Federal regulations, known collectively as the “HIPAA Privacy Rules,” require we (Radiology Imaging Associates, P.A. and East Central Florida Outpatient Imaging, LLC) provide you with this detailed written notice of our privacy practices regarding individually identifiable patient health information (“PHI”) we otherwise create, use or maintain in the course of providing our medical services. This Notice of Privacy Practices (“NPP”), which is effective as of September 20, 2013, describes the privacy practices of our group and each of ECFOI’s imaging facilities at which we practice.
I. OUR COMMITMENT TO PROTECTING YOUR PERSONNEL HEALTH INFORMATION/AMENDMENTS TO THIS NPP/QUESTIONS-COMPLAINTS/PRIVACY OFFICE
Commitment/Legal Duties. Under the HIPAA Privacy Rules and applicable Florida law, we are required to:
- maintain the privacy of your PHI, consistent with the requirements of the HIPAA Privacy Rules and applicable Florida law;
- provide you with notice of our legal duties and privacy practices regarding your PHI, including giving you this written notice of the uses and disclosures of your PHI we are permitted or required to make;
- notify you, if applicable, following a breach of your “unsecured” PHI; and
- abide by the terms of this NPP, while in effect.
Amendments to NPP. As permitted by law, we reserve the right to amend our privacy policies and the terms of this NPP at any time. If amended, our amended NPP will apply to all PHI we otherwise maintain.
If we amend this NPP. A copy of our amended NPP will be posted in a prominent location in our patient waiting area in our office for review;; and, for so long as we maintain a website to provide information about our services, we will prominently post a copy of our amended NPP on that website. If we do amend our NPP, a copy of the amended NPP will be provided to you upon request either made to our Privacy Office or when at our office for a scheduled appointment. (If we post a copy of an amended NPP on a website we maintain, then you will be able to obtain an electronic copy of that amended NPP through this website.)
Questions/Further Information . If you have any questions about this NPP or our privacy policies or would like further information concerning uses or disclosures of your PHI described in this NPP, please contact our Privacy Office.
Complaints . If you believe your privacy rights (with regard to your PHI) have been violated, you may file a complaint with our Privacy Office and/or with the Secretary of the U.S. Department of Health and Human Services. You will not be retaliated against for making or filing a complaint. Contact Information for Our Privacy Office.
Privacy Office Contact Information. You can contact our Privacy Office at the following contact information (communications faxed or mailed should be marked “Attention-Privacy Office”):
1673 Mason Avenue, Suite 305
Daytona Beach, FL 32117
Telephone: (386) 274-7118
Fax: (386) 274-6173
II. USES AND DISCLOSURES OF PHI
A. Treatment, Payment and Health Care Operation Purposes . We may use and disclose your PHI for treatment, payment and/or health care operation purposes without your consent and without prior notice to you. The examples included within each of the below listed categories do not purport to describe, nor do they describe, every type of use or disclosure of your PHI within each such category that we may make:
Treatment . We may use and disclose your PHI to provide or coordinate our diagnostic imaging services. For example, we may (i) use your medical history to assess your health and perform requested diagnostic services; (ii) provide copies of the diagnostic tests we perform and our interpretation of such tests to your doctor who orders the same, and (iii) send a copy of such medical information to another health care provider to whom you may be referred for treatment (or to whom you go for treatment) of a medical condition to which our diagnostic services may relate.
Payment . Your PHI will or may be disclosed by us as needed to obtain payment for our medical services. For example, we may share with your health plan/health insurance company details concerning our medical services, either before we provide such services to confirm or determine applicable coverage for our services-and/or following our provision of medical services, to obtain payment therefore. We may also disclose limited PHI concerning you to consumer reporting agencies relating to the collection of monies owed us for our services. We may also disclose your relevant PHI to your insurance plan or to another health care provider involved in your care for payment activities of your health plan (or health care company) or other health care provider. For example, we may allow a health insurance company to review your PHI in connection with its activities undertaken to determine applicable coverage or benefits for medical care furnished (or to be furnished) you by another health care provider.
Healthcare Operations. We may use and disclose your PHI for our health care operations, which encompass many activities. Examples of these activities and/or permitted uses or disclosures, include using and/or disclosing your PHI: (i) to assess and improve the quality, efficiency and costs of our services; (ii) to evaluate skills, qualifications and/or performance of or by our individual doctors and/or non-doctor medical personnel; (iii) for training or educational programs we may provide our medical (or non-medical) personnel or medical residents we may train; (iv) to outside organizations that evaluate, certify or license our group, medical personnel or our office facility, for their use in connection therewith; (v) for cost-management and/or business planning activities or functions of our group; and (vi) for legal compliance or legal defense purposes or activities, whether on our behalf or on behalf of any of our medical personnel. We may also use or disclose your PHI for the health care operations of an “organized health care arrangement” in which we participate. An example of an “organized health care arrangement” is the joint care provided by a hospital, its employees, and its physician medical staff members, a group health plan, or a “risk-sharing” network of participating providers.
B. Other Permitted or Required Uses or Disclosures That May Be Made Without Your Consent, Authorization or Opportunity to Object . In addition to our permitted uses or disclosures of your PHI for treatment, payment or health care operation purposes, as generally described in Part II.A above, we may use or disclose your PHI, without your consent or opportunity to object as follows:
Required By Law . As and to the extent required by applicable law, including laws requiring the reporting of abuse, neglect or domestic violence or certain types of wounds or physical injuries, so long as such use or disclosure complies with and is limited to the relevant requirements of such law(s).
Public Health and Related Activities . For public health activities, to: (i) a public health authority for purposes of preventing or controlling diseases, injuries or disabilities or for public health surveillances, investigations or interventions; (ii) a public health authority or other appropriate governmental authority for purpose of reporting child abuse or neglect; (iii) a person subject to FDA jurisdiction, for activities related to the quality, safety or effectiveness of FDA-regulated drugs, medical devices, products or activities; (iv) a person who may have been exposed to a communicable disease or who may otherwise be at risk of contracting or spreading a disease or condition, if either we or an applicable public health authority are legally authorized to notify such person in the conduct of a public health intervention or investigation; and/or (v) your employer, if we provide our medical services at your employer’s request (to evaluate whether you have a work related injury), subject to certain specified limitations and subject to the satisfaction of certain specified conditions.
Health Oversight . To a health oversight agency for oversight activities authorized by law, including audits; civil, administrative or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions; or other activities necessary for appropriate oversight of:(i) the health care system, (ii) relevant government benefit programs, and/or (iii) entities subject to government regulatory programs or civil rights laws, for purposes of determining our or such other entities’ compliance with such programs or laws.
Threats to Health/Safety . To the extent otherwise authorized by applicable law, to prevent or lessen a serious and immediate threat to the health or safety of a person or the public, provided our disclosure is made to a person or persons who we, in good faith, believe is or are reasonably able to prevent or lessen such threat.
Abuse, Neglect, Domestic Violence. To an authorized government authority if we reasonably believe you to be a victim of abuse, neglect, or domestic violence. If we make a disclosure of your PHI for this purpose, then, except in limited circumstances, we are obligated to promptly inform you (or your personal representative) that such disclosure has been (or will be) made.
Legal Proceedings . When required by a court or administrative tribunal order. Subject to certain limits or conditions, we may also disclose your PHI in response to subpoenas, discovery requests, or pursuant to other legal process,
Law Enforcement .In compliance with and as limited by (i) a court order or court-ordered warrant, subpoena or summons issued by a judicial officer, (ii) a grand jury subpoena, or (iii) an administrative request (which includes administrative subpoenas or summons, civil or an authorized investigative demands or similar process authorized by law), We may also disclose the following information concerning you in response to a law enforcement official’s request for assistance in identifying or locating a suspect, fugitive, material witness, or missing person: (i) your name, address, date and place of birth (and, if applicable, death), social security number, any of your distinguishing physical characteristics and ABO blood type and rh factor; and ii) the type of injury (or injuries) to which our medical services relate and the date(s)/time(s) our medical services were provided. Further, if you are (or are suspected of being) a crime victim, then we also disclose your PHI in response to a law enforcement official’s requests related thereto if authorized by law, to the extent relevant and material to a legitimate law enforcement inquiry (not involving legal action against you).
Coroners, Funeral Directors, and Organ Donation. If relevant, to a coroner or medical examiner , for identification of a deceased person, determining a person’s cause of death or otherwise to facilitate the authorized legal duties of a coroner or medical examiner; and to a funeral director, consistent with applicable law, if necessary for the funeral director to carry out his or her duties. If you are an “organ” donor, to organizations that handle organ, eye or tissue procurement or transplantation, to facilitate organ or tissue donation or transplantation.
For Certain Research Purposes . For certain statistical and scientific research purposes provided we receive certain documentation or assurances from an applicable institutional review or privacy board or researcher specified under the HIPAA Privacy Rules. (Other uses and disclosures of your PHI for research purposes will only be permitted if made pursuant to an unrevoked valid written authorization given by you.)
Specialized Government Functions . If a member of the U.S. or foreign armed forces, as deemed necessary for the proper execution of a military mission by appropriate military command authorities, or, a member of the U.S. armed forces, to the component of the Department of Veterans Affairs that determines eligibility for or entitlement to VA benefits. We may disclose your PHI to authorized federal officials for the conduct of lawful intelligence, counter-intelligence, and other national security activities, and for the provision of protective services to the United States President or other legally authorized persons.If incarcerated (or in held in custody), to a correctional institution or law enforcement official having lawful custody of you, for specified purposes.
Workers’ Compensation . As authorized to comply with workers’ compensation laws, and other similar established programsestablished by law and which provide benefits for work-related injuries without regard to fault.
Secretary of DHHS . To the Secretary of the U.S, Department of Health and Human Services in connection with a government investigation or determination of our compliance with the HIPAA privacy, breach notification and security rules,
C. Other Permitted and Required Uses and Disclosures Requiring Notice/ Opportunity to Object. We may use and disclose your PHI as follows, provided, (i) you have agreed (verbally or in writing) to these uses/disclosures, (ii) we provide you with an opportunity to object to these uses/disclosures and you do not object, (iii) we reasonably infer, from the circumstances, based on our professional judgment, that you do not (or would not) object, or, (iv) if you are not present, or are otherwise unavailable due to an incapacity or emergency circumstances, we, in the exercise of our professional judgment, determine it to be in your best interests:
Others Involved In Your Healthcare . During your lifetime, we may disclose to a family member, other relative, close personal friend or any other person(s) you may identify, such of your PHI directly relevant to such person’s involvement with your health care or payment for your health care. We may also use or disclose your PHI to notify, or assist us in notifying, any such family member, relative, friend, person or other individual responsible for your care, of your location or general condition; and, if applicable, may use or disclosure your PHI to coordinate any such notifications by or with a public or private entity authorized by law or charter to assist in disaster relief efforts. Unless you otherwise object, in our discretion, if we believe it to be in your best interests, we may allow a person designated by you to pick up at our office, on your behalf, prescriptions, medical supplies, diagnostic films or other similar items we may write, order/fill or perform for you.
Deceased Patients . Following your death, unless inconsistent with preferences you expressed to us while living, we may disclose to your family member(s), relative(s), close personal friends or other person(s) identified by you while alive and involved with your care or payment for your health care prior to death, the portion of your PHI relevant to such involvement.
D. Other Uses and Disclosures of PHI-Requirement for Written Authorization. Uses or disclosures of your PHI for marketing purposes, disclosures of your PHI that constitute a “sale” (as defined under the HIPAA Privacy Rules) and any other uses or disclosures of your PHI not described in this NPP, may only be made by us pursuant to and in accordance with a written authorization, if applicable, you may provide us. Any such written authorization given by you must be in form and content required by HIPAA and applicable Florida law, and may be revoked or terminated by you at any time by delivery of written notice of revocation to our Privacy Office. (Any such revocation of a previously granted written authorization will not be effective as to any actions we may have taken in reliance on the revoked authorization before receipt of your written notice of revocation.)
III. YOUR RIGHTS
The following outlines certain specific rights granted you under the HIPAA Privacy Rules with regard to your PHI (or our communications to you concerning your PHI), and briefly describes how you may exercise these rights:
Right to Inspect/Copy/Receive Copy of PHI . Subject to very limited exceptions, you have the right to inspect and copy or obtain a copy of your PHI which we maintain in your medical and billing records or other designated records. (Such right includes the right to request we transmit a copy of such PHI to you or directly to another person. All such requests must be made in writing and delivered to our Privacy Office; provided, a written request for us to transmit a copy of such PHI directly to another person must be signed by you and clearly identify such other person and where we are to send such copy. If a copy is requested, then we may charge you a reasonable cost-based fee (permitted by applicable Florida law), based on our costs of labor, supplies and postage in satisfying your request.
Unless a request for access or copy is properly denied by us , we are legally obligated to provide you with access to (or a copy of) your PHI or requested portions thereof, in form and format you request, provided, the requested PHI is readily producible by us in such requested form and format; or, if not, in a readable hard copy unless you and we otherwise mutually agree, If you request access to or a copy of your PHI which we maintain in electronic form and you request we provide you with an electronic copy of such record(s), then we are legally obligated to furnish you with the requested PHI (or access thereto) in the electronic form and format you request, if the requested PHI is readily producible by us in such form and format; or, if not, in a readable electronic form and format you and we agree.
Right to Request Restrictions on Certain Uses/Disclosures of Your PHI . You have the right to request in writing (delivered to our Privacy Office) that we restrict an otherwise permitted use or disclosure of your PHI for treatment, payment or health care operation purposes, or our disclosures (or uses and disclosures) of your PHI as described in Part C of Section II of this NPP; however, with one exception, we are not legally obligated to agree to any such requested restrictions. If we agree to any such requested restriction, we will be legally obligated to comply with such requested restriction, provided, we can use or disclose your PHI (i) as necessary to provide you (whether by us or others) with emergency treatment, or (ii) as permitted or required by applicable law for any non-treatment, payment or health care operation purpose otherwise described in this NPP.
Any written request sent our Privacy Office asking us to restrict our use or disclosure of your PHI for treatment, payment or health care operation purposes, should include a description of: (1) the specific PHI you want to restrict our use or disclosure of; (2) how you want to restrict our use or disclosure of the specified PHI (and/or to whom you want the requested restrictions to apply to); and (3) the time period you want the requested restriction to apply.
A restriction you may request on our use or disclosure of your PHI for treatment, payment or health care operation purposes and which have been agreed to by us may be terminated at any time by you, we (you and us) or us, provided, a termination by us must be made in writing. Any termination by us of a previously requested and agreed to restriction on our use/disclosure of your PHI for treatment, payment or health care operation purposes will only be effective to such of your PHI that we create or receive after you receive written notice of our termination of such restriction.
Requested Restriction We Must Agree To. You may request in writing that we not disclose to a health plan, for payment or health care operation purposes, your PHI pertaining solely to any of our medical services for which you or someone on your behalf (not a health plan) has paid us in full. (This excludes payments made by or on your behalf which are applied to patient “co-pays” or “deductibles” for which you are responsible). If any such restriction is requested by you in writing, then we would be legally obligated to agree to such restriction, and would not be permitted to unilaterally terminate such requested restriction or our “agreement” thereto.
Right to Request Confidential Communications by or to A lternative Means/Locations. In connection with our treatment of you, we will or may send communications to you containing or concerning your PHI, including, sending you copies of requested medical or billing records, and contacting you, if applicable, about outstanding invoices for our services or to provide appointment reminders. You have the right to request, in writing, delivered or sent to our Privacy Office, that our communications to you of or concerning your PHI be made by alternate means or at alternate locations (from the means or locations we otherwise would use). We are legally obligated to accommodate any such reasonable written request you may make, provided: (i) your written request specifies, in reasonable detail, both the confidential communications from us you want transmitted by alternate means or at alternate locations and the specific alternate means, address, phone number or other alternate method of contact you want us to use to transmit these communications to you, and, (ii) if accommodating your request would cause us to incur costs and expenses above those we otherwise would incur had such request not been made, we receive adequate information from you concerning how payment of these additional costs and expenses will be handled.
Right to Amend Your PHI . You have the right to request in a writing that we amend your PHI which we otherwise create or maintain and retain in your medical or billing records (or in other discrete records we may maintain). Any such written request to amend your PHI must be sent or delivered to our Privacy Office and specify the reason or basis for your request to amend. In certain cases we may deny any such request you may make. If we deny a written request you may make to amend any of your PHI created or maintained by us, we will be legally obligated to provide you, on a timely basis, with (i) written notice of our denial, setting forth the basis for such decision, (ii) statements of your rights resulting from our denial of your request to amend your PHI, including a statement of your right to submit (and a description of how you may file) a statement of disagreement with our decision or, if not submitted, a statement of your right to request we provide a copy of your amendment request and our written denial of such request with any future disclosures we may make of your PHI which is the subject of such amendment request; and (iii) a description of how you may file a complaint concerning our denial of your amendment request with our Privacy Office, the Secretary of the U.S. Department of Health and Human Services or both.
Right to Accounting of Specified Disclosures of Your PHI . You have the right to request and receive an accounting of all disclosures of your PHI made by us or on our behalf during the six year period (or such shorter period, if any, you may specify) prior to our receipt of your request for an “accounting,” other than (the “Excluded Disclosures”) disclosures of your PHI we make: (i) for treatment, payment or health care operation purposes; (ii) to the persons or for the purposes described in Section C of Part II of this NPP (iii) directly to you; (iv) pursuant to a valid written authorization given by you; (v) incident to an otherwise permitted or required use or disclosure of your PHI; (v) for national security and intelligence purposes; (vi) to correctional institutions or law enforcement officials having lawful custody of you; and/or (vii) in paper or electronic form if it omits specified information that could allow the recipient thereof to identify you, other members of your household, any of your relatives or your employer. Under certain circumstances, your right to an accounting of prior disclosures of your PHI we may make for health oversight or law enforcement activities will be temporarily suspended. Please direct all requests for such accounting to our Privacy Office.
Note that, the first request you may make during any 12-month period for an accounting of our prior disclosures of your PHI (excluding the Excluded Disclosures) will be furnished without charge. For each subsequent accounting request, if any, you may make during a given 12-month period, such accounting(s) will be furnished at a reasonable cost-based fee, provided, before providing you with any such subsequently requested accountings, we will inform you of the fee we will charge for such accounting(s) and provide you with a reasonable opportunity to withdraw or modify such subsequent accounting request(s) so as to avoid or reduce such fee.