Notice of Privacy Practices

1. What we mean by “health information”

Each time you receive care from us, we make a record of that visit. It typically includes your symptoms and history, examination and assessment findings, wound and medication records, the plan of care, visit notes written by the caregiver who saw you, and billing and insurance information. Federal law calls this protected health information, or PHI. This Notice describes what we may and may not do with it.

Where a use or disclosure is permitted, we limit ourselves to the minimum necessary information to accomplish the purpose — except when disclosing to you, to another provider for treatment, to HHS for enforcement, or where you have authorized the disclosure.

2. Uses and disclosures for treatment, payment, and health care operations

We may use and disclose your health information without your written authorization for the following three purposes.

2.1 For treatment

We use your health information to provide and coordinate your care. For example: the nurse assigned to your visit reads the previous caregiver’s notes before arriving; we discuss your wound healing with your physician; we send an assessment to a physical therapist so therapy can be planned; or we tell a pharmacy what has been prescribed so a medication can be filled.

2.2 For payment

We use and disclose your health information to get paid for the care we provide. For example: we send a claim to your insurer, a workers’ compensation carrier, or a third-party administrator, including the diagnosis and the services delivered; we verify coverage before a visit; or we provide records requested by a payer to substantiate a claim.

2.3 For health care operations

We use your health information to run our practice. For example: reviewing visit documentation for quality and completeness; evaluating the performance of our caregivers; training staff; arranging for legal and accounting services; and business planning. Where we disclose information to a vendor who performs a service for us — for example our electronic records host — we do so under a written business associate agreement that requires that vendor to protect your information as we do.

3. Workers’ compensation

A substantial part of our practice involves care delivered in connection with a workers’ compensation claim. Because this is likely to affect you, we call it out separately.

We may disclose your health information as authorized by, and to the extent necessary to comply with, laws relating to workers’ compensation and other similar programs established by law that provide benefits for work-related injuries or illness without regard to fault. In practice this means that when you are treated under a workers’ compensation claim, information about your injury, your assessments, your progress, and your ability to work may be disclosed to:

• Your employer’s workers’ compensation insurance carrier
• The third-party administrator or claims adjuster handling your claim
• The Oklahoma Workers’ Compensation Commission, where required
• An independent medical examiner or case manager assigned to your claim
• Attorneys of record in the claim, to the extent required by law or court order

These disclosures are permitted without your separate authorization. They are limited to information relevant to the work-related injury or illness. Care you receive from us that is unrelated to the claim is not disclosed on this basis.

4. Other uses and disclosures permitted without your authorization

Federal law permits us to use or disclose your health information without your authorization in the following circumstances.

As required by law

When federal, state, or local law requires the disclosure.

Public health activities

To a public health authority to prevent or control disease, injury, or disability; to report births and deaths; to report reactions to medications or problems with products; or to notify a person who may have been exposed to a communicable disease.

Victims of abuse, neglect, or domestic violence

To a government authority authorized to receive such reports, including Oklahoma Adult Protective Services, where we reasonably believe an adult or child in our care is a victim. Because we care for people in their homes, and often for vulnerable adults, this obligation applies to us frequently and we take it seriously.

Health oversight activities

To an oversight agency for audits, investigations, inspections, and licensure — activities necessary for the government to monitor the health care system.

Judicial and administrative proceedings

In response to a court order, or to a subpoena or discovery request where we have received satisfactory assurance that you have been notified or that a protective order has been sought.

Law enforcement

To identify or locate a suspect, fugitive, material witness, or missing person; to report a death we believe may have resulted from criminal conduct; to report a crime on our premises; or in response to a valid legal process.

Coroners, medical examiners, and funeral directors

To identify a deceased person, determine a cause of death, or allow a funeral director to carry out their duties.

Organ and tissue donation

To organizations that handle procurement, banking, or transplantation.

To avert a serious threat to health or safety

When necessary to prevent or lessen a serious and imminent threat to the health or safety of you or the public, and to someone able to help prevent the threat.

Research

Where an institutional review board or privacy board has approved the research and established protocols to protect your privacy.

Military, national security, and protective services

If you are a member of the armed forces, as required by military command authorities; and to authorized federal officials for national security activities or the protection of the President.

Inmates and correctional institutions

If you are an inmate, to the institution or a law enforcement official where necessary for your health or the safety of others.

Persons involved in your care

To a family member, relative, close personal friend, or any person you identify, information directly relevant to that person’s involvement in your care or payment for your care. We will give you an opportunity to object where you are present and able to. If you are not present or are incapacitated, we will use our professional judgment to determine whether the disclosure is in your best interest.

Disaster relief

To an entity assisting in disaster relief, so your family can be notified of your location and condition.

5. Uses and disclosures that require your written authorization

Other than the purposes described above, we will not use or disclose your health information without a written authorization signed by you. In particular, your written authorization is always required for:

• Psychotherapy notes, with narrow exceptions permitted by law.
• Marketing — any communication that encourages you to buy a product or service, where we receive payment from a third party for making it.
• Any sale of your health information. We do not sell health information and have no intention of doing so.

You may revoke an authorization at any time, in writing, by contacting our Privacy Officer. A revocation stops any further use or disclosure under that authorization. It cannot undo a disclosure we already made while the authorization was in effect.

6. Your rights regarding your health information

The record of your care is our physical property. The information in it is yours. You have the following rights.

6.1 Right to inspect and copy

You may inspect and obtain a copy of your health information, including in an electronic format if we maintain it electronically and you request it that way. You may also direct us to send a copy to a person you designate. Submit your request in writing to our Privacy Officer. We will act on it within 30 days, with one 30-day extension if we notify you of the reason. We may charge a reasonable, cost-based fee for copying, mailing, and supplies. In limited circumstances we may deny a request; where the law provides for it, you may have that denial reviewed.

6.2 Right to request an amendment

If you believe information in your record is incorrect or incomplete, you may ask us to amend it. Submit the request in writing with the reason for it. We may deny the request if the information was not created by us, is not part of the record we keep, is not information you would be permitted to inspect, or is accurate and complete. If we deny it, we will tell you why in writing and you may submit a statement of disagreement that becomes part of your record.

6.3 Right to an accounting of disclosures

You may request a list of the disclosures we made of your health information — other than disclosures for treatment, payment, and health care operations, disclosures you authorized, and certain other exceptions. The request may cover up to six years prior to the date of the request. The first accounting in any 12-month period is free; we may charge a reasonable cost-based fee for additional requests, and will tell you the cost in advance so you may withdraw or modify the request.

6.4 Right to request restrictions

You may ask us to restrict how we use or disclose your health information for treatment, payment, or health care operations, or to a person involved in your care. We are not required to agree to a requested restriction — but if we do agree, we will honor it except in an emergency.

There is one restriction we must honor: if you pay for a service in full, out of pocket, and ask us not to disclose information about that service to your health plan, we will not do so, unless the disclosure is otherwise required by law.

6.5 Right to request confidential communications

You may ask us to contact you about your care in a particular way or at a particular place — for example, only on your mobile phone, or by mail to an address other than your home. We will accommodate reasonable requests and will not ask you why.

6.6 Right to a paper copy of this Notice

You may ask for a paper copy of this Notice at any time, including if you have already received it electronically. We will give you one.

6.7 Right to be notified of a breach

We are required to notify you if a breach occurs that may have compromised the privacy or security of your health information.

6.8 Right to choose someone to act for you

If you have given someone medical power of attorney, or if someone is your legal guardian, that person may exercise these rights and make choices about your health information. We will verify that the person has authority before we act.

To exercise any right in this section, contact our Privacy Officer using the details in Section 10. We will not retaliate against you for exercising a right, and exercising one will never affect the care you receive.

7. Our responsibilities

• We are required by law to maintain the privacy and security of your health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this Notice and give you a copy of it.
• We will not use or share your information other than as described here unless you tell us we may, in writing. If you tell us we may, you may change your mind at any time by telling us so in writing.

8. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us, with the federal government, or both.

8.1 With Jones Medical

Contact our Privacy Officer in writing at the address in Section 10. We will investigate and respond. Filing a complaint with us does not affect the care you receive.

8.2 With the U.S. Department of Health and Human Services

You may file a complaint with the Office for Civil Rights. A complaint must generally be filed within 180 days of when you knew the act occurred.

We will not retaliate against you for filing a complaint, and you will not be penalized in any way.

9. Changes to this Notice

We reserve the right to change this Notice, and to make the revised Notice effective for health information we already hold as well as information we create or receive in the future. Whenever we revise it materially, we will post the revised Notice on this page with a new revision date, make paper copies available on request, and provide a copy at your next visit.

10. Who to contact

For questions about this Notice, to exercise any of the rights described in Section 6, or to file a complaint:

Requests to inspect, copy, amend, restrict, or receive an accounting of your health information should be made in writing to the address above.