Privacy

The HIPAA Privacy Rules require that we protect the privacy of health information that identifies a patient, or where there is a reasonable basis to believe the information can be used to identify a patient. This information is called “protected health information” or “PHI.” This notice describes your rights as our patient and our obligation regarding the use and disclosure of PHI. We are required by law to:

• Maintain the privacy of PHI about you, consistent with the requirements of HIPAA (the Health Insurance Portability and Accountability Act of 1996, and its rules) and Florida state law:
• Give you this Notice of our privacy practices with respect to our use and disclosure of PHI; and
• Comply with the terms of our policies and practices, which are summarized in this Notice, and as may be amended from time to time.

We reserve the right to make changes to our privacy policies and practices at any time, including to address changes in the law. The terms of this Notice will be revised and made available as required by law. If and when this Notice is changed, we will post a copy in our office in a prominent location. We will also provide you with a copy of the revised Notice upon your request made to our Privacy Office.

As used herein, in this Notice, the following terms have the definitions listed below: “Use” means, with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such protected health information within Central Florida Cardiology Group (CFCG).

“Disclose” means the release, transfer, provision of access to, or divulging in any other manner of protected health information outside of CFCG.

USES AND DISCLOSURES FOR TREATMENT, PAYMENT, AND HEALTH CARE OPERATIONS. The following categories describe the different ways we may use and disclose PHI for treatment, payment, or health care operations. The examples included with each category do not list every type of use or disclosure that may fall within that category.

TREATMENT: We may use and disclose PHI about you to provide, coordinate, or manage your health care and related services. We may consult with other health care providers regarding your treatment and coordinate and manage your healthcare with others. We may use and disclose PHI when you need a prescription, lab work, an x-ray, or other health care services. In addition, we may use and disclose PHI about you when referring you to another health care provider. If you are referred to another physician, we may disclose PHI to your new physician regarding whether you are allergic to any medications. We may also disclose PHI about you for the treatment activities of another health care provider. For example, we may send a report about your care from us to a physician who we refer you to so that the other physician may treat you.

PAYMENT: We may use and disclose PHI so that we can bill and collect payment for the treatment and services provided to you. Before providing treatment or services, we may share details with your health plan concerning the services you are scheduled to receive. For example, we may ask for payment approval from your health plan before we provide care or services. We may use and disclose PHI to confirm you are receiving the appropriate amount of care to obtain payment for services. We may disclose PHI to insurance companies providing you with additional coverage. We may disclose limited PHI to consumer reporting agencies relating to collection of payments owed to us. We may also disclose PHI to another health care provider or to a company or health plan required to comply with the HIPAA Privacy Rules for the payment activities of that health care provider, company, or health plan. For example, we may allow a health insurance company to review PHI for the insurance company’s activities to determine the insurance benefits to be paid for your care.

HEALTH CARE OPERATIONS: We may use or disclose your PHI in our health care operations, which encompass many activities. Some examples of how your PHI may be used or disclosed in our health care operations include: case management and care coordination activities; assessing and improving the quality, efficiency, and cost of care provided to you; reviewing and evaluating the skills, qualifications, and performance of health care providers by providing training programs for students, trainees, health care providers, or non-health care professionals; cooperating with outside organizations that evaluate, certify, or license health care providers or staff in a particular field or specialty; conducting cost-management and business planning activities for our practice; and assisting with legal compliance or legal defense activities of our practice. We may also use or disclose your PHI for the health care operations of an “organized health care arrangement” in which we participate. An example of an “organized health care arrangement” is the joint care provided by a hospital, its employees, and the doctors who see patients at the hospital, a group health plan, or a risk-sharing network of participating providers.

In addition to the various uses and disclosures of your PHI which routinely occur incident to treatment, payment, and health care operations activities, we are sometimes required or permitted by law to make other types of uses and disclosures of your PHI, most of which do not require your written authorization. Some uses and disclosures, for which neither an authorization nor an opportunity to agree or object are required, are summarized in III.A. below. Other uses and disclosures, which require that you be presented an opportunity to agree or to object, but that do not require your authorization as a condition of use or disclosure, are summarized in III.B. below. Uses and disclosures that require your written authorization are addressed briefly in III.C. below.

A. USES AND DISCLOSURES FOR WHICH AN AUTHORIZATION OR OPPORTUNITY TO AGREE OR OBJECT IS NOT REQUIRED

Uses and disclosures required by law. We may use or disclose protected health information to the extent such use or disclosure is required by law, and the use or disclosure complies with and is limited to the relevant requirements of such law.

Uses and disclosures for public health activities. We may disclose your protected health information for public health activities, including: (1) the reporting of information for the purpose of preventing or controlling disease, injury, or disability, or pursuant to public health surveillance or investigation; (2) the reporting of child abuse or neglect to any authorized government authority; (3) to an individual having responsibility for the purpose of activities related to the quality, safety, or effectiveness of such FDA-regulated product or activity; (4) to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition, if we or the public health authority is authorized by law to notify such person as necessary in the conduct of a public health intervention or investigation; or (5) an employer, about an individual who is a member of the workforce of the employer, if we provide care at the request of the employer to evaluate a work-related condition, illness, or injury.

Disclosures about victims of abuse, neglect, or domestic violence. We may disclose your protected health information to a government authority if we reasonably believe you to be a victim of abuse, neglect, or domestic violence.

Uses and disclosures for health oversight activities. We may disclose your protected health information to a health oversight agency for oversight activities authorized by law, including audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions; or other activities necessary for appropriate oversight of government programs, benefit programs, the health care system, or civil rights compliance.

Disclosures for judicial and administrative proceedings. We may use or disclose PHI when required by a court or administrative tribunal order. We may also disclose PHI in response to subpoenas or discovery requests, or pursuant to other legal process.

Disclosures for law enforcement purposes. (1) If you are a victim of a crime (including, but not limited to) abuse, neglect, or domestic violence, or to alert law enforcement authorities of the potential commission of a crime, we will disclose information, including PHI, to law enforcement officials, as required by law. (2) We may release your protected health information as requested by a court order, a grand jury, or administrative subpoena. (3) We may also disclose your protected health information in response to a law enforcement official’s request for such information for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person, provided that we may disclose only the following information: (A) Name and address; (B) Date and place of birth; (C) Social security number; (D) ABO blood type and rh factor; (E) Type of injury; (F) Date and time of treatment; (G) Date and time of death, if applicable; and (H) A description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or mustache), scars, and tattoos.

Uses and disclosures about decedents. (1) We may disclose protected health information to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law. (2) We may disclose your protected health information to funeral directors, consistent with applicable law, as necessary to carry out their duties with respect to the decedent.

Uses and disclosures for research purposes. We may use or disclose your protected health information for certain research purposes, without your further authorization, upon receiving certain required assurances from research review boards that authorization requirements may appropriately be waived. Other uses and disclosures for research purposes will be subject to your prior written authorization.

Uses and disclosures regarding organ and tissue donation. Our practice may release your PHI to organizations that handle organ, eye, or tissue procurement or transplantation, including organ donation banks, as necessary, to facilitate organ or tissue donation and transplantation if you are an organ donor.

Uses and disclosures to prevent a serious threat to health or safety. We may use or disclose your protected health information to prevent a serious threat to health or safety.

Uses and disclosures for specialized government functions. These uses and disclosures include but are not limited to: (1) We may use and disclose protected health information of individuals who are Armed Forces personnel for activities deemed necessary by appropriate military command authorities to assure the proper execution of the military mission; (2) We may use and disclose the protected health information of individuals who are foreign military personnel to their appropriate foreign military authority for the same purposes for which uses and disclosures are permitted for Armed Forces personnel; (3) We may disclose protected health information to authorized federal officials for the conduct of lawful intelligence, counter-intelligence, and other national security activities; and/or (4) We may disclose to a correctional institution or a law enforcement official having lawful custody of an inmate or other individual protected health information about such inmate or individual.

Disclosures for workers’ compensation. We may disclose your protected health information as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or other similar programs.

B. USES AND DISCLOSURES WE CAN MAKE WITHOUT YOUR WRITTEN AUTHORIZATION, FOR WHICH YOU HAVE THE OPPORTUNITY TO AGREE OR OBJECT

We may use and disclose PHI about you in some situations where you have the opportunity to agree or object to certain uses and disclosures of PHI about you. If you do not object, then we may make these types of uses and disclosures of PHI.

Individuals Involved in Your Care or Payment for Your Care. We may disclose PHI about you to your family member, close friend, or any other person identified by you if that information is directly relevant to the person’s involvement in your case or payment for your care. If you are present and able to consent or object (or if you are available in advance), then we may only use or disclose PHI if you do not object after you have been informed of your opportunity to object. If you are not present or you are unable to consent or object, we may exercise professional judgment in determining whether the use or disclosure of PHI is in your best interests. For example, if you are brought into this office and are unable to communicate normally with your physician for some reason, we may find it is in your best interest to give your prescription and other medical supplies to the friend or relative who brought you in for treatment. We also may use professional judgment and our experience with common practice to make reasonable decisions about your best interests in allowing a person to act on your behalf to pick up filled prescriptions, medical supplies, x-rays, or other things that contain PHI about you.

Notification. We may also use and disclose PHI to notify such persons of your location, general condition, or death. We also may coordinate with disaster relief agencies to make this type of notification.

C. USES AND/OR DISCLOSURES OF YOUR PROTECTED HEALTH INFORMATION THAT REQUIRE WRITTEN AUTHORIZATION OR CONSENT

Authorizations. Other than those uses and disclosures that we may encounter in the course of treatment, payment, and health care operations and those additional uses and disclosures that we are required or permitted to make by law without your authorization or consent, we will not make other uses or disclosures of your protected health information without signed written authorization. Authorizations that are required for such purposes must contain, in plain language, specific descriptions of the information you want disclosed, to whom, your authorized purposes, and the duration of such authorization. We will provide you with a copy for your records of any signed authorization we request from you. Any written authorization you give us for such purposes may be revoked by you at any time, except to the extent we have taken action in reliance thereon.

Appointment reminders. Unless you object, our office may contact you to remind you of an appointment or surgery. The form of contact may be by letter, by personal phone call, by computerized appointment reminder system, or by e-mail. We will leave a message on your answering machine unless you instruct us otherwise. You must notify us in writing of your objections to be reminded of an appointment.

Request for records to be sent. Except as otherwise specified above with regard to disclosures of protected health information required or permitted by law, you will be required to sign a release if you want copies of your PHI sent outside our office. You have the right to revoke any authorization to disclose this information at any time.

UNDER FEDERAL LAW, YOU HAVE THE FOLLOWING RIGHTS REGARDING PHI ABOUT YOU:

Right to Request Restrictions. You have the right to request restrictions on certain uses and disclosures of your protected health information. This requested restriction must be in writing and we reserve the right to deny any requested restriction and will inform you so in writing. If we do agree to your request, we are required to comply with our agreement except in certain cases, including where the information is needed to treat you in the case of an emergency. To request restrictions, you must make your request in writing to our Privacy Office. In your request, please include: (1) the information that you want to restrict; (2) how you want to restrict the information (for example, restricting use to this office, only restricting disclosure to persons outside this office, or restricting both); (3) to whom you want those restrictions to apply; and, 4) how long the restrictions shall apply.

Right to Receive Confidential Communications by Alternative Means. You have the right to request certain alternative means of communication. For example, if you do not want us to contact you at your home or workplace, you must provide us with an alternative means to contact you. This request for alternative communications must be in writing and we reserve the right to deny any requested alternative means to contact you and will inform you so in writing. You must make your request in writing to our Privacy Office. You must specify how you would like to be contacted (for example, by regular mail to your post office box and not to your home). We are required to accommodate reasonable requests.

Right to Inspect and Copy. You have the right to access, inspect, and obtain a copy of your protected health information. This includes your medical and billing records but does not include all types of records. We may deny your request to inspect and copy PHI only in limited circumstances. To inspect and copy PHI please contact our Privacy Office (See Section VII below). If you request a copy of PHI about you, we may charge you a reasonable fee for the copying, postage, labor, and supplies used in meeting your request.

Right to Amend. You have the right to request that we amend PHI about you as long as such information is kept by or for our office. To make this type of request you must submit your request in writing to our Privacy Office. You must also give us a reason for your request. This request to amend your protected health information must be in writing and we reserve the right to deny any requested amendment to your protected health information and will inform you so in writing.

Right to Receive an Accounting of Disclosures. You have the right to request an “accounting” of certain disclosures that we made of PHI about you. This is a list of disclosures made by us during a specified period of up to six years, other than disclosures made: for treatment, payment, and health care operations; for use in or related to facility directory; to family members or friends involved in your care; to you directly; pursuant to an authorization of you or your personal representative, or for certain notification purposes (including national security, intelligence, correctional, and law enforcement purposes); and disclosures made before April 14, 2003. If you wish to make such a request, please contact our Privacy Office below. The first list that you request in a 12-month period will be free, but we may charge you for our reasonable cost or providing additional lists in the same 12-month period. We will tell you about these costs, and you may choose to cancel your request at any time before costs are incurred.

Right to a Paper Copy of this Notice. You have the right to receive a paper copy of this Notice at any time, upon request. You are entitled to a paper copy of this Notice even if you have previously received it electronically. To obtain a paper copy of this Notice, please contact our Privacy Office.

If you believe your privacy rights have been violated, you may file a complaint with us or the Secretary of the United States Department of Health and Human Services. To file a complaint with our office, please contact our Privacy Office at the address and number listed below. We will not retaliate or take action against you for filing a complaint.

If you have any questions about this Notice, please contact our Privacy Office at the address and telephone number listed below.

You may contact our Privacy Office at the following address and phone number:

Central Florida Cardiology Group, P.A.

Attn: Privacy Office
1745 North Mills Avenue
Orlando, FL 32803
407-841-7151