NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

State and Federal laws require us to maintain the privacy of your protected health information (PHI), including electronic PHI, and to inform you about your privacy practices, our legal duties and your rights regarding your PHI by providing you with this Notice. We are further required to abide by the privacy practices in this notice and to notify you in the event of the occurrence of a breach related to your unsecured PHI. This Notice will take effect September 23, 2013 and will remain in effect until it is amended or replaced by us.

We reserve the right to change our privacy practices and the terms of this notice at any time, provided law permits the changes. Any modifications to our privacy practices, and to this notice will become effective for all PHI maintained, created and/or received by us, including PHI maintained and/or received by us before the date changes were made. Before we make any such changes, this Notice will be amended to reflect the changes and we will make the new Notice available upon request.

You may request a copy of our Privacy Notice at any time by contacting our Privacy Officer. Information on contacting us can be found at the end of this notice.

USES AND DISCLOSURES OF YOUR HEALTH INFORMATION

This section describes different ways that we use and disclose PHI. Following are different kinds of uses or disclosures and their meaning. Not every use or disclosure will be listed; however, we have listed examples of ways we are permitted to use and disclose PHI.

Treatment: We may use your PHI and disclose your PHI with other health care providers, business associates and their subcontractors or individuals who are involved in your treatment to provide, coordinate, or manage your health care and any related services. In addition, we may disclose your PHI from time-to-time to another healthcare provider who is not located at our facility, at his or her request, for your health care diagnosis or treatment by that provider.
Examples: Our doctors and nurses may use and disclose your PHI with each other to provide treatment to you. Your PHI may be provided to a doctor to whom you have been referred so that he may diagnose or treat you.

Payment: We may use and disclose your PHI to bill, collect and otherwise seek payment for services we provide to you. This disclosure involves our business office staff and may include disclosures to insurance organizations, collection agents, or other third parties that may be responsible for such costs, such as family members.
Examples: We may provide portions of your PHI to your health insurance plan to get paid for the health care services we provided to you, to permit it to make a determination of eligibility or coverage for insurance benefits, to enable it to review the services we provided to you for medical necessity, and to perform utilization review activities. We may also disclose PHI about you to the responsible party of your account. If you are listed as a dependent on another person’s insurance policy, financial information regarding medical care provided may be mailed to that responsible party. In addition, if you do not timely pay us for the health care services we provided to you, we may also disclose limited PHI to a collection agency. We may also disclose your PHI to other health care providers, health plans or health care clearinghouses for their payment activities. For example, we may provide your PHI to an ambulance/transportation company that provided services to you.

Healthcare Operations: We may use and disclose your PHI to keep our practice operable, to support our business activities, such as quality assessment activities, employee review activities, training of medical students, licensing, and conducting or arranging for our other business activities.
Examples: We may use your PHI to review our treatment and services and to evaluate the performance of our staff in caring for you. We may also disclose your PHI to medical school students who see patients at our office. In addition, we may use and disclose your PHI to other health care providers, health plans or health care clearinghouses for their limited health care operations, such as quality assessment activities, licensing and other health care compliance activities.

Business Associates: We may disclose your PHI to our business associates that assist us in our delivery of health care and related services, such as billing companies, lawyers, accountants and others. Before we disclose your PHI to our business associates, we will have a written contract with each of them that will require each of them to agree to maintain the privacy of your PHI.

OTHER PERMITTED AND REQUIRED USES AND DISCLOSURES THAT MAY BE MADE WITHOUT YOUR CONSENT OR OPPORTUNITY TO OBJECT

Required by Law: We may use or disclose your PHI when we are required to do so by law (including statutes, regulations, court or administrative orders, subpoenas, or other lawful processes).

Public Health Responsibilities: As required by law, we may disclose your PHI to public health or legal authorities charged with preventing or controlling disease, injury or disability, including child abuse or neglect. We may also disclose your PHI to persons subject to jurisdiction of the Food and Drug Administration for purposes of reporting adverse events associated with product defects or problems, to enable product recalls, repairs or replacements, to track products, or to conduct activities required by the Food and Drug Administration. We may also disclose your PHI, but limited to proof of immunization, to a school if you are a student of the school and such school is required by the state or other law to have such proof of immunization prior to admitting you. We may also disclose your PHI, when authorized by law, to notify a person who may have been exposed to a communicable disease or otherwise be at risk of contracting or spreading a disease or condition.

Abuse or Neglect: We may disclose your PHI to a public health authority that is authorized by law to receive reports of child abuse or neglect. We may disclose your PHI to appropriate authorities if we reasonably believe that you are a possible victim of abuse, neglect, or domestic violence or the possible victim of other crimes. This PHI will be disclosed only to the extent permitted by applicable law.

Health Oversight Activities: We may use or disclose your PHI to a health oversight agency for health oversight activities authorized by law, including, for example, inspections and licensure of health care facilities.

Judicial and Administrative Proceedings: We may use or disclose your PHI under certain conditions to comply with legal proceedings, such as a subpoena or order by a court or administrative tribunal. We may share limited PHI with a law enforcement official concerning the PHI of a suspect, fugitive, material witness, crime victim or missing person.

Law Enforcement Purposes: Under certain circumstances, we may disclose PHI to law enforcement officials. These circumstances include, but are not limited to, reporting required by certain laws (such as the reporting of certain types of wounds), pursuant to certain subpoenas or court orders, reporting limited information concerning identification and location at the request of a law enforcement official, reports regarding suspected victims of crimes at the request of a law enforcement official, reporting deaths, crimes on our premises, and crimes in emergencies. We may share limited PHI with a law enforcement official concerning the PHI of a suspect, fugitive, material witness, crime victim or missing person. We may share PHI of an inmate or other person in lawful custody with a law enforcement official or correctional institution under certain circumstances.

Decedents: We may use or disclose PHI about decedents to coroners, medical examiners and funeral directors.

Organ, Eye, Tissue Donation: We may use or disclose your PHI to notify organ procurement organizations to assist them in organ, eye or tissue donation and transplants.

Research: In limited circumstances, we may use and disclose your PHI to conduct medical research.

Serious Safety Threat: We may use or disclose your PHI where we believe it is necessary to prevent or lessen a serious threat to the safety of a person or the public.

Special Government Functions: We may use or disclose your PHI under some circumstances for specialized government functions, including those related to the armed forces, national security, and intelligence, correctional institutions and other law enforcement custodial situations, and for government programs providing public benefits. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release PHI about you to the correctional institution or law enforcement official. We may also disclose your PHI to authorized federal officials for conducting national security and intelligence activities, including those for the provision of protective services to the President or other legally authorized services.

Workers’ Compensation: We may use or disclose your PHI as authorized by and to the extent necessary to comply with laws related to workers’ compensation and similar programs.

To Your Personal Representatives: We may disclose your PHI to your personal representatives that are appointed by you or authorized by applicable law.

USES AND DISCLOSURES FOR WHICH YOU HAVE AN OPPORTUNITY TO AGREE OR OBJECT

Patient Directories: We may include your name, location in our office, general condition, and religious affiliation in our patient directory for use by clergy and visitors who ask for you by name unless you object in whole or in part. In an emergency situation and if you are incapacitated, you will be given the opportunity to agree or object when it becomes practicable.

Individuals Involved in Your Care: We may disclose your PHI to a family member, friend or other person that you indicate is involved in your care or the payment for your health care, unless you object in whole or in part. In an emergency situation and if you are incapacitated, you will be given the opportunity to agree or object when it becomes practicable.

Disaster Relief: In certain circumstances, we may use or disclose PHI to a public or private entity authorized by law or by its charter to assist in disaster relief efforts to coordinate with such entities the notification of your condition, location and/or death to your family, personal representative or other individuals responsible for your care.

Fundraising: We may use certain PHI to contact you for the purpose of raising money and you will have the right to opt out of receiving such communications with each solicitation.

PATIENT RIGHTS

You have the following rights regarding the PHI we maintain about you:

Right to an Accounting of Disclosures: You have the right to request an accounting of certain disclosures of your PHI. The right to receive this accounting is subject to certain exceptions, restrictions and limitations. To request this accounting of disclosures, you must submit your request in writing to the address below. Your request must state a time period of not longer than six (6) years prior to the date of the request. Your request should indicate in what form you want the list (for example, paper or electronic). The first list you request within a 12-month period will be provided free of charge. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to Request Restriction of PHI: You may request that we place additional restrictions on our use or disclosure of your PHI, including, in limited circumstances, the disclosure of certain PHI to your health plan when you pay out-of-pocket in full for a treatment you receive. Additionally, you have the right to request that we restrict our disclosure of your PHI to only certain individuals involved in your care or the payment for your care, such as family members and friends. We do not have to agree to your request, unless such request relates to a permissible restriction on disclosure of PHI to your health plan; however, if we do agree, we are bound by our agreement to the restriction except when otherwise required by law when the information is necessary to treat you in an emergency or when the disclosure does not require your consent or that you be given an opportunity to object. In order to request a restriction in our use or disclosure of your PHI, you must make your request in writing. Your request must describe in clear and concise fashion: the information you wish restricted; whether you are requesting to limit our use, disclosure, or both; and to whom you want the limits to apply.

Right to Inspect and Copy: You have the right to inspect and copy certain PHI maintained in our records. To exercise your right to inspect and copy your PHI, you must submit your request in writing to the address below. If you request a copy of the PHI, we may charge a reasonable fee for the costs of copying, mailing, or other supplies associated with your request. We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to your medical information, you may request that the denial be reviewed by submitting a written request to the address below.

Right to Request an Amendment: You have the right to amend your healthcare information, if you feel it is inaccurate or incomplete. Your request must be in writing and must include an explanation of why the information should be amended. Under certain circumstances, your request may be denied.

Right to Request Confidential Communications: You may request to receive confidential communications from us by alternative means or to alternative locations. You do not need to give a reason for your request. For instance, you may ask that we contact you at home, rather than work. In order to request a type of confidential communication, you must make a written request specifying the requested method of contact, or the location where you wish to be contacted. The request must be made to the address listed at the end of this notice. In limited circumstances, we do not have to agree to your request.

BREACH NOTIFICATION REQUIREMENTS

It is presumed that any acquisition, access, use or disclosure of PHI not permitted under HIPAA regulations is a breach. We are required to complete a risk assessment, and if necessary, inform HHS and take any other steps required by law. You will be notified of the situation and any steps you should take to protect yourself against harm due to the breach.

Right to File a Complaint: If you believe that your privacy rights have been violated, contact the practice administrator named at the end of this notice. You may also submit a written complaint to the U.S. Department of Health and Human Services. We will provide you with the address to file your complaint with the U.S. Department of Health and Human Services. We will not retaliate in any way if you choose to file a complaint.

Refusal to Receive the Notice of Privacy Practices: You may refuse a copy of the Notice of Privacy Practices. Your treatment will not be conditioned on your refusal unless it is for the purpose of creating PHI or research related treatment.

Right to Receive a Copy of this Notice: You are entitled to receive a paper copy of our Notice of Privacy Practices. You may ask us to give you a copy of this notice at any time.

Right to Provide an Authorization for Other Uses and Disclosures: We must obtain your written authorization for uses and disclosures that are not identified by this notice or permitted by applicable law. Any authorization you provide to us regarding the use and disclosure of your PHI may be revoked at any time in writing. After you revoke your authorization, we will no longer use or disclose your PHI for the reasons described in the authorization. The exceptions to this revocation are if your physician has taken an action in reliance on the authorization, and if the authorization was obtained as a condition of obtaining insurance coverage. Please note: we are required to retain records of your care.

Below are some of the circumstances when we may use and disclose your PHI information only with your authorization:

• Marketing Health-Related Services: We will not use your PHI for marketing purposes unless we have your written authorization to do so. No authorization is required if communication is made face-to-face or for promotional gifts.

• Psychotherapy Notes: With limited exceptions, your authorization is required for use or disclosure of psychotherapy notes, which are notes recorded by a mental health professional documenting the contents of a conversation during a private counseling session or a group, joint, or family counseling session that are separated from the rest of your medical record.

• Sale of PHI: We are prohibited to disclose PHI without an authorization if it constitutes remuneration (getting paid in exchange for the PHI). A “sale,” subject to limited exceptions, is when we receive remuneration, indirectly or directly, from or on behalf of the recipient of your PHI in exchange for our disclosure of your PHI.

HOW TO CONTACT US

The Eye Center
Attn: Assigned Privacy Officer
401 Meridian Street, Suite 201
Huntsville, AL 35801
Phone: (256) 705-3937
Fax: (256) 533-3210
www.eyecentersurgeons.com
Revised 9/9/13