing at any time, except to the extent that we have already taken action in reliance on your authorization. The following uses and disclosures require your written authorization:

—Most uses and disclosures of psychotherapy notes
—Uses and disclosures of PHI for marketing purposes
—Disclosures that constitute a sale of PHI
—Other uses and disclosures not described in this Notice

3. Special Protections for Certain Health Information

Certain categories of health information receive heightened protection under federal and New York State law. We apply additional safeguards to the following types of information:

—Mental health and psychiatric records
—Substance use disorder treatment records (42 C.F.R. Part 2, where applicable)
—HIV/AIDS-related information
—Reproductive health information
—Genetic information (GINA)

Disclosure of these categories of information may require your specific written authorization beyond what is otherwise permitted under HIPAA.

4. Uses and Disclosures We May Make Without Your Authorization

We may use or disclose your PHI without your authorization in the following circumstances, as permitted or required by law:

As Required by Law

We will disclose your PHI when required to do so by federal, state, or local law.

Public Health Activities

We may disclose your PHI to public health authorities for activities such as preventing or controlling disease, injury, or disability; reporting births and deaths; and reporting adverse reactions to medications.

Health Oversight Activities

We may disclose your PHI to health oversight agencies (e.g., the New York State Department of Health, the Office of Inspector General) for activities authorized by law, such as audits, investigations, and licensure.

Judicial and Administrative Proceedings

We may disclose your PHI in response to a court order, subpoena, or other lawful process, subject to applicable legal protections.

Law Enforcement

We may disclose your PHI to law enforcement officials for limited purposes, including to report certain types of wounds or injuries, or to comply with court orders.

Serious Threats to Health or Safety

We may use or disclose your PHI if we believe it is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, consistent with applicable law and ethical standards.

Coroners, Medical Examiners, and Funeral Directors

We may disclose PHI to a coroner or medical examiner to identify a deceased person, determine cause of death, or as authorized by law.

Research

Under certain circumstances, we may use and disclose medical information for research purposes, subject to applicable privacy protections and institutional review board oversight.

Workers' Compensation

We may disclose your PHI as authorized by and to the extent necessary to comply with workers' compensation laws.

Inmates

If you are an inmate of a correctional institution, we may disclose your PHI to the institution or law enforcement officials as necessary for your health and the health and safety of others.

5. Your Rights Regarding Your Health Information

You have the following rights regarding your PHI. To exercise any of these rights, please submit a written request to us at the contact information listed at the end of this Notice.

Right to Inspect and Copy

You have the right to inspect and obtain a copy of your PHI that is maintained in a designated record set, including your medical record and billing records. We may charge a reasonable, cost-based fee for copies. We may deny access in limited circumstances; if denied, you may request a review of the denial.

Right to Request an Amendment

If you believe that your PHI is incorrect or incomplete, you may request that we amend the information. We may deny your request under certain circumstances (e.g., if the information was not created by us, or if we determine the record is accurate and complete). If denied, you have the right to submit a written statement of disagreement.

Right to an Accounting of Disclosures

You have the right to request an accounting of certain disclosures of your PHI made by us during the six years prior to your request. This right does not apply to disclosures made for treatment, payment, or health care operations, or disclosures made with your authorization.

Right to Request Restrictions

You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or health care operations, or to persons involved in your care. We are not required to agree to your request, except in the case of a request to restrict disclosure to a health plan for services you have paid for in full out-of-pocket.

Right to Request Confidential Communications

You have the right to request that we communicate with you about your health information in a certain way or at a certain location. For example, you may ask that we contact you only by email or only at a specific phone number. We will accommodate reasonable requests.

Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice upon request, even if you have agreed to receive it electronically.

Right to Be Notified of a Breach

You have the right to be notified in the event of a breach of your unsecured PHI, as required by the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414).

6. Our Duties

We are required by law to:

—Maintain the privacy of your PHI
—Provide you with this Notice of our legal duties and privacy practices
—Notify you following a breach of your unsecured PHI
—Abide by the terms of the Notice currently in effect

We reserve the right to change the terms of this Notice and to make the new Notice provisions effective for all PHI we maintain. Revised Notices will be posted on our website and made available in the office. The effective date of the current Notice is stated at the top of this document.

7. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights. You will not be retaliated against for filing a complaint.

File a Complaint with Us

Heather Pisano NP in Family Health and Psychiatry, PLLC

2711 Transit Road, Suite 124

Elma, NY 14059

[email protected]

File a Complaint with HHS

U.S. Dept. of Health & Human Services

Office for Civil Rights

www.hhs.gov/hipaa/filing-a-complaint

1-800-368-1019 (toll-free)

8. Contact Information and Privacy Officer

For questions about this Notice or to exercise your rights, please contact:

Privacy Officer

Heather Pisano, NP-C

Heather Pisano NP in Family Health and Psychiatry, PLLC

2711 Transit Road, Suite 124

Elma, NY 14059

Email: [email protected]

This Notice of Privacy Practices has been prepared in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HITECH Act, and applicable New York State law. This document is provided for informational purposes and does not constitute legal advice. hp | np Health recommends that this Notice be reviewed by a qualified healthcare attorney prior to distribution to patients to ensure full compliance with all applicable federal and state requirements.