KENTUCKIANA ALLERGY, P.S.C.
HIPAA PRIVACY NOTICE – LONG FORM 2013
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
USES AND DISCLOSURES
Kentuckiana Allergy, P.S.C. (“KA”) is permitted to use and disclose your private and confidential health information for treatment, payment and health care operations of KA. For example, KA may disclose your protected health information to other physicians to facilitate treatment, and KA may use health information about you so that KA may bill and collect payment from an insurance company, health plan, or other third party payor. KA may discuss your health information to review treatment and services to evaluate performance of KA staff and other management and administrative purposes [provide at least one example of types of uses and disclosures]. In addition, KA may use or disclose your protected health information which is incident to a permitted use or disclosure. “Protected health information” is information about you that may identify you and relates to your past, present, or future physical or mental health or condition and related health services.
Treatment. KA will use and disclose your protected health information to provide, coordinate, and manage your health care and related services. KA may disclose information to other treating physicians, medical practices, and laboratory (blood/urine tests), for their services.
Payment. Your health information will also be used and disclosed to obtain payment for your health care services. This means information will be disclosed to your health insurance plan or benefit program responsible for providing your health care coverage. KA will forward information for purposes of determining eligibility or coverage, medical necessity, and undertaking litigation review activities. KA may also use your health information to bill you directly, or a family member, for health care services and items.
Health Care Operations. Your information will be used and disclosed, as needed, to support the business activities and health care operations of KA. Such activities include, but are not limited to, quality assessment and improvement activities, outcomes evaluation, practitioner and provider performance evaluation, and business planning and development.
Business Associates. KA will share and disclose your health information with third party “business associates” (and their subcontractors) which perform various activities on behalf of KA (for example, billing, collections, and network and software servicing). KA will implement a written contract with any such third party which will contain terms that will protect the privacy of your health information.
The following is a description of other purposes for which KA is permitted or required to use or disclose your protected health information without your written authorization; this is not a complete list of all possible disclosures.
Uses and disclosures requiring an opportunity for you to agree or object:
KA may use and disclose your health information in the following instances. In each of these examples, you have the opportunity to agree to or prohibit or restrict the use or disclosure. If you are not present or able to agree or object to the use or disclosure, KA may determine whether the disclosure is in your best interest. Emergency disclosures may also be made %u2011%u2011 due to your incapacity or emergency treatment situation %u2011%u2011 if disclosure is consistent with your prior expressed preference and in your best interest as determined by KA.
Facilities Directory: Unless you object, KA will use and disclose certain of your health information to maintain a directory of patients.
Family Members: Unless you object, KA will disclose your health information to a family member, other relative, close friend, or other person you identify; such information disclosed will be directly relevant to such person’s involvement with your health care. If you are unable or unavailable to agree or object, KA may disclose information as necessary if KA determines it is in your best interest. KA may use or disclose information to notify, or assist in the notification of (including identifying or locating), a family member, your personal representative or other responsible person for your care, your address or phone number, general condition, or death.
Disclosures made without your authorization or consent:
KA may use or disclose your protected health information in the following situations without your consent, authorization or your opportunity to object:
- For use or disclosure by KA for its own training programs.
- For use or disclosure by KA to defend itself in a legal action or other proceeding brought by you.
- Uses or disclosures required by law as long as use or disclosure complies with and is limited to relevant requirements of law.
- For public health activities, such as disclosures to:
- public health authorities to prevent or control disease, injury or disability, and for public health surveillance, including immunization information to schools;
- public health authorities to report child abuse or neglect;
- to persons exposed to a communicable disease or at risk of contacting or spreading a disease or condition, if KA is authorized by law to notify such person;
- your employer, if:
- KA provides health care to you at employer’s request to conduct an evaluation relating to medical surveillance of the workplace or to evaluate whether you have a work-related illness or injury;
- disclosure consists of findings concerning a work-related illness or injury or a workplace-related medical surveillance;
- the employer needs such findings to comply with its obligations under federal regulations relating to OSHA and reporting workplace injuries or under state law having a similar purpose, to record such illness or injury or to carry out responsibilities for workplace medical surveillance; and
- KA provides written notice to you that such information is disclosed to your employer.
- To a government authority, including social service or protective service agencies, to receive reports of abuse, neglect or domestic violence.
- To a health oversight agency for oversight activities authorized by law, including audits, civil, administrative, or criminal investigations, licensure or disciplinary actions.
- In the course of any judicial or administrative proceeding in response to a court order, discovery request or other lawful process.
- For law enforcement purposes to a law enforcement official, for example,
- pursuant to process and as otherwise required by law
- for locating a suspect, fugitive, material witness, or missing person
- for someone who is or is suspected to be a victim of a crime
- in response to a medical emergency in connection with a crime
- in response to a warrant, summons, court order, or subpoena
- To a coroner or medical examiner for identifying a deceased person, determining a cause of death, or other duties as authorized by law.
- To organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes or tissue.
- To researchers, provided that their research has been approved by an institutional review board and certain other privacy requirements are met.
- For uses or disclosures necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, including disclosure to a person(s) reasonably able to prevent or lessen the threat or as necessary for law enforcement authorities to identify or apprehend an individual.
- If you are a member of Armed Forces personnel, for activities deemed necessary by appropriate military command authorities.
- To federal officials for national security and intelligence activities.
- As authorized to comply with laws relating to workers= compensation, or similar programs, that provide benefits for workplace injuries.
- When required by the Department of Health and Human Services (AHHS@) under compliance and enforcement rules of HIPAA privacy regulations to investigate or determine KA=s compliance with HIPAA regulations.
- Use by the originator of psychotherapy notes for treatment.
Certain uses and disclosures will be made only with your written authorization, and you may revoke such authorization at any time, provided that the revocation is in writing, except to the extent that (i) KA has taken action in reliance thereon; or (ii) if the authorization was obtained as a condition of obtaining insurance coverage, other law provides the insurer with the right to contest a claim under the policy or the policy itself. Uses and disclosures which require your authorization include: certain uses/disclosures of psychotherapy notes; sale of your protected health information; and, use of your protected health information for KA=s marketing if it involves financial remuneration paid to the KA.
The above-mentioned uses and disclosures may be further prohibited or materially limited by more stringent law (as defined in 45 C.F.R. 160.202) under Kentucky/Indiana law.
Under Indiana law the following statutes may apply:
- IC 16-39-1-1(c): On written request and reasonable notice, provider shall supply to patient health records possessed by the provider concerning the patient.
- IC 16-39-1-2: On patient written request and reasonable notice, provider shall, at provider’s actual costs, provide to the patient or the patient’s designee: (1) access to; or (2) a copy of the patient’s x-ray film possessed by the provider.
- IC 16-39-1-5: If provider reasonably determines that information requested by patient is (1) detrimental to physical or mental health of the patient; or (2) likely to cause the patient to harm the patient or another, the provider may withhold information from the patient.
- IC 16-41-8 confidentiality requirements for communicable diseases.
SEPARATE STATEMENTS FOR CERTAIN USES OR DISCLOSURES
(A) KA may contact you to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you.
(B) KA may contact you to raise funds for KA. You have the right to opt-out of receiving any such communications.
(C) A group health plan may disclose protected health information to the sponsor of the plan.
The following are statements of your privacy rights and a brief description of how you may exercise these rights.
(A) You have the right to request restrictions on certain uses and disclosures of your protected health information. KA is not required to agree to a requested restriction. However, KA must comply with the requested restriction if the disclosure is to a health plan (i) for purposes of carrying out payment or health care operations (and is not for purposes of carrying out treatment and is not otherwise required by law); and (ii) if the protected health information pertains to a service which the patient, and not the health plan, has paid KA in full. You may ask KA not to use or disclose your protected health information for treatment, payment, or health care operations. You may also request that your health information not be disclosed to family members or friends. Your request must state the specific restriction requested and to whom the restriction will apply. If KA agrees with your request, it may not use or disclose information except in compliance with the restriction, although KA may use or disclose restricted information if needed to provide emergency treatment. To request restrictions on uses and disclosures, forward your written request to the privacy contact listed below.
(B) You have the right to receive confidential communications of your protected health information (for example, in a certain way or at a certain location) consistent with HIPAA privacy regulations. KA must accommodate reasonable requests to receive confidential communications. To request receipt of confidential communications, forward your written request to the privacy contact listed below.
(C) You have the right to inspect and copy your protected health information if it is contained in a designated record set for as long as KA maintains such information. A “designated record set” means your medical and billing records used by KA to make decisions about you. You may not inspect and copy psychotherapy notes or information compiled in anticipation of an administrative action or proceeding. You may forward your written request to the privacy contact listed below.
(D) You have the right to amend your protected health information for as long as KA maintains information in a designated record set. In certain cases, KA may deny your request to amend your health information, and if that happens, you may submit a written statement disagreeing with such denial. To request amendment to your protected health information, forward your written request and provide a reason(s) to support your requested amendment to the privacy contact listed below.
(E) You have the right to receive an accounting of certain disclosures of your protected health information. This right does not apply to disclosures to carry out treatment, payment, or health care operations. Also, you are not entitled to an accounting of disclosures: (1) made pursuant to your written authorization; (2) incident to uses or disclosures permitted by the privacy regulations; (3) to KA’s facility directory; (4) to family members or friends involved in your health care; and (5) made prior to April 14, 2003. To request an accounting, forward your written request to the privacy contact listed below.
(F) You have the right to obtain a paper copy of this notice from KA; to request a paper copy, forward your written request to the privacy contact listed below.
However, if KA uses e-health records, then you may request an accounting of disclosure of your electronic protected health information for the 3-year period prior to request. This becomes effective as of the later of January 1, 2011 or the date KA acquires e-health records. [HITECH ‘13405(C)]
KENTUCKIANA ALLERGY’s DUTIES
(A) Kentuckiana Allergy is required by law to maintain the privacy of your protected health information and to provide you with this notice of its legal duties and privacy practices with respect to protected health information.
(B) Kentuckiana Allergy is required to abide by the terms of the privacy notice currently in effect.
(C) Kentuckiana Allergy reserves the right to change the terms of its privacy notice and to make the new notice provisions effective for all protected health information Kentuckiana Allergy maintains. Any such revised notice shall be provided to individuals in the same manner this notice is given.
COMPLAINTS AND CONTACT
If you believe that your HIPAA privacy rights have been violated, you may make a written complaint by delivery to KA. You will not be retaliated against if you file a complaint. You should file your complaint at the following address and you may also request further information by written request to:
Janet Wimsatt, Compliance Officer
9113 Leesgate Road
Louisville, Kentucky 40222
Phone: (502) 426-1621
This Privacy Notice is effective May 1, 2013.