This is a different document from our Privacy Policy. The Privacy Policy covers information collected through the website, including waitlist emails. This notice covers protected health information ("PHI") created when a clinician treats you, and is governed by HIPAA. If the two ever conflict as to PHI, this notice controls.
Who this notice applies to
This notice is issued by [AFFILIATED PROFESSIONAL ENTITY, P.C.] and the licensed clinicians practicing through it ("we," "us"), who are responsible for your clinical care.
[LEGAL ENTITY NAME] ("OH!") provides technology and administrative support to the professional entity and acts as its business associate under HIPAA. OH! is contractually bound to protect your PHI on the same terms described here.
Our legal duties
We are required by law to maintain the privacy of your PHI, to give you this notice describing our legal duties and privacy practices, to notify you following a breach of unsecured PHI, and to follow the terms of the notice currently in effect.
How we may use and disclose your health information without your authorization
Treatment
To provide, coordinate, and manage your care. For example, your clinician reviews your intake to determine whether treatment is appropriate, and shares your prescription with the dispensing pharmacy.
Payment
To bill and collect payment for services. For example, sharing the minimum necessary information with a payment processor.
Health care operations
For quality assessment, clinician review, training, compliance, and administration of the practice.
Business associates
We disclose PHI to vendors who perform functions on our behalf — including OH!, our pharmacy partner, and our records platform — each under a written business associate agreement requiring them to safeguard it.
As required or permitted by law
- When required by federal, state, or local law
- For public health activities, including reporting adverse drug reactions to the FDA
- To report suspected abuse, neglect, or domestic violence as required by law
- For health oversight activities such as audits and licensure investigations
- In response to a court order, subpoena, or lawful discovery request
- To law enforcement in the limited circumstances the law permits
- To avert a serious and imminent threat to health or safety
- For workers' compensation, coroners, medical examiners, and funeral directors as permitted
- For research, only with IRB or privacy board approval or where the data is de-identified
Uses that always require your written authorization
We will never do any of the following without your separate, signed authorization:
- Sell your PHI.
- Use your PHI for marketing where we receive payment from a third party.
- Share psychotherapy notes, except as narrowly permitted by law.
- Use your PHI for advertising or ad targeting.
You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.
Your rights
You have the right to:
- Inspect and copy your records, generally within 30 days, in electronic form if you ask. We may charge a reasonable, cost-based fee.
- Request an amendment if you believe information is incorrect or incomplete. We may deny the request, and if we do we will explain why in writing and you may submit a statement of disagreement.
- Receive an accounting of disclosures we made in the six years before your request, excluding those for treatment, payment, operations, and certain others.
- Request restrictions on how we use or disclose your PHI. We are not required to agree, with one exception below.
- Restrict disclosure to a health plan where you paid out of pocket in full for the service. We must honor this request. Because we do not bill insurance, this protection applies to all of our services by default.
- Request confidential communications by an alternative means or at an alternative address. We will accommodate reasonable requests without asking why.
- Receive a paper copy of this notice, even if you agreed to receive it electronically.
- Be notified if a breach compromises the privacy or security of your PHI.
To exercise any of these rights, email privacy@getoh.co.
Complaints
If you believe your privacy rights have been violated, you may file a complaint with us at privacy@getoh.co, or with the U.S. Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue SW, Washington, DC 20201, or at hhs.gov/ocr/complaints.
We will not retaliate against you for filing a complaint. Ever. Your care will not be affected.
Changes to this notice
We may change this notice and make the new terms effective for all PHI we maintain, including information created before the change. The current notice will always be posted here with its effective date.
Contact
Privacy Officer
[AFFILIATED PROFESSIONAL ENTITY, P.C.]
[MAILING ADDRESS]
privacy@getoh.co