HIPAA Notice of Privacy Practices

I. USES & DISCLOSURES NOT REQUIRING YOUR AUTHORIZATION

We may use and disclose your PHI without your authorization (verbal, written or otherwise) for treatment, payment, health care operations, and the other purposes described below.

Treatment. To provide, coordinate, or manage your care, including sharing PHI with physicians, nurses, technicians, medical students, and others involved in your care, and with other health care providers for their own treatment, payment, or operations. For example, a physician treating an injury may need to know if you have diabetes, which can slow healing.

Payment. To document and collect payment for services. DC Orthopedics does not participate with or bill insurance carriers or Medicare; payment is your responsibility at the time of service. On request, we can provide a receipt or statement you may submit to your insurer or another third party for reimbursement.

Health Care Operations. To review our services and staff performance; evaluate services, effectiveness, and patient needs (including by combining data from other patients); for teaching, business planning, management, and administration; and to meet legal reporting requirements. We may remove identifying information to create de-identified data or a limited data set and use it as permitted by law.

Family, Friends, and Caregivers. We may share PHI with family, close friends, caregivers, or others you identify who are involved in your care or payment. If you are present, we will do so only if you authorize it, you do not object when given the chance, or we reasonably infer you would not object. If you are absent, incapacitated, or in an emergency, we will use professional judgment and share only what is directly relevant to their involvement. You may ask us at any time not to share PHI with these individuals.

Disaster Relief. With authorized disaster-relief organizations, to help notify or locate your family, personal representative, or others responsible for your care regarding your location, condition, or death.

Public Health. As required by law, to:

• Prevent or control disease, injury, or disability
• Report immunizations (e.g., to the state registry or your child's school), births, and deaths
• Report child abuse to authorized agencies
• Report FDA-regulated product issues, such as medication reactions, and notify patients of recalls
• Alert a person who may have been exposed to or be at risk of spreading a communicable disease
• Report work-related illness or injury to your employer where required by law

Health Oversight. To oversight agencies such as Medicaid or Medicare, for audits and compliance investigations.

Abuse, Neglect, or Domestic Violence. If we believe you may be a victim, to authorized government, social, or protective service agencies.

Legal Proceedings and Law Enforcement. In response to a court order, subpoena, or other lawful process; to law enforcement as required or permitted by law; regarding criminal conduct on our premises; and in an emergency, to report a crime or identify or locate a victim or suspect.

Decedents and Organ Donation. To coroners to identify a person or determine cause of death; to funeral directors as needed for their duties; and, if you are an organ donor, to organizations that procure organs, tissue, or eyes for donation or transplantation.

Workers' Compensation. As needed to comply with workers' compensation or similar laws.

Research. We generally ask for your written authorization before disclosing PHI to a third party for research. Limited exceptions apply, such as research overseen by an Institutional Review Board or privacy board meeting HIPAA requirements, or where researchers provide assurances limiting their use of the PHI.

Health or Safety. To prevent or lessen an imminent, serious threat of physical violence to you, another person, or the public.

Military and Government Functions. As required by military command authorities (including foreign military authorities, for foreign military personnel); to the U.S. Armed Forces or Department of State; to federal officials for intelligence, counter-intelligence, and national security activities; and to protect the President, foreign heads of state, or other authorized persons.

Inmates. If you are in custody, to the correctional institution or law enforcement as needed to provide your care, protect health and safety, or maintain institutional security.

As Required by Law. In any other circumstance where state or federal law requires it.

Health Information Exchange (HIE). We may share PHI through electronic HIEs in which we participate, for treatment, payment, operations, and other lawful purposes such as care coordination, billing, quality improvement, and public health. Other providers, health care entities, and health plans may access your information in the HIE for similar purposes. HIE information may identify you and may include sensitive information (such as mental health, drug and alcohol treatment, HIV status, and sexually transmitted diseases). You may opt out of all HIEs we participate in by notifying our Privacy Officer.

II. USES & DISCLOSURES REQUIRING YOUR WRITTEN AUTHORIZATION

For any purpose not listed in Section I, we need your written authorization; for example, to send your information to your life insurance company. Unless otherwise permitted or required by law, we will also obtain your written authorization before disclosing:

• HIV/AIDS information. Limited exceptions apply, such as disclosures to state agencies or upon court order.
• Sexually transmitted disease or tuberculosis information that identifies you as having, or suspected of having, either condition.
• Psychotherapy notes, in most cases.
• Mental health information, or information identifying you as having a mental health condition.
• Drug and alcohol treatment information in certain circumstances, such as treatment at a federally funded facility or program.
• Emancipated treatment of a minor. PHI related to treatment a minor sought on their own (e.g., pregnancy, their child, or a sexually transmitted disease), including to parents or guardians.
• Marketing. Except face-to-face communications and communications about your treatment, case management, care coordination, or alternative treatments, therapies, providers, or care settings.
• Sale of PHI. Activities in which we would receive payment from a third party for your PHI, except for treatment, public health, or research purposes.

You may revoke any authorization at any time (see Section III).

III. YOUR RIGHTS

To exercise any of these rights, submit a written request to our Privacy Officer (see Section VI).

1. Request Restrictions. You may ask us to limit uses and disclosures of your PHI for treatment, payment, or operations; to those involved in your care or payment; or for notification purposes. We will consider all requests but are not required to agree, unless the request is to withhold PHI from a health plan or payer for payment or operations regarding an item or service you paid for in full, out of pocket.

2. Confidential Communications. You may ask to receive PHI by alternative means or at an alternative location, with specific instructions; you need not give a reason. We will accommodate reasonable requests. Our patient portal offers a secure way to communicate and set contact preferences.

3. Access and Copies. You may access and obtain copies of PHI in your designated record set, including an electronic copy in a reasonable format if readily producible. We may deny access in certain circumstances and will tell you why. We may charge a reasonable fee as permitted by law.

4. Amendment. You may ask us to amend PHI in your designated record set. We may ask your provider to review the request, and may deny it if the information is accurate and complete, was not created by a DC Orthopedics provider, or other special circumstances apply. We will notify you of any denial, and update our records if we accept.

5. Accounting of Disclosures. You may request a list of disclosures made within six (6) years before your request. It excludes certain disclosures, such as those for treatment, payment, operations, or that you authorized. The first request in any twelve (12) months is free; later requests may carry a reasonable charge.

6. Revoke Authorization. You may revoke an authorization, whether given verbally or in writing, at any time by written notice. We may rely on an authorization until we receive your revocation.

7. Notice of Breach. We will notify you if a breach involves or may involve your unsecured PHI, and tell you what steps you may need to take to protect yourself.

8. Paper Copy of This Notice. You may request a paper copy at any time, even if you agreed to receive it electronically. Copies are available at our office and at dcorthopedics.com.

IV. OUR DUTIES

We are required by law to protect the privacy of your PHI, provide you with this Notice, and abide by its terms. We may amend this Notice at any time without prior notice, to the extent permitted by law; changes will apply to all PHI we maintain, including PHI created before the change. The current Notice is posted at our office and on our website, dcorthopedics.com, and is available from our Privacy Officer.

Where state law provides greater privacy protection than HIPAA, we may be required to follow that stricter standard. We maintain medical records for as long as required by law.

V. COMPLAINTS

If you believe your privacy rights have been violated, you may submit a written complaint to our Privacy Officer or to the Secretary of the U.S. Department of Health and Human Services (see Section VI). We will not retaliate against you for filing a complaint.

VI. CONTACT INFORMATION