HIPAA PRIVACY STATEMENT
THIS STATEMENT DESCRIBES HOW YOUR PROTECTED HEALTH INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THE INFORMATION THAT WE MAINTAIN. PLEASE REVIEW THIS STATEMENT CAREFULLY.
INTRODUCTION
PHC of Buffalo Grove Clinical Psychology, Professional Corporation, and its affiliated entities, operating as Portrait Health Centers® (hereafter “we” or “us”), are committed to maintaining the privacy and confidentiality of your Protected Health Information (“PHI”). PHI includes any individually identifiable information that we retain relating to your past, present or future physical or mental health, the healthcare services you have received, or payment for your healthcare. Typically, each time you visit one of our healthcare professionals, a record of your visit is added to your clinical record. Your clinical record contains a list of your session dates and payments, medications, symptoms, history, test results, diagnoses, treatment and treatment plans, as well as other information that you have authorized to have forwarded to our healthcare professionals from other professionals outside of our offices.
As required by law, this Privacy Statement provides you with information about your rights and our legal duties and privacy practices with respect to your PHI and discusses the uses and disclosures that we may or will make of your PHI. We must comply with the provisions of this Privacy Statement as currently in effect, although we reserve the right to change the terms of this Privacy Statement and our privacy practices from time to time and to issue the revised Privacy Statement effective for all PHI that we maintain. You can always access and download the most current Privacy Statement through our website at www.portraithealthcenters.com via the link set out at the end of this Privacy Statement or you can request a copy from our Privacy Officer via our Executive Offices located at 175 East Hawthorn Parkway, Suite 235, Vernon Hills, Illinois 60061.
PERMITTED USES AND DISCLOSURES OF YOUR PHI
We may use or disclose your PHI for purposes of treatment, payment and healthcare operations without your prior authorization. For each of these categories of uses and disclosures, we have provided a description and an example below; however, not every particular use or disclosure in every category will be listed.
• Treatment means the provision, coordination or management of your healthcare, including consultations between and among our healthcare providers regarding your care and referrals for additional care or consultation to our healthcare providers from outside providers, or from our healthcare providers to outside providers. For example, a therapist treating you may need to consult with another therapist in our office about your particular situation for additional perspective on a specific diagnosis or alternative treatment options in light of our diagnosis.
• Payment means those activities undertaken to obtain payment or reimbursement for our healthcare services provided to you, including billing, collections, claims management, determinations of eligibility and coverage and utilization review activities. For example, prior to providing healthcare services, we may need to provide information to your third-party payor about your condition to determine whether the proposed course of treatment will be covered. When we subsequently bill the third-party payor for the services rendered to you, we can provide the third-party payor with information regarding your care if necessary to obtain payment. Federal or state law may require us to obtain a written release from you prior to disclosing certain PHI for payment purposes, and we will ask you to sign a release when necessary under applicable law.
• Healthcare operations encompass the support functions of our practice related to treatment and payment, such as quality assurance activities, case management, receiving and responding to patient comments and complaints, provider reviews, compliance programs, audits, business planning, development, management and administrative activities. For example, we may use your PHI to evaluate the performance of our staff when caring for you. We may also combine health information about many patients to decide what additional services we should offer, what services are not needed, and whether certain new treatments are effective. In addition, we may remove information that identifies you from your patient information so that others can use the de-identified information to study healthcare and healthcare delivery without learning who you are.
• Business Associates are third parties with which we may contract to perform certain services for us, such as billing and collection services, management services or consulting services. These third-party service providers, referred to as Business Associates, may need access to your PHI in order to perform their services for us. They are required by contract and by law to protect your PHI and only use and disclose it as necessary to perform their services for us.
OTHER USES AND DISCLOSURES OF PHI
In addition to using and disclosing your information for treatment, payment and healthcare operations as described above, we may use your PHI in the following ways:
• We may contact you to provide appointment reminders for treatment or follow-up care.
• We may contact you to tell you about or recommend possible treatment alternatives or other health-related benefits and services that may be of interest to you.
• We may disclose your PHI to your family or friends or any other individual identified by you that is directly relevant to that person’s involvement with your care or payment for your care. We may disclose your PHI to your “personal representative.” If a person has authority by law to make healthcare decisions for you, we will generally consider that person as your “personal representative” and will treat that person the same way as we would treat you with respect to your PHI.
• We may use or disclose your PHI in order to notify, or assist in the notification of, a family member, a personal representative, or another person responsible for your care, of your location or general condition. If you are present or otherwise available, we will give you an opportunity to object to these disclosures, and we will not make these disclosures if you object. If you are not present or otherwise available, we will determine whether a disclosure to your family or friends is in your best interest, taking into account the circumstances and based upon our professional judgment.
• We may contact you as part of our efforts to market our services or to provide you with information about our fundraising programs, all as permitted by applicable law. You have the right to “opt out” of receiving these communications and the materials that you receive will explain how you may opt out of future communications if you do not want us to contact you for marketing or fundraising purposes.
• Subject to applicable law, we may make incidental uses and disclosures of your PHI. Incidental uses and disclosures are by-products of otherwise permitted uses or disclosures which are limited in nature and cannot be reasonably prevented.
• Applicable Law. We may use or disclose your PHI when required to do so by applicable federal, state or local law.
• Research. We may use or disclose your PHI for research purposes, subject to the requirements of applicable law. For example, a research project may involve comparisons of the health and recovery of all patients who received a particular medication. All research projects are subject to a special approval process which balances research needs with a patient’s need for privacy. When required, we will obtain a written authorization from you prior to using your health information for research.
• Military and Veterans. If you are a member of the Armed Forces, we may disclose your PHI as required by military command authorities. We may also disclose PHI about foreign military personnel to the appropriate foreign military authority.
• Worker’s Compensation. To the extent required by law, we may disclose your PHI to worker’s compensation programs or other similar programs established by law.
• Public Health Activities. We may disclose your PHI to public health or legal authorities charged with preventing or controlling disease, injury or disability, including the U.S. Food & Drug Administration, and as required or authorized by law. In certain circumstances, we may also report work-related injuries or illnesses to employers for workplace safety purposes.
• Health Oversight Activities. We may disclose your PHI to federal or state agencies that oversee our activities. These activities are necessary for the government to monitor or audit the healthcare system, government benefit programs, and compliance with civil rights laws or regulatory program standards.
• Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose your PHI in response to a court or administrative order. We may also disclose your PHI in response to a subpoena, discovery request or other lawful process by someone else involved in the dispute, but only if we are given assurances that efforts have been made by the person making the request to tell you about the request or to obtain an order protecting the information requested.
• Law Enforcement. We may disclose your PHI to law enforcement officials as required or permitted by law – for example, in response to a subpoena or court order, in response to a request from law enforcement, and to report limited information in certain circumstances.
• Coroners, Medical Examiners and Funeral Directors. We may disclose your PHI to a coroner or medical examiner so that person may carry out his/her assigned legal duties. Any such disclosure may be necessary, for example, to identify a deceased person or determine the cause of death. We may also disclose PHI about our patients to funeral directors, consistent with applicable law, as necessary for them to carry out their duties.
• Disaster Relief. When permitted by law, we may coordinate our uses and disclosures of your PHI with public or private entities authorized by law or by charter to assist in disaster relief efforts.
• National Security/Intelligence Activities. We may disclose your PHI to authorized federal officials for intelligence, counterintelligence, or other national security activities authorized by law.
• Inmates. If you are or become incarcerated in a correctional institution or are under the custody of a law enforcement official, we may disclose your PHI to the correctional institution or law enforcement official. This disclosure would be necessary (1) for the institution to provide you with healthcare; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
• Serious Threats. As permitted by applicable law and standards of ethical conduct, we may use and disclose your PHI if we, in good faith, believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of the public or third person, including that of the President of the United States.
Note: HIV-related information, genetic information, alcohol and/or substance abuse records, mental health records and other specially protected health information may enjoy certain special confidentiality protections under applicable state and federal law. Any disclosures of these types of records will be subject to these special protections.
OTHER USES OF YOUR PHI
Other uses and disclosures of your PHI not covered by this Statement or the laws that apply to us will be made only with your permission in a written authorization. You have the right to revoke that authorization at any time, provided that the revocation is in writing, except to the extent that we already have taken action in reliance on your authorization.
YOUR HEALTH INFORMATION RIGHTS
1. You have the right to request additional restrictions on our uses and disclosures of your PHI for treatment, payment and healthcare operations. To request a restriction, you must make your request in writing to our Privacy Officer. We are not required to agree with your request, except in the case where the disclosure is to a health plan for purposes of carrying out payment or healthcare operations, is not otherwise required by law, and the PHI pertains solely to a healthcare item or service for which you, or a person on your behalf, has paid in full.
2. You have the right to reasonably request that we communicate with you about healthcare matters in a certain way or at a certain location. For example, you may request that we contact you at a different residence or post office box or via e-mail or other electronic means. Please note that, if you choose to receive communications from us via e-mail or other electronic means, those means may not be secure and your PHI that may be contained in those communications will not be encrypted. This means that there is a risk that our communications may be intercepted and read by, or disclosed to, unauthorized third parties. To make such a request, you must submit your request in writing to our Privacy Officer. Your request must tell us how or where you would like to be contacted. We will accommodate all reasonable requests. However, if we are unable to contact you using the ways or locations that you have requested, we may contact you using the information that we have on file.
3. With certain exceptions, you have the right to access and obtain a copy of the PHI that we maintain about you. If we maintain electronic health records containing your PHI, you have the right to request that you receive those records in an electronic format. To inspect and copy your PHI, you must send a request to us using the link provided on the “Contact Us” page on our website: www.portraithealthcenters.com. You may ask that we send a copy of your PHI to other individuals or entities that you designate. We may deny your request to inspect and copy your PHI in certain limited circumstances. If you are denied access to your PHI, you may request that the denial be reviewed. We reserve the right to charge for copies of your PHI that are provided and for the other expense incurred in responding to a request for copies, consistent with applicable law.
4. You have the right to request that your PHI be amended if you believe that it is incomplete or incorrect. To request an amendment, you must send a written request to our Privacy Officer, including a statement of the reason(s) supporting your request. If we deny your request for an amendment to your PHI, we will provide you a written explanation as to why your request was denied. Any agreed-upon amendment will be included as an addition to, and not a replacement of, already existing records.
5. With certain exceptions, you have the right to receive an accounting of our disclosures of your PHI to individuals or entities other than to you for the six years prior to your request. To request an accounting of disclosures of your PHI as provided, you must submit your request in writing to our Privacy Officer. Your request must state a specific time period for the accounting (e.g., the past three months). The first accounting you request within a twelve (12) month period will be free. For additional accountings, we may charge you for the costs of providing the list. We will notify you of the costs involved, and you may choose to withdraw or modify your request at that time before any costs are incurred.
6. You have the right to be notified following any breach of your unsecured PHI, and we will notify you in accordance with applicable law.
COMPLAINTS
If you believe that your privacy rights have been violated, you should immediately contact our Privacy Officer. We will not take action against you for filing a complaint. You also may file a complaint with the Secretary of Health and Human Services.
CONTACT INFORMATION
If you have any questions or would like further information about this Privacy Statement or about our privacy practices, please contact our Privacy Officer at our Executive Offices, 175 East Hawthorn Parkway, Suite 235, Vernon Hills, Illinois 60061, or by calling 847-868-3435.
The Effective Date of this updated HIPAA Privacy Statement is November 23, 2016.
THIS STATEMENT DESCRIBES HOW YOUR PROTECTED HEALTH INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THE INFORMATION THAT WE MAINTAIN. PLEASE REVIEW THIS STATEMENT CAREFULLY.
INTRODUCTION
PHC of Buffalo Grove Clinical Psychology, Professional Corporation, and its affiliated entities, operating as Portrait Health Centers® (hereafter “we” or “us”), are committed to maintaining the privacy and confidentiality of your Protected Health Information (“PHI”). PHI includes any individually identifiable information that we retain relating to your past, present or future physical or mental health, the healthcare services you have received, or payment for your healthcare. Typically, each time you visit one of our healthcare professionals, a record of your visit is added to your clinical record. Your clinical record contains a list of your session dates and payments, medications, symptoms, history, test results, diagnoses, treatment and treatment plans, as well as other information that you have authorized to have forwarded to our healthcare professionals from other professionals outside of our offices.
As required by law, this Privacy Statement provides you with information about your rights and our legal duties and privacy practices with respect to your PHI and discusses the uses and disclosures that we may or will make of your PHI. We must comply with the provisions of this Privacy Statement as currently in effect, although we reserve the right to change the terms of this Privacy Statement and our privacy practices from time to time and to issue the revised Privacy Statement effective for all PHI that we maintain. You can always access and download the most current Privacy Statement through our website at www.portraithealthcenters.com via the link set out at the end of this Privacy Statement or you can request a copy from our Privacy Officer via our Executive Offices located at 175 East Hawthorn Parkway, Suite 235, Vernon Hills, Illinois 60061.
PERMITTED USES AND DISCLOSURES OF YOUR PHI
We may use or disclose your PHI for purposes of treatment, payment and healthcare operations without your prior authorization. For each of these categories of uses and disclosures, we have provided a description and an example below; however, not every particular use or disclosure in every category will be listed.
• Treatment means the provision, coordination or management of your healthcare, including consultations between and among our healthcare providers regarding your care and referrals for additional care or consultation to our healthcare providers from outside providers, or from our healthcare providers to outside providers. For example, a therapist treating you may need to consult with another therapist in our office about your particular situation for additional perspective on a specific diagnosis or alternative treatment options in light of our diagnosis.
• Payment means those activities undertaken to obtain payment or reimbursement for our healthcare services provided to you, including billing, collections, claims management, determinations of eligibility and coverage and utilization review activities. For example, prior to providing healthcare services, we may need to provide information to your third-party payor about your condition to determine whether the proposed course of treatment will be covered. When we subsequently bill the third-party payor for the services rendered to you, we can provide the third-party payor with information regarding your care if necessary to obtain payment. Federal or state law may require us to obtain a written release from you prior to disclosing certain PHI for payment purposes, and we will ask you to sign a release when necessary under applicable law.
• Healthcare operations encompass the support functions of our practice related to treatment and payment, such as quality assurance activities, case management, receiving and responding to patient comments and complaints, provider reviews, compliance programs, audits, business planning, development, management and administrative activities. For example, we may use your PHI to evaluate the performance of our staff when caring for you. We may also combine health information about many patients to decide what additional services we should offer, what services are not needed, and whether certain new treatments are effective. In addition, we may remove information that identifies you from your patient information so that others can use the de-identified information to study healthcare and healthcare delivery without learning who you are.
• Business Associates are third parties with which we may contract to perform certain services for us, such as billing and collection services, management services or consulting services. These third-party service providers, referred to as Business Associates, may need access to your PHI in order to perform their services for us. They are required by contract and by law to protect your PHI and only use and disclose it as necessary to perform their services for us.
OTHER USES AND DISCLOSURES OF PHI
In addition to using and disclosing your information for treatment, payment and healthcare operations as described above, we may use your PHI in the following ways:
• We may contact you to provide appointment reminders for treatment or follow-up care.
• We may contact you to tell you about or recommend possible treatment alternatives or other health-related benefits and services that may be of interest to you.
• We may disclose your PHI to your family or friends or any other individual identified by you that is directly relevant to that person’s involvement with your care or payment for your care. We may disclose your PHI to your “personal representative.” If a person has authority by law to make healthcare decisions for you, we will generally consider that person as your “personal representative” and will treat that person the same way as we would treat you with respect to your PHI.
• We may use or disclose your PHI in order to notify, or assist in the notification of, a family member, a personal representative, or another person responsible for your care, of your location or general condition. If you are present or otherwise available, we will give you an opportunity to object to these disclosures, and we will not make these disclosures if you object. If you are not present or otherwise available, we will determine whether a disclosure to your family or friends is in your best interest, taking into account the circumstances and based upon our professional judgment.
• We may contact you as part of our efforts to market our services or to provide you with information about our fundraising programs, all as permitted by applicable law. You have the right to “opt out” of receiving these communications and the materials that you receive will explain how you may opt out of future communications if you do not want us to contact you for marketing or fundraising purposes.
• Subject to applicable law, we may make incidental uses and disclosures of your PHI. Incidental uses and disclosures are by-products of otherwise permitted uses or disclosures which are limited in nature and cannot be reasonably prevented.
• Applicable Law. We may use or disclose your PHI when required to do so by applicable federal, state or local law.
• Research. We may use or disclose your PHI for research purposes, subject to the requirements of applicable law. For example, a research project may involve comparisons of the health and recovery of all patients who received a particular medication. All research projects are subject to a special approval process which balances research needs with a patient’s need for privacy. When required, we will obtain a written authorization from you prior to using your health information for research.
• Military and Veterans. If you are a member of the Armed Forces, we may disclose your PHI as required by military command authorities. We may also disclose PHI about foreign military personnel to the appropriate foreign military authority.
• Worker’s Compensation. To the extent required by law, we may disclose your PHI to worker’s compensation programs or other similar programs established by law.
• Public Health Activities. We may disclose your PHI to public health or legal authorities charged with preventing or controlling disease, injury or disability, including the U.S. Food & Drug Administration, and as required or authorized by law. In certain circumstances, we may also report work-related injuries or illnesses to employers for workplace safety purposes.
• Health Oversight Activities. We may disclose your PHI to federal or state agencies that oversee our activities. These activities are necessary for the government to monitor or audit the healthcare system, government benefit programs, and compliance with civil rights laws or regulatory program standards.
• Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose your PHI in response to a court or administrative order. We may also disclose your PHI in response to a subpoena, discovery request or other lawful process by someone else involved in the dispute, but only if we are given assurances that efforts have been made by the person making the request to tell you about the request or to obtain an order protecting the information requested.
• Law Enforcement. We may disclose your PHI to law enforcement officials as required or permitted by law – for example, in response to a subpoena or court order, in response to a request from law enforcement, and to report limited information in certain circumstances.
• Coroners, Medical Examiners and Funeral Directors. We may disclose your PHI to a coroner or medical examiner so that person may carry out his/her assigned legal duties. Any such disclosure may be necessary, for example, to identify a deceased person or determine the cause of death. We may also disclose PHI about our patients to funeral directors, consistent with applicable law, as necessary for them to carry out their duties.
• Disaster Relief. When permitted by law, we may coordinate our uses and disclosures of your PHI with public or private entities authorized by law or by charter to assist in disaster relief efforts.
• National Security/Intelligence Activities. We may disclose your PHI to authorized federal officials for intelligence, counterintelligence, or other national security activities authorized by law.
• Inmates. If you are or become incarcerated in a correctional institution or are under the custody of a law enforcement official, we may disclose your PHI to the correctional institution or law enforcement official. This disclosure would be necessary (1) for the institution to provide you with healthcare; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
• Serious Threats. As permitted by applicable law and standards of ethical conduct, we may use and disclose your PHI if we, in good faith, believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of the public or third person, including that of the President of the United States.
Note: HIV-related information, genetic information, alcohol and/or substance abuse records, mental health records and other specially protected health information may enjoy certain special confidentiality protections under applicable state and federal law. Any disclosures of these types of records will be subject to these special protections.
OTHER USES OF YOUR PHI
Other uses and disclosures of your PHI not covered by this Statement or the laws that apply to us will be made only with your permission in a written authorization. You have the right to revoke that authorization at any time, provided that the revocation is in writing, except to the extent that we already have taken action in reliance on your authorization.
YOUR HEALTH INFORMATION RIGHTS
1. You have the right to request additional restrictions on our uses and disclosures of your PHI for treatment, payment and healthcare operations. To request a restriction, you must make your request in writing to our Privacy Officer. We are not required to agree with your request, except in the case where the disclosure is to a health plan for purposes of carrying out payment or healthcare operations, is not otherwise required by law, and the PHI pertains solely to a healthcare item or service for which you, or a person on your behalf, has paid in full.
2. You have the right to reasonably request that we communicate with you about healthcare matters in a certain way or at a certain location. For example, you may request that we contact you at a different residence or post office box or via e-mail or other electronic means. Please note that, if you choose to receive communications from us via e-mail or other electronic means, those means may not be secure and your PHI that may be contained in those communications will not be encrypted. This means that there is a risk that our communications may be intercepted and read by, or disclosed to, unauthorized third parties. To make such a request, you must submit your request in writing to our Privacy Officer. Your request must tell us how or where you would like to be contacted. We will accommodate all reasonable requests. However, if we are unable to contact you using the ways or locations that you have requested, we may contact you using the information that we have on file.
3. With certain exceptions, you have the right to access and obtain a copy of the PHI that we maintain about you. If we maintain electronic health records containing your PHI, you have the right to request that you receive those records in an electronic format. To inspect and copy your PHI, you must send a request to us using the link provided on the “Contact Us” page on our website: www.portraithealthcenters.com. You may ask that we send a copy of your PHI to other individuals or entities that you designate. We may deny your request to inspect and copy your PHI in certain limited circumstances. If you are denied access to your PHI, you may request that the denial be reviewed. We reserve the right to charge for copies of your PHI that are provided and for the other expense incurred in responding to a request for copies, consistent with applicable law.
4. You have the right to request that your PHI be amended if you believe that it is incomplete or incorrect. To request an amendment, you must send a written request to our Privacy Officer, including a statement of the reason(s) supporting your request. If we deny your request for an amendment to your PHI, we will provide you a written explanation as to why your request was denied. Any agreed-upon amendment will be included as an addition to, and not a replacement of, already existing records.
5. With certain exceptions, you have the right to receive an accounting of our disclosures of your PHI to individuals or entities other than to you for the six years prior to your request. To request an accounting of disclosures of your PHI as provided, you must submit your request in writing to our Privacy Officer. Your request must state a specific time period for the accounting (e.g., the past three months). The first accounting you request within a twelve (12) month period will be free. For additional accountings, we may charge you for the costs of providing the list. We will notify you of the costs involved, and you may choose to withdraw or modify your request at that time before any costs are incurred.
6. You have the right to be notified following any breach of your unsecured PHI, and we will notify you in accordance with applicable law.
COMPLAINTS
If you believe that your privacy rights have been violated, you should immediately contact our Privacy Officer. We will not take action against you for filing a complaint. You also may file a complaint with the Secretary of Health and Human Services.
CONTACT INFORMATION
If you have any questions or would like further information about this Privacy Statement or about our privacy practices, please contact our Privacy Officer at our Executive Offices, 175 East Hawthorn Parkway, Suite 235, Vernon Hills, Illinois 60061, or by calling 847-868-3435.
The Effective Date of this updated HIPAA Privacy Statement is November 23, 2016.
| HIPAA PRIVACY STATEMENT |