This HIPAA notice describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully. My office respects your privacy. We are also legally required to maintain the privacy of your protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPPA) and other federal and state laws. As part of our commitment to maintaining your privacy, we are providing you with this Notice of HIPAA Privacy Policies (the “Notice”). This Notice describes your rights and obligations of Covered Entities and Business Associates under the Health Insurance Portability & Accountability Act and amendments thereto (HIPAA), the Health Information Technology for Economic and Clinical Health Act and amendments thereto (HITECH), and the regulations promulgated under these Acts. All capitalized terms shall have the meanings assigned to the terms under HIPAA, unless the terms have been otherwise defined herein. Please note that this Notice only applies to your protected health information (“PHI”), if any, that is created or obtained in connection with the services you elect to receive from my office. PHI is personally identifiable health information that we keep or transmit in electronic, oral, or written form. PHI includes, but is not limited to, information such as your name, contact information, information about past, present, or future physical or mental health conditions, payment for services, or prescriptions. Regardless of Bethany Detwiler, PhD LLC’s designation under HIPAA, all of your PHI is obtained, maintained, and shared consistent with HIPAA requirements and kept safe through the use of a combination of physical, electronic, and procedural safeguards in accordance with applicable Federal and State laws. Our office policy is to create a record of the care and health services you receive to both provide care and comply with legal requirements. Both my staff and I follow the duties and privacy practices that this Notice describes and any changes once they take effect.
I. HOW YOUR PHI MAY BE USED AND DISCLOSED A. Use and Disclosure Permitted by HIPAA. Your PHI may be used and disclosed for purposes of treatment, payment, health care operations, health related services, and in accordance with any applicable Business Associate Agreement. Any use or disclosure of your PHI for payment or health care operations must be limited to the minimum necessary to accomplish the purpose of the use or disclosure. The following provides a non-exhaustive list of examples to help illustrate the circumstances in which we may use or disclose your PHI: Treatment. Bethany Detwiler, PhD LLC may use and disclose your PHI in connection with the services you elect to receive from Bethany Detwiler, PhD LLC, which may include the information you provide on a health risk assessment form, the results of your laboratory tests, the information exchanged between you and any health coaches or healthcare professionals who you may connect with through our services (“Services”). The information you provide, the results of any of your laboratory tests and the accompanying explanations of your results, and other relevant health information will be provided to you through a personalized and secure internet platform (“Dashboard”) that is accessible through our website. The Dashboard helps to simplify and expedite your access to your PHI and the exchange of your PHI with the health coaches, physicians, and other healthcare professionals you may connect with and utilize through our Services. Payment. Your PHI is permitted to be used and disclosed for purposes of billing and collecting payment for our Services. Health Care Operations. Your PHI is permitted to be used and disclosed for health care operations. Examples of health care operations include: quality assessment and improvement activities; protocol development
B. Authorization for Certain Uses and Disclosures. By electing to receive our Services and/or using the Dashboard, you agree that Bethany Detwiler, PhD LLC can make the following uses and disclosures of your PHI. Before any information is released, we require that you make an access request in writing. If you request to provide a copy of the information to another person or organization, we require that you sign a written authorization that clearly identifies the designated individual(s) or entity and where to send the information. The client shall have the right to revoke the authorization, in writing, at any time prior to the release of the confidential information. Each authorization will contain an expiration date, your signature and date. Section II of this Notice sets forth your rights to revoke or make changes to your authorization.
C. Uses and Disclosures Required by Law. Your PHI may be used and disclosed as allowed or required by law. PHI can be shared for public health oversight activities, for judicial or administrative proceedings with public health authorities, for law enforcement reasons, and with coroners or medical examiners. PHI can also be shared with organ donation groups for certain reasons, for research (in accordance with HIPAA restrictions), and to avoid a serious threat to health or safety. PHI can also be shared for special government functions, Workers’ Compensation, to respond to requests from the U.S. Department of Health and Human Services, to alert proper authorities if we reasonably believe that you may be a victim of abuse, neglect, domestic violence or other crimes, and any other manner required by law. HIPAA does not require our office to share PHI with a client’s family or friend, unless they are the client’s personal representative or the client does not object to the disclosure.
II. USES AND DISCLOSURES THAT REQUIRE YOUR WRITTEN AUTHORIZATION The following uses and disclosures of your PHI will be made only with your written authorization: 1. Uses and disclosures of PHI for marketing purposes;
2. Disclosures that constitute a sale of your PHI; and
3. Other uses and disclosures of PHI not covered by this Notice or the laws that apply to Bethany Detwiler, PhD LLC.
If you give Bethany Detwiler, PhD LLC such authorization, you may revoke it at any time (except to the extent that we have taken action based on the authorization) by submitting a written revocation to Bethany Detwiler, PhD, LLC. Upon receipt of your written revocation, Bethany Detwiler, PhD LLC will no longer disclose PHI under the revoked authorization. Please note that information disclosed pursuant to an authorization may no longer protected under HIPAA.
We will not release any copies of our notes about our sessions (psychotherapy notes) unless you provide us with your written authorization. Psychotherapy notes are notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session that are separate from the rest of the individual’s medical records. These notes exclude medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date. There are limited circumstances where written authorization is not needed to disclose psychotherapy notes. The HIPAA Privacy Rule and state law permits disclosure of client confidential information if disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public or to alert proper authorities if we reasonably believe that you may be a victim of abuse, neglect, domestic violence or other crimes, and any other manner required by law.
III. YOUR RIGHTS REGARDING PROTECTED HEALTH INFORMATION ABOUT YOU You have several rights with regard to the PHI that Bethany Detwiler, PhD LLC maintains about you. If you wish to exercise any of the following rights, please contact Bethany Detwiler, PhD, LLC.
Right to Request Restrictions. You have the right to request additional restrictions on the PHI that Bethany Detwiler, PhD LLC may use for treatment, payment, and health care operations. You may also request additional restrictions on our disclosure of PHI to certain individuals involved in your care or benefit coverage that otherwise are permitted by HIPAA. Bethany Detwiler, PhD LLC is not required to agree to your request. If we do agree to your request, we are required to comply with our agreement except in certain cases, including where the information is needed to treat you or verify coverage in the case of an emergency. A request for restrictions must be made in writing, directed to the Covered Entity, and should include (1) the information you want to limit; (2) whether you want to limit its use, disclosure or both; and (3) to whom you want the limits to apply.
Right to Receive Confidential Communications. You have the right to request that Bethany Detwiler, PhD LLC communicate with you about medical in a certain manner or at a certain location. For example, you may request that Bethany Detwiler, PhD LLC only contact you at work, or only at home, or only by mail. To request confidential communications, you must make a request in writing to Bethany Detwiler, PhD LLC, and your request must specifically and clearly state how you would like to be contacted.
Right to Inspect and Copy.You have the right to request the opportunity to inspect and receive a copy of PHI about you from Bethany Detwiler, PhD LLC. Such records may include your insurance and billing records but does not include information gathered or prepared for a civil, criminal, or administrative proceeding. Please note that a request to inspect your medical records means that you may examine them at a mutually convenient time or place. To inspect and copy PHI, you must submit your request in writing to Bethany Detwiler, PhD LLC. If you request a copy of PHI about you, we may charge you a reasonable fee for the copying, postage, labor, and supplies used to meet your request. We may deny your request to inspect and copy PHI only in limited circumstances.
Right to an Electronic Copy of Electronic Medical Records.If your PHI is maintained in an electronic format (known as an electronic medical record or an electronic health record), you have the right to request that an electronic copy of your record be given to you or transmitted to another individual or entity from Bethany Detwiler, PhD LLC. Bethany Detwiler, PhD LLC will make every effort to provide access to your PHI in the form or format you request, if it is readily producible in such form or format. If the PHI is not readily producible in the form or format you request your record will be provided in either its standard electronic format or if you do not want this form or format, a readable hard copy form. Bethany Detwiler, PhD LLC may charge you a reasonable, cost-based fee for the labor associated with transmitting the electronic medical record.
Right to Amend. You have the right to request that the Covered Entity and in certain instances that Bethany Detwiler, PhD LLC amend PHI about you as long as such information is kept by or for our office. To make this type of request of us, you must submit your request in writing to Bethany Detwiler, PhD LLC. A request to amend your medical records must give the reasons for the amendment. Bethany Detwiler, PhD LLC may deny your request in certain cases, including if it is not in writing or if you do not give us a reason for the request or if we are not the proper entity under HIPAA to perform such amendments.
Right to Receive an Accounting of Disclosure. You have the right to receive a list of certain disclosures of your PHI in the past six years other than disclosures made for treatment, payment or health care operations. You may exercise this right by contacting Bethany Detwiler, PhD LLC.
Right to a Paper Copy of this Notice.You have a right to receive a paper copy of this Notice at any time. To obtain a paper copy of this notice, contact Bethany Detwiler, PhD LLC. You may also obtain a copy of the current version of this Notice on our website at www.bdetwilerphd.com.
Right to Breach Notification. Under HIPAA, a Covered Entity must provide notification to you upon any breach of your PHI without unreasonable delay but no later than 60 days after the breach has been discovered. Bethany Detwiler, PhD LLC will promptly notify you if a data breach occurs that may have compromised the privacy or security of your PHI. If a data breach occurs, we will notify you no later than 60 days after we discover the breach in writing, by first-class mail, or we may email you if you have provided us with your current email address and you have previously agreed to receive notices electronically. In limited circumstances when we have insufficient or out-of-date contact information, we may provide notice in a legally acceptable alternative form.
IV. AMENDMENTS TO THIS NOTICE Bethany Detwiler, PhD LLC reserves the right to amend this Notice at any time. In addition, Bethany Detwiler, PhD LLC is required to amend this Notice as made necessary by changes to HIPAA, HITECH, or the regulations promulgated thereto. Each version of the Notice will have an effective date on the first page. Bethany Detwiler, PhD LLC reserves the right to make the amended Notice effective for PHI at the time the amendment is made, as well as for any PHI that Bethany Detwiler, PhD LLC may receive or create in the future. Bethany Detwiler, PhD LLC will post a copy of the current Notice on our website, bdetwilerphd.com.
V. QUESTIONS AND COMPLAINTS If you want further information about matters covered in this Notice, or believe that your privacy rights have been violated, or disagree with a decision made about access to your personal and health information, you can contact Bethany Detwiler, PhD LLC. You may also submit a complaint to the office of the Secretary of Health and Human Services, 150 S. Independence Mall West, Suite 372, Public Ledger Building, Philadelphia, PA 19106-9111. You will not be penalized for filing a complaint.