NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice of Privacy Practices (this “Notice”) tells you about the ways we may use and disclose your medical information. This Notice applies to Arbor Diagnostics, Inc. and all of its subsidiaries and affiliated entities, including its professional, employees and contractors (collectively referred to in this Notice as, “Arbor”).
References to “medical information,” “health information,” or “protected health information” (“PHI”) in this Notice include individually identifiable information maintained by Arbor that relates to past, present or future health care services provided to you, the payment for such services or your health condition, including information that may reasonable be used to identify you.
- OUR OBLIGATIONS
We are required by law to:
- Make sure that the medical information we have about you is kept private, to the extent required by state and federal law;
- Give you this Notice explaining our legal duties and privacy practices with respect to medical information about you;
- Inform you that Arbor may create and/or receive medical information about you and such medical information may be subject to further disclosure to authorized parties in an electronic format;
- Accommodate your request (unless required by law to make a disclosure) that we not disclose to a health plan PHI related solely to services provided by Arbor, if you have paid for services out of pocket in full;
- Notify you of any breach of your unsecured PHI; and
- Abide by the terms of this Notice.
- HOW WE MAY USE AND DISCLOSE MEDICAL INFORMATION ABOUT YOU
The following categories describe the different reasons that we typically use and disclose your medical information. These categories are intended to be generic descriptions only, and not a list of every instance in which we may use or disclose your medical information. Please understand that for these categories, the law generally does not require us to get your consent in order for us to release your medical information.
- For Treatment. We may use medical information about you to provide you with medical treatment and services, and we may disclose medical information about you to doctors, nurses, technicians, medical students, or hospital personnel who are providing medical or healthcare services to you. For example, we send your test results to the provider that ordered the test. The provider, including and its staff, will have access to your test results in order to provide treatment to you.
- For Payment. We may use and disclose medical information about you so that we may bill and collect from you, an insurance company, or a third party for the services we provide. This may also include the disclosure of medical information to obtain prior authorization for treatment and procedures from your insurance plan. For example, we may send a claim for payment to your insurance company, or other party responsible for payment, and that claim may have a code on it that describes the services that have been rendered to you. Arbor is required to restrict disclosure of your medical information to a health plan or third-party payor if the disclosure is for payment or health care operations and pertains to a health care item or service that you paid for in full out-of-pocket.
- For Health Care Operations. We may use and disclose medical information about you for our health care operations. Theses uses and disclosures are necessary to operate our business appropriately and make sure all of our patients receive quality care. For example, we may need to use or disclose your medical information in order to conduct certain cost-management practices, to conduct quality assessment and improvement activities, to review the qualifications and performance of healthcare providers, or to assess the quality of the services we provide.
- Business Associates. There are some services Arbor provides through business associates. Arbor may also use the services of business associates to perform certain functions on behalf of Arbor, for example, billing services. When these services are provided by our business associates, the business associate may need access to your medical information in order to perform these services. To protect your medical information, Arbor enters into an agreement with the business associate which requires the business associate to appropriately safeguard your information.
- Quality Assurance. We may need to use or disclose your medical information for our internal processes to determine that we are providing appropriate care.
- Utilization Review. We may need to use or disclose your medical information to perform a review of the services we provide to ensure that the proper level of services is provided to patients depending on their condition and diagnosis.
- Peer Review. We may need to use or disclose medical information about you in order to review the credentials and actions of our health care personnel to ensure they meet our qualifications and standards.
- Treatment Alternatives. We may use and disclose medical information to tell you about or recommend possible treatment options or alternatives that we believe may be of interest to you.
- Health Related Benefits and Services. We may use and disclose medical information about you to tell you about health-related benefits or services that we believe may be of interest to you, particularly if certain of those services are offered by your health plan.
- Individuals Involved in Your Care or Payment for Your Care. We may release medical information about you to a friend or family member who is involved in your medical care, as well as to someone who helps pay for your care, but we will do so only as allowed by state or federal law, or in accordance with your prior authorization.
- As Required By Law. We will disclose medical information about you when required to do so by federal, state, or local law.
- To Avert a Serious Threat to Health or Safety. We may use or disclose your medical information when necessary to prevent or decrease a serious and imminent threat to your health or safety or the health and safety to the public or another person. Such disclosure would only be to someone able to help prevent the threat, or to appropriate law enforcement officials.
- Organ and Tissue Donation. If you are an organ donor, we may release medical information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank as necessary to facilitate organ or tissue donation and transplantation.
- Research. We may use or disclose your medical information to an Institutional Review Board or other authorized research body if your consent has been obtained as required by law, or if the information we provide is “de-identified”. Limited data or records may be viewed by researchers to identify patients who may qualify for their research project or for other similar purposes as long as the researchers do not remove or copy any of the PHI. Before Arbor uses or discloses PHI for any other research activity, one of the following will happen: 1) a special committee will determine that the research activity poses minimal risk to privacy and there is an adequate plan to safeguard PHI; 2) if the PHI relates to deceased individuals, the researchers give us assurances that the PHI is necessary for the research and will be used only as part of the research; or 3) the researcher will be provided only with information that does not identify you directly.
- Military and Veterans. If you are or were a member of the armed forces, we may release medical information about you as required by the appropriate military authorities.
- Workers’ Compensation. We may release medical information about you for your employer’s workers’ compensation or similar program. These programs provide benefits for work-related injuries. For example, if you have injuries that resulted from your employment, workers’ compensation insurance or a state workers’ compensation program may be responsible for payment for your care, in which case we might be required to provide information to the insurer or program.
- Public Health Risks. We may disclose medical information about you to public health authorities for public health activities. As a general rule, we are required by law to disclose certain types of information to public health authorities, such as the Texas Department of State Health.
- Health Oversight Activities. We may disclose medical information to a health oversight agency for activities authorized by law. These oversight activities include audits, civil, administrative, or criminal investigations and proceedings, inspections, licensure and disciplinary actions, and other activities necessary for the government to monitor the health care system, certain governmental benefit programs, certain entities’ compliance with government regulations related to health information and civil rights laws.
- As Required by Law. If you are involved in a lawsuit or a legal dispute, we may disclose medical information about you in response to a court or administrative order, subpoena, discovery request, or other lawful process. In addition to lawsuits, there may be other legal proceedings for which we may be required or authorized to use or disclose your medical information, such as investigations of health care providers, competency hearings on individuals, or claims over the payment of fees for services rendered.
- Law Enforcement. We may disclose your medical information if we are asked to do so by law enforcement officials, or if we are required by law to do so.
- Coroners, Medical Examiners and Funeral Home Directors. We may disclose your medical information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release medical information to funeral home directors as necessary to carry out their duties.
- De-identified Information and Limited Data Sets. Arbor may use and disclose health information that has been “de-identified” by removing certain identifies making it unlikely that you could be identified. Arbor may disclosed limited health information, contained in a “limited data set.” The limited data set does not contain any information that can directly identify you. For example, a limited data set may include your age, city, county and zip code, but not your name or street address.
- National Security and Intelligence Activities. We may disclose medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
- Inmates. If you are an inmate of a correctional institution or under custody of a law enforcement official, we may disclose medical information about you to the correctional institution or the law enforcement official. This would be necessary for the institution to provide you with health care, to protect your health and safety and the health and safety of others, or for the safety and security of the correctional institution or law enforcement official.
III. OTHER USES OF MEDICAL INFORMATION
There are times we may need or want to use or disclose your medical information other than for the reasons listed above, but to do so will need your prior permission. Disclosures which require your authorization include: (i) release of psychotherapy notes, (ii) uses and disclosures of PHI for marketing purposes, (iii) sale of PHI, and (iv) other uses and disclosures not outlined in this Notice. If you provide us permission to use or disclose medical information about you for such other purposes, you may revoke that permission in writing at any time. If you revoke your permission in writing to the Privacy Officer at the address listed in Section VI below, we will no longer use or disclose medical information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided to you.
- YOUR RIGHTS REGARDING MEDICAL INFORMATION ABOUT YOU
Federal and State laws provide you with certain rights regarding the medical information we have about you. The following are a summary of those rights.
- Right to Inspect and Copy. Under most circumstances, you have the right to inspect and/or copy your medical information that we have in our possession, which generally includes your medical and billing records. To inspect or copy your medical record you must submit your request in writing to Arbor’s Privacy Officer the address listed in Section VI below.
Arbor will generally set up a mutually agreeable time for you to inspect or obtain a copy of your medical information within thirty days of your request. To the extent that Arbor maintains a portion of your record in an electronic format, Arbor will provide a paper copy of that portion of your record or will provide you with an electronic copy of that portion of your record if able to do so in a readable format. If you request a copy of your information, we may charge a fee for the costs of copying, mailing, or other supplies associated with your request. The fee we charge will not exceed the amount allowed by state law.
In certain very limited circumstances allowed by law, we may deny your request to review or copy your medical information. We will give you any such denial in writing. If you are denied access to medical information, you may request that the denial be reviewed. Another licensed health care professional chosen by Arbor will review your request and the denial. The person conducting the review will not be the person who denied your request. We will abide by the outcome of the review.
- Right to Request an Amendment. If you feel the medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by Arbor. To request an amendment, your request must be in writing and submitted to the Privacy Officer at the address listed in Section VI below. In your request, you must provide a reason as to why you want this amendment. If we accept your request, we will notify you of that in writing.
Arbor is not required to amend your information at your request. Arbor may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that (i) was not created by us, (ii) is not part of the information kept by Arbor, (iii) is not part of the information which you would be permitted to inspect or copy, (iv) is accurate and complete, or (v) is not part of the Designated Record Set. If we deny your request, we will notify you of that denial in writing.
- Right to an Accounting of Disclosures. You have the right to request an “accounting of disclosures” of your medical information. This is a list of the disclosures we have made for up to six years prior to the date of your request of your medical information, but does not include disclosures for Treatment, Payment, or Health Care Operations (as described in Sections II A, B, and C of this Notice), or disclosures made pursuant to your specific authorization (as described in Section III of this Notice), or certain other disclosures. To request this accounting, you must submit your request in writing to Arbor’s Privacy Officer at the address set forth in Section VI below.
Your request must state a time period the accounting should cover which may not be longer than six years and may not include dates before April 14, 2003. The first request for an accounting within a twelve-month period will be free. However, Arbor may charge a reasonable fee for each additional accounting provided at your request during the same twelve month period. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
To the extent Arbor maintains and electronic health record, Arbor will account for disclosures made of the electronic information even if made for treatment, payment, or health care operations. If you request an electronic accounting, the accounting by law is only required to cover the three years prior to the date of your request for an accounting. Depending upon how long Arbor has had an electronic health record in place, Arbor may not be able to provide an electronic accounting for the years prior to the full implementation of its electronic health record.
- Right to Request Restrictions. You have the right to request a restriction or limitation on the medical information we use or disclose about you in various situations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend.
We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you with emergency treatment. In addition, there are certain situations where we won’t be able to agree to your request, such as when we are required by law to use or disclose your medical information. To request restrictions, you must make your request in writing to Arbor’s Privacy Officer at the address listed in Section VI below. In your request, you must specifically tell us what information you want to limit, whether you want us to limit our use, disclosure, or both, and to whom you want the limits to apply.
- Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we contact you at work rather than at home. To request such confidential communications, you must make your request in writing to Arbor’s Privacy Officer at the address listed in Section VI below.
We will not ask the reason for your request, and we will use our best efforts to accommodate all reasonable requests, but there are some requests with which we will not be able to comply. Your request must specify how and where you wish to be contacted.
- Notification of a Breach. You have a right to be notified if your medical information is used or disclosed in a manner that is not permitted by federal law (HIPAA). In the event of a breach, Arbor actively takes steps to rectify the disclosure.
- Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice. To obtain a copy of this Notice, you should visit our website or send a request to Arbor’s Privacy Officer at the address set forth in Section VI below.
- CHANGES TO THIS NOTICE.
We reserve the right to change this Notice at any time, along with our privacy policies and practices. We reserve the right to make the revised or changed Notice effective for medical information we already have about you as well as any information we receive in the future. We will post a copy of the current notice, along with an announcement that changes have been made, as applicable, on our website. When changes have been made to the Notice, you may obtain a revised copy by sending a letter to Arbor’s Privacy Officer at the address listed in Section VI below or by visiting our website.
If you believe that your privacy rights as described in this notice have been violated, you may file a complaint with Arbor at the following address or phone number:
Arbor Diagnostics, Inc.
Attn: Privacy Officer
4848 Lemmon Ave #399
Dallas, Texas 75219
Telephone: (469) 886-4700
To file a complaint or to ask questions about this Notice, you may send an email, call, or send a written letter to Arbor’s Privacy Officer. Arbor will not retaliate against any individual who files a complaint. You may also file a complaint with the Secretary of the Department of Health and Human Services.
Effective Date of Notice: June 1, 2017