COMMITMENT TO PATIENT PRIVACY:
Our Practice is dedicated to maintaining the privacy of Protected Health Information (PHI). Protected Health Information is defined as individually identifiable health information. In conducting our business, we will create records regarding patients and the treatment and services we provide our patients. We are required by law to maintain the confidentiality of health information that identifies any patient. We are required by law to provide patients with a notice of our legal duties and the privacy practices that we maintain in our practice concerning PHI. By federal law, we must follow the terms of the Notice of Privacy Practices that we have in effect at the time and which we post in our waiting areas.
We must provide patients with the following information:
- How we may use and disclose PHI
- Patients' privacy rights regarding PHI
- Our obligations concerning the use and disclosure of PHI
Our privacy policies apply to all records containing PHI that are created or retained by our practice. We reserve the right to revise or amend our policies or the Notice of Privacy Practices. Any revision or amendment to the notice will be effective for all patient records that our practice has created or maintained in the past, and for any of records that we may create or maintain in the future. Our Practice will post a copy of our current Notice of Privacy Practices in our offices(s) in visible locations at all times, and patients may request a copy of our most current Notice at any time.
Our policies and procedures comprise the methods by which we are ethically committed to protect the privacy and confidentiality of our patients. Employees who fail to respect our patient's privacy and confidentiality may be sanctioned and terminated.
QUESTIONS ABOUT THIS NOTICE SHOULD BE DIRECTED TO:
A. WE MAY USE AND DISCLOSE PHI IN THE FOLLOWING WAYS:
Practice Administrator or Compliance Officer
Lowcountry Cardiology Associates, P.A.
4969 Centre Pointe Dr
North Charleston, SC 29461
B. USE AND DISCLOSURE OF PHI IN CERTAIN SPECIAL CIRCUMSTANCES
- Treatment. Our practice may use your PHI to treat a patient. For example, we may ask the patient to have laboratory tests or radiological exams and we may use the results to help us reach a diagnosis. We might use PHI in order to write a prescription. Or we might disclose PHI to a pharmacy when we order a prescription. Many of the people who work for our practice - including, but not limited to, doctors and nurses - may use or disclose PHI in order to treat a patient or to assist others in patient treatment. Additionally, we may disclose PHI to others who may assist in patient care, such as a patient spouse, children or parents.
- Payment. Our practice may use and disclose PHI in order to bill and collect payment for the services and items you may receive from us. For example, we may contact a health insurer to certify that a patient is eligible for benefits (and for what range of benefits), and we may provide an insurer with details regarding treatment to determine if an insurer will cover, or pay for, treatment. We also may use and disclose PHI to obtain payment from third parties that may be responsible for such costs, such as family members. Also, we may use PHI to bill a patient directly for services and items.
- Health Care Operations. Our practice may use and disclose PHI to operate our business. As examples of the ways in which we may use and disclose PHI for our operations, our practice may use PHI to evaluate quality of care, or to conduct cost-management and business planning activities for our practice.
- Appointment Reminders. Our practice may use and disclose PHI to contact a patient and remind them of an appointment.
- Treatment Options. Our practice may use and disclose PHI to inform the patient of potential treatment options or alternatives.
- Health-Related Benefits and Services. Our practice may use and disclose PHI to inform the patient of health-related benefits or services that may be of interest to the patient.
- Release of Information to Family/Friends. Our practice may release PHI to a friend or family member that is involved in the patient's care, for example, a parent or guardian may ask that a babysitter bring their child to the our office for treatment of a cold. In this example, the babysitter may have access to this child's medical information.
- Disclosures Required By Law. Our practice will use and disclose PHI when we are required to do so by federal, state or local law.
The following categories describe unique scenarios in which we may use or disclose PHI:
C. PATIENT RIGHTS REGARDING PHI
- Public Health Risks. Our practice may disclose PHI to public health authorities that are authorized by law to collect information for the purpose of:
- maintaining vital records, such as births and deaths reporting child abuse or neglect
- preventing or controlling disease, injury or disability
- notifying a person regarding potential exposure to a communicable disease
- notifying a person regarding a potential risk for spreading or contracting a disease or condition
- reporting reactions to drugs or problems with products or devices
- notifying individuals if a product or device they may be using has been recalled
- notifying appropriate government agency(ies) and authority(ies) regarding the potential
- abuse or neglect of an adult patient (including domestic violence); however, we will only disclose this information if the patient agrees or we are required or authorized by law to disclose this information
- notifying your employer under limited circumstances related primarily to workplace injury or illness or medical surveillance.
- Health Oversight Activities. Our practice may disclose PHI to a health oversight agency for activities authorized by law. Oversight activities can include:
- licensure and disciplinary actions
- civil, administrative, and criminal procedures or actions
- other activities necessary for the government to monitor government programs, compliance with civil rights laws and the health care system in general.
- Lawsuits and Similar Proceedings. Our practice may use and disclose PHI in response to a court or administrative order. We also may disclose PHI in response to a discovery request, subpoena, or other lawful process by another party involved in the dispute, but only if we have made an effort to inform the patient of the request or to obtain an order protecting the information the party has requested.
4. Law Enforcement. We may release PHI if asked to do so by a law enforcement official:
- regarding a crime victim in certain situations, if we are unable to obtain the person's agreement.
- concerning a death we believe has resulted from criminal conduct.
- regarding criminal conduct at our offices.
- in response to a warrant, summons, court order, subpoena or similar legal process
- to identify/locate a suspect, material witness, fugitive or missing person
- In an emergency, to report a crime (including the location or victim(s) of the crime, or the description, identity or location of the perpetrator)
- Deceased Patients. Our practice may release PHI to a medical examiner or coroner to identify a deceased individual or to identify the cause of death. If necessary, we also may release information in order for funeral directors to perform their jobs.
- Research. Our practice may use and disclose PHI for research purposes in certain limited circumstances. We will obtain written authorization from the patient to use PHI for research purposes except when:
- our use or disclosure was approved by an Institutional Review Board or a Privacy Board;
- we obtain the oral or written agreement of a researcher that
- the information being sought is necessary for the research study;
- the use or disclosure of your PHI is being used only for the research and
- the researcher will not remove any PHI from our practice; or
- the PHI sought by the researcher only relates to decedents and the researcher agrees either orally or in writing that the use or disclosure is necessary for the research and, if we request it, to provide us with proof of death prior to access to the PHI of the decedents.
- Serious Threats to Health or Safety. Our practice may use and disclose PHI when necessary to reduce or prevent a serious threat to health and safety or the health and safety of another individual or the public. Under these circumstances, we will only make disclosures to a person or organization able to help prevent the threat.
- Military. Our practice may disclose PHI if the patient is a member of U.S. or foreign military forces (including veterans) and if required by the appropriate authorities.
- National Security. Our practice may disclose PHI to federal officials for intelligence and national security activities authorized by law. We also may disclose PHI to federal officials in order to protect the President, other officials or foreign heads of state, or to conduct investigations.
- Inmates. Our practice may disclose PHI to correctional institutions or law enforcement officials if the patient is an inmate or under the custody of a law enforcement official. Disclosure for these purposes would be necessary:
- for the institution to provide health care services to you,
- for the safety and security of the institution, and/or
- to protect your health and safety or the health and safety of other individuals.
- Workers' Compensation. Our practice may release PHI for workers' compensation and similar programs. However, we are prohibited from discussing PHI with the employer or the employer's representatives.
A patient has the following rights regarding the PHI that we maintain about them:
D. GENERAL POLICIES AND PROCESSES
- Confidential Communications. The patient has the right to request that our practice communicate with them about their health and related issues in a particular manner or at a certain location. For instance, the patient may ask that we contact them at home, rather than work. In order to request a type of confidential communication, the patient must make a written request to The Practice Manager specifying the requested method of contact, or the location where they wish to be contacted. Our practice will accommodate reasonable requests. The patient does not need to give a reason for their request.
- Requesting Restrictions. The patient has the right to request a restriction in our use or disclosure of their PHI for treatment, payment or health care operations. Additionally, the patient has the right to request that we restrict our disclosure of their PHI to only certain individuals involved in their care or the payment for their care, such as family members and friends. We are not required to agree to the patient's request; however, if we do agree, we are bound by our agreement except when otherwise required by law, in emergencies, or when the information is necessary to treat the patient. In order to request a restriction in our use or disclosure of PHI, the patient must make the request in writing to The Practice Manger. The request must describe in a clear and concise fashion:
- the information the patient wishes to be restricted
- whether they are requesting to limit our practice's use, disclosure or both
- to whom they want the limits to apply.
- Inspection and Copies. The patient has the right to inspect and obtain a copy of the PHI that may be used to make decisions about them, including patient medical records and billing records, but not including psychotherapy notes. The patient must submit their request in writing to the Practice Manger in order to inspect and/or obtain a copy of their PHI. Our practice may charge a fee for the costs of copying, mailing, labor and supplies associated with your request. Our practice may deny the request to inspect and/or copy in certain limited circumstances; however, the patient may request a review of our denial. Another licensed health care professional chosen by us will conduct reviews.
- Amendment. The patient may ask us to amend health information if they believe it is incorrect or incomplete, and the patient may request an amendment for as long as the information is kept by or for our practice. To request an amendment, the request must be made in writing and submitted to the Practice Manager. The patient must provide us with a reason that supports their request for amendment. Our practice will deny the request if the patient fails to submit their request (and the reason supporting your request) in writing. Also, we may deny the request if the patient asks us to amend information that is -- in our opinion:
- accurate and complete;
- not part of the PHI kept by or for the practice
- not part of the PHI which you would be permitted to inspect and copy; or
- not created by our practice, unless the individual or entity that created the information is not available to amend the information.
- Accounting of Disclosures. All of our patients have the right to request an "accounting of disclosures." An "accounting of disclosures" is a list of certain non-routine disclosures our practice has made of a patient's PHI for non-treatment or operations purposes. Use of PHI as part of the routine patient care in our practice is not required to be documented. For example, the doctor sharing information with the nurse; or the billing department using PHI to file an insurance claim. In order to obtain an accounting of disclosures, the patient must submit the request in writing to the Practice Manager. All requests for an "accounting of disclosures" must state a time period, which may not be longer than six (6) years from the date of disclosure and may not include dates before April 14, 2003. The first list a patient requests within a 12-month period is free of charge, but our practice may charge for additional lists within the same 12-month period. Our practice will notify the patient of the costs involved with additional requests, and the patient may withdraw the request before incurring any costs.
- Right to a Paper Copy of the Notice of Privacy Practices. The patient is entitled to receive a paper copy of our notice of privacy practices. The patient may ask us for a copy of the notice at any time.
- Right to File a Complaint. If the patient believes his or her privacy rights have been violated, they may file a complaint with our practice or with the Secretary of the Department of Health and Human Services. To file a complaint with our practice, the patient is notified in the Notice to contact the Practice Manager. All complaints must be submitted in writing. The patient will not be penalized for filing a complaint.
- Right to Provide an Authorization for Other Uses and Disclosures. Our practice will obtain a written authorization for uses and disclosures that are not identified by our notice or permitted by applicable law. Any authorization the patient provides us regarding the use and disclosure of PHI may be revoked at any time in writing. After the patient revokes the authorization, we will no longer use or disclose the PHI for the reasons described in the authorization.
- Patients' Access to Medical Records. Patients will be provided access to their medical records in accord with Paragraph C above.
- Notice of Privacy Practices. The Practice will post a copy of the practice's Notice of Privacy Practices posted in the waiting area of our offices.
- The notice will be posted prominently.
- The receptionist will make a good faith effort to give each new patient a copy of the notice.
- The Notice will be posted on the practice's website.
- Changes to the notice will be posted on the website.
- Minimum Necessary. The employees of the practice are expected to disclose only the minimum of a patient's PHI as is required to accomplish a specific task. For example, in requesting pre-authorization, the employee needs only to disclose the PHI necessary to the specific procedure. However, when the physicians or physicians of another practice require the entirety of PHI to facilitate medical decision making, withholding PHI would be inappropriate. Abuse or poor judgement regarding this concept and this requirement may be cause for disciplinary action.
- Privacy Official. The practice will appoint an employee to act as the privacy official. This employee shall have the responsibility of:
- Becoming informed and remaining knowledgeable on Privacy laws and regulations
- Receiving and handling complaints from patients
- Maintaining and amending the practice's privacy policies
- Planning and providing for employee training in Privacy.
- Employee Training. All new employees will receive training in the practice's privacy policies. Periodically, all staff will receive additional training or review.
- Business Associates. The practice will write or cause to be written business associates agreements which comply with the HIPAA statutory requirements with all suppliers, vendors or business associates whose work on behalf of the practice requires the use of PHI.
- Policies and Procedures. The practice will endeavor to develop, maintain and enforce procedures which are consistent with our policies. All Notices of Privacy Practice and all written policies and all written procedures are subject to revision and improvement. Each version of these documents will be kept on file for six years.