HIPAA Info

NOTICE OF PRIVACY PRACTICES

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Effective Date of Notice: September 23, 2013

Revised: June 1, 2013

HIMG is dedicated to protecting your medical information. We are required by law to take reasonable steps to ensure the privacy of your personally identifiable health information and to inform you about:

  • Your privacy rights with respect to your protected health information (PHI);
  • HIMG’s duties with respect to your PHI;
  • Your right to file a complaint with HIMG and with the Secretary of the U.S. Department of Health and Human Services; and
  • The person or office to contact for further information about HIMG’s privacy practices.

Section 1 - Notice of PHI uses and disclosures

As explained in this Notice, HIMG may generally use or disclose your PHI for treatment, payment or health care operations without the need for you to provide your consent or authorization. HIMG is also permitted to disclose your PHI to other persons or entities pursuant to and in compliance with a valid authorization from you, pursuant to your agreement, or as otherwise permitted or provided for by applicable law.

Upon your request, HIMG is also generally required to give you access to certain PHI in order to inspect and copy it.

Use and disclosure of your PHI may also be required by the Secretary of the Department of Health and Human Services in order to investigate or determine HIMG’s compliance with the privacy regulations.

Uses and Disclosures for Treatment, Payment and Health Care Operations

HIMG and its business associates may use or disclose PHI without your consent, authorization or opportunity to agree or object in order to carry out treatment, payment and health care operations.

Treatment is the provision, coordination or management of health care and related services. It also includes, but is not limited to, consultations and referrals between one or more of your providers. For example, an HIMG primary care physician may disclose X-rays, reports, and or films to a consulting physician for continuity of care.

Payment includes, but is not limited to, actions relating to coverage determinations and payment (including billing, claims management, reviews for medical necessity and appropriateness of care and receiving pre-authorizations). For example, an HIMG employee may contact your insurance carrier to verify whether you are eligible for coverage or to pre-certify a procedure.

Health care operations include, but are not limited to, conducting quality assessment and improvement activities, reviewing the competence of health care professionals, evaluating provider performance, for accreditation, conducting or arranging medical reviews, legal services and auditing functions, business planning and development, business management and general administrative activities. For example, HIMG may use information about your services in order to perform compliance audits or peer review on our physicians.

Other Uses and Disclosures for Which Consent, Authorization or the Opportunity to Object is Not Required

Use and disclosure of your PHI is also allowed without your consent, authorization or request under the following circumstances:

  1. When required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.

  2. When permitted for public health activities and purposes. Such uses and disclosures may include, but are not limited to, disclosures to public health or governmental entities authorized by law to collect or receive information for the purpose of preventing or controlling disease, disclosures to public health authorities or governmental agencies authorized by law to receive reports of child abuse or neglect, disclosures to persons subject to the Food and Drug Administration to report adverse events, product defects, and to facilitate product recalls. PHI may also be disclosed to an employer subject to certain conditions.

  3. When authorized by law to report information about abuse, neglect or domestic violence to public authorities if there exists a reasonable belief that you may be a victim of abuse, neglect or domestic violence. In such case, HIMG will promptly inform you that such a disclosure has been or will be made unless we reasonably believe that such disclosure would cause a risk of serious harm.

  4. When required by public health agencies for oversight activities authorized by law. Such uses and disclosures may include, but are not limited to, disclosures required by civil, administrative or criminal investigations, proceedings or actions, activities necessary for the appropriate oversight of the health care system, and other activities necessary for appropriate oversight of government benefit programs.

  5. When required for disaster relief. Uses and Disclosures of PHI may occur during coordination of a private or public entity, such as the American Red Cross, to assist in disaster relief efforts.

  6. When required for judicial or administrative proceedings, including disclosures in response to a subpoena, court order or pursuant to a discovery request provided that certain conditions are met.

  7. When required or permitted by law for law enforcement purposes, including, but not limited to, disclosures pursuant to legal process, disclosures for the purpose of identifying or locating a suspect, fugitive, material witness or missing persons, and/or disclosures relating to individuals suspected to be a victim of crime under certain circumstances.

  8. When required by a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death or other duties as authorized by law. Also, disclosures may be made to funeral directors, consistent with applicable law, as necessary to carry out their duties with respect to the decedent.

  9. When required for research papers, subject to certain conditions.

  10. When consistent with applicable law and standards and standards of ethical conduct if HIMG, in good faith, believes the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and the disclosure is to a person reasonably able to prevent or lessen the threat, including the target of the threat.

  11. When required for specialized governmental functions under certain conditions.

  12. When authorized by and to the extent necessary to comply with workers’ compensation or other similar programs established by law.

We may also contact you to provide appointment reminders, notice of missed appointments, requests dealing with fundraising activities, information about treatment alternatives or other health related benefits and services that may be of interest to you. This information may be distributed by mail, email, or by phone. You will be given the opportunity to opt out of fundraising notices. HIMG may disclose protected health information to its business associated permitted by law. To protect your PHI, we require our business associates to approximately safeguard the health information of our patients.

Except as Otherwise Indicated in this Notice, Uses and Disclosure of Your PHI will be Made Only With Your Written Authorization Subject to Your Right to Revoke Such Authorization.

Uses and Disclosures that Require Your Written Authorization

HIMG must generally obtain an authorization from you for the use or disclosure of psychotherapy notes. Your authorization is not required for uses or disclosures of such notes which are necessary for treatment, payment or health care operations, including the use, by the originator of the psychotherapy notes, for treatment, or the use or disclosure of such information for training purposes as provided by law. We may also use and disclose such notes to defend against litigation or secure legal proceeding brought by you or on your behalf.

HIMG must also obtain an authorization from you for the use or disclosure of PHI for marketing purpose and sale of PHI, except otherwise provided by law.

Other Uses and Disclosures that Require that You be Given an Opportunity to Agree or Disagree Prior to the Use or Release

Unless otherwise required or permitted by law or by your authorization, disclosure of your PID to family members, other relatives and your close personal friends is allowed only if the information is directly relevant to the family or friend’s involvement with your care or payment for that care, and you have either agreed to the disclosure or have been given an opportunity to object and have not objected.

Section 2 - Individual Rights

Right to Request Restrictions on PHI Uses and Disclosures

You may request that HIMG restrict certain uses and disclosures of your PHI to carry out treatment, payment or healthcare operations for which you have paid for out-of-pocket in full. You or your personal representative will be required to complete a form to request restrictions on uses and disclosures of your PHI. Such requests should be made to the following officer:

Privacy Officer | (304) 528-4600 | 1-800-511-4464
5170 U.S. Rt. 60 East | Huntington, WV 25705

HIMG will accommodate reasonable requests to receive communications of PHI by alternative means or at alternative locations.

Right to Inspect and Copy PHI

You have a right to inspect and obtain a copy of your PHI contained in a “designated record set,” for as long as HIMG maintains the PHI. Your PHI, or “Protected Health Information,” includes all individually, identifiable health information transmitted or maintained by HIMG, regardless of form.

Designated Record Set includes the medical records and billing records about individuals maintained by or for a covered health care provider, enrollment, payment, billing, claims adjudication and case or management record system maintained by or for a provider; or other information used in whole or in part by or for the covered entity to make decisions about individuals. Information used for quality control or peer review analyses and not used to make decisions about individuals is not a part of a designated record set.

A response to a request for PHI information will be provided within 30 days if the information is maintained on site, or within 60 days if the information is maintained offsite. A single 30-day extension is allowed if HIMG is unable to comply with the deadline.

You or your personal representative will be required to complete a form to request access to the PHI and should be made to the following officer:

Privacy Officer | (304) 528-4600 | 1-800-511-4464
5170 U.S. Rt. 60 East | Huntington, WV 25705

If access is denied, you or your personal representative will be provided with a written denial setting forth the basis for denial, a description of how you may exercise those review rights and a description of how you may complain to HlMG or to the Secretary of the U.S. Department of Health and Human Services.

Right to Amend PHI

You have the right to request HIMG to amend your PHI or a record about you in a designated recorded set for as long as the PHI is maintained in the designated record set. You must make any amendment request in writing, stating within the request the reasons that you believe support the requested amendment.

HIMG has 60 days after the request is made to act on the request. A single 30-day extension is allowed if HIMG is unable to comply with the deadline. If the request is denied in whole or in part, HIMG must provide you with a written denial that explains the basis for the denial. You or your personal representative may then submit a written statement disagreeing with the denial and have that statement included with any future disclosures of your PHI.

You or your personal representative will be required to complete a form to request amendment of the PHI in your designated record set. Requests for amendment of PHI in a designated record set should be made to the following officer:

Privacy Officer | HIPAA Compliance Officer
5170 U.S. Rt. 60 East | Huntington, WV 25705
(304) 528-4600 | 1-800-511-4464

The Right to Receive an Accounting of PHI Disclosures

At your request and subject to limited exceptions, you are entitled to receive an accounting of disclosures by HIMG of your PHI during the six years prior to the date of your request. However, such accounting need not be provided by HIMG for PHI disclosures made: (1) to carry out treatment, payment or health care operations; (2) to individuals about their own PHI; (3) to persons involved in your care or for notification purposes required by law; (4) for national security purposes; (5) to others pursuant to your authorization; (6) to law enforcement officials as permitted by law; (7) as part of a limited data set; or (8) prior to the compliance date.

If the accounting cannot be provided by HIMG within 60 days, an additional 30 days is allowed so long as you are given a written statement of the reasons for the delay and the date by which the accounting will be provided.

If you request more than one accounting within a 12-month period, HIMG will charge a reasonable, cost-based fee for each subsequent accounting.

The Right to Receive a Paper Copy of This Notice Upon Request

To the extent that you have received this Notice on a service or benefits website maintained by HIMG, you also have the right to request and obtain a paper copy of this Notice by contacting the following officer:

HIPAA Compliance Officer
(304) 528-4600 | 1-800-511-4464
5170 U.S. Rt. 60 East | Huntington, WV 25705

A Note About Personal Representatives

You may exercise your rights through a personal representative. Your personal representative will be required to produce evidence of his/her authority to act on your behalf before that person will be given access to your PHI or allowed to take any action for you. Proof of such authority may take one of the following forms:

  • A power of attorney for health care purposes, notarized by the notary public;
  • A court order of appointment of the person as the conservator or guardian of the individual; or
  • An individual who is the parent of a minor child.

HIMG’s disclosure of PHI relating to an unemancipated minor, to a parent, guardian or other person acting in loco parentis for such unemancipated minor, is subject, at all times, to applicable provisions of state and federal law, including applicable case law.

HIMG retains discretion to deny access to PHI to a personal representative in order to provide protection to those vulnerable people who depend on others to exercise their rights under these rules and who may be subject to abuse or neglect. This also applies to personal representatives of minors.

Section 3 - HIMG’S duties

HIMG is required by law to maintain the privacy of PHI and to provide participants and beneficiaries with notice of its legal duties and privacy practices.

This Notice is effective beginning April 14, 2003 and HIMG is required to comply with the terms of this Notice. However, HIMG reserves the right to change its privacy practices and to apply the changes to any PHI received or maintained by HIMG prior to that date. If a privacy practice is changed, a revised version of this Notice will be made available to individuals for whom HIMG still maintains PHI.

Any revised version of this Notice will be made available to all affected individuals, in writing or by electronic means, upon date changes that are effective of any material change to the uses of disclosures, the individual’s rights, the duties of HIMG or other privacy practices stated in this Notice.

Minimum Necessary Standard

When using or disclosing PHI or when requesting PHI from another covered entity, HIMG will make reasonable efforts not to use, disclose or request more than the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure or request, taking into consideration practical and technological limitations. However, the minimum necessary standard will not apply in the following situations:

  • Disclosures to or requests by a health care provider for treatment;
  • Uses or disclosures made to you or on your behalf;
  • Uses or disclosures made pursuant to an authorization from you;
  • Disclosures made to the Secretary of U.S. Department of Health and Human Services;
  • Uses or disclosures that are required by law; and
  • Uses or disclosures that are required for HIMG’s compliance with legal regulations.

This Notice does not apply to information that has been de-identified. De-identified information is information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual.

Section 4 - Your right to file a complaint with HIMG or the HHS secretary

If you believe that your privacy rights have been violated, you may complain to HIMG in care of the following officer:

HIMG | HIPAA Compliance Officer
(304) 528-4600 | 1-800-511-4464
5170 U.S. Rt. 60 East | Huntington, WV 25705

You may also file a complaint with:

Secretary of the U.S. Department of Health and Human Services | Office for Civil Rights, Region III
150 S. Independence Mall West, Suite 372
Public Ledger Building | Philadelphia, PA 19106-9111

Or please email us at: [email protected]

HIMG will not retaliate against you for filing a complaint.

Section 5 - Whom to contact at HIMG for more information

If you have any questions regarding this notice or the subjects addressed in it, you may contact the following officer:

HIPAA Compliance Officer
(304) 528-4600 | 1-800-511-4464
5170 U.S. Rt. 60 East | Huntington, WV 25705
[email protected] | [email protected]

Conclusion

The uses and disclosures of PHI made by HIMG are regulated by a federal law known as HIPAA (the Health Insurance Portability and Accountability Act of 1996). You may find these rules at 45 Code of Federal Regulations Parts 160 and 164. This notice attempts to summarize the regulations. The regulations will supersede any discrepancy between the information in this notice and the regulations.