State and Federal laws require us to maintain the privacy and confidentiality of your protected health information (PHI) and to inform you about our legal duties and privacy practices by providing you with this Notice. Under Federal Law, your health information is protected and confidential. Protected health information includes all individually identifiable health information held or transmitted by the Center or our business associates, in any form or media, whether electronic, paper, or oral. Individually identifiable health information is information including demographic data, information about your symptoms, test results, diagnosis, and treatment, other related medical information, and payment, billing, and insurance information that can be used to identify you. We are required to abide by the terms of this notice currently in effect, and to notify affected individuals following a breach of unsecured protected health information. The terms of this notice apply to both the individual (subject of the PHI) and the personal representative of the individual.

A major purpose of the HIPAA Security and Privacy Regulations is to define and limit the circumstances in which an individual’s protected health information may be used or disclosed by covered entities such as the Center. We may not use or disclose protected health information, except either: (1) as the HIPAA Regulations permits or requires; or (2) as the patient or their representative authorizes in writing. We must disclose protected health information in only two situations: (1) to individuals (or their personal representatives) specifically when they request access to, or an accounting of disclosures of their protected health information: and (2) to Health and Human Services (HHS) for the purpose of them investigating or determining our compliance with the Privacy Rule. Our business associates must also disclose your PHI to Health and Human Services for the purpose of them investigating or determining their compliance with the HIPAA Regulations. With some exceptions, we may not use or disclose any more or your health information than is necessary to accomplish the purpose of the use of disclosure.

A record of your care is kept for the following reasons: as a basis for planning your care and treatment, as a means of communication among health care providers who contribute to your care, as a legal document describing the care you received, as a means by which you or a third-party payer can verify that services billed were actually provided, as a tool in educating health professionals, as a source of data for medical research, as a source of public health information, as a source for facility planning, and a tool with which the practice can assess and continually work to improve the care we render and outcomes we achieve. The Center collects health information about you and stores it in an electronic health record. This is your medical record. The medical record is the property of this Center, but the information in the medical record belongs to you. We are committed to keeping your health information confidential, and will not disclose your health information without your authorization, except as described in this notice.

Prior to any disclosure, the Center will verify the identity of a person requesting PHI and the authority of any such persons to have access to PHI if the identity or authority of such person is not known to us. We will also obtain any documentation, statements, or representations whether oral or written, from the person requesting the protected health information when such information is a condition of the disclosure.

This Notice will take effect on September 23, 2013 and will remain in effect until it is amended or replaced by us. We will make policies and procedures with respect to PHI that comply with the HIPAA Regulations. Any changes in the law will be reflected in our policies and procedures and this privacy notice. Changes in our policies or procedures will not be implemented prior to the effective date of the revised notice. We reserve the right to change the terms of this notice and to make the new notice provisions effective for all PHI that we maintain regardless of when it was created or received.

Our current Privacy Notice will be provided to you no later than the date of your first service delivery after the effective date. You may request a copy of our Privacy Notice at any time by asking our receptionist or other staff member. Our current Privacy Notice is posted in our reception area and on our website: www.seafordendo.com.

PERMITTED USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION

The Center is permitted, but not required, to use and disclose PHI, without an individual’s authorization, for the following purposes or situations:

1) To the Individual. We may disclose PHI to the individual who is the subject of the information.

2) Treatment, Payment, and Health Care Operations. Except with respect to uses or disclosures that require an authorization or are prohibited under the HIPAA Regulations, we may use or disclose your PHI for treatment, payment, or health care operations as described below.

• a) Treatment: While we are providing you with health care services, we may share your protected health information (PHI) including electronic protected health information (ePHI) with our employees, other health care providers, business associates and their subcontractors and other individuals who are involved in your treatment, billing, administrative support or data analysis. These business associates and subcontractors through signed contracts are required by Federal law to protect your health information. We may disclose and/or share protected health information (PHI) including electronic disclosure with other health care professionals outside of this practice who provide treatment and/or service to you. These professionals will have a privacy and confidentiality policy like this one. Health information about you may also be disclosed to your family, friends, personal representative and/or other persons you choose to involve in your care, only if you agree that we may do so. For example we may disclose your PHI to others who may assist in your care, such as a family member, a referring or consulting physician, a pharmacist when ordering a prescription for you, or to a laboratory when ordering lab or pathology tests.
• b) Payment: We may use and disclose your PHI to another covered entity or a health care provider to seek payment for services we provide to you. This disclosure involves our business office staff and may include insurance organizations, collections or other third parties that may be responsible for such costs, such as family members. For example we may contact your health insurer to certify that you are eligible for benefits and we may disclose your treatment plan to determine if your insurer will pay for your treatment. Our practice may submit an itemized billing statement to your insurance carrier for the purpose of payment for health care services rendered. If you pay for your health care services personally, we may provide an itemized billing to your insurance carrier for the purpose of reimbursement to you, unless you request otherwise. The billing statement contains medical information, including diagnosis, date of injury or condition, and codes which describe the health care services you received. If you request that your insurance not be notified of services that you have paid for out of pocket, we take every reasonable precaution to avoid their notification.
• c) Healthcare Operations: We will use and disclose your PHI as part of our business operations including conducting quality assessment and improvement activities, patient safety activities, improving health or reducing health care costs, reviewing the competence or qualifications of health care professionals, health care provider training, accreditation, certification, licensing, or credentialing activities, activities related to health insurance contracting, conducting reviews, audits, fraud and abuse detection and compliance programs, business planning, development and management. We may also disclose your PHI to another covered entity for health care operations activities of the entity that receives the information, if each entity either has or had a relationship with you, the PHI pertains to such relationship, and the disclosure is for the purpose of treatment, payment or detection of health care fraud and abuse or compliance. Examples of personnel who may have access to this information include, but are not limited to, outside health or management reviewers, our consulting pharmacist, accreditation surveyors, and individuals performing similar activities.

3) Business Associates. We may disclose your PHI to a business associate and may allow a business associate to create, receive, maintain, or transmit PHI on its behalf, if we obtain satisfactory assurance that the business associate will appropriately safeguard the information. Similarly, our business associates may disclose PHI to a business associate that is a subcontractor with assurance that the subcontractor will safeguard the information. This satisfactory assurance will be documented in a written contract between the Center and our business associates. This contract is called a Business Associate Agreement and will establish required uses and disclosures of PHI by the business associate. The contract will (a) notify the business associate not to use or further disclose the information other than as permitted by the contract, (b) specify that they use appropriate safeguards and protect electronic health information, (c) require them to report any use or disclosure of information not provided for by its contract including breaches of unsecured PHI, (d) ensure that any subcontractors agree to the same restrictions and conditions that apply to them with respect to PHI,(e) make available PHI according to the HIPAA Regulations, (f) make PHI available for amendment, (g) provide an accounting of disclosures, (h) comply with the HIPAA Regulations, (i) make their internal records available to HHS for the purposes of determining compliance with the HIPAA Regulations, (j) at the termination of the contract, return or destroy all PHI received from, or created or received by them on behalf of the Center, and (k) authorize termination of our contract with them if we determine that they have violated the terms of our business associate contact. Our business associates may use or disclose your PHI for their proper management and administration and to carry out their legal responsibilities. Any subcontractors of our business associates are subject to the same requirements that apply between the Center and that business associate. Examples of business associates are providers of our electronic medical records, call reminder services, and patient satisfaction survey providers.

4) Uses or Disclosures with Opportunity to Agree or Object. Informal permission to use or disclose PHI may be obtained by asking you outright, or by circumstances that clearly give you the opportunity to agree or object. Except when an objection is expressed, we may use the following PHI to maintain a directory in the Center; your name, location in the Center, and your condition in general terms that does not communicate specific medical information about you. We will ask your permission to disclose your PHI to the person(s) who accompanies you to your procedure or someone else who may inquire about you. We will also use your PHI to give you reminders of recommended services, treatment, or scheduled appointments. We will use the contact information you provide us unless you request otherwise. For example, we will ask your permission for your responsible driver to be with you after your procedure and receive information about your health and procedure results. You will also receive written and phone reminders regarding your treatment and scheduled appointments. If you are not home we may leave a message on your answering machine or in a message left with the person answering the phone. We will also have you sign in when you arrive for your appointments and will call out your name when we are ready to see you.

Emergencies: If the opportunity to object to uses or disclosures discussed in this section cannot practically be provided to you because you are incapacitated, receiving emergency treatment, or deceased, we may use or disclose your PHI to notify, or assist in the notification of a family member, a personal representative, or other person involved in your health care or payment. We may also disclose your PHI for disaster relief purposes. We may disclose your name, location, general condition or death, and religious affiliation consistent with your prior expressed preference if known. Under emergency conditions or if you are incapacitated we will use our professional judgment to disclose only that information directly relevant to your care. If you are present and it is at all possible, we will give you the opportunity to agree or object prior to making a disclosure discussed in this paragraph.

5) Incidental Use and Disclosure. We will adopt reasonable safeguards as required by the HIPAA Regulations to prevent the risk of an incidental use or disclosure of your PHI that may occur as a result of an otherwise permitted use or disclosure. We will follow the “minimum necessary” principle regarding use and disclosure of your PHI. We will make reasonable efforts to use, disclose, and request only the minimum amount of PHI needed to accomplish the intended purpose of the use, disclosure, or request. Staff access to your PHI is limited to such persons or classes of person who need access to PHI to carry out their duties. Everyone on our staff is required to sign a confidentiality statement. The minimum necessary requirement is not imposed in any of the following circumstances: (a) disclosure to a request by a health care provider for treatment; (b) disclosure to the individual or personal representative of the subject of the information; (c) use or disclosure that has been authorized; (d) disclosure to HHS for a compliance investigation, review or enforcement; (e) use or disclosure required by law; or (f) use or disclosure required for compliance with HIPAA Regulations.

6) Public Interest and Benefit Activities. For the purposes of public interest and benefit, we are permitted to use or disclose your PHI as described below:

• a. Uses and disclosures required by law. We may use or disclose your PHI without authorization when we are required to do so by law including by statute, regulation, or court orders.
• b. Uses and disclosures for public health activities. We may use or disclose your PHI to a public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions; or, at the direction of a public health authority, to an official of a foreign government agency that is acting in collaboration with a public health authority. We may disclose your health information to appropriate authorities any report of child abuse or neglect. We are required to report to the Food and Drug Administration (FDA) any concerns related to the quality, safety, or effectiveness of any FDA-regulated product or activity. This includes adverse events with respect to food or dietary supplements, product defects or problems, or biological product deviations. We may also have to participate in the tracking of FDA-regulated products, enable product recalls, repairs, replacement or look-back including locating and notifying individuals who have received affected products, and conduct post-marketing surveillance. We are required to report a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition. We may disclose PHI about you if you are a student or prospective student of a school if the PHI is limited to proof of immunization and the school is required by law to have such proof of immunization prior to admitting you. Agreement with this disclosure will be obtained from the parent, guardian, or other person acting in loco parentis, or the individual if the individual is an adult or emancipated minor.
• c. Uses and disclosures about victims of abuse, neglect or domestic violence. Except for reports of child abuse or neglect, we may disclose PHI about you if we reasonably believe you to be a victim of abuse, neglect, or domestic violence to a government authority, including a social service or protective agency, authorized by law to receive reports of such. The disclosure must be limited to the relevant requirements of the law; you must agree to the disclosure; and in our professional judgment we must believe that the disclosure is necessary to prevent serious harm to you or other potential victims. We will inform you that such a report has been or will be made unless in our professional judgment, we believe that informing you would place you at risk of serious harm, or we would be informing your personal representative that we reasonably believe is responsible for the abuse, neglect, or other injury and that informing such person would not be in your best interest.
• d. Uses and disclosures for health oversight activities. We may disclose your PHI to a health oversight agency for the activities authorized by law, including audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions; or other activities necessary for appropriate oversight of: the health care system; government benefit programs; entities subject to government regulatory programs or civil rights laws; for which health information is necessary for determining compliance. We are not permitted to make disclosures for health oversight in which you are the subject or which are not directly related to health care, health benefits or services.
• e. Disclosures for judicial and administrative proceedings. We may disclose your PHI in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal, provided we disclose only the PHI expressly authorized by such order, or in response to a subpoena, discovery request, or other lawful process. We will ask for assurance that you have been notified of the request for PHI; the reason for request of PHI; that you have been given the opportunity to object to the disclosure; the time frame to object has elapsed; and no objections are pending.
• f. Disclosures for law enforcement purposes. We may disclose your PHI to a law enforcement official’s request if any of the following conditions are met; (1) pursuant to process and as otherwise required by law; (2) limited for the purpose of identifying and locating a suspect, fugitive, material witness, or missing person by disclosure of name, address, date and place of birth, social security number, blood type, type of injury, date and time of treatment, date and time of death, and description of distinguishing physical characteristics. We may not disclose DNA analysis, dental records, samples or analysis of body fluids or tissue; (3) the request is about you as a victim of a crime if you agree to the disclosure. We may disclose your PHI without your permission if you are incapacitated if the information is not to be used against you, law enforcement activity depends on prompt disclosure, and in our professional judgment disclosure is in your best interest; (4) law enforcement is requesting your PHI after you are deceased if we have a suspicion that such death may have resulted from criminal conduct; (5) we are disclosing PHI to a law enforcement official that we believe constitutes evidence of criminal conduct that occurred on the premises of the Center; or (6) we are reporting crime in an emergency situation to alert law enforcement of the commission, nature and location of a crime, the location of a victim, or the identity, descriptions and location of a perpetrator.
• g. Uses and disclosures about decedents. We may disclose your PHI to a coroner or medical examiner for the purpose of identifying you, determining a cause of death, or other duties as authorized by law. We may also disclose your PHI to a funeral director as necessary to carry out their duties after or in reasonable anticipation of your death. After your death, we may disclose your PHI to a family member or individual involved in your care or payment prior to death.
• h. Uses and disclosures for cadaveric organ, eye or tissues donation purposes. We may use or disclose PHI for organ procurement organizations for the purpose of facilitating organ, eye, or tissue donation and transplantation.
• i. Uses and disclosures for research purposes. We may use or disclose your PHI for research provided that the Center Management Board has approved a waiver of authorization, the PHI is necessary for research and not removed from the Center, the waiver specifies how PHI will be protected, there is a description of what PHI is needed, and the waiver has been reviewed, approved and signed.
• j. Uses and disclosures to avert a serious threat to health or safety. Consistent with applicable law and standards of ethical conduct, we may disclose your PHI if in good faith we believe that doing so is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and is necessary for law enforcement to identify or apprehend an individual. We cannot disclose your PHI learned in the course of treatment, referral to treatment, or counseling for the criminal conduct which is the basis for the disclosure.
• k. Uses and disclosures for specialized government functions. We may use and disclose your PHI if you are Armed Forces personnel for activities deemed necessary for appropriate military command authorities to assure the proper execution of the military mission. We may also disclose your PHI to authorized federal officials for the conduct of lawful intelligence, counter-intelligence, and other national security activities, and for the provision of protective services to the President or other foreign heads of state. If you are an inmate we may also disclose your PHI to correctional institutions or law enforcement officials having lawful custody of you if that PHI is necessary for: (1) the provision of your care; (2) the health and safety of you or other inmates; (3) the health and safety of the officers, employees or others at the correctional institution; (4) the health and safety of such individuals and officers transporting the inmates; (5) law enforcement on the premises of the correctional institution; or (6) the administration and maintenance of the safety, security, and good order of the correctional institution.
• l. Disclosures for workers’ compensation. We may disclose your PHI as authorized by and to the extent necessary to comply with state laws relating to worker’s compensation that provided benefits for work-related injuries or illness without regard to fault. We may use or disclose PHI to your employer about you if we provide health care to you at the request of your employer. Information disclosed would be for the purpose of your employer conducting an evaluation relating to medical surveillance of the workplace or evaluating whether you have a work-related illness or injury.
• m. Change of Ownership. In the event that this Center is sold or merged with another organization, you health information will become the property of the new owner, although you will maintain the right to request that copies of your health information be transferred to another physician or medical group.

USES AND DISCLOSURES THAT REQUIRE YOUR AUTHORIZATION

YOUR PRIVACY RIGHTS AS OUR PATIENT

QUESTIONS AND COMPLAINTS