HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

EFFECTIVE DATE: SEPTEMBER 23, 2013

Introduction
At PromiseCare we understand that medical information about you and your health is personal. We are committed to protecting medical information about you. We create a record of the exams and services you receive at our facility. We need this record to provide you with quality of care and to comply with certain legal requirements.

This Notice applies to all of the records of your exams and services you receive at our facilities. This Notice describes your rights and certain obligations regarding the use and disclosure of your protected health information, as well as the ways in which we may use and disclose your protected health information. We are required by law to maintain the privacy of you medical information, also known as “protected health information” or “PHI”. We are also required to give you this Notice regarding our legal duties and privacy practices pertaining to your PHI and follow the terms of this Notice of Privacy Practices. We are also required to notify you if our privacy or security measures are ever breached.

Understanding Your Health Record/Information
Each time you visit a PromiseCare provider a record of your visit is made. Typically, this record could contain your symptoms, examinations, test results, diagnoses, treatment, images, a plan for future care or treatment, and insurance and billing information. This information is often referred to as your health or medical record. Your medical record serves purposes such as a:

Basis for planning your care and treatment
Means of communication among the many health professionals who contribute to your care
Legal document describing the care you received
Means by which you or a third-party payer can verify that services billed were actually provided
A tool in educating health professionals
A source of data for medical research
A source of information for public health officials charged with improving the health of the state and nation
A source of data for our planning and marketing
A tool with which we can assess and continually work to improve the care we render and the outcomes we achieve

Some of Our Responsibilities

PromiseCare is required to:

Maintain the privacy of your health information
Provide you with this Notice as to our legal duties and privacy practices with respect to information we collect and maintain about you
Abide by the terms of this Notice
Notify you if we are unable to agree to a requested restriction
Accommodate reasonable requests you may have to communicate health information by alternate means or at alternative locations.
We will not use or disclose your health information without your authorization, except as described in this Notice.
Notify you regarding a Security Breach of your PHI
We will discontinue the use or disclosure of your health information after we have received a written revocation of the authorization according to the procedures included in the authorization.

How PromiseCare May Use and Disclose Your Protected Health Information

The following are ways that we use and disclose your PHI:

We Will Use Your PHI For Treatment

We create a record of the treatment and services you receive at our facilities. We may use your PHI to provide you with medical treatment services. We may disclose your PHI to doctors, nurses, technicians, technologists, facility personnel involved in taking care of you at the facility, and for other operational functions.

For example: Information obtained by a physician, nurse, technologist or other member of your PromiseCare health care team will be recorded in your record and used to determine the types of exams that should work best for you. A physician may document in your record his or her expectations or recommendations of the members of your health care team. We will also disclose your PHI to people outside the facility who are involved in your treatment, such as your primary care physician, a physician specialist, or a subsequent health care provider with copies of various images and reports that should assist him or her in treating you and coordinating and managing your health care.

We Will Use Your PHI for Payment

We may use and disclose your PHI in order to get paid for the treatment and services we have provided you.

For example: A bill may be sent to you, a health plan, or a third-party payer. The information on or accompanying the bill may include information that identifies you, as well as your diagnoses, procedures, and supplies used. We may also tell your health plan about a treatment or service you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment. We may also disclose your PHI to other health care providers for their payment purposes.

We Will Use Your PHI For Health Care Operations

We may use and disclose your PHI to carry out activities that are necessary to run our operations and to make sure that all our patients receive quality care.

For example: Members of the medical staff, the risk or quality improvement manager, or members of the quality improvement team may use information in your health record to assess the care and outcomes in your case and others like it. This information will then be used in an effort to continually improve quality assurance, compliance, and effectiveness of the healthcare and services we provide.

We Will Use Your PHI for Appointment Reminders

We may use and disclose your PHI to contact you as a reminder that you have an appointment for an exam or medical care at the facility.

Individuals Involved in Your Care or Payment for Your Care

We may disclose your PHI to a family member or friend who is involved in your medical care or payment related to your health care, provided that you agree to this disclosure, or we give you an opportunity to object to this disclosure. However, under appropriate circumstances, including emergencies, we will use our professional judgment to decide whether this disclosure is in your best interests or to infer that you do not object.

Disaster Relief Purposes

We may disclose your PHI to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location. We will give you the opportunity to agree to this disclosure or object to this disclosure, unless we decide that we need to disclose your PHI in order to respond to the emergency circumstances.

Organ and Tissue Donation

Consistent with applicable law, we may disclose your PHI to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs for the purpose of tissue donation and transplant.

Marketing or Selling Information

We do not market or sell your PHI. If at any time we decide to market or sell your PHI, we are required to tell you the information we wish to disclose and obtain your authorization prior to any use or disclosure.

Research

We may disclose information to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your PHI.

As Required By Law

We will disclose your PHI when required to do so by federal, state, or local law. For example, we will disclose your PHI when ordered to do so by a Court.

To Avert a Serious Threat to Health and Safety

We may use and disclose your PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.

Public Health Risks

We may use and disclose medical information about you for public health activities, such as those aimed at preventing or controlling disease, preventing injury or disability, and reporting the abuse or neglect of children, elders, and dependent adults.

Food and Drug Administration (FDA)

We may use and disclose your PHI to the FDA relative to adverse events with respect to food, supplements, product and product defects, or post marketing surveillance information to enable product recalls, repairs, or replacement.

Military and Veterans

If you are a member of the armed forces, we may use and disclose your PHI as required by military command authorities. We may also release medical information about foreign military personnel to the appropriate foreign military authority.

Business Associates

There are some services provided in our organization through contacts with business associates. When these services are contracted, we may use and disclose your health information to our business associate so they can perform the tasks we have requested of them. To protect your health information, however, we require the business associate to appropriately safeguard your information.

Some examples of business associates are physician services in certain laboratory tests, a copy service we may use when making copies of your health record, billing contractors and third-party payers for services rendered.

Workers’ Compensation

We may release your PHI for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illnesses.

Lawsuits and Disputes

If you are involved in a lawsuit or dispute, we may disclose your PHI in response to a court or administrative order. We may also disclose your PHI in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request (which may include written notice to you) or to obtain an order protecting the PHI requested.

Law Enforcement

We may disclose PHI to government law enforcement agencies in the following circumstances:

In response to a court order, warrant, subpoena, summons or similar process issued by a court
To identify or locate a suspect, fugitive, material witness or missing person
If you are a victim of a crime, under certain limited circumstances, and we are unable to obtain your agreement
About a death that may be the result of criminal conduct
About criminal conduct at the facility
In emergency circumstances to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime.
If we believe you, while in the facility, have committed or have been a victim of a crime. Such disclosures are limited to information that constitutes evidence of criminal conduct that occurred on the premises, and will not include any information that relates to your health or the circumstances of your treatment
Federal Law makes provision for your PHI to be released to an appropriate health oversight agency, public health authority or attorney, provided that a work force member or business associate believes in good faith that we have engaged in unlawful conduct or have otherwise violated professional or clinical standards and are potentially endangering one or more patients, workers or the public

Coroners, Medical Examiners, and Funeral directors

We may release PHI to a coroner or medical examiner. This may be necessary to identify a deceased person or determine the cause of death. We may also release medical information to funeral directors as necessary to carry out their duties.

Specialized Government Functions

We may disclose your PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law, the President, other authorized persons, or foreign heads of state.

Inmates

If you are an inmate or under the custody of a law enforcement official, we may release your PHI to the correctional institution or law enforcement official for the institution to provide you with health care, protect your health and safety or the health and safety of others, or for the safety and security of the correctional institution.

Other Uses of Your Medical Information

Other uses and disclosures of your PHI not covered by this Notice or the laws that apply to PromiseCare will be made only with your written authorization. If you provide us authorization to use or disclose your PHI, you may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose your PHI for the reasons covered by the authorization, except to the extent that action has already been taken in reliance upon it.

Your Protected Health Information Rights

You have the following rights:

Obtain a paper copy of this Notice of Privacy Practices upon request
Inspect and copy your health record
Amend your health record
Obtain an accounting of disclosures of your PHI
Request a restriction on certain uses and disclosures of your PHI
Request communications of your PHI by alternative means or at alternative locations
Right to Receive Notification Regarding a Security Breach
Revoke your authorization to use or disclose your PHI except to the extent that action has already been taken with reliance upon it

Right to Inspect and Copy

With certain exceptions, you have the right to inspect and copy your PHI from our records. Typically, this includes treatment and billing records. To inspect and copy PHI that may be used to make decisions about you, you must submit your request in writing. If you request a copy of your PHI, we may charge you a fee for the costs of copying, mailing or other supplies associated with your request. We may deny your request to inspect and copy your PHI in certain circumstances. If you are denied the right to inspect and copy your PHI in our records, you may request that the denial be reviewed. With the exception of a few circumstances that are not subject to review, another licensed health care professional within PromiseCare, who was not involved in the denial, will review the decision. We will comply with the outcome of the review.

Right to Request Amendment

If you believe that your PHI in our records is incorrect or incomplete, you may ask us to amend the information. You must submit your request for amendment in writing. You must provide a reason that supports your request. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend PHI that:

Was not created by us, unless you can provide us with a reasonable basis to believe that the person or entity that created the PHI is no longer available to make the amendment
Is not part of the PHI kept by or for the facility
Is not part of the PHI which you would be permitted to inspect and copy
Is accurate and complete

If we deny your request for amendment, you have the right to submit a written request for reviewing the denial access, with respect to any item or statement in your record you believe is incomplete or incorrect. If you clearly indicate in writing that you want your denial request to be made part of your medical record we will attach it to your records and include it whenever we make a disclosure of the item or statement you believe to be incomplete or incorrect.

Right to an Accounting of Disclosures

You have the right to request an “accounting of disclosures.” This is a list of the disclosures we made of your PHI other than our own uses for treatment, payment, and health care operations (as those functions are described above) or pursuant to your authorization and with other exceptions pursuant to the law. To request this list, you must submit a written request. Your request must state a time period that may not be longer than six years. The first list you request within a 12-month period will be free. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to Request Restrictions

You have the right to request that we follow additional, special restrictions when using or disclosing your PHI for treatment, payment, or health care operations. You also have the right to request that we follow additional, special restrictions when using or disclosing your PHI to someone who is involved in your care or the payment for your health care, like a family member or friend. For example, you could ask that we not use or disclose that you are receiving services at this facility. We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment. To request restrictions, you must submit a written request that tells us (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply, for example, disclosures to your spouse.

Right to Request Confidential Communications

You have the right to request that we communicate with you about your appointments or other matters related to your treatment in a specific way or at a specific location. For example, you can ask that we only contact you at work or by mail. To request confidential communications, you must submit a written request. Your request must specify how or where you wish to be contacted. We will not ask you the reason for your request. We will accommodate all reasonable requests.

Right to Receive Notification Regarding a Security Breach

As required by law, we must notify you within 60 days following the discovery of a security breach involving PHI. Additionally, a business associate must notify PromiseCare if a security breach occurs involving PHI. We will notify you, in writing, within 60 days, by first-class mail, if a security breach occurs that compromises the security or privacy of your PHI such that the use or disclosure poses a significant risk of financial, reputational, or other harm to you.

If we have insufficient or out-of-date contact information for you, we may contact you by telephone, post the breach Notice on the home page of our website or use major print or broadcast media where you are likely to reside. The breach notice will include, to the extent possible, a description of the breach, a description of the types of information that were involved in the breach, the steps affected individuals should take to protect themselves from potential harm, a brief description of what we are doing to investigate the breach, mitigate the harm, and prevent further breaches, as well as our contact information and a toll-free number for you to contact to determine if your PHI was involved in the breach.

Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice. You may ask us to give you a copy if this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of this Notice. You may obtain a copy of this Notice at the PromiseCare website: www.promisecare.com.

Right to Revoke Your Authorization

You have the right to revoke your authorization at any time for the use and disclosure of your PHI. To revoke your authorization to use and disclose your PHI you must submit a written request to PromiseCare at 1545 W. Florida Avenue, Hemet, California 92543, Attention Privacy Officer. The revocation will take effect when PromiseCare receives it, except to the extent that action has been taken in reliance upon it.

Changes to this Notice of Privacy Practices

We reserve the right to change the terms of this Notice. We reserve the right to make the revised or changed Notice effective for PHI we already have about you as well as any information we receive in the future. A copy of the current Notice is posted in our facility. The Notice contains the effective date at the top of first page. If we change our Notice, you may obtain a copy of the revised Notice by requesting one from our staff at our facility or by visiting our website at www.promisecare.com.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or the Federal Government. All complaints must be submitted in writing. You will not be penalized or retaliated against for filing a complaint. To file a complaint with us, or if you have comments or questions regarding our Privacy Practices, you may contact the following office:

PromiseCare

Attention: Privacy Officer

1545 W. Florida Avenue Hemet, CA 92592

To file a complaint with the Federal Government, contact:

US Department of Health and Human Services Office for Civil Rights, Region IX

90 7th Street, Suite 4-100

San Francisco, California 94103

Phone: (415) 437-8310

TDD: (415) 437-8311

Fax: (415) 437-8329

HIPAA Notice of Privacy Practices

Riverside Medical Care, Urgent Care, Emergency Services - PromiseCare