HIPAA Policy
Your Health Information Rights
The health and billing records we maintain are the physical property of the Practice. The information in them, however, belongs to you. You have a right to:
- Obtain a paper copy of our current Notice of Privacy Practices for PHI (“the Notice”);
- Receive Notification of a breach of your unsecured PHI;
- Request restrictions on certain uses and disclosures of your health information. We are not required to grant most requests, but we will comply with any request with which we agree. We will, however, agree to your request to refrain from sending your PHI to your health plan for payment or operations purposes if at the time an item or service is provided to you, you pay in full and out-of-pocket;
- Request that you be allowed to inspect and copy the information about you that we maintain in the Practice’s designated record set. You may exercise this right by delivering your request, in writing, to our Practice;
- Appeal a denial of access to your PHI, except in certain circumstances;
- Request that your health care record be amended to correct incomplete or incorrect information by delivering a written request to our Practice. We may deny your request if you ask us to amend information that (a) was not created by us (unless the person or entity that created the information is no longer available to make the amendment), (b) is not part of the health information kept by the Practice, (c) is not part of the information that you would be permitted to inspect and copy, or (d) is accurate and complete. If your request is denied, you will be informed of the reason for the denial and will have an opportunity to submit a statement of disagreement to be placed in your record;
- Request that communication of your health information be made by alternative means or at alternative locations by delivering a written request to our Practice;
- If we engage in fundraising activities and contact you to raise funds for our Practice, you will have the right to opt-out of any future fundraising communications;
- Obtain a list of instances in which we have shared your health information with outside parties, as required by the HIPAA Rules.
- Revoke any of your prior authorizations to use or disclose information by delivering a written revocation to our Practice (except to the extent action has already been taken based on a prior authorization).
Our Responsibilities
The Practice is required to:
- Maintain the privacy of your health information as required by law;
- Notify you following a breach of your unsecured PHI;
- Provide you with a notice (‘Notice’) describing our duties and privacy practices with respect to the information we collect and maintain about you and abide by the terms of the Notice;
- Notify you if we cannot accommodate a requested restriction or request; and,
- Accommodate your reasonable requests regarding methods for communicating with you about your health information and comply with your written request to refrain from disclosing your PHI to your health plan if you pay for an item or service we provide you in full and out-of-pocket at the time of service.
We reserve the right to amend, change, or eliminate provisions of our privacy practices and to enact new provisions regarding the PHI we maintain about you. If our information practices change, we will amend our Notice. You are entitled to receive a copy of the revised Notice upon request by phone or by visiting our website or Practice.
Other Uses and Disclosures of your PHI
Communication with Family
- Using our best judgment, we may disclose to a family member, other relative, close personal friend, or any other person you identify, health information relevant to that person’s involvement in your care or payment for care, if you do not object or in an emergency. We may also do this after your death, unless you tell us before you die that you do not wish us to communicate with certain individuals.
Notification
- Unless you object, we may use or disclose your PHI to notify, or assist in notifying, a family member, personal representative, or other person responsible for your care about your location, your general condition, or your death.
Research
- We may disclose information to researchers if an institutional review board has reviewed the research proposal and established protocols to ensure the privacy of your PHI. We may also disclose your information if the researchers require only a limited portion of your information.
Disaster Relief
- We may use and disclose your PHI to assist in disaster relief efforts.
Organ Procurement Organizations
- Consistent with applicable law, we may disclose your PHI to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs for the purpose of tissue donation/transplant.
Food and Drug Administration (FDA)
- We may disclose to the FDA your PHI relating to adverse events with respect to food, supplements, products and product defects, or post-marketing surveillance information to enable product recalls, repairs, or replacements.
Workers’ Compensation
- If you are seeking compensation from Workers Compensation, we may disclose your PHI to the extent necessary to comply with laws relating to Workers Compensation.
Public Health
- We may disclose your PHI to public health or legal authorities charged with preventing or controlling disease, injury, or disability; to report reactions to medications or problems with products; to notify people of recalls; or to notify a person who may have been exposed to a disease or who is at risk for contracting or spreading a disease or condition.
As Required by Law
- We may disclose your PHI as required by law, or to appropriate public authorities as allowed by law to report abuse or neglect.
Employers
- We may release health information about you to your employer if we provide health care services to you at the request of your employer, and the health care services are provided either to conduct an evaluation relating to medical surveillance of the workplace or to evaluate whether you have a work-related illness or injury. In such circumstances, we will give you written notice of the release of information to your employer. Any other disclosures to your employer will be made only if you execute a specific authorization for the release of information to your employer.
Law Enforcement
- We may disclose your PHI to law enforcement officials (a) in response to a court order, court subpoena, warrant or similar judicial process; (b) to identify or locate a suspect, fugitive, material witness, or missing person; (c) if you are a victim of a crime and we are unable to obtain your agreement; (d) about criminal conduct on our premises; and (e) in other limited emergency circumstances where we need to report a crime.
Health Oversight
- Federal law allows us to release your PHI to appropriate health oversight agencies or for health oversight activities such as state and federal auditors.
Judicial/Administrative Proceedings
- We may disclose your PHI in the course of any judicial or administrative proceeding as allowed or required by law, with your authorization, or as directed by a proper court order.
For Specialized Governmental Functions or Serious Threat
- We may disclose your PHI for specialized government functions as authorized by law such as to Armed Forces personnel, for national security purposes, to public assistance program personnel, or to avert a serious threat to health or safety. We may disclose your PHI consistent with applicable law to prevent or diminish a serious, imminent threat to the health or safety of a person or the public.
Correctional Institutions
- If you are an inmate of a correctional institution, we may disclose to the institution or its agents the PHI necessary for your health and the health and safety of other individuals.
Coroners, Medical Examiners, and Funeral Directors
- We may release health information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release health information about our Patients to funeral directors as necessary for them to carry out their duties.
Website
- You may access a copy of this Notice electronically on our website.
Other uses and disclosures of your PHI not described in this Notice will only be made with your authorization, unless otherwise permitted or required by law. Most uses and disclosure of psychotherapy notes, uses and disclosures of your PHI for marketing purposes, and disclosures of your PHI that constitute a sale of PHI will require your authorization. You may revoke any authorization at any time by submitting a written revocation request to the Practice (as previously provided in this Notice under “Your Health Information Rights.”)
To Request Information, Exercise a Patient Right, or File a Complaint
If you have questions, would like additional information, want to exercise a Patient Right described above, or believe your (or someone else’s) privacy rights have been violated, you may contact the Practice’s Privacy Officer at 720-668-8818, or in writing to us at:
ECCO Medical
8080 Park Meadows Dr. Suite 150
Lone Tree, CO 80124
Please note that all complaints must be submitted in writing to the Privacy Officer at the above address. You may also file a complaint with the Secretary of Health and Human Services (HHS), Office for Civil Rights (OCR). Your complaint must be filed in writing, either on paper or electronically, by mail, fax, or e-mail. The address for the Colorado regional office is: Office for Civil Rights, U.S. Department of Health and Human Services, 999 18th Street, Suite 417, Denver, CO 80202; or call (800) 368-1019. More information regarding the steps to file a complaint can be found at: www.hhs.gov/ocr/privacy/hipaa/complaints.
- We cannot, and will not, require you to waive the right to file a complaint with the Secretary of HHS as a condition of receiving treatment from the Practice.
- We cannot, and will not, retaliate against you for filing a complaint with the Secretary of HHS.