Notice of Privacy Practices

Effective July 1, 2024

This Notice of Privacy Practices (the “Notice”) describes the ways we may use and disclose your protected health information (“PHI”) and your rights and our obligations regarding the use and disclosure of your PHI. This Notice applies to Elevior Spine Institute, including its clinicians and employees (the “Practice”).

I. Our Obligations

We are required by law to:

• Maintain the privacy of your PHI, to the extent required by state and federal law;
• Give you this Notice explaining our legal duties and privacy practices regarding your PHI;
• Notify you if we discover a breach of unsecured PHI according to federal and state laws;
• Follow the terms of the Notice that is currently in effect; and
• Not engage in any actions that could constitute “information blocking” under the 21st Century Cures Act and related regulations.

II. How We May Use and Disclose PHI About You

The following categories describe different ways we typically use and disclose PHI without your authorization. These categories are intended to be general descriptions only, and not a list of every instance where we may use or disclose your PHI.

A. For Treatment.

We may use and disclose your PHI to provide health care treatment and related services to you, including coordinating and managing your health care. We may disclose PHI about you to physicians, nurses, other clinicians, and personnel who are involved in providing health care to you (both within and outside of the Practice). An example would be if the Practice referred you to a specialist such as an orthopedic surgeon for additional treatment.

B. For Payment.

We may use and disclose your PHI to bill and collect from you or an insurance company for the health care services we provide. This may also include the disclosure of PHI to obtain prior authorization for treatment and procedures from your insurance plan.

C. For Health Care Operations.

We may use and disclose PHI about you necessary to operate and manage our practice and to promote quality care. For example, we may use your PHI to assess the quality of care you receive or to conduct certain cost management, business management, or other quality assurance activities.

D. Credentialing, Utilization and Peer Review.

We may need to use or disclose your PHI to review the credentials, qualifications and actions of our clinicians, as well as to review the services we provide to evaluate appropriate service levels.

E. Treatment Alternatives.

We may use and disclose PHI to inform you about available services, treatment options or alternatives that may be of interest to you.

F. Appointment Reminders.

We may use and disclose PHI to contact you to provide appointment reminders and other information.

G. Business Associates.

There are some services (such as billing or legal services) that may be provided for the Practice through contracts with outside providers known as business associates. We may disclose your PHI to our business associates to perform contracted services. Business associates by law are also required to appropriately safeguard your PHI.

H. Individuals Involved in Your Care.

We may disclose PHI about you to an individual involved in your health care or payment for your care, but we will do so only as allowed by state or federal law (with an opportunity for you to agree or object when required under the law), or in accordance with your prior authorization.

I. As Required by Law.

We will disclose PHI about you when required to do so by federal, state, or local law or regulations.

J. Imminent Threat of Injury to Health or Safety.

We may use and disclose your PHI when necessary to prevent or decrease a serious and imminent threat of injury to you or another person. Such disclosure would only be to medical or law enforcement personnel.

K. Research.

We may use or disclose your PHI for limited research purposes. In these circumstances, the Practice will only disclose PHI with your authorization, under a research protocol approved by an institutional review board or other authorized privacy board to obtain a waiver of authorization under HIPAA, or if the information provided is “de-identified.”

L. Military and Veterans.

If you are a member of the armed forces, we may use and disclose your PHI as required by appropriate military authorities.

M. Workers’ Compensation.

We may disclose your PHI for workers’ compensation or similar program established by law that provide benefits for work-related injuries.

N. Public Health Risks.

We may disclose your PHI to public health authorities for public health activities. As a general rule, we are required by law to disclose certain types of information to public health authorities, such as the Texas Department of State Health Services. The types of information generally include information used:

• To help prevent or control exposure to and spreading of disease.
• To report births and deaths.
• To report suspected child abuse or neglect.
• To report medication reactions, product recalls, or issues with medical devices.
• To notify authorities if we believe a patient has been the victim of abuse, neglect, or domestic violence when required or authorized by law.
• To assist in public health investigations, surveillance, or interventions.

O. Health Oversight Activities.

We may disclose PHI to a health oversight agency for activities authorized by law. Examples include audits, inspections, and other activities necessary for designated agencies to monitor the health care system.

P. Legal Matters.

We may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process or in relation to any litigation or legal proceedings involving you.

Q. Law Enforcement, National Security and Intelligence Activities.

Upon request or if required by law, we may disclose your PHI to law enforcement officials or to authorized federal officials for intelligence, counterintelligence, and other national security activities.

R. Coroners, Medical Examiners and Funeral Home Directors.

We may disclose your PHI to a coroner, medical examiner, or funeral home director as necessary to assist them in fulfilling their duties.

S. Marketing of Related Health Services.

We may use or disclose your PHI to send you treatment or healthcare operations communications concerning treatment alternatives or other health-related products or services.

T. Electronic Disclosures of PHI.

We may also disclose your PHI electronically for treatment, payment, or health care operations or as otherwise authorized or required by state or federal law.

III. Other Uses of PHI

A. Authorizations.

There are times we may need or want to use or disclose your PHI for reasons other than those listed above, but to do so we will need your prior authorization. Other than expressly provided herein, any other uses or disclosures of your PHI will require your specific written authorization.

B. Psychotherapy Notes, Marketing and Sale of PHI.

Most uses and disclosures of “psychotherapy notes,” uses and disclosures of PHI for marketing purposes, and disclosures that constitute a “sale of PHI” under HIPAA require your authorization.

C. Right to Revoke Authorization.

If you provide us with written authorization to use or disclose your PHI for such other purposes, you may revoke that authorization in writing at any time. If you revoke your authorization, we will no longer use or disclose your PHI for the reasons covered by your written authorization. However, we are unable to take back any uses or disclosures we have already made in reliance upon your authorization or that we are required to retain as records of the care we provide to you.

IV. Your Rights Regarding PHI About You

Federal and state laws provide you with certain rights regarding the PHI we have about you. The following is a summary of those rights.

A. Right to Inspect and Copy.

You have the right to inspect and/or copy your PHI in our possession, which generally includes your medical and billing records. To inspect or copy your PHI, you must submit a written request to the Practice’s HIPAA Officer at the address listed in this Notice. We shall comply with your request within a reasonable time frame, but not to exceed 15 business days from the date we receive your request. We may also charge a reasonable fee to copy your records. In certain limited circumstances, we may deny your request.

B. Right to Amend.

If you feel the PHI we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by the Practice. To request an amendment, your request must be in writing and submitted to the HIPAA Officer at the address in this Notice. Your request must outline a reason to justify the amendment. We may deny your request if it is not in writing, does not include a reason to support the request, or in other limited circumstances.

C. Right to an Accounting of Disclosures.

You have the right to request an “accounting of disclosures” of your PHI. This is a list of the disclosures we have made for up to six years prior to the date of your request of your PHI, but does not include disclosures for Treatment, Payment, or Health Care Operations (as described in Sections II A, B, and C of this Notice) or disclosures made pursuant to your specific authorization (as described in Section III of this Notice), or certain other disclosures.

You have an additional right to an accounting of disclosures for Treatment, Payment, and Health Care Operations made through an Electronic Health Record. Please contact the Practice’s HIPAA Officer at the address listed in this Notice for more information.

To request a list of accounting, you must submit your request in writing to the Practice’s HIPAA Officer at the address in this Notice. Your request must state a time period, which may not be longer than six years, and the preferred form of production (i.e., paper or electronically). The first list you request within a twelve-month period will be free. For additional lists, we may charge you a reasonable fee for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

D. Right to Request Restrictions.

You have the right to request a restriction or limitation on the PHI we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a restriction or limitation on the PHI we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend.

Except as specifically described below in this Notice, we are not required to agree to your request for a restriction or limitation. If we do agree, we will comply with your request unless the information is needed to provide emergency treatment. In addition, there are certain situations where we won’t be able to agree to your request, such as when we are required by law to use or disclose your PHI. To request restrictions, you must make your request in writing to the Practice’s HIPAA Officer at the address in this Notice. In your request, you must specifically tell us what information you want to limit, whether you want us to limit our use, disclosure, or both, and to whom you want the limits to apply.

As stated above, in most instances we do not have to agree to your request for restrictions on disclosures that are otherwise allowed. However, if you pay or another person (other than a health plan) pays on your behalf for an item or service in full, out of pocket, and you request that we not disclose the PHI relating solely to that item or service to a health plan for the purposes of payment or health care operations, then we will be obligated to abide by that request for restriction unless the disclosure is otherwise required by law. You should be aware that such restrictions may have unintended consequences, particularly if other clinicians need to know that information (such as a pharmacy filling a prescription). It will be your obligation to notify any such other clinicians of this restriction. Additionally, such a restriction may impact your health plan’s decision to pay for related care that you may not want to pay for out of pocket (and which would not be subject to the restriction).

E. Right to Request Confidential Communications.

You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at home. Any request for confidential communications must be made in writing to the Practice’s HIPAA Officer at the address in this Notice.

F. Right to a Paper Copy of This Notice.

You have the right to a paper copy of this Notice at any time. To obtain a copy of this Notice, please contact the Practice’s HIPAA Officer at the address in this Notice.

G. Right to Breach Notification.

In certain instances, we may be obligated to notify you if we become aware that your PHI has been improperly disclosed or otherwise subject to a “breach” as defined by HIPAA and applicable state law.

V. Changes to This Notice

We reserve the right to change this Notice at any time to reflect changes in our privacy policies and practices, and to make the new terms and practices applicable to all PHI that we maintain about you, including PHI created or received prior to the effective date of any Notice revision. This Notice is posted on our website and a copy is available upon request.

VI. Complaints

If you believe your privacy rights as described in this Notice have been violated, you may file a complaint with the Practice at the following address or phone number:

To file a complaint, you may either call or send a written letter. The Practice will not retaliate against any individual who files a complaint. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services. In addition, if you have any questions about this Notice, please contact the Practice’s HIPAA Officer at the address or phone number above.