THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice of Privacy Practices ("Notice") applies to Pelvic Health Institute of Illinois, P.C. ("PHII," "we," "our," or "us") and all records of your care generated by or maintained at PHII. It describes your rights and our legal obligations with respect to your protected health information ("PHI") under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the HITECH Act, as amended.
1. Our Legal Duties
We are required by law to:
- Maintain the privacy of your PHI;
- Provide you with this Notice describing our legal duties and privacy practices with respect to PHI;
- Notify you following a breach of unsecured PHI, as described in Section 6 below; and
- Follow the terms of the Notice currently in effect.
We reserve the right to change our privacy practices and the terms of this Notice. If we make a material change, we will make the revised Notice available at our offices and on this website. Any change applies to PHI we already hold as well as PHI we receive in the future.
2. How We May Use and Disclose Your PHI
Uses and disclosures that do not require your authorization
- Treatment. We use and share PHI to provide, coordinate, and manage your health care. For example, we may share information with a referring physician, a specialist, a laboratory, or another treating provider to support your care.
- Payment. We use and share PHI to bill and collect payment for services. For example, we may send claim information to your health insurance plan, verify benefits, or respond to a payment dispute.
- Health care operations. We use and share PHI for activities that support the operation of our practice, such as quality improvement, staff training, accreditation, auditing, and business management.
- Appointment reminders and care communications. We may contact you to remind you of an appointment or provide information about treatment options or services.
- As required by law. We will disclose PHI when required to do so by federal, state, or local law, including in response to a court order, subpoena, or legally authorized government request.
- Public health activities. We may disclose PHI to public health authorities for activities such as disease surveillance, reporting of abuse or neglect, FDA safety reporting, or workplace safety oversight.
- Health oversight activities. We may disclose PHI to government agencies authorized to conduct audits, investigations, or inspections of our practice.
- Serious threat to health or safety. We may disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of you or another person.
- Decedents. We may disclose PHI to funeral directors, coroners, or medical examiners as permitted by law.
- Research. We may use or disclose PHI for research purposes under specified conditions that protect patient privacy.
Uses and disclosures that require your written authorization
We will not use or disclose your PHI for any purpose not described in this Notice without your written authorization, except as required by law. Authorization is specifically required for:
- Marketing purposes;
- Sale of your PHI;
- Most disclosures of psychotherapy notes; and
- Any other use or disclosure not otherwise permitted.
You may revoke an authorization at any time in writing. Revocation does not apply to actions we already took in reliance on the authorization.
3. Your Rights Regarding Your PHI
-
Right to inspect and obtain a copy. You have the right to inspect and receive a copy of PHI that we use to make decisions about your care. We may charge a reasonable cost-based fee. To request access, submit a written request to our Privacy Officer. We will respond within 30 days.
-
Right to request amendment. If you believe PHI we hold is inaccurate or incomplete, you may request that we amend it. We may deny your request if the information was not created by us or if we determine the information is accurate. We will notify you of our decision in writing.
-
Right to an accounting of disclosures. You may request a list of certain disclosures we have made of your PHI during the past six years. This right does not apply to disclosures made for treatment, payment, or health care operations, or certain other disclosures. We will respond within 60 days.
-
Right to request restrictions. You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or health care operations, or to limit disclosures to family members or others involved in your care. We are not required to agree to a requested restriction, except that we must agree to your request not to disclose PHI to a health plan for services you paid out-of-pocket in full.
-
Right to request confidential communications. You may request that we communicate with you about your PHI in a specific way or at a specific location. For example, you may ask us to contact you only at a particular phone number or address. We will honor reasonable requests.
-
Right to a paper copy of this Notice. You have the right to receive a paper copy of this Notice at any time, even if you have agreed to receive it electronically.
-
Right to be notified of a breach. You have the right to be notified if a breach of your unsecured PHI occurs, as described in Section 6 below.
To exercise any of these rights, please contact our Privacy Officer in writing at the address below.
4. Minimum Necessary Standard
When using or disclosing PHI, or when requesting PHI from another covered entity, we will make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose, consistent with applicable law.
5. Business Associates
We may share PHI with third-party "business associates" who perform services on our behalf, such as billing companies, electronic health record vendors, and scheduling platforms. We require our business associates to protect PHI through written agreements that comply with HIPAA.
6. Breach Notification
In the event of a breach of your unsecured PHI, we are required by the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D) to notify you without unreasonable delay and in no case later than 60 calendar days after discovery of the breach. Notification will be provided by first-class mail to your last known address, or by email if you have agreed to electronic notice.
Our breach notification to you will include, to the extent possible:
- A brief description of what happened, including the date of the breach and the date of its discovery;
- A description of the types of PHI involved (e.g., name, date of birth, diagnosis, insurance information);
- Steps you should take to protect yourself from potential harm;
- A brief description of what we are doing to investigate the breach, mitigate the harm, and prevent future occurrences; and
- Contact information for you to ask questions or obtain additional information.
If a breach involves 500 or more individuals in Illinois, we will also notify prominent media outlets serving the state and report the breach to the Secretary of the U.S. Department of Health and Human Services (HHS) within 60 days. Breaches affecting fewer than 500 individuals will be reported to HHS on an annual basis.
7. Complaints
If you believe your privacy rights have been violated, you may file a complaint with PHII or with the Secretary of the U.S. Department of Health and Human Services:
You will not be penalized, retaliated against, or disadvantaged in any way for filing a complaint.
8. Contact
Privacy Officer
Pelvic Health Institute of Illinois, P.C.
5851 W. 95th Street, Suite 300
Oak Lawn, IL 60453
info@pelvichealthil.com
(708) 499-9800
