HIPAA NOTICE OF PRIVACY PRACTICES
I. It Is My Legal Duty To Safeguard Your Protected Health Information (PHI). By law, I am required to insure that your PHI is kept private. The PHI constitutes information created or noted by me that can be used to identify you. It contains data about your past, present, or future health or condition, the provision of health care services to you, or the payment for such health care. I am required to provide you with this Notice about my privacy procedures. This Notice must explain when, why, and how I would use and/or disclose your PHI. Use of PHI means when I share, apply, utilize, examine, or analyze information within my practice; PHI is disclosed when I release, transfer, give, or otherwise reveal it to a third party outside my practice. With some exceptions, I may not use or disclose more of your PHI than is necessary to accomplish the purpose for which the use or disclosure is made; however, I am always legally required to follow the privacy practices described in this Notice.
Please note that I reserve the right to change the terms of this Notice and my privacy policies at any time. Any changes will apply to PHI already on file with me. Before I make any important changes to my policies, I will immediately change this Notice. You may also request a copy of this Notice from me, or you can view a copy of it in my office.
II. How I Will Use And Disclose Your PHI.
I will use and disclose your PHI for many different reasons. Some of the uses or disclosures will require your prior written authorization; others will not. Below, you will find the different categories of uses and disclosures, with some examples.
A. Uses & disclosures related to treatment, payment, or health care operations that do not require prior written consent.
1. For treatment. I may disclose your PHI to physicians, psychiatrists, psychologists, and other licensed health care providers who provide you with health care services or are otherwise involved in your care.
2. For health care operations. I may disclose your PHI to facilitate the efficient and correct operation of my practice, such as quality control or to make sure that I am in compliance with applicable laws.
3. To obtain payment for treatment. I may use and disclose your PHI to bill and collect payment for the treatment and services I provided you. Example: I might send your PHI to your insurance company or health plan in order to get payment for the health care services that I have provided to you. I could also provide your PHI to business associates, such as billing companies, claims processing companies, and others that process health care claims for my office.
4. Other disclosures. If you have signed an authorization to disclose your PHI (e.g. to a family member or medical provider), you may later revoke that authorization, in writing, to stop any future uses or disclosures, except as permitted by law.
B. Certain other uses and disclosures do not require your consent. I may use and/or disclose your PHI without your consent or authorization for the following reasons:
1. When disclosure is required by federal, state, or local law, judicial, board, or administrative proceedings; or law enforcement.
2. If disclosure is compelled by a party to a proceeding before a court of an administrative agency pursuant to its lawful authority.
3. To avoid harm (e.g. disclosure to law enforcement personnel to prevent or mitigate a serious threat to the health or safety of a person or the public).
4. If disclosure is compelled or permitted by the fact that you are in such mental or emotional condition as to be dangerous to yourself or the person or property of others, in order to prevent the threatened danger.
5. If disclosure is required by a search warrant lawfully issued to a governmental law enforcement agency.
6. If disclosure is compelled by the patient or the patient’s representative pursuant to federal statutes or regulations.
7. To seek emergency medical treatment for you (e.g. if you are unconscious or unable to speak) provided that I attempt to get your consent after treatment is rendered.
8. If disclosure is mandated by the Abused and Neglected Child Reporting Act of Illinois or by the Adult Protective Services Act of Illinois.
9. For public health activities. In the event of your death, if a disclosure is permitted or compelled, I may need to give the county coroner information about you.
10. For health oversight activities (e.g. to assist the government in the course of an investigation or inspection of a health care organization or provider or assess compliance with HIPAA).
11. For specific government functions. I may disclose PHI of military personnel and veterans under certain circumstances or other individuals in the interests of national security.
12. For research purposes. In limited circumstances, I may disclose PHI (e.g.
when it has been de-identified).
13. For Workers’ Compensation purposes. I may provide PHI to comply with
Workers’ Compensation laws.
14. Appointment reminders and health related benefits or services. I am permitted to contact you, without your prior authorization, to provide appointment reminders or information about alternative or other heath-related benefits and services that may be of interest to you.
15. If disclosure is otherwise specifically required by law.
III. Rights You Have Regarding Your PHI.
A. The right to see and get copies of your PHI. In general, you have the right to see your PHI that is in my possession, or to get copies of it; however, you must request it in writing. If I do not have your PHI, but I know who does, I will advise you how you can get it. You will receive a response within 30 days of receiving your written request. Under certain circumstances, I may feel I must deny your request, but if I do, I will give you, the reasons for the denial. If you ask for copies of your PHI, I will charge you $1 per page plus professional time prorated for completing your request. I may provide you instead with a summary or explanation of the PHI, if clinically appropriate.
B. The right to request limits on uses and disclosures of your PHI. You have the right to ask that I limit how I use and disclose your PHI. If I do agree to your request, I will put those limits in writing and abide by them except in emergency situations or where legally required or permitted.
C. The right to choose how I send your PHI to you. It is your right to ask that your PHI be sent to you at an alternate address such as, sending information to your work address rather than your home address. I am obliged to agree to your request providing that I can give you the PHI, in the format you requested, without undue inconvenience.
D. The right to get a list of the disclosures I have made. You are entitled to a list of disclosures of your PHI that I have made. The list will not include uses or disclosures to which you have already consented, i.e., those for treatment, payment, or health care operations, sent directly to you, or to your family; neither will the list include disclosures made for national security purposes, or to corrections or law enforcement personnel. Disclosure records will be held for six years for adults or until one year after a child client turns 21 years old. I will respond to disclosure request within 60 days of receipt. The list will include disclosures made in the previous six years unless you indicate a shorter period. The list will include the date of the disclosure, to whom PHI was disclosed (including their address, if known), a description of the information disclosed, and the reason for the disclosure. I will provide the list to you at no cost, unless you make more than one request in the same year, in which case I will charge you a reasonable sum based on a set fee for each additional request.
E. The right to amend your PHI. If you believe that there is error in your PHI or important information has been omitted, it is your right to request that I correct the existing information or add the missing information. Your request and the reason for the request must be made in writing. You will receive a response within 60 days of my receipt of your request. I may deny your request, in writing, if I find that: the PHI is (a) correct and complete, (b) forbidden to be disclosed, (c) not part of my records, or (d) written by someone other than me. My denial must be in writing and must state the reasons for the denial. It must also explain your right to file a written statement objecting to the denial. If you do not file a written objection, you still have the right to ask that your request and my denial be attached to any future disclosures of your PHI. If I approve your request, I will make the change(s) to your PHI. Additionally, I will tell you that the changes have been made, and I will advise all others who need to know about the change(s) to your PHI.
F. The right to get this notice by email. You have the right to request this notice by email.
IV. How To Complain About My Privacy Practices
If, in your opinion, I may have violated your privacy rights, or if you object to a decision I made about access to your PHI, you are entitled to file a complaint with the person listed in Section V below. You may also send a written complaint to the Secretary of the Department of Health and Human Services at:
200 Independence Avenue S.W.
Washington, D.C. 20201.
If you file a complaint about my privacy practices, I will take no retaliatory action against you.
V. Person To Contact For Information About This Notice Or To Complain About My Privacy Practices
If you have any questions about this notice or would like to know how to file a complaint with the Secretary of the Department of Health and Human Services, please contact the privacy officer at this office:
R. Scott Waller, PsyD
30 N. Michigan Ave., Suite 529
Chicago, IL 60602
(312) 629-5075