Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who we are

This notice applies to [Practice Legal Name — the covered entity, e.g. your professional corporation; this is a separate entity from any university or hospital you hold an appointment at, and their notices do not cover this practice], at [Street address, city, state, and ZIP of the practice. If there is no patient-facing office, use the entity's business address of record and do not describe it as an office.].

[State who else this notice covers — this sentence defines the workforce bound by the notice, so it cannot be left vague. If you practice solo with no employees or contractors, say so plainly: "This practice is a solo practice; Peter A. Pellionisz, MD, PhD is its only clinician." If you employ or contract with other clinicians, an administrator, a scheduler, a biller, or a transcriptionist, the notice must cover them and say so, and each outside vendor needs a Business Associate Agreement. Settle this with counsel before any patient signs the notice.]

Our obligations

We are required by law to maintain the privacy and security of your protected health information ("PHI"), give you this notice of our legal duties and privacy practices, notify you if a breach compromises your unsecured PHI, and follow the terms of the notice currently in effect.

How we may use and disclose your PHI

• Treatment. To provide and coordinate your care — for example, consulting with another clinician involved in your treatment, with appropriate authorization where required.
• Payment. To bill and collect payment for services. [Describe how this practice actually bills, because what leaves the practice differs completely by model and patients sign this notice: billing insurance directly (claims containing diagnoses go to the health plan and any clearinghouse); issuing superbills on request (the coded record goes to you, and you decide whether to submit it); or cash-pay with no superbill and no claim (nothing goes to a plan for payment). Then name every vendor that will touch patient information in the process — payment processor, clearinghouse, billing service, practice-management software — since each one needs a Business Associate Agreement. This paragraph MUST state the same policy as the "Insurance & reimbursement" and "Payment & cancellation" sections of /fees.html; a signed notice that contradicts the published fee policy is the version a patient will rely on.]
• Health care operations. Quality improvement, professional consultation, and practice administration.
• Psychotherapy notes. Psychotherapy notes receive special protection; most uses and disclosures require your specific written authorization.
• Required or permitted by law. Including: mandated reporting of suspected abuse or neglect; response to court orders; averting a serious and imminent threat to health or safety; health oversight activities; and workers' compensation, as applicable. [State law in your state may narrow or broaden these — counsel will conform this list.]

Uses and disclosures not described in this notice — including most uses for marketing, any sale of PHI, and most sharing of psychotherapy notes — will be made only with your written authorization, which you may revoke at any time in writing.

Your rights

• Access. You may inspect and receive a copy of your records, with narrow exceptions (including certain psychotherapy notes), usually within 30 days of a written request.
• Amendment. You may request correction of records you believe are inaccurate or incomplete.
• Accounting of disclosures. You may request a list of certain disclosures we have made of your PHI.
• Restrictions. You may request limits on how we use or disclose PHI. If you pay for a service in full out of pocket, you may direct us not to disclose that service to your health plan, and we must comply.
• Confidential communications. You may ask us to contact you in a specific way — for example, only at a particular phone number.
• Paper copy. You may request a paper copy of this notice at any time.

Complaints

If you believe your privacy rights have been violated, you may complain to us at the contact below or to the U.S. Department of Health and Human Services, Office for Civil Rights. We will never retaliate against you for filing a complaint.

Changes to this notice

We reserve the right to change this notice and to make the revised notice effective for PHI we already hold. The current notice is posted on this page and a paper copy is available on request. [If the practice has a physical location where patients are seen, HIPAA also requires the notice to be posted there in a clear and prominent place — add that here once the location is settled. If the practice is telehealth-only with no patient-facing office, say that instead, rather than referring to "the office."]

Privacy contact

[Privacy Officer name — in a solo practice, typically the physician]
[Practice Legal Name]
[Mailing address where a written privacy complaint can be sent — the same address used above]
[Practice phone number a patient can actually reach for privacy questions — a dedicated practice line or answering service, not a personal mobile] · [Practice contact email — a practice address you control, not a university address]