Changes to Privacy Policies Rule
We reserve the right to change our privacy practices (by changing the terms of this Notice) at any time as authorized by law. The changes will be effective immediately upon us making them. They will apply to all PHI we create or receive in the future, as well as to all PHI created or received by us in the past (i.e. to PHI about you that we had before the changes took effect). If we make changes, we will post the changed Notice, along with its effective date, in our office and on our website. Also, upon request, you will be given a copy of our current Notice.
We will not use or disclose your PHI for any purpose or to any person other than as stated in the rules above without your signature on our specifically worded, written Authorization / Acknowledgement Form (not a Consent or an Acknowledgement). If we need your Authorization, we must obtain it via a specific Authorization Form, which may be separate from any Authorization / Acknowledgement we may have obtained from you. We will not condition your treatment here on whether you sign the Authorization (or not).
Marketing and Fund Raising Rules
Limitations on the disclosure of PHI regarding Remuneration
The disclosure or sale of your PHI without authorization is prohibited. Under the new HIPAA Omnibus Rule, this would exclude disclosures for public health purposes, for treatment / payment for healthcare, for the sale, transfer, merger, or consolidation of all or part of this facility and for related due diligence, to any of our Business Associates, in connection with the business associate's performance of activities for this facility, to a patient or beneficiary upon request, and as required by law. In addition, the disclosure of your PHI for research purposes or for any other purpose permitted by HIPAA will not be considered a prohibited disclosure if the only reimbursement received is “a reasonable, cost-based fee” to cover the cost to prepare and transmit your PHI which would be expressly permitted by law. Notably, under the Omnibus Rule, an authorization to disclose PHI must state that the disclosure will result in remuneration to the Covered Entity. Notwithstanding the changes in the Omnibus Rule, the disclosure of limited data sets (a form of PHI with a number of identifiers removed in accordance with specific HIPAA requirements) for remuneration pursuant to existing agreements is permissible until September 22, 2014, so long as the agreement is not modified within one year before that date.
Limitation on the Use of PHI for Paid Marketing
We will, in accordance with Federal and State Laws, obtain your written authorization to use or disclose your PHI for marketing purposes, (i.e.: to use your photo in ads) but not for activities that constitute treatment or healthcare operations. To clarify, Marketing is defined by HIPAA’s Omnibus Rule, as "a communication about a product or service that encourages recipients . . . to purchase or use the product or service." Under the Omnibus Rule, we will obtain a written authorization from you prior to recommending you to an alternative therapist, or non-associated Healthcare Covered Entity.
Under Omnibus Rule we will obtain your written authorization prior to using your PHI or making any treatment or healthcare recommendations, should financial remuneration for making the communication be involved from a third party whose product or service we might promote (i.e.: businesses offering this facility incentives to promote their products or services to you). This will also apply to our Business Associate who may receive such remuneration for making a treatment or healthcare recommendations to you. All such recommendations will be limited without your expressed written permission.
We must clarify to you that financial remuneration does not include “as in-kind payments” and payments for a purpose to implement a disease management program. Any promotional gifts of nominal value are not subject to the authorization requirement, and we will abide by the set terms of the law to accept or reject these.
The only exclusion to this would include: "refill reminders", so long as the remuneration for making such a communication is "reasonably related to our cost" for making such a communication. In accordance with law, this facility and our Business Associates will only ever seek reimbursement from you for permissible costs that include: labor, supplies, and postage. Please note that “generic equivalents” , “adherence to take medication as directed” and “self-administered drug or delivery system communications” are all considered to be "refill reminders."
Face-to-face marketing communications, such as sharing with you, a written product brochure or pamphlet, is permissible under current HIPAA Law.
Flexibility on the Use of PHI for Fundraising
Under the HIPAA Omnibus Rule use of PHI is more flexible and does not require your authorization should we choose to include you in any fund raising efforts attempted at this facility? However, we will offer the opportunity for you to “opt out” of receiving future fundraising communications. Simply let us know that you want to “opt out” of such situations. There will be a statement on your HIPAA Patient Acknowledgement Form where you can choose to “opt out”. Our commitment to care and treat you will in no way effect your decision to participate or not participate in our fund raising efforts.
Improvements to Requirements for Authorizations Related to Research
Under HIPAA Omnibus Rule, we may seek authorizations from you for the use of your PHI for future research. However, we would have to make clear what those uses are in detail.
Also, if we request of you a compound authorization with regards to research, this facility would clarify that when a compound authorization is used, and research-related treatment is conditioned upon your authorization, the compound authorization will differentiate between the conditioned and unconditioned components.
YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION
If you got this Notice via email or website, you have the right to get, at any time, a paper copy by asking our Privacy Officer. Also, you have the following additional rights regarding PHI we maintain about you:
To Inspect and Copy
You have the right to see and get a copy of your PHI including, but not limited to, medical and billing records by submitting a written request to our Privacy Officer. Original records will not leave the premises, will be available for inspection only during our regular business hours, and only if our Privacy Officer is present at all times. You may ask us to give you the copies in a format other than photocopies (and we will do so unless we determine that it is impractical) or ask us to prepare a summary in lieu of the copies. We may charge you a fee not to exceed state law to recover our costs (including postage, supplies, and staff time as applicable, but excluding staff time for search and retrieval) to duplicate or summarize your PHI. We will not condition release of the copies on summary of payment of your outstanding balance for professional services if you have one). We will comply with Federal Law to provide your PHI in an electronic format within the 30 days, to Federal specification, when you provide us with proper written request. Paper copy will also be made available. We will respond to requests in a timely manner, without delay for legal review, or, in less than thirty days if submitted in writing, and in ten business days or less if malpractice litigation or pre-suit production is involved. We may deny your request in certain limited circumstances (i.e. we do not have the PHI, it came from a confidential source, etc.). If we deny your request, you may ask for a review of that decision. If required by law, we will select a licensed health-care professional (other than the person who denied your request initially) to review the denial and we will follow his or her decision. If we select a licensed healthcare professional who is not affiliated with us, we will ensure a Business Associate Agreement is executed that prevents re-disclosure of your PHI without your consent by that outside professional.