PREMIER ORTHOPEDIC SURGERY AND SPORTS MEDICINE, PLLC
I. COMMITMENT TO PROTECTING PHI. Premier Orthopedic Surgery and Sports Medicine, PLLC (the “Practice”) is committed to protecting medical information about you and your health, including all demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related health care services (“protected health information” or “PHI”). This Policy describes how the Practice may use and disclose your PHI to carry out treatment, payment or health care operations and for other purposes that are permitted or required by law. This Policy also describes your rights to access and certain obligations we have regarding the use and disclosure of your PHI. This Policy is in compliance with the requirements set forth under The Health Insurance Portability and Accountability Act (“HIPAA”) and those requirements as set forth by the Secretary of the Department of Health and Human Services (the “Secretary”), as may be modified or adopted from time to time.
II. USES AND DISCLOSURES.
A. Treatment, Payment and Health Care Operations.
The Practice may use and disclose PHI for the following purposes:
1. Treatment: To provide, coordinate, or manage your health care and related services, such as disclosing PHI to other healthcare professionals involved in your care. For example, phoning in prescriptions to your pharmacy or scheduling lab work.
2. Payment: To bill and collect payment from you, an insurance company or a third party. For example, to obtain prior approval of a particular treatment, or to substantiate services rendered for payment purposes.
3. Health Care Operations: To ensure that you receive quality care. For example, to evaluate the performance of our staff in caring for you, to help us decide what additional services we should offer, or whether certain new treatments are effective.
4. Appointment Reminders: We may contact you as a reminder that you have an appointment for treatment or medical care at this office.
5. Treatment Alternatives and Health-Related Products and Services: The Practice may recommend possible treatment alternatives or other health-related benefits and services that may be of interest to you. For example, to send you a brochure about products or services that may be beneficial to you.
B. Special Situations.
Subject to all applicable legal requirements and limitations, the Practice may use or disclose PHI without your permission for the following purposes:
1. Required By Law: The Practice will disclose PHI about you when required to do so by federal, state or local law.
2. Public Health: The Practice may disclose PHI about you for public health activities, including disclosures:
• to prevent or control disease, injury or disability;
• to report births and deaths;
• to report child abuse or neglect;
• to persons subject to the jurisdiction of the Food and Drug Administration (FDA) for activities raised to the quality, safety, or • effectiveness of FDA-regulated products of services and to report reactions to medications or problems with products;
• to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or
• to notify the appropriate government authority if we believe that an adult patient has been the victim of abuse, neglect or domestic violence. (The Practice will only make this disclosure if the patient agrees or when required or authorized by law.)
3. Victims of Abuse, Neglect or Domestic Violence: The Practice may disclose PHI about you to a government authority, including a social service or protective services agency, authorized by law to receive reports of such abuse, neglect, or domestic if we reasonably believe you to be a victim of abuse, neglect, or domestic violence to the extent the disclosure is required by law and the disclosure complies with and is limited to the relevant requirements of such law, you agree to the disclosure; or to the extent the disclosure is expressly authorized by statute or regulation.
4. Health Oversight: The Practice may disclose PHI to a health oversight agency for audits, investigations, inspections or licensing purposes. These disclosures may be necessary for certain state and federal agencies to monitor the health care system, government programs and compliance with civil rights laws or other legal or regulatory requirements.
5. Lawsuits and Disputes: If you are involved in a lawsuit or a dispute, the Practice may disclose PHI in response to a court or administrative order. Subject to all applicable legal requirements, the Practice may also disclose PHI in response to a subpoena or other legal process.
6. Law Enforcement: The Practice may release PHI if asked to do so by a law enforcement official:
• in response to a court order, subpoena, warrant, summons or similar process;
• to identify or locate a suspect, fugitive, material witness, or missing person;
• about the victim of a crime under certain limited circumstances;
• about a death we believe may be the result of criminal conduct;
• in emergency circumstances, to report a crime, the location thereof the victims, or the identity, description or location of the • perpetrator.
7. Coroners, Medical Examiners and Funeral Directors: The Practice may release PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. The Practice may release information to a Funeral Director, consistent with applicable law, as necessary to carry out their duties with respect to the decedent.
8. Organ and Tissue Donation: If you are an organ donor, the Practice may release PHI to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate such donation and transplantation.
9. Research: The Practice may use and disclose PHI for research projects that are subject to a special approval process and the requirements of applicable law.
10. To Avert a Serious Threat to Health or Safety: Subject to applicable law, the Practice may use and disclose PHI when necessary to prevent or lessen a serious and imminent threat to your health and safety or the health and safety of the public or another person. The Practice may also use and disclose PHI if necessary for law enforcement authorities to identify or apprehend an individual.
11. Specialized Governmental Functions: In certain circumstances the Practice may be required to disclose PHI to authorized governmental agencies for national security activities or for protective services for the President or other authorized persons. If you are a member of the Armed Forces, we may release PHI as required by military command authorities. We may also release PHI about foreign military personnel to the appropriate foreign military authority.
12. Workers’ Compensation: The Practice may release PHI as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or other similar programs.
13. Disaster Recovery Efforts: When permitted by law, the Practice may coordinate uses and disclosures of protected PHI with public entities authorized by law or by charter to assist in disaster relief efforts.
14. Incidental Disclosures: Subject to applicable law, the Practice may make incidental uses and disclosures, by-products of otherwise permitted uses or disclosures which are limited in nature and cannot be reasonably prevented, of PHI.
15. Family and Friends: The Practice may disclose to your family members or friends PHI which is directly relevant to their involvement in your care or payment for your care, if the Practice obtains your verbal agreement to do so or if the Practice gives you an opportunity to object to such a disclosure and you do not raise an objection. The Practice may also disclose PHI to your family or friends if the Practice infers from the circumstances, based on professional judgment that you would not object. For example, the Practice may assume you agree to the disclosure of your PHI to your spouse when you bring your spouse with you into the exam room during treatment or while treatment is discussed.
In situations where you are not capable of giving consent (because you are not present or due to your incapacity or medical emergency), the Practice may, using professional judgment, determine that a disclosure to a family member or friend is in your best interest. In that situation, the Practice will disclose only PHI relevant to the person’s involvement in your care. The Practice may also use professional judgment and experience to make reasonable inferences that it is in your best interest to allow another person to act on your behalf to pick up your PHI or records, for example, X-rays. Additionally, the Practice may use or disclose your protected PHI to notify or assist a family member or friend responsible for your care of your location, general condition or death.
III. Other Uses and Disclosures of PHI.
The Practice will not use or disclose your PHI for any purpose other than those identified in the previous sections without your specific, written authorization. Any authorization to use or disclose PHI may be revoked at any time so long as the revocation is in writing. If you revoke your authorization, the Practice will no longer use or disclose PHI for the reasons covered by your written Authorization, except to the extent that the Practice has already used or disclosed PHI in reliance on your authorization.
IV. SPECIAL AUTHORIZATION. The Practice may not use or disclose PHI under the following circumstances without a valid authorization, and any such use or disclosure by the Practice must be consistent with such authorization.
1. HIV/Substance or Alcohol Abuse/Mental Health: The Practice may not release HIV, substance or alcohol abuse or mental health information about you without a specific written authorization in the form to be provided to you by the Practice. Upon diagnoses of HIV, substance or alcohol abuse or related to mental health, you will be required for purposes of treatment, payment and health care operations to execute an authorization that complies with the law governing such records, when required by applicable law.
2. Psychotherapy Notes: The Practice must obtain a valid authorization for any use or disclosure of psychotherapy notes, except to carry out the following treatment, payment or health care operations: (A) use by the originator of the psychotherapy notes for treatment; (B) use or disclosure by the Practice for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family or individual counseling; (C) use or disclosure by the Practice to defend itself in a legal action or other proceeding brought by the individual; (D) when required by the Secretary to investigate or determine the Practice’s compliance with HIPAA; (E) as required by law and the use or disclosure complies with and is limited to the relevant requirements of such law; (F) to a health oversight agency for oversight activities authorized by law, with respect to the oversight of the originator of the psychotherapy notes; (G) to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law; and (H) use or disclose PHI if the Practice, in good faith, believes the use or disclosure: (i) is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and (ii) is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.
3. Marketing: The Practice must obtain an authorization for any use or disclosure of PHI for marketing, except if the communication is in the form of: (A) a face-to-face communication made by a Practice to an individual; or (B) a promotional gift of nominal value provided by the Practice. If the marketing involves financial remuneration to the Practice from a third party, the authorization shall state that remuneration is involved.
4. Sale of PHI: Other than the transition provisions in 45 CFR 164.532, the Practice must obtain an authorization for any disclosure of PHI which is a sale of PHI, and such authorization must state that the disclosure will result in remuneration to the Practice, if any.
Revocation of Authorizations. You may revoke an authorization provided under this section at any time, provided that the revocation is in writing and addressed to the Privacy Officer designated below, except that no such authorization may be revoked to the extent that: (A) the Practice has taken action in reliance thereon; or (B) if the authorization was obtained as a condition of obtaining insurance coverage, other law provides the insurer with the right to contest a claim under the policy or the policy itself.
V. Fundraising Activities. The Practice may utilize your PHI to contact you in an effort to raise money for a disease specific-non profit foundation affiliated with the Practice and its operations. If you do not want the Practice to contact you for fundraising efforts, you must notify the Practice in writing.
VI. Your Rights Regarding PHI. You have the following rights regarding your PHI:
1. Right to Inspect and Copy: You have the right to inspect and copy your PHI for as long as we maintain that information. You must submit a written request in order to inspect and/or copy your PHI. If you request a copy of the information, we may charge a fee for the costs of copying as approved by state law. We may deny your request to inspect and/or copy in certain limited circumstances. In some circumstances, you may have the right to have this decision reviewed. Please contact the Practice if you have questions about access to your medical record.
2. Right to Amend: You have the right to request amendment of incorrect or incomplete PHI so long as the information is kept by this office. To request an amendment, complete and submit a Medical Record Amendment/Correction Form to this office. The Practice may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, the Practice may deny your request if:
• the Practice did not create the PHI (unless the person or entity that created the PHI is no longer available to make this
• the Practice is no longer in possession of the PHI;
• you would not be permitted to inspect and copy the record at issue; or
• is accurate and complete.
3. Right to an Accounting of Disclosures: You have the right to request an “accounting of disclosures.” This is a list of certain limited disclosures the Practice made with respect to your PHI. To obtain this list, you must submit your request in writing to this office. It must state a time period, which may not be longer than six years and may not include dates before April 14, 2003. The Practice may charge you for the costs of providing the response to your request, but you may request one free accounting per year. The Practice will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
4. Right to Request Restrictions: You have the right to request a restriction or limitation on the PHI the Practice uses or discloses for treatment, payment and health care operations. You also have the right to request a limit on the PHI the Practice discloses about you to someone who is involved in your care, such as a family member or friend. To request restrictions you must complete and submit the Request For Restriction On Use/Disclosure Of Medical Information and/or Confidential Communication Form to this office. The Practice is NOT required to agree to your request.
5. Right to Request Confidential Communications: You have the right to request (within reason) that the Practice communicate with you in a certain manner. For example, you may request that the Practice only contact you at work or on your cell phone. The Practice will make every effort to honor reasonable requests made in writing and submitted to the Practice.
6. Right to a Paper Copy of This Notice: You have the right to request a paper copy of this Policy at any time, even if you have agreed to receive the Policy electronically. To obtain such a copy please contact the Practice.
VII. NOTIFICATION OF BREACH. Should it be determined by the Practice that there is a breach of your PHI (the acquisition, access, use, or disclosure of PHI in a manner not permitted under 45 CFR 164 subpart E which compromises the security or privacy of your PHI), you will be notified in writing by the Practice no later than sixty calendar days after the discovery of the breach. If the breach involves the PHI of more than 500 individuals in any state, the Practice shall following discovery of the breach give notice of the breach to prominent media outlets in that state and will also notify the Secretary.
VIII. MODIFICATION. The Practice reserves the right to change this Policy at any time, effective for previously obtained PHI as well as future PHI. The Practice will post a copy of the current Policy in this office with the effective date. In addition, each time you register at or are seen at the Practice for treatment or health care services, the Practice will offer you a copy of the current Policy in effect.
IX. Complaints. If you believe your privacy rights have been violated, you may file a written complaint with the Practice by mailing your complaint to Premier Orthopedic Surgery and Sports Medicine, PLLC, 1800 Walt Whitman Road, Suite 120, Melville, New York 11747, Attn: Mary Maloney, Privacy Officer, or with the Secretary of the Department of Health and Human Services. This Practice maintains a non-retaliation Policy for complaints.
X. PRACTICE REQUIREMENT. The Practice is required by law to: (1) ensure all PHI is maintained in a confidential manner; (2) abide by the terms of this Policy; and (3) notify patients of the Practice’s legal duties and policies with respect to PHI.