HIPAA PRIVACY NOTICE
Policies and Practices to Protect the Privacy of your Health Information
IN COMPLIANCE WITH THE HEALTH INFORMATION PORTABILITY AND ACCOUNTABILITY ACT (HIPAA), THIS NOTICE DESCRIBES HOW PSYCHOLOGICAL AND MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Definitions:
Etheridge Psychology, P.A. – Unless otherwise specified, Etheridge Psychology, P.A., or pronouns such as “We,” “Us,” or “Our”, refers to the above-named practice and its employees, volunteers, and related personnel.
“You” – Refers to the patient or the patient’s legally authorized personal representative.
Protected Health Information (PHI) – Information in your health record that could identify you. With certain limited exceptions, PHI is generally defined as information that identifies an individual or that reasonably can be used to identify an individual, and that relates to the individual’s past, present, or future health or condition, healthcare provided to the individual, or the past, present, or future payment for healthcare provided to the individual.
Use – Applies to activities within our practice such as sharing, employing, applying, utilizing, examining, and analyzing information that identifies you.
Disclosure – Applies to activities outside our practice, such as releasing, transferring, or providing access to information about you to other parties.
Authorization – Your written permission to disclose confidential mental health information.
I. Uses and Disclosures for Treatment, Payment, and Health Care Operations
We may use or disclose your Protected Health Information (PHI), for:
Treatment – When we provide, coordinate, or manage your health care and other services related to your health care. Example: A psychologist who has evaluated you may need to tell your family doctor that you have an anxiety disorder that is affecting your sleep or that may be causing your stomachaches or headaches. A therapist who is treating you may need to tell your psychiatrist that you are experiencing a manic episode so that the psychiatrist can adjust your medications.
Payment – When we obtain reimbursement for your healthcare. Examples: We may disclose your PHI to your health insurer to obtain preauthorization for your treatment or to obtain reimbursement for your health care. We may disclose limited PHI to a collection agency to collect payment for a delinquent balance.
Health Care Operations – Activities that relate to the performance and operation of this practice. Examples of this are quality assessment/improvement activities and business-related matters such as audits/administrative services. We may use outside individuals or companies (business associates) to perform services for us (e.g., scanning, accounting, legal, technology, and test scoring services). We require these business associates to safeguard your health information.
II. Other Uses and Disclosures Requiring Authorization
Etheridge Psychology, P.A. may use or disclose PHI for purposes outside of treatment, payment, or health care operations when your appropriate authorization is obtained unless required by law (see section IV). Psychotherapy notes are different from and not included in PHI and include notes that have been made about the content of an individual, group, joint, or family therapy session. We will obtain an authorization from you before using or disclosing PHI in a way that is not described in this notice.
III. Revocation of Authorization
You may revoke all or any authorizations of PHI and/or psychotherapy notes at any time, provided each revocation is in writing. You may not revoke and authorization to the extent that 1) we have relied on that authorization; or 2) if the authorization was obtained as a condition of obtaining insurance coverage, law provides the insurer the right to contest the claim under the policy.
IV. Uses and Disclosures without Authorization
We may use and disclose your PHI to contact you about appointments, treatment, or other communications. We may contact you by any method you provide to us, which may include mail, telephone, or email.
We will disclose your PHI when required by federal, state, or local law or other judicial or administrative proceeding without your consent or authorization. Following are examples:
Child Abuse – If you give us information that leads us to suspect child abuse, neglect, or death due to maltreatment of any child, we must report such information to the county Department of Social Services (DSS) or law enforcement if after hours. If asked by DSS to turn over information from your records relevant to a child protective services investigation, we must do so. We will inform you a report has been made unless we believe that informing you may place the individual at risk of serious harm.
Adult and Domestic Abuse – If you provide us with information that leads to reasonable belief that any disabled adult needs protective services because of abuse or neglect by themselves or another person, we must immediately report this to the Department of Social Services. We will inform you a report has been made unless we believe that informing you may place the individual at risk of serious harm.
Health Oversight Activities – The North Carolina Psychology Board and other professional boards have the authority to receive relevant records, including your entire clinical record, should we be the focus of an inquiry.
Judicial and Administrative Proceedings – If you are involved in a court proceeding and a request is made for information about the professional services we provided you and/or your clinical records, we will not release such information without your written authorization or a court order. If a court order requires that your records be released, under law we must release them, even without your written consent or authorization. The privilege does not apply when you are being evaluated for a third party or where the evaluation is court ordered. You will be informed in advance if this is the case.
Serious Threat to Health or Safety – If we believe disclosure of PHI is necessary to protect you or another individual from a substantial risk of imminent and serious physical injury, we will disclose the PHI to the appropriate individuals, which may include but is not limited to family members, police, or the individual at risk of harm. For example, if you tell your therapist that you plan to poison your spouse, we may notify your spouse as well as law enforcement. If you lose consciousness or become injured while at our practice, we will seek medical care for you and disclose any necessary PHI (e.g., that you have diabetes or a heart condition).
Worker’s Compensation – If you file a worker’s compensation claim, we are required by law to provide your mental health information relevant to the claim to your employer and the North Carolina Industrial Commission.
When the use and disclosure without your consent or authorization is allowed under other sections of Section 164.512 of the Privacy Rule and the state’s confidentiality law - This includes certain narrowly-defined disclosures to law enforcement agencies, to a health oversight agency (such as HHS or a state department of health), to a coroner or medical examiner, for public health purposes relating to disease or FDA-regulated products, or for specialized government functions such as fitness for military duties, eligibility for VA benefits, and national security and intelligence.
V. Patient’s Rights and Our Duties
Patient’s Rights:
You have the right to request restrictions on certain uses and disclosures of protected health information. However, we are not required to agree to a restriction you request.
You have the right to request and receive confidential communications of PHI by alternative means and at alternative locations. For example, you may not want a family member to know you are seeing a mental health professional. At your request, we will send your bills to another address.
You have a right to inspect and/or obtain a copy of PHI in our mental health and billing records used to make decisions about you for as long as the PHI is maintained in the record. We may deny your access to PHI under certain circumstances. In some cases, you may have this decision reviewed. You may be denied access to psychotherapy notes if we believe that a limitation of access is necessary to protect you from a substantial risk of imminent psychological impairment or to protect you or another individual from a substantial risk of imminent and serious physical injury. We will notify you or your representatives if we do not grant complete access. On your request, we will discuss with you the details of the request and/or denial process.
You have the right to request an amendment of PHI for as long as the PHI is maintained in the record. We may deny your request. On your request, we will discuss with you the details of the amendment process.
You generally have the right to receive an accounting of disclosures of PHI. Upon your request, we will discuss with you the details of the accounting process.
You have the right to obtain a paper copy of this notice from us.
You have the right to restrict certain disclosures of PHI to a health plan when you pay out-of-pocket for our services.
You have a right to be notified if: (a) there is a breach (a use or disclosure of your PHI in violation of the HIPAA Privacy Rule) involving your PHI; (b) that PHI has not been encrypted to government standards; and (c) our risk assessment fails to determine that there is a low probability that your PHI has been compromised.
Our Duties:
We are required by law to maintain the privacy of PHI, to provide you with notice of our legal duties and privacy practices with respect to PHI, and to notify you following a breach of unsecured PHI.
We are required to comply with the provisions of this notice and only use and/or disclose your health information as described in this notice.
We will explain how, when, and why we use and/or disclose your health information.
We reserve the right to change the privacy policies and practices described in this notice and to make the new notice provisions effective for all PHI we maintain. Unless we notify you of such changes, however, we are required to abide by the terms currently in effect (as described in this document). If we revise this notice, the new notice will be effective
If we revise the terms of this notice, we will provide you with a revised notice in writing either by mail or in person during a regularly scheduled appointment, post it at our office, and upload it to our website.
VI. Questions and Complaints
If you have questions about this notice, disagree with a decision we make about access to your records, or have concerns about your privacy rights, you may contact Etheridge Psychology, P.A. directly by phone at (919) 600-4906, or in writing at 115 Kildaire Park Drive, Suite 313, Cary, NC 27518.
If you believe that your privacy rights have been violated and wish to file a complaint with our office, you may send your written complaint to the address provided above. You may also send a written complaint to the Secretary of the U.S. Department of Health and Human Services. You have specific rights under the Privacy Rule. We will not retaliate against you for exercising your right to file a complaint.
VII. Effective Date, Restrictions and Changes to Privacy Policy
This notice went into effect on 4/28/09. It was updated on 3/11/14, 12/29/14, 3/3/16, and 10/7/19.
We are happy to give you a paper copy of this notice. Please ask.