HIPAA Notice of Privacy Practices

• Treatment. We use and share PHI to provide, coordinate and manage healthcare, including with on-site clinicians, off-site specialists, hospitals, laboratories and pharmacies involved in your care.
• Payment. We use and share PHI to bill and obtain payment from the contracting agency, an insurer or another responsible payer, including for utilization review and determinations of medical necessity.
• Healthcare operations. We use and share PHI for quality assessment and improvement, accreditation and licensing activities, peer review, credentialing, training, audits, and general administration.

HIPAA contains specific provisions for individuals who are inmates of a correctional institution. We may disclose PHI to a correctional institution or a law enforcement official having lawful custody where the disclosure is necessary for:

• Providing healthcare to the individual;
• The health and safety of the individual, other inmates, officers, employees or others at the facility, or persons involved in transport;
• Law enforcement on the premises of the facility; or
• The administration and maintenance of the safety, security and good order of the institution.

While in lawful custody, an individual does not have the same right to request restrictions, confidential communications, or a copy of records that applies outside a correctional setting, as permitted by 45 C.F.R. § 164.501 and § 164.524.

• When required by law, court order, subpoena or administrative request.
• For public health activities, including communicable disease reporting, and to report suspected abuse, neglect or domestic violence.
• For health oversight activities such as audits, inspections and licensure.
• To avert a serious and imminent threat to the health or safety of a person or the public.
• For workers' compensation, organ and tissue donation, coroners, medical examiners and funeral directors, and specialized government functions.
• For research, when approved by an institutional review board or privacy board.

Most uses and disclosures of psychotherapy notes, uses for marketing, and any sale of PHI require your written authorization. You may revoke an authorization at any time in writing, except to the extent we have already acted in reliance on it.

• Access. Request inspection or a copy of your health record, subject to the correctional-setting limits described above.
• Amendment. Request correction of information you believe is inaccurate or incomplete.
• Accounting of disclosures. Request a list of certain disclosures made in the six years prior to your request.
• Restrictions. Request limits on how information is used or shared. We are not required to agree to all requests.
• Paper copy. Request a paper copy of this notice at any time, even if you agreed to receive it electronically.

We will notify affected individuals, and where required the Secretary of the U.S. Department of Health and Human Services, following a breach of unsecured protected health information, as required by the HIPAA Breach Notification Rule.

If you believe your privacy rights have been violated, you may file a complaint with the health services administrator at the facility, with Corizon Health at the address below, or with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, D.C. 20201, or at hhs.gov/ocr/complaints.

You will not be retaliated against for filing a complaint.

We may change this notice and make the new terms effective for all PHI we maintain. The current notice will be posted on this page and made available at the facilities we serve.