OnPoint Medical Group, LLC
Notice of Protected Health Information Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.
OUR RESPONSIBILITIES REGARDING YOUR MEDICAL INFORMATION:
The OnPoint Medical Group providers (“OnPoint Medical Group”) are required to maintain the privacy of your protected health information and to provide you with a notice of their legal duties and privacy practices pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). This notice applies to all entities that are affiliated with OnPoint Medical Group and have designated themselves an “affiliated covered entity” for purposes of compliance with HIPAA, which means that they may share, access, use and disclose protected health information as a single covered entity. We are also required to implement reasonable and appropriate safeguards to prevent use or disclosure of protected health information other than as described herein. We will not use or disclose your protected health information except as described in this Notice. This Notice applies to all of the medical records generated by OnPoint Medical Group, as well as records we receive from other providers that contain protected health information. This Notice does not apply to health information that is not subject to HIPAA or similar state health information privacy laws, or information used or shared in a manner that cannot identify you. This Notice does not apply to any OnPoint Medical Group health plan or to OnPoint Medical Group as an employer. Any OnPoint Medical Group health plan is considered a separate covered entity for the purpose of HIPAA and has its own notice of privacy practices.
This Notice only applies to those parts of OnPoint Medical Group’s websites and mobile device applications where you can access your protected health information or interact with a clinician regarding your specific care, such as OnPoint Medical Group’s patient portal with respect to your protected health information. However, these websites and applications may contain additional terms associated with your use. You should review those terms as well as the website terms and privacy policy contained on the OnPoint Medical Group website that you visit.
You may have additional rights under other applicable state or federal law. Applicable state or federal laws that provide greater privacy protection or broader privacy rights will continue to apply and we will comply with such laws to the extent they are applicable.
HOW WE MAY USE AND SHARE PROTECTED HEALTH INFORMATION:
We may use and disclose your protected health information in the following situations; however, applicable laws governing sensitive information (including behavioral health information, drug and alcohol treatment information, reproductive health information and HIV status) may further limit these uses and disclosures.
For treatment: We may use your protected health information in the course of providing your medical care as well as any related services. We may share your protected health information with other professionals who are treating you in order to manage and coordinate your care.
Example: Medical information may be disclosed to a doctor you are referred to who is treating you for a broken leg. This doctor may need to know if you have diabetes because diabetes may slow the healing process. In addition, if you were hospitalized the doctor may need to tell the dietitian at the hospital if you have diabetes so that we can arrange for appropriate meals.
For billing and payment: We may use and disclose protected health information to bill and get payment from health plans or other persons or entities. Such uses or disclosures may include disclosures to your health plan to get approval for a recommended procedure or to determine whether you are eligible for benefits or whether a particular service is covered under your health plan. We may also disclose your protected health information to another provider where that provider is involved in your care and requires the information to obtain payment.
Example: Protected health information may be disclosed to your health plan about your office visit so your health plan will pay us or reimburse you for your health care. We may disclose protected health information to your health plan to obtain prior approval/authorization or to determine whether your health plan will cover the treatment.
For health care operations: We may use or disclose your protected health information for the purposes of management, operation or administration of the medical practice and for offering quality health care services. Health care operations may include, but are not limited to: (1) quality evaluations and improvement activities; (2) employee review activities and training programs; (3) accreditation, certification, licensing, or credentialing activities; (4) reviews and audits such as compliance reviews, medical reviews, legal services, and maintaining compliance programs; and (5) business management and general administrative activities. In addition, we may disclose your protected health information to another provider or health plan for their health care operations. We may also share your protected health information for case management and care coordination purposes. We may share protected health information with our students, trainees, and staff for review and learning purposes. We may also use and share your protected health information to confirm the time, place and attendance of your appointment for treatment with third-party transportation services.
Example: We may use your protected health information to review or manage your treatment course. We may text call or email you to remind you of an upcoming appointment or help schedule an annual physical.
Other Uses and Disclosures: As part of treatment, payment, and health care operations, we may also use or disclose your protected health information to: (1) remind you of an appointment; (2) inform you of potential treatment alternatives or options; or (3) inform you of health-related benefits or services that may be of interest to you.
YOUR CHOICES:
For certain protected health information, you can tell us your choices about what we share. If you have a preference for how we share your information in the situations described below, please tell us and we will do our best to follow your instructions.
Family, close friends or others involved in your care: We may share your protected health information with the person named in your Durable Power of Attorney for Health Care (if you have one), or with family, a close friend or others involved in your medical care or payment for such care. If you have any objection to the use and disclosure of your protected health information in this manner, please tell us. We may share your protected health information with these persons if you are present or available before we share your protected health information with them, and you do not object to our sharing your protected health information with them or we reasonably believe that you would not object to this.
If you are unable to tell us your preference because you are unavailable, for example, you are unconscious or because of other emergency circumstances, we may share your protected health information if we believe it is in your best interest. This could include sharing information with your family or friend so that they could pick up a prescription or a medical supply. We may tell your family or friends that you are in a OnPoint Medical Group facility and your general condition.
Disaster relief: We may disclose protected health information about you in a disaster relief effort to disaster relief organizations to coordinate your care and/or so your family can be notified about your condition, status and location. Whenever possible, we will provide you with an opportunity to agree or object.
HOW ELSE WE MAY USE OR SHARE PROTECTED HEALTH INFORMATION:
Research: Your protected health information may be used by or disclosed to researchers for the purpose of conducting research when the research has been approved by an Institutional Review or Privacy Board and in compliance with law governing research or where you have provided your authorization. You may choose to participate in a research study that requires you to obtain related health care services. In this case, we may share your protected health information 1) with the researchers involved in the study who ordered the hospital or other health care services; and 2) with your insurance company in order to receive payment for those services that your insurance agrees to pay for. We may use and share your protected health information with a researcher if certain parts of your protected health information that would identify you are removed before we share it with the researcher. This will only be done if the researcher agrees in writing not to share the information, to not try to contact you, and to obey other requirements that the law provides.
Public Health and Health Oversight Activities: Your protected health information may be disclosed and may be required by law to be disclosed for public health purposes. This includes: to prevent or control disease; report births and deaths; reporting of reactions to medications or problems with health products; reporting a person who may have been exposed to a disease or may be at risk of contracting and/or spreading a disease or condition. We may share your protected health information with public health authorities for public health purposes to prevent or control disease, injury, or disability and for conducting public health monitoring, investigations, or activities. We may disclose your protected health information to a health oversight agency for audits, investigations, inspections, licensures, and other activities as authorized by law. The relevant agencies include governmental units that oversee or monitor the health care system, government benefit and regulatory programs, and compliance with civil rights laws. This may include disclosures to assist with product recalls or reporting adverse reactions to medications.
Abuse, Neglect, and Domestic Violence or Other Threats to Safety: Your protected health information will be disclosed to the appropriate government agency if we believe that a patient has been or is currently the victim of abuse, neglect, or domestic violence and the patient agrees to the disclosure, or we are otherwise permitted or required by law to do so. In addition, your protected health information may also be disclosed when necessary to prevent a serious threat to your health or safety or the health and safety of others to someone who may be able to help prevent the threat. State laws may require such disclosure when an individual or group has been specifically identified as the target or potential victim.
Organ Procurement Organizations. To the extent allowed by law, we may disclose your protected health information to organ procurement organizations and other entities engaged in the procurement, banking or transplantation of organs, eyes or tissue for the purpose of donation and transplant.
Compliance with law and legal proceedings. We will share information about you if state or federal laws require it, including the Department of Health and Human Services if it wants to see that we are complying with federal privacy law. We may use and disclose your protected health information in conjunction with judicial or administrative proceedings or for purposes of litigation as permitted by law. We may also share your protected health information in response to an administrative or court order, or in response to a subpoena, a discovery request, or other legal process if we are advised that you have been made aware of the request or that efforts were made to secure a qualified protective order (unless the law specifically requires a court order).
Work with a coroner, medical examiner or funeral director. We can share protected health information with a coroner, medical examiner, or funeral director when an individual dies as necessary for them to carry out their duties.
Address workers’ compensation. We can use or share protected health information about you for workers’ compensation claims, as permitted by applicable law. This protected health information may be reported to your employer and/or your employer’s representative regarding an occupational injury or illness.
Law Enforcement: To the extent permitted by applicable law, we may disclose your protected health information for law enforcement purposes when all applicable legal requirements have been met. This includes, but is not limited to, law enforcement due to identifying or locating a suspect, fugitive, material witness or missing person; complying with a court order or warrant, and grand jury subpoena; reporting information about a victim of a crime, reporting a death we believe resulted from criminal conduct, reporting criminal conduct occurring on our premises, or reporting crime in an emergency, such as the location of the crime or victims or the identity, description or location of the person who committed the crime.
Inmates and Correctional Institutions: If you are an inmate at a correctional institution, then under certain circumstances we may disclose your protected health information to the correctional institution or law enforcement official. This may be necessary 1) for the institution to provide you with health care; 2) to protect your health and safety or the health and safety of others; or 3) for the safety and security of the correctional institution and its staff.
Military, National Security, and other Specialized Government Functions: We may disclose your protected health information, if you are in the Armed Forces, for activities deemed necessary by appropriate military command authorities for determination of benefit eligibility by the Department of Veterans Affairs or to foreign military authorities if you are a member of that foreign military service. We may disclose your protected health information to authorized federal officials for conducting national security and intelligence activities or special investigations (including for the provision of protective services to the President of the United States, other authorized persons, or foreign heads of state) or to the Department of State to make medical suitability determinations.
De-Identification of Protected Health Information: We may de-identify your protected health information as permitted by law, which means that we have removed certain unique identifiers from the information about you, your employer, and your household members so that it no longer reasonably identifies you. We may use or disclose to others the de-identified information for any purpose, without your further authorization or consent, including but not limited to, research studies, use or development of artificial intelligence tools, and health care/health operations improvement activities. Such de-identified information is not subject to this Notice.
Business Associates: We may disclose your protected health information to our business associates who provide us with services necessary to operate and function as a medical practice. We will generally only provide the minimum information necessary for the associate(s) to perform their functions as it relates to our business operations. For example, we may use a separate company to process our billing or transcription services that require access to a limited amount of your protected health information. Please know and understand that all of our business associates are obligated to comply with the same HIPAA privacy and security rules in which we are obligated. Additionally, all of our business associates are under contract with us and committed to protect the privacy and security of your protected health information. We may also share your protected health information with a Business Associate who will remove information that identifies you so that the remaining information can be used or disclosed for purposes outside of this Notice.
Proof of Immunization: We will disclose proof of immunization to a state immunization registry or a school that is required to have it before admitting a student if you have agreed to the disclosure on behalf of yourself or your dependent or as otherwise permitted or required by applicable law.
Health Information Exchanges: We may participate in certain Health Information Exchanges or Networks (HIEs) that permit health care providers or other health care entities, such as your health plan or health insurer, to share your health information for treatment, payment and other purposes permitted by law, including those described in this Notice. As of the effective date of this Notice, we participate in the following HIE(s): CORHIO, Commonwell. You are automatically opted in to such HIEs. If you wish to opt out, please contact us. If opt out of participating in these HIEs, your health information will no longer be provided through the exchange. However, your decision does not affect the information that was exchanged prior to the time you opted out of participation.
Practice Ownership Change: If our medical practice is sold, acquired, or merged with another entity, your protected health information may become the property of the new owner. However, you will still have the right to request copies of your records and have copies transferred to another provider.
ADOLESCENT PATIENTS IN COLORADO:
The legal age for consent of medical treatment in Colorado is 18. We will comply with Colorado law regarding minors (children under the age of 18). We may release certain types of your protected health information to a minor’s parent or guardian (qualifying as a personal representative) if such release is required or permitted by law, unless the law requires or permits denial (such as where it poses a risk of harm to the minor or in cases of suspected child abuse or neglect). Colorado law provides instances where minors may consent to treatment, and request that their protected health information be kept confidential and not be shared with their parents or guardians without their consent. We will abide by such laws granting minors privacy rights with respect to their protected health information.
USE AND DISCLOSURE OF REPRODUCTIVE HEALTH RECORDS:
Federal law recognizes and protects the confidentiality of comprehensive reproductive health care services, including abortion care, and places additional restrictions on the use or disclosure of protected health information related to reproductive health care. Reproductive health care means health care that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes. This includes, but is not limited to, contraception, including emergency contraception; preconception screening and counseling; management of pregnancy and pregnancy-related conditions, including pregnancy screening, prenatal care, miscarriage management, treatment for preeclampsia, hypertension during pregnancy, gestational diabetes, molar or ectopic pregnancy, and pregnancy termination; fertility and infertility diagnosis and treatment, including assisted reproductive technology and its components (e.g., in vitro fertilization (IVF)); diagnosis and treatment of conditions that affect the reproductive system (e.g., perimenopause, menopause, endometriosis, adenomyosis); and other types of care, services, and supplies used for the diagnosis and treatment of conditions related to the reproductive system (e.g., mammography, pregnancy-related nutrition services, postpartum care products). OnPoint Medical Group is prohibited from using or disclosing any protected health information potentially related to reproductive health care for the following activities: (i) to conduct criminal, civil or administrative investigation into a person for the mere act of seeking, obtaining, providing or facilitating reproductive health care, (ii) to impose criminal, civil or administrative penalties for the mere act of seeking, obtaining, providing or facilitating reproductive health care, or (iii) to identify a person for either of these purposes. Seeking, obtaining, providing, or facilitating reproductive health care includes, but is not limited to, any of the following: expressing interest in, using, performing, furnishing, paying for, disseminating information about, arranging, insuring, administering, authorizing, providing coverage for, approving, counseling about, assisting, or otherwise taking action to engage in reproductive health care; or attempting any of the same. Outside of these activities, OnPoint Medical Group may continue to use and disclose protected health information related to reproductive health care for all other purposes described in this Notice.
The prohibition on use and disclosure of reproductive health care information only applies where the relevant activity is in connection with a person seeking, obtaining, providing, or facilitating reproductive health care, and OnPoint Medical Group has reasonably determined either that:
The reproductive health care is lawful under the law of the state in which such health care is provided under the circumstances in which it is provided. For example, if a resident of one state traveled to another state to receive reproductive health care, such as an abortion, that is lawful in the state where such health care was provided.
The reproductive health care is protected, required, or authorized by Federal law, including the United States Constitution, under the circumstances in which such health care is provided, regardless of the state in which it is provided. For example, if use of the reproductive health care, such as contraception, is protected by the Constitution.
Where the reproductive health care is provided by someone other than OnPoint Medical Group, OnPoint Medical Group may presume it is lawful unless either of the following is true:
OnPoint Medical Group has actual knowledge that the reproductive health care was not lawful under the circumstances in which it was provided. For example, an individual discloses to their doctor that they obtained reproductive health care from an unlicensed person and the doctor knows that the specific reproductive health care must be provided by a licensed health care provider.
The requestor provides factual information that demonstrates a substantial factual basis that the reproductive health care was not lawful under the specific circumstances in which it was provided. For example, a law enforcement official provides a health plan with evidence that the information being requested is reproductive health care that was provided by an unlicensed person where the law requires that such health care be provided by a licensed health care provider.
When OnPoint Medical Group receive s request for protected health information potentially related to reproductive health care for purposes of health oversight activities, judicial and administrative proceedings, law enforcement purposes or regarding decedents, as described above, OnPoint Medical Group will obtain a valid, signed attestation from the requestor that the use or disclosure is not for a prohibited purpose, as provided in this section. For example, if OnPoint Medical Group receives a subpoena for medical records related a civil law suit to which the patient is a party from an attorney, it would obtain such an attestation from the attorney before providing the records. OnPoint Medical Group is only permitted to disclose reproductive health information for law enforcement purposes where the disclosure is not subject to the prohibition above, the disclosure is required by law, and the disclosure meets all applicable conditions of HIPAA’s permission to use or disclose protected health inforamtion as required by law.
USE AND DISCLOSURE OF SUBSTANCE USE DISORDER RECORDS SUBJECT TO PART 2:
Federal law protects the confidentiality of substance use disorder patient records and places additional restrictions on the use or disclosure of such health information. A substance use disorder is a cluster of cognitive, behavioral, and physiological symptoms indicating that the individual continues using the substance (such as drugs or alcohol, but not including tobacco or caffeine) despite significant substance-related problems such as impaired control, social impairment, risky use, and pharmacological tolerance and withdrawal. If you receive services from OnPoint Medical Group covered by such laws, OnPoint Medical Group complies with the federal Confidentiality of Substance Use Disorder Patient Records laws and regulations that protect information regarding substance use disorder diagnosis, treatment and referral for treatment. See 42 U.S.C 290dd-3 and 42 U.S.C. 290ee-3 for Federal laws and 42 CFR Part 2 for Federal regulations (collectively, "Part 2"). Additionally, if OnPoint Medical Group receives records containing information regarding substance use disorders, these records may also be protected by Part 2. Where Part 2 is applicable, OnPoint Medical Group will not disclose your substance use disorder records, that you are enrolled in a Part 2 program, or any other information that would identify you as having or having had a substance use disorder (collectively, "Part 2 Records") except in compliance with this Section.
We will obtain your written consent to use and disclose your Part 2 Records unless we are permitted to use and disclose Part 2 Records without your written consent consistent with Part 2. The following categories describe the ways that we may use and disclose your Part 2 Records without your written consent under Part 2.
Medical Emergencies. We may disclose your Part 2 Records to medical personnel to the extent necessary to meet a bona fide medical emergency in which the your prior written consent cannot be obtained or in which we are closed and unable to provide services or obtain your prior written consent during a temporary state of emergency declared by a state or federal authority as the result of a natural or major disaster, until such time as we resume operations. OnPoint Medical Group will obtain your authorization prior to disclosing your information for non-emergency treatment. OnPoint Medical Group may also disclose your Part 2 Records to medical personnel of the Food and Drug Administration (FDA) who assert a reason to believe that your health may be threatened by an error in the manufacturer, labeling, or sale of a product under the FDA jurisdiction, and that your Part 2 Records will be used for the exclusive purpose of notifying you or your physicians of potential danger.
Research. Under certain circumstances, OnPoint Medical Group may use and disclose your Part 2 Records without your consent for research purposes. Generally, we would first obtain your written consent; however, in certain circumstances, we may be permitted to use or disclose your Part 2 Records for research purposes without your consent to the extent permitted by HIPAA, FDA and HHS regulations related to human subject research where a waiver of consent has been granted.
Management and Financial Audits and Program Evaluation. Under certain circumstances we may use or disclose your Part 2 Records for purposes of the performance of certain program financial and management audits and evaluations. For example, we may disclose your identifying information to any federal, state, or local government agency that provides financial assistance to the Part 2 program or is authorized by law to regulate the activities of Part 2 program. We may also use or disclose your identifying information to qualified personnel who are performing audit or evaluation functions on behalf of any person that provides financial assistance to the Part 2 program, which is a third-party payer or health plan covering you in your treatment, or which is a quality improvement organization (QIO), performing QIO review, the contractors, subcontractors, or legal representatives of such person or QIO, or an entity with direct administrative control over our program.
Fundraising. Consistent with provisions elsewhere in this Notice, we may also use or disclose your Part 2 Records for fundraising purposes.
Public Health. We may use or disclose to a public health authority your Part 2 Records for public health purposes. However, the contents of the information from the Part 2 Records disclosed will be de-identified in accordance with the requirements of the HIPAA regulations, such that there will be no reasonable basis to believe that the information can be used to identify you.
Designated person or entities. We may use and disclose your Part 2 Records in accordance with the consent to any person or category of persons identified or generally designated in the consent. For example, if you provide written consent naming your spouse or a healthcare provider, we will share your health information with them as outlined in your consent.
Single Consent for Treatment, Payment or Healthcare Operations. We may also use and disclose your Part 2 Records when the consent provided is a single consent for all future uses and disclosures for treatment, payment, and healthcare operations, as permitted by the HIPAA regulations, until such time you revoke such consent in writing.
Central Registry or Withdrawal Management Program. We may disclose your Part 2 Records to a central registry or to any withdrawal management or treatment program for the purposes of preventing multiple enrollments, with your written consent. For instance, if you consent to participating in in a drug treatment program, we can disclose your information to the related program to coordinate care and avoid duplicate enrollment.
Criminal Justice System. We may disclose information from your Part 2 Records to those persons within the criminal justice system who have made your participation in the Part 2 program a condition of the disposition of any criminal proceeding against you. The written consent must state that it is revocable upon the passage of a specified amount of time or the occurrence of a specified, ascertainable event. The time or occurrence upon which consent becomes revocable may be no later than the final disposition of the conditional release or other action in connection with which consent was given. For example, if you consent, we can inform a court-appointed officer about your treatment status as part of legal agreement or sentencing conditions.
PDMPs. We may report any medication prescribed or dispensed by us to the applicable state prescription drug monitoring program if required by applicable state law. We will first obtain your consent to a disclosure of Part 2 Records to a prescription drug monitoring program prior to reporting of such information.
Any Part 2 Record, or testimony relaying the content of such Part 2 Records, shall not be used or disclosed in a civil, administrative, criminal, or legislative proceeding against you unless you provide specific written consent (separate from any other consent) or a court issues an appropriate order. Your Part 2 Records will only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to you, the OnPoint Medical Group or other holder of the Part 2 Record in accordance with Part 2. A court order authorizing use or disclosure of Part 2 Records must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the Part 2 Records may be used or disclosed.
Part 2 does not protect health information about a crime committed on OnPoint Medical Group's premises or against any OnPoint Medical Group personnel or about any threat to commit such crime. Part 2 also does not prohibit the disclosure of health information by OnPoint Medical Group to report suspected child abuse or neglect under state law to appropriate state or local authorities. The restrictions on use and disclosure in Part 2 do not apply to communications of Part 2 Records between or among personnel having a need for them in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment of patients with substance use disorders if the communications are within the program (or with an entity that has direct administrative control over the program the communications between a part 2 program) and to communications of Part 2 Records to a qualified service organization if needed by the qualified service organization to provide services to or on behalf of OnPoint Medical Group (similar to provisions herein regarding Business Associates). To the extent applicable state law is even more stringent than Part 2 on how we may use or disclose your health information, we will comply with the more stringent state law.
Please note that if Part 2 Records are disclosed to us or our business associates pursuant to your written consent for treatment, payment, and healthcare operations, we or our business associates may further use and disclose such health information without your written consent to the extent that the HIPAA regulations permit such uses and disclosures, consistent with the other provisions in this Notice regarding protected health information.
USES AND DISCLOSURES REQUIRING YOUR AUTHORIZATION:
Other than the circumstances described above where authorization is not required, we do not disclose your protected health information unless you provide written authorization. You can obtain an authorization form from us upon request. Your authorization is specifically required in most situations involving uses or disclosures of protected health information for marketing purpose, for the sale of protected health information, or where the information constitutes psychotherapy notes. This also applies to protected health information in Part 2 Records.
We will obtain your authorization prior to disclosures for marketing purposes which result in our receiving financial payment from a third party whose product or services is being marketed . This does not include compensation that merely covers our cost of reminding you to take and refill your medication or otherwise communicate about a drug or biologic that is currently prescribed to you. However, we may use or disclose your protected health information without your authorization to send you information about alternative medical treatments, our own programs or about health-related products and services that may be of interest to you, provided that we do not receive financial remuneration for making such communications. For example, if you suffer from a chronic illness or condition, we may use your protected health information to assess your eligibility and propose newly available treatments. When we see you face-to-face, we may also use your protected health information without your authorization to encourage you to maintain a healthy lifestyle and get recommended tests, suggest that you participate in a disease management program, provide you with promotional gifts of nominal value, or tell you about government sponsored health programs.
Some circumstances in which we will disclose your psychotherapy notes include the following: for your continued treatment; training of medical students and staff; to defend ourselves during litigation; if the law requires; health oversight activities regarding your psychotherapist; to avert a serious or imminent threat to yourself or others; and to the coroner or medical examiner upon your death.
You may revoke your authorization in writing at any time except to the extent that we have already taken action in reliance on your prior authorization. To revoke authorization, please submit your notice in writing to OnPoint Medical Group.
YOUR PROTECTED HEALTH INFORMATION RIGHTS:
You have the following rights regarding your protected health information, including protected health information in Part 2 Records:
Right to Inspect and Copy: You generally have the right to see or get a copy of your protected health information maintained in a designated record set (as defined by HIPAA), except as restricted by your physician or by law. If you request a copy of your health information, we may charge a reasonable fee for the costs of copying, mailing, or other supplies and services associated with your request, including where you designate a third-party recipient.
You have the right to request only a summary of your protected health information if you do not desire to obtain a copy of your entire record. You also have the option to request an explanation of the protected health information to which you were provided access when you request your entire record.
If we maintain an electronic health record for you, you may request an electronic copy of your health records for yourself or to be sent to another individual or organization. We will make every attempt to provide the records in the format you request; however, in the case that the information is not readily accessible or producible in the format you request, we will provide the record in a standard electronic format or a legible hard copy form. We provide the OnPoint Medical Group patient portal as one option for patients to electronically access their protected health information. You may set up access to the OnPoint Medical Group patient portal by requesting a link from the front desk staff. There is no fee for you to access information through the OnPoint Medical Group patient portal.
Under federal law, you may not inspect or copy the following types of records: psychotherapy notes, information compiled as it relates to civil, criminal, or administrative action or proceeding; information restricted by law; information related to medical research in which you have agreed to participate; information obtained under a promise of confidentiality; and information whose disclosure may result in harm or injury to yourself or others.
If we deny your request for a copy of your protected health information, you may request that the denial be reviewed under certain circumstances. If our decision is reviewable under the federal or state privacy laws, another licensed health care professional chosen by us will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.
To request a copy of your medical information, please submit your request in writing to OnPoint Medical Group.
Right to Amend: If you feel that your medical record or protected health information that we have about you is incorrect or incomplete, you have the right to request an amendment or correction to such information. If we agree that an amendment or correction is appropriate, we will ensure that the amendment or correction is attached to your medical record and included with any future disclosures.
Please note that submitting a request for an amendment does not necessarily mean the protected health information will be amended. If we deny your request for an amendment, you may file a written statement of disagreement, which we may rebut in writing. The denial, statement of disagreement, and rebuttal will be included in any future disclosures of the relevant protected health information. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend protected health information that: is not part of the protected health information maintained by us; was not created by us, unless the person or entity that created the information is no longer available to make the amendment; is not part of the information which you would be permitted to inspect and copy; or is accurate and complete. All denials will be provided in writing.
To request an amendment, please submit your request in writing to OnPoint Medical Group, including what protected health information is inaccurate or incomplete and why.
Right to an Accounting of Disclosures: You have the right to request an accounting of disclosures of your protected health information. This is a list of certain disclosures of your protected health information we make for purposes other than treatment, payment, or healthcare operations. Certain disclosures are exempt from the accounting requirement, such as (but not limited to) disclosures made for the purposes of treatment; payment; health care operations; notification and communication with family and/or friends; and those required by law.
To request an accounting, please submit your request in writing to OnPoint Medical Group. Your request must state a time period which may not be longer than six years prior to the date of your request. The first accounting you request within a 12-month period will be free. For additional lists, we may charge you for a reasonable cost-based fee for providing the accounting. We will notify you of the cost involved and you may choose to withdraw or modify your request before any costs are incurred. We will mail you a list of disclosures in paper form. We will notify you if we are unable to supply the list within 60 days from the date you made the request and provide the reason for the delay and the date by which we will provide the accounting, which shall be within 90 days from the date we initially received your request.
If you are requesting an accounting of disclosures of Part 2 Records made pursuant to your written consent in the 3 years prior to the date of the request (or a shorter time period chosen by you), we will provide such accounting consistent with these HIPAA requirements and Part 2. When regulations are effective requiring such accountings pursuant to HIPAA and Part 2, we will provide a patient with an accounting of disclosures of records for treatment, payment, and health care operations only where such disclosures are made through an electronic health record and during only the 3 years prior to the date on which the accounting is requested.
Right to Request a Limit on What We Share: You have a right to request to restrict and/or limit the protected health information we disclose to others, such as family members, friends, and individuals involved in your care or payment for your care. . For example, you may ask that we not disclose information to a family member about a surgery you had. You also have the right to request to limit or restrict the protected health information we use or disclose for treatment, payment, and/or health care operations.
To request a restriction on what we share, submit your request in writing to OnPoint Medical Group. In your request you must tell us what information you want to restrict, whether you want to limit our use, disclosure or both, and to whom you want the limits to apply.
We are generally not required to agree to your request for restrictions. However, we are required to abide by your request to not disclose protected health information for purposes of payment or health care operations to your health plan for care and services in which you (or another person besides your health plan) have paid us in full out-of-pocket, unless required by law.
If we do (or are required by law to) agree, we will comply with your request unless the information is needed to provide you emergency treatment.
Right to Request Confidential Communications: You have the right to request that we communicate with you about health matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail to a post office box.
To request confidential communications, please submit your request in writing to OnPoint Medical Group and specify how or where you wish to be contacted. We will not ask you the reason for your request. We will accommodate reasonable requests, however, please realize, we reserve the right to contact you by other means and at other locations if you fail to respond to any communication from us that requires a response.
Right to Notice of Breach of Security: You have the right to be notified in the event a breach of unsecured protected health information occurs. We will notify you of breach of your unsecured protected health information experienced by us or one of our Business Associates in accordance with applicable law.
Right to Appoint a Personal Representative: You have the right to appoint a personal representative, such as a medical power of attorney or if you have legal guardian. Your personal representative may be authorized to exercise your rights and make choices about your protected health information. We will confirm the person has this authority and can act for you before we take any action based on their request.
Right to a Paper Copy of This Notice: You have the right to receive a paper copy of this Notice, upon request, at any time. You can also get a copy of this Notice at our website.
Written requests should be sent to: OnPoint Medical Group, LLC Attn.: Compliance Officer 1805 Shea Center Dr., Suite 450 Highlands Ranch, CO 80219
NOTICE OF REDISCLOSURE
Protected health information that is disclosed pursuant to this Notice may be subject to redisclosure by the recipient and no longer protected by HIPAA. Law applicable to the recipient may limit their ability to use and disclose the protected health information received, such as if they are another covered entity subject to HIPAA or a program or entity subject to Part 2.
ELECTRONIC MEDICAL INFORMATION SHARING THROUGH APPLICATION PROGRAMMING INTERFACES:
You have the right to request or authorize that your electronic protected health information in your designated record set be transmitted to you or another person or OnPoint Medical Group through an application programming interface (API). APIs are computer coding mechanisms that permit two or more electronic computer applications or software programs to communicate with each other and share information. OnPoint Medical Group is required by law to comply with requests regarding API transmissions, subject to certain exceptions. You understand that protected health information transmitted through an API at your request will no longer be under OnPoint Medical Group’s protection and control, will no longer be subject to the protections and rights outlined in this Notice, and may no longer be subject to the same laws, regulations, policies or procedures regarding its confidentiality, security, privacy, use, or disclosure. You understand and agree that you make requests to OnPoint Medical Group to transmit your protected health information through an API at your own risk and you assume all liability for the consequences of such action taken by OnPoint Medical Group at your direction. OnPoint Medical Group cautions you to confirm any confidentiality, security or privacy protections with respect to your transmitted protected health information with the recipient of the protected health information prior to submitting a request to OnPoint Medical Group to transmit your protected health information through an API.
CHANGES TO THIS NOTICE:
We are required to abide by the terms of this Notice of Privacy Practices. We reserve the right to change our privacy practices and the terms of this Notice at any time, provided the change is permitted by law. The revised or changed Notice will be effective for information that we already have about you as well as any information we receive in the future. The current notice will be posted in the facility and on our website and include the effective date. In addition, each time you register for treatment or health care services, we will offer you a copy of the current notice in effect.
QUESTIONS AND COMPLAINTS:
If you believe your privacy rights have been violated, you may file a complaint with us or you may send your complaint to the Secretary of Health and Human Services.
To file a complaint with us or if you have any questions regarding this Notice, please contact OnPoint Medical Group, HIPAA Compliance Officer, 1805 Shea Center Drive, Suite 450, Highlands Ranch CO 80219. All complaints must be submitted in writing. Questions may also be asked by contacting the Compliance Office at Susan Sweeney, SVP Human Resources 720-370-3329. We cannot, and will not, penalize you for filing a complaint.
If you wish to file a complaint with the Secretary of the United States Department of Health and Human Services, please go to the website of the Office for Civil Rights (www.hhs.gov/ocr/hipaa/), call 202-619-0257 (toll free 877-696-6775), or mail to:
Secretary of the US – Department of Health and Human Services
200 Independence Ave S.W.
Washington, D.C. 20201
To file a complaint with the Secretary, you must 1) name the OnPoint Medical Group place or person that you believe violated your privacy rights and describe how that place or person violated your privacy rights; and 2) file the complaint within 180 days of when you knew or should have known that the violation occurred. Violation of Part 2 is a crime. You may report suspected violations of Part 2 to the Secretary of the United States Department of Health and Human Services in the same manner as HIPAA violations are reported.
