Privacy Officer: Donovan B.
Revision Date: June 21, 2007
Effective Date: April 12, 2003
Notice of Privacy Rights as required by the Health Insurance Portability and Accountability Act.
This Notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully. If you have any questions about this Notice, please contact our Privacy Officer (312-255-9444 fax 312-255-9446).
If s/he is unavailable, you may fill out the question/complaint form located at the front desk.
This office maintains various procedures to do the most possible to protect the confidentiality of protected health information. This practice is required by law to maintain the privacy of that information and to abide by the terms of this Notice. This is a summary of our policies, our responsibilities, and patient rights, according to this act. The responsibilities listed in this Notice apply to any healthcare provider authorized to enter information into patient medical records, and all employees and staff at this practice who may need access to this information. Further, all subsidiaries, business associates (e.g. collections services), sites, and locations of this practice (i.e. our Chicago office) may share medical information for treatment, payment purposes, or health care operations described in this Notice and must abide by this Notice.
healthWorks, IMC, SC, may use and disclose protected health information to carry out treatment, payment, and healthcare operations. This includes, but is not limited to:
- appointment reminder calls to a patient’s home or work
- contacting insurance companies regarding payment for services
- mailing account statements to a patient’s home or calling about past-due balances
- filling and mailing Natural Dispensary orders
- mailing laboratory results and medical records to the home address listed in a patient’s file
- contacting a patient’s primary care doctor or specialists regarding a patient’s clinical care
- assisting a patient’s specialist with their treatment, payment, or healthcare operations
- calling and faxing prescription authorization to a patient’s pharmacist
- notifying patients of new advances in treatment procedures that may be of benefit
- discussing a patient’s condition with other healthWorks, IMC providers to coordinate treatment plans
In every circumstance, except where treatment is involved, our staff will only share the minimum information necessary to perform the required task.
Further, healthWorks, IMC does not release patient information without consent. Our “blanket” consent applies to the type of procedures itemized above. Specifically, it also applies to releasing copies of treatment notes to insurance companies to acquire payment. It is our policy to take the additional step of calling patients to notify them when this type of disclosure is occurring.
Certain disclosures, however, are required by law. Therefore, they do not require a written release. We do, however, notify patients of these releases (when appropriate) and keep a record of these releases:
- as required during a compliance investigation by the Secretary of Health and Human Services
- in response to a subpoena or legal proceeding or during an investigation by law enforcement agencies
- as required by the US Food and Drug Administration (especially in the event of a product recall)
- as required by military command authorities for their medical records
- if an inmate, to the correctional institution or law enforcement official
- to workers’ compensation or similar programs for processing claims
- to a coroner or medical examiner for the identification of a body
- uses and disclosures in domestic violence or neglect situations
- to investigate potential misuse of controlled substances
- to avert a serious threat to public health or safety
- uses and disclosures for any other public health or health oversight activities or as required by law
Right to an Accounting: Patients have the right to request a list of these non-standard disclosures of protected health information that were not authorized by the patient. A request for this list must be submitted in writing to our Privacy Officer. The request must state the time period for which the disclosures should be accounted. This time period can be no longer than six years, and may not include dates before April 12, 2003. The first list requested within a 12-month period will be free. For additional lists, we reserve the right to charge patients for the cost of providing the list.
Though allowed by law under certain circumstances, healthWorks, IMC does not participate in any marketing ventures that involve selling patient information to any third parties.
To help us protect health information, we will maintain a copy of patients’ driver’s licenses or state identification cards with a signature. We use this to identify patients that come in to retrieve records and to verify signatures on releases. If we receive a telephone request to release medical information, we will ask certain questions (such as Social Security number or date of birth) to verify the patient identity.
Uses and Disclosures Requiring the Patient’s Written Authorization
Any disclosures not covered here, or by other laws that apply, may only be made with written consent.
Right to Revoke: If a patient gives us the authorization to use or disclose medical information, the patient may revoke that authorization, in writing, at any time. If the patient revokes authorization, we will thereafter no longer use or disclose that medical information for the purposes covered by that written authorization. It must be understood that we are unable to take back any disclosures we have already made with that authorization and that we are required to retain our records of the care we have provided to our patients.
Exclusion for Psychotherapy Treatments
For patients receiving mental health treatment, we are required to obtain written authorization for every release of psychotherapy notes, except for use in our legal defense, or as required by law.
Other Patient Rights Set Forth In This Act:
Right to Inspect and Copy: Patients have the right to inspect and have a copy of their medical records. This includes medical and billing records but does not include psychotherapy notes, information compiled for use in a civil, criminal, or administrative action or proceeding, and protected health information to which access is prohibited by law. If patients are denied access to medical information, they may request that the denial be reviewed. Another licensed healthcare professional, chosen by this practice, will review the request and the denial. We will comply with the outcome of the review.
healthWorks, IMC is required to fulfill copy requests within 30 days for records kept on site. Older records kept off-site may take up to 60 days to retrieve. Records may be obtained by sending a written request to healthWorks, IMC. We reserve the right to charge a fee for the costs of copying.
Right to Amend: If patients feel that medical information we have about them is incorrect or incomplete, they may ask us to amend the information. The request to amend must be made in writing and submitted to our Privacy Officer. In addition, a reason that supports the request to amend must be provided. We may deny the request if it is not in writing or does not include a reason to support the request. In addition, we may deny the request if the information was not created by us, is not part of the medical information kept at this practice, is not part of the information which would be permitted to be inspected by the patient, or if we deem the amendment to be inaccurate or incomplete. If we deny the request for amendment, patients have the right to file a statement of disagreement with us. We may prepare a rebuttal to the statement and will provide a copy of any such rebuttal. These statements will be kept on file and sent out with any future authorized requests for information pertaining to the appropriate portion of the patient’s record.
Right to Request Restrictions: Patients have the right to request a restriction or limitation on the medical information we use or disclose for treatment, payment, or health care operations, or to someone who is involved in the patient’s care or the payment for that care. Due to certain required payment and treatment operations, as well as legally required releases (e.g. subpoenas) not all requests can be fulfilled. If we do agree, we will comply with the request unless the information is needed to provide emergency treatment. To request restrictions, the request must be submitted in writing to our Privacy Officer. The request must list what protected health information to limit and to whom. healthWorks, IMC is required to inform patients of the consequences whenever they refuse to release protected health information.
Right to Request Confidential Communications: Patients have the right to request how we should send communications to them about medical matters, and where they would like those communications sent. The request must be submitted in writing to our Privacy Officer. We will not ask for the reason for the request. We will accommodate all reasonable requests. The request must specify how or where the patient should be contacted. We reserve the right to deny a request if it imposes an unreasonable burden on the practice.
Complaints: If patients believe that their privacy rights have been violated, they may file a complaint with our Privacy Officer or with the Secretary of the Department of Health and Human Services. All complaints must be submitted in writing. We have complaint forms available to assist you. Patients will not be penalized or discriminated against for filing a complaint.
Right to a Paper Copy: Even if they received this Notice electronically, patients are still entitled to a paper copy of the current Notice. Copies are available at the front desk, or by writing to the Privacy Officer.
healthWorks, IMC reserves the right to revise its Notice of Privacy Practices at any time, within the parameters of HIPAA. A revised Notice may be requested, in writing, from our Privacy Officer.