Notice of Privacy Practices

Treatment

We use and disclose your PHI in the course of your treatment. Once we complete your evaluation, re-evaluation, or plan of care, we send a copy or summary of our report to your referring or attending physician. We keep records of the care and services you receive so we can provide care accurately and consistently, and to meet legal requirements. Members of our workforce may use these records to make sure you get proper care.

Payment involving a third-party payer

After we treat you, we typically bill a third party for your services. We collect the treatment information, enter it into our system, and process the claim on paper or electronically. The claim details your health problem and the treatments you received, and includes your insurance policy number and other identifying details. If your Social Security number is required, the first five digits are redacted. The payer may also request a review of your records to confirm the services were medically necessary.

Payment without a third-party payer, fully self-pay

If you pay for your services in full without involving an insurer or employer, you may ask us not to disclose information about those services for payment purposes.

You will receive a Good Faith Estimate for all self-paid visits or treatments, whatever the reason. You will not receive one if you are enrolled in Medicare Part A, B, or C, Medicaid, TRICARE, Veterans Affairs, or Indian Health Services.

Health care operations

We use and disclose your PHI to run the practice. Our therapists meet periodically to review clinical records and monitor the quality of care, and your records may be used in those reviews. We participate in student internship programs, and we use the PHI of actual patients to assess students’ skills and knowledge. Other operational work includes business planning, compliance monitoring, and investigating and resolving complaints.

Permitted without your authorization

• If you do not object, we may share some of your PHI with a family member or friend who participates in your care.
• We may use your PHI in an emergency if you are unable to communicate.
• If you are a workers’ compensation patient, we may update your case worker or employer, unless state law requires your authorization.

Required without your authorization

• When required by law, such as a court order to disclose certain types of PHI.
• For public health activities, such as reporting a communicable disease or an adverse reaction to the Food and Drug Administration.
• To report neglect, abuse, or domestic violence.
• When government regulators or their agents need to determine whether we comply with applicable rules.
• For judicial or administrative proceedings, such as a response to a valid subpoena.
• When properly requested by law enforcement, or in response to other legal requirements such as reporting gunshot wounds.
• To avert a health hazard or respond to a threat to public safety.
• When deemed necessary by military command authorities, if you are in the Armed Forces.
• In connection with certain types of organ donor programs.

Substance use disorder records are different

If there are substance use disorder records, you must authorize the release of any history or treatment records under 42 CFR Part 2, unless federal law requires otherwise. Part 2 permits disclosure without your authorization only in limited circumstances: medical emergencies, scientific research under strict safeguards, audits or program evaluations, court orders that meet specific legal requirements, reporting suspected child abuse or neglect as required by law, and crimes committed on program premises or against program staff.

Your right to request limited use or disclosure

You may ask us not to use or disclose your PHI in a particular way. We are not required to agree. If we do agree, we must honor it. We require this request in writing.

Your right to confidential communication

You may ask us to contact you at a specific location or phone number. We require this request in writing, including the alternative address or phone number, and confirmation that it will not interfere with your payment method.

Your right to inspect and copy your PHI

You have the right to inspect and copy your PHI. If we keep your records on paper, that is the format you will receive. If we keep them electronically, you may review or obtain copies electronically.

Under California law we must let you inspect your records during business hours within 5 working days of receiving your written request, and we must provide copies within 15 days of your request.

If we decline a request, we must give you a resource person to help you seek review of that decision. We may charge reasonable fees for copying and for labor related to copying, and we may need to schedule an appointment for record inspection. We require this request in writing.

Your right to revoke your authorization

If you have authorized us to use or disclose your PHI, you may revoke that authorization at any time in writing. We relied on your permission before the revocation, and used or disclosed your PHI within its scope during that time.

Your right to amend your PHI

You may request an amendment to your record. We require the request in writing. We may deny it if the record is accurate, or if this practice did not create the record. If we accept the amendment, we must notify you and make an effort to inform others who hold the original record.

Your right to know who else sees your PHI

You may request an accounting of certain disclosures we have made over the past six years. We do not have to account for every disclosure, including those made directly to you, those involving treatment, payment, or health care operations, those to family or friends involved in your care, and those involving national security. You may request an accounting once a year at no charge. We require written confirmation and may charge for additional requests in the same year. We must tell you of any charge, and you may withdraw your request or pay to proceed.

Your right to be told about a breach of your PHI

We must notify you of any breach of unsecured protected health information by first-class mail, or by email if you have told us you prefer email. We will do so as soon as possible, and in any event no later than 15 business days after the breach is discovered.

"Unsecured protected health information" means information that is not protected by a technology or method identified by the Secretary of the U.S. Department of Health and Human Services as making it unusable, unreadable, or undecipherable to unauthorized users.

That notice must include:

• A description of the breach, including the date it happened and the date it was discovered, if known
• A description of the type of unsecured protected health information involved
• What you should do to protect yourself from potential harm
• What Peak Physical Therapy has done or will do to investigate the breach, reduce the harm, and protect you from further breaches
• Contact information for Peak Physical Therapy, including a telephone number, email address, website, and postal address, so you can ask questions

Your right to complain

You may complain if you believe your privacy rights have been violated. You may complain directly to us by contacting our HIPAA Officer, listed at the end of this Notice.

You may also complain to the U.S. Department of Health and Human Services, Office for Civil Rights, by writing to 200 Independence Avenue SW, Washington, D.C. 20201, by calling 1-877-696-6775, or online.

We will not retaliate against you for filing a complaint. Please give enough detail that we can investigate your concern.

Your right to a copy of this Notice

We must give our patients a copy of this Notice and post it in a conspicuous place and on our website, so you can review it. We may modify this Notice to comply with policy, rule, or regulatory changes, and we must provide the new version to current and future patients as changes are made. We keep every version for at least six years.

Your right to protection of substance use disorder records

Federal law requires us to protect the privacy of your substance use disorder treatment records. 42 CFR Part 2 gives these records confidentiality protections beyond HIPAA. Part 2 protects any information identifying you as having a substance use disorder or receiving treatment from us, including diagnosis, treatment, medications, appointment information, and billing records.

We may not use or disclose these records without your written consent unless federal law allows it. You may authorize disclosure, including for treatment, payment, or health care operations, and your authorization must meet the requirements of Part 2. You may revoke it at any time unless we have already acted on it.

Anyone who receives your substance use disorder information is prohibited from sharing it further unless you give written permission or Part 2 otherwise permits it. Federal law does not protect information you voluntarily disclose to others who are not bound by Part 2.

• Request restrictions on how your information is used or disclosed
• Request an accounting of disclosures of your Part 2 protected information
• Receive a copy of this Notice and any updates
• File a complaint if you believe your privacy rights have been violated, without retaliation