• Download
the HIPAA Business Agreement (28K PDF)
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION
ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET
ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
The practice acts to maintain the privacy
of protected health information and provide individuals
with notice of the practice’s legal duties and privacy
practices with respect to protected health information
as described in this Notice and abide by the terms of
the Notice currently in effect.
Provision of Notice: The practice provides
its Notice of Privacy Practices to every patient with
whom it has a direct treatment relationship. The Notice
is provided no later than the date of the first treatment
to the patient after April 13, 2003.
The practice makes its Notice available
to any member of the public to enable prospective patients
to evaluate the practice’s privacy practices when
making his or her decision regarding whether to seek treatment
from the practice. The practice provides its Notice via
e-mail to any patient or other individual who so requests
the Notice.
Documentation of Provision of Notice:
When a direct treatment patient receives the Notice from
the practice, the practice asks the patient to sign its
“Receipt of Notice of Privacy Practices” form.
The form is filed with the patient’s medical record.
If the patient refuses to sign the form, it is noted in
the medical record that the patient was given the Notice
and refused to sign the form.
Effective Date and Changes to Notice:
This Notice is effective April 13, 2003. The practice
reserves the right to revise this Notice whenever there
is a material change to the uses or disclosures, the individual’s
rights, the covered entity’s legal duties, or other
privacy practices stated in the Notice. Except when required
by law, a material change to any term of the Notice will
not be implemented prior to the effective date of the
notice in which such material change is reflected.
If the Notice is revised, the practice
makes the revised Notice available upon request beginning
on the revision’s effective date. The revised notice
is posted in the practice’s reception area and made
available to all patients, including those who have received
a previous Notice. Upon receipt of a revised Notice, a
patient is asked to acknowledge receipt of the Notice.
Complaints: The practice allows all
patients and their agents to file complaints with the
practice and with the Secretary of the federal Department
of Health and Human Services (DHHS). A patient or his
or her agent may file a complaint with the practice whenever
he or she believes that the practice has violated their
rights.
Complaints to the practice must be in
writing, must describe the acts or omissions that are
the subject of the complaint, and must be filed within
180 days of the time the patient became aware or should
have become aware of the violation. Complaints must be
addressed to the attention of the practice’s privacy
officer at the practice’s address. The practice
investigates each complaint and may, at its discretion,
reply to the patient or the patient’s agent.
Complaints to the Secretary of the Department
of Health and Human Services must be in writing, must
name the practice, must describe the acts or omissions
that are the subject of the complaint, and must be filed
within 180 days of the time the patient became aware or
should have become aware of the violation. Complaints
must be addressed to: Office for Civil Rights, U.S. Department
of Health and Human Services, 233 N. Michigan Ave., Suite
240, Chicago, Ill. 60601, Voice Phone (312) 886-2359,
FAX (312) 886-1807, TDD (312) 353-5693.
The practice does not take any adverse
action against any patient who files a complaint (either
directly or through an agent) against the practice.
Contact Person: The practice has a privacy
officer that serves as the contact person for all issues
related to the Privacy Rule. If you have any questions
about this Notice, please contact the Business Office
Manager at 630-355-3774 or by mail at: Orthopedic Associates
of Naperville, 10 West Martin Avenue, Suite 50, Naperville,
IL 60540 attn: the Business Office Manager.
USES AND DISCLOSURES OF PROTECTED
HEALTH INFORMATION
The practice reasonably ensures that
the protected health information (PHI) it requests, uses,
and discloses for any purpose is the minimum amount of
PHI necessary for that purpose.
The practice treats all qualified individuals
as personal representatives of patients. The practice
generally allows individuals to act as personal representatives
of patients. The two general exceptions to allowing individuals
to act as personal representatives relate to unemancipated
minors and abuse, neglect, or endangerment situations.
The practice makes reasonable efforts
to ensure that protected health information is only used
by and disclosed to individuals that have a right to the
protected health information. Toward that end, that practice
makes reasonable efforts to verify the identity of those
using or receiving protected health information.
Uses and Disclosures – Treatment,
Payment, and Health Care Operations
The practice uses and discloses protected
health information for payment, treatment, and health
care operations. Treatment includes those activities related
to providing services to the patient, including releasing
information to other health care providers involved in
the patient’s care. Payment relates to all activities
associated with getting reimbursed for services provided,
including submission of claims to insurance companies
and any additional information requested by the insurance
company so they can determine if they should pay the claim.
Health care operations includes a number of areas, including
quality assurance and peer review activities.
Uses and Disclosures – Not Requiring
Authorization
Disclosure to Those Involved in Individual’s
Care: The practice discloses protected health information
to those involved in a patient’s care when the patient
approves or, when the patient is not present or not able
to approve, when such disclosure is deemed appropriate
in the professional judgment of the practice.
When the patient is not present, the
practice determines whether the disclosure of the patient’s
protected health information is authorized by law and
if so, discloses only the information directly relevant
to the person’s involvement with the patient’s
health care.
The practice does not disclose protected
health information to a suspected abuser, if, in its professional
judgment, there is reason to believe that such a disclosure
could cause the patient serious harm. Further, the practice
uses and discloses information as required by law.
Uses and Disclosures Required by Law:
The practice uses and discloses protected health information
to appropriate individuals as required by law.
As required by law the practice discloses
protected health information to public health officials.
This includes reporting of communicable diseases and other
conditions, sexually transmitted diseases, lead poisoning,
Reyes Syndrome, and mandated reports of injury, medical
conditions or procedures, or food-borne illness including
but not limited to adverse reactions to immunizations,
cancer, adverse pregnancy outcomes, death, birth.
The practice discloses protected health
information regarding victims of abuse, neglect, or domestic
violence. The practice discloses information about a minor,
disabled adult, nursing home resident, or person over
60 years of age whom the practice reasonably believes
to be a victim of abuse or neglect to the appropriate
authorities as required by law or, if not required by
law, if the individual agrees to the disclosure. This
includes child abuse and neglect, elder abuse and exploitation,
abused and neglected nursing home residents, or disabled
adults abuse.
The practice informs the individual
of the reporting unless the practice, in the exercise
of professional judgment, believes informing the individual
would place the individual at risk of serious harm or
the practice would be informing a personal representative,
and the practice believes the personal representative
is responsible for the abuse, neglect, or other injury,
and that informing such person would not be in the best
interests of the individual as determined by the professional
judgment of the practice.
Uses and Disclosures for Health Oversight
Activities: The practice uses and discloses PHI as required
by law for health oversight activities. The information
may be used and released for audits, investigations, licensure
issues, and other health oversight activities, including,
but not limited to hospital peer review, managed care
peer review, or Medicaid or Medicare peer review.
Disclosures for Judicial and Administrative
Proceedings: In general, the practice discloses information
for judicial and administrative proceedings in response
to an order of a court or an administrative tribunal;
or a subpoena, discovery request or other lawful process,
not accompanied by a court order or an ordered administrative
tribunal.
Disclosures for Law Enforcement Purposes:
The practice discloses PHI for law enforcement purposes
to law enforcement officials.
Uses and Disclosures Related to Decedents:
The practice uses and discloses PHI as required to a coroner
or medical examiner and funeral directors as required
by law. The attending physician is required to sign the
death certificate and provide the coroner with a copy
of the decedent’s protected health information.
Uses and Disclosures Related to Cadaveric
Organ, Eye or Tissue Donations: The practice uses and
discloses protected health information to facilitate organ,
eye or tissue donations.
Uses and Disclosures to Avert a Serious
Threat to Health or Safety: The practice uses and discloses
protected health information to public health and other
authorities as required by law to avert a serious threat
to health or safety.
Uses and Disclosures for Specialized
Government Functions: The practice uses and discloses
protected health information for military and veterans
activities, national security and intelligence activities,
and other activities as required by law.
Uses and Disclosures in Emergency Situations:
The practice uses and discloses protected health information
as appropriate to provide treatment in emergency situations.
In those instances where the practice has not previously
provided its Notice of Privacy Practices to a patient
who receives direct treatment in an emergency situation,
the practice provides the Notice to the individual as
soon as practicable following the provision of the emergency
treatment.
Marketing Purposes: The practice does
not use or disclose any protected health information for
marketing purposes. The practice does engage in communications
about products and services that encourages recipients
of the communication to purchase or use the product or
service for treatment, to direct or recommend alternative
treatments, therapies, health care providers, or settings
of care to the individual. These activities are not considered
marketing.
In addition, the practice will/will
not contact the individual with appointment reminders
or information about treatment alternatives or other heath-related
benefits and services that may be of interest to the individual.
Uses and Disclosures – Do Not Apply
to Practice
Research: The practice does not engage
in any research activities that require it to use or disclose
protected health information.
Other Uses and Disclosures: The practice
does not use or disclose protected health information
to an employer or health plan sponsor, for underwriting
and related purposes, for facility directories, to brokers
and agents, or for fundraising.
If an individual wants the practice
to release his or her protected health information to
employers or health plan sponsors, for underwriting and
related purposes, for facility directories, or to brokers
and agents, then he or she can contact the practice and
complete an appropriate written authorization.
INDIVIDUAL RIGHTS
Individual Rights –
Accounting for Disclosures of Protected Health Information
The practice tracks all disclosures
of a patient’s protected health information that
occur for other than the purposes of treatment, payment,
and health care operations, that are not made to the individual
or to a person involved in the patient’s care, that
are not made as a result of a patient authorization, and
that are not made for national security or intelligence
purposes or to correctional institutions or law enforcement
officials.
The practice allows an individual to
request one accounting within a 12-month period free of
charge. The practice charges a reasonable fee for more
frequent accounting requests. The charge will be $25.00
starting, for records and $5.00 per sheet for MRI and
X-Ray. An individual can request an accounting of disclosures
for a period of up to six years prior to the date of the
request. Requests for shorter accounting periods will
be accepted. However, patients may only request an accounting
of disclosures made on or after April 14, 2003.
The practice responds to all requests
for an accounting of disclosures within 60 days of receipt
of the request. If the practice intends to provide the
accounting for disclosures and cannot do so within 60
days, the practice informs the requestor of such and provides
a reason for the delay and the date the request is expected
to be fulfilled. Only one 30-day extension is permitted.
A request for an accounting for disclosures
must be made in writing and mailed or sent to the practice.
It should be marked “Attention: Privacy Officer.”
Individual Rights – Inspect and
Copy Protected Health Information
The practice allows individuals to inspect
and copy their protected health information, documents
all requests, responds to those requests in a timely fashion,
informs individuals of their appeal rights when a request
is rejected in whole or in part, and charges a reasonable
fee for the copying of records.
The practice reviews the request in
a timely fashion and acts on a request for access generally
within 30 days. The practice may have a single extension
of 30 days, if needed to act on the request. Each request
will be accepted or denied and the requestor notified
in writing. If a request is denied, the requestor is informed
if the denial is “reviewable” or not. The
requestor has the right to have any denial reviewed by
a licensed health care professional who is designated
by the practice as a reviewing official and who did not
participate in the original decision to deny. The practice
informs the requestor of the decision of the reviewing
official and adheres to the decision.
The practice charges reasonable fees
based on actual cost of fulfilling the request. The practice
will determine the appropriate charge for providing the
requested records and inform the requestor in advance
of providing the records. If the requestor agrees to pay
the fee in advance, the records will be provided. Otherwise,
the records will not be provided, unless the Privacy Officer
determines that the charge is burdensome to the requestor.
Illinois law prohibits charges that
exceed the following: $20.48 handling fee plus 77 cents
each for pages 1-25, 51 cents each for pages 26-50, and
26 cents each for pages 51 to end; plus actual expenses
related to the copying of x-rays, CAT scans, and similar.
The practice limits charges for records to the amounts
allowed under Illinois law.
Requests for the inspection and copying
of records must be sent to the practice in writing. It
should be marked “Attention: Privacy Officer.”
Individual Rights – Request
Amendment to Protected Health Information
The practice allows an individual to
request that the practice amend the protected health information
maintained in the patient’s medical record or the
patient’s billing record. The practice documents
all requests, responds to those requests in a timely fashion,
and informs individuals of their appeal rights when a
request is denied in whole or in part.
Generally the practice will act on a
request for amendment no later than 60 days after receipt
of such a request. If the practice cannot act on the amendment
within 60 days, the practice extends the time for such
action by 30 days and, within the 60-day time limit, provides
the requestor with a written statement of the reasons
for the delay and the date by which the practice will
complete action on the request. Only one such extension
is allowed.
If the practice denies the request,
in whole or in part, the practice provides the requestor
with a written denial in a timely fashion. The practice
allows a requestor to submit a written statement disagreeing
with the denial of all or part of the initial request.
The statement must include the basis of the disagreement.
The practice limits the length of a statement of disagreement
to one page.
The practice accepts requests to amend
the PHI maintained by the practice. The requests must
be in writing and should be marked “Attention: Privacy
Officer.”
Individual Rights – Request Confidential
Communications
The practice accommodates all reasonable
requests to keep communications confidential. The practice
determines the reasonableness based on the administrative
difficulty of complying with the request.
A request for confidential communications must be in writing
and on the practice’s Request for Confidential Communications
form, must specify an alternative address or other method
of contact, and must provide information about how payment
will be handled. The request must be addressed to the
practice’s privacy officer. No reason for the request
needs to be stated.
The practice accommodates all reasonable
requests. The reasonableness of a request is determined
solely on the basis of the administrative difficulty of
complying with the request. The practice will reject a
request due to administrative difficulty: if no independently
verifiable method of communication such as a mailing address
or published telephone number is provided for communications,
including billing; or if the requestor has not provided
information as to how payment will be handled.
The practice will not refuse a request:
if the requestor indicates that the communication will
cause endangerment; or based on any perception of the
merits of the requestor’s request.
Individual Rights – Request Restriction
of Disclosures
The practice accepts all requests for
restrictions of disclosures of protected health information.
The practice does not agree to any restrictions in the
use or disclosure of protected health information.
All requests for restrictions of disclosures
must be submitted in writing. They must be sent to the
attention of the practice’s privacy officer. The
privacy officer notifies the requestor in writing that
the practice does not accept restrictions of disclosure.
Individual Rights – Authorizations
The practice obtains a written authorization
from a patient or the patient’s representative for
the use or disclosure of protected health information
for other than treatment, payment, or health care operations;
however, the practice will not get an authorization for
the use or disclosure of protected health information
specifically allowed under the Privacy Rule in the absence
of an authorization. The practice will provide a patient
upon request a copy of any authorization initiated by
the practice (as opposed to requested by the patient)
and signed by the patient.
The practice does not condition treatment
of a patient on the signing of an authorization, except
disclosure necessary to determine payment of claim (excluding
authorization for use or disclosure of psychotherapy notes);
or provision of health care solely for purpose of creating
protected health information for disclosure to a third
party (e.g., pre-employment or life insurance physicals).
In Illinois, a specific written authorization
is required to disclose or release of mental health treatment,
alcoholism treatment, drug abuse treatment or HIV/Acquired
Immune Deficiency Syndrome (AIDS) information.
The practice allows an individual to
revoke an authorization at any time. The revocation must
be in writing and must be sent to the attention of the
practice’s privacy officer; however, in any case
the practice will be able to use or disclose the protected
health information to the extent practice has taken action
in reliance on the authorization.
Individual Rights – Waiver of Rights
The practice never requires an
individual to waive any of his or her individual rights
as a condition for the provision of treatment, except
under very limited circumstances allowed under law.
