This notice describes how health information about you (as a patient of Carolina Family Healthcare) may be used and disclosed and how you can get access to your individually identifiable health information. As required by the privacy regulations created as a result of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
A. Our commitment to your privacy:
Carolina Family Healthcare (CFHC) is dedicated to maintaining the privacy of your individually identifiable health information (also called protected health information, or PHI). In conducting our business, we will create records regarding you and the treatment and services we provide to you. We are required by law to maintain the confidentiality of health information that identifies you. We also are required by law to provide you with this notice of our legal duties and the privacy practices that we maintain in our practice concerning your PHI. By federal and state law, we must follow the terms of the Notice of Privacy Practices that we have in effect at the time.
The terms of this notice apply to all records containing your PHI that are created or retained by our practice. We reserve the right to revise or amend this Notice of Privacy Practices. Any revision or amendment to this notice will be effective for all of your records that our practice has created or maintained in the past, and for any of your records that we may create or maintain in the future. Our practice will post a copy of our current Notice in our offices in a visible location at all times, and you may request a copy of our most current Notice at any time.
B. We may use and disclose your PHI without your authorization for the following purposes or situations:
1. Disclosures made to you (unless required for access or accounting of disclosures);
2. Treatment, Payment and Health Care Operations:
Treatment. Treatment is the provision, coordination, or management of health care and related services by our healthcare providers, including consultation between providers regarding referrals. Many of the people who work for our practice – including, but not limited to, our doctors and nurses – may use or disclose your PHI in order to treat you or to assist others in your treatment. Additionally, we may disclose your PHI to others who may assist in your care, such as your spouse, children or parents. Finally, we may also disclose your PHI to other health care providers for purposes related to your treatment.
Payment. Our practice may use and disclose your PHI in order to bill and collect payment for the services and items you may receive from us. For example, we may provide your insurer with details regarding your treatment to determine if your insurer will cover, or pay for, your treatment. We also may use and disclose your PHI to obtain payment from third parties that may be responsible for such costs, such as family members. Also, we may use your PHI to bill you directly for services and items. We may disclose your PHI to other health care providers and entities to assist in their billing and collection efforts.
Health care operations. Health care operations are any of the following activities: (a) quality assessment and improvement activities; (b) competency assurance activities, including provider performance evaluation, credentialing and accreditation; (c) conducting or arranging for medical reviews, audits, or legal services; (d) business planning, development, management, and administration; (f) business management and general administrative activities of CFH, including but not limited to: de-identifying protected health information, and creating a limited data set.
3. Informal permission may be obtained by asking you outright, or by circumstances that clearly give you the opportunity to agree, acquiesce, or object.
4. The Privacy Rule does not require that every risk of an incidental use or disclosure of PHI be eliminated.
5. The Privacy Rule permits use and disclosure of PHI without your authorization or permission for the following purposes. Specific conditions or limitations apply to each public interest purpose, striking the balance between the individual privacy interest and the public interest need for this information.
Required by Law. We may use and disclose your PHI when we are required to do so by federal, state or local law.
Public Health Activities. We may disclose your PHI to (a) public health authorities authorized by law to collect or receive such information for the preventing or controlling disease, injury, ,or disability and to public health or other government authorities authorized to receive reports of child abuse and neglect; (b) entities subject to FDA regulation regarding FDA regulated products or activities for purposes such as adverse event reporting, tracking of products, product recalls, and post-marketing surveillance; (c) individuals who may have contracted or been exposed to a communicable disease when notification is authorized by law; and (d) employers, regarding employees, when requested by employers, for information concerning a work-related illness or injury or workplace related medical surveillance, because such information is needed by the employer to comply with OSHA, or similar state law.
Victims of Abuse, Neglect or Domestic Violence. In certain circumstances, we may disclose your PHI to appropriate government authorities regarding victims of abuse, neglect or domestic violence.
Health Oversight Activities. We may disclose your PHI to a health oversight agency for purposes of legally authorized health oversight activities, such as audits and investigations necessary for oversight of the health care system and government benefit programs.
Judicial and Administrative Proceedings. We may disclose your PHI in a judicial or administrative proceeding if the request for the information is through an order from a court or administrative tribunal. Such information may also be disclosed in response to a subpoena or other lawful process.
Law Enforcement Purposes. We may disclose your PHI to law enforcement officials for law enforcement purposes under the following circumstances, (a) as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; (b) to identify or locate a suspect, fugitive material witness, or missing person; (c) in response to a law enforcement official’s request for information about a victim or suspected victim of a crime; (d) to alert law enforcement of a person’s death, if we suspects that criminal activity caused the death; (e) when we believe that protected health information is evidence of a crime that occurred on our premises; and (f) by our provider in a
medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime.
Decedents. We may disclose PHI to funeral directors as needed, and to coroners or medical examiners to identify a deceased person, determine the cause of death, and perform other functions authorized by law.
Fundraising Activities. We may use medical information about you to contact you in an effort to raise money for CFHC and its operations. Specifically, we may use information about you to target our fundraising efforts. For example, if we are raising money for women’s health services, we may focus our fundraising efforts on individuals who have received women’s health services from us in the past. We may also disclose medical information to a business partner or a foundation related to CFHC so that the business partner or the foundation may contact you in raising money. We would release limited information about you, such as your name, address and phone number, age and date of birth, gender, your physician, and the dates you received treatment or services.
If you do not want to be contacted for fundraising efforts, you must opt out in writing. If you have not already done so, we must ask you each time we contact you for fundraising efforts if you wish to opt out of all future fundraising communications. If you do opt out of future fundraising communications, we will no longer disclose your information for fundraising purposes. However, in the future you may let us know in writing that you would like to receive these fundraising communications. Your decision whether or not to receive targeted fundraising materials from us will have no impact on your access to health care services or the treatment we provide to you.
Even if you have opted-out, we may send you non-targeted fundraising materials that are sent out to the general community and are not based on information from your treatment.
Cadaveric Organ, Eye, or Tissue Donation. We may use or disclose PHI to facilitate the donation and transplantation of cadaveric organs, eyes, and tissue.
Research. “Research” is any systematic investigation designed to develop or contribute to generalizable knowledge. We may to use and disclose PHI for research purposes, without an individual’s authorization, if specific conditions are met.
Serious Threat to Health or Safety. We may disclose PHI that we believe is necessary to prevent or lessen a serious and imminent threat to a person or the public, when such disclosure is made to someone they believe can prevent or lessen the threat (including the target of the threat). We may also disclose to law enforcement if the information is needed to identify or apprehend an escapee or violent criminal.
Essential Government Functions. An authorization is not required to use or disclose PHI for certain essential government functions. Such functions include: assuring proper execution of a military mission, conducting intelligence and national security activities that are authorized by law, providing protective services to the President, making medical suitability determinations for U.S. State Department employees, protecting the health and safety of inmates or employees in a correctional institution, and determining eligibility for or conducting enrollment in certain government benefit programs.
Workers’ Compensation. We may disclose PHI as authorized by, and to comply with, workers’ compensation laws and other similar programs providing benefits for work-related injuries or illnesses.
Sale of Medical Information. We cannot sell your medical information without first receiving your authorization in writing. Any authorization form you sign agreeing to the sale of your medical information must state that we will receive payment of some kind disclosing your information. However, because a “sale” has a specific definition under the law, it does not include all situations in which payment of some kind is received for the disclosure. For example, a disclosure for which we charge a fee to cover the cost to prepare and transmit the information does not qualify as a “sale” of your information.
C. Your rights regarding your PHI: You have the following rights regarding the PHI that we maintain about you:
1. Confidential communications. You have the right to request that our practice communicate with you about your health and related issues in a particular manner or at a certain location. For instance, you may ask that we contact you at home, rather than work. In order to request a type of confidential communication, you must make a written request to Dino Kanelos, MD at 11220 Elm Lane, Suite 102 Charlotte, NC 28277 specifying the requested method of contact, or the location where you wish to be contacted. Our practice will accommodate reasonable requests. You do not need to give a reason for your request.
2. Requesting restrictions. You have the right to request a restriction in our use or disclosure of your PHI for treatment, payment or health care operations. Additionally, you have the right to request that we restrict our disclosure of your PHI to only certain individuals involved in your care or the payment for your care, such as family members and friends. We are not required to agree to your request; however, if we do agree, we are bound by our agreement except when otherwise required by law, in emergencies or when the information is necessary to treat you. In order to request a restriction in our use or disclosure of your PHI, you must make your request in writing to Dino Kanelos, MD at 11220 Elm Lane, Suite 102 Charlotte, NC 28277. Your request must describe in a clear and concise fashion the following: (a) the information you wish restricted, (b) whether you are requesting to limit our practice’s use, disclosure or both, (c) to whom you want the limits to apply.
You may request that we not disclose your medical information to your health insurance plan for some or all of the services you receive during a visit to any Carolina Family Healthcare location. If you pay the charges for those services you do not want disclosed in full at the time of such service, we are required to agree to your request. “In full” means the amount we charge for the service, not your copay, coinsurance, or deductible responsibility when your insurer pays for your care. Please note that once information about a service has been submitted to your health plan, we cannot agree to your request. If you think you may wish to restrict the disclosure of your medical information for a certain service, please let us know as early in your visit as possible.
3. Inspection and copies. You have the right to inspect and obtain a copy of the PHI that may be used to make decisions about you, including patient medical records and billing records, but not including psychotherapy notes. You must submit your request in writing to Dino Kanelos, MD at 11220 Elm Lane, Suite 102 Charlotte, NC 28277 in order to inspect and/or obtain a copy of your PHI. Our practice may charge a fee for the costs of copying, mailing, labor and supplies associated with your request. Our practice may deny your request to inspect and/or copy in certain limited circumstances; however, you may request a review of our denial. Another licensed health care professional chosen by us will conduct reviews.
4. Amendment. You may ask us to amend your health information if you believe it is incorrect or incomplete, and you may request an amendment for as long as the information is kept by or for our practice. To request an amendment, your request must be made in writing and submitted to Dino Kanelos, MD at 11220 Elm Lane, Suite 102 Charlotte, NC 28277. You must provide us with a reason that supports your request for amendment. Our practice will deny your request if you fail to submit your request (and the reason supporting your request) in writing. Also, we may deny your request if you ask us to amend information that is in our opinion: (a) accurate and complete; (b) not part of the PHI kept by or for the practice; (c) not part of the PHI which you would be permitted to inspect and copy; or (d) not created by our practice, unless the individual or entity that created the information is not available to amend the information.
5. Accounting of disclosures. All of our patients have the right to request an “accounting of disclosures.” An “accounting of disclosures” is a list of certain non-routine disclosures our practice has made of your PHI for purposes not related to treatment, payment or operations. Use of your PHI as part of the routine patient care in our practice is not required to be documented – for example, the doctor sharing information with the nurse; or the billing department using your information to file your insurance claim. In order to obtain an accounting of disclosures, you must submit your request in writing to Dino Kanelos, MD at 11220 Elm Lane, Suite 102 Charlotte, NC 28277. All requests for an “accounting of disclosures” must state a time period, which may not be longer than six (6) years from the date of disclosure and may not include dates before April 14, 2003. The first list you request within a 12-month period is free of charge, but our practice may charge you for additional lists within the same 12-month period. Our practice will notify you of the costs involved with additional requests, and you may withdraw your request before you incur any costs.
6. Right to file a complaint. If you believe your privacy rights have been violated, you may file a complaint with our practice or with the Secretary of the Department of Health and Human Services at the Office for Civil Rights, 61 Forsyth Street, Suite 3B70, Atlanta, GA 30323. To file a complaint with our practice, contact Dino Kanelos, MD at 11220 Elm Lane, Suite 102 Charlotte, NC 28277. All complaints must be submitted in writing. You will not be penalized for filing a complaint.
7. Right to provide an authorization for other uses and disclosures. Our practice will obtain your written authorization for uses and disclosures that are not identified by this notice or permitted by applicable law. Any authorization you provide to us regarding the use and disclosure of your PHI may be revoked at any time in writing. After you revoke your authorization, we will no longer use or disclose your PHI for the reasons described in the authorization. Please note: we are required to retain records of your care.
D. Investigations of Breaches of Privacy: We will investigate any discovered unauthorized use or disclosure of your medical information to determine if it constitutes a breach of the federal privacy or security regulations addressing such information. If we determine that such a breach has occurred, we will provide you with notice of the breach and advise you what we intend to do to mitigate the damage (if any) caused by the breach, and about the steps you should take to protect yourself from potential harm resulting from the breach.
If you have any questions regarding this notice or our health information privacy policies, please contact Dino Kanelos, MD at 704-847-4000. You may also view the Privacy Rule at www.hhs.gov/ocr/hipaa.