NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.

This Notice describes the privacy practices of Lumera Healthcare, LLC and all business associates with whom we may share your protected health and medical information.  We provide the Notice of Privacy Practices to every patient we have a direct treatment relationship with after January 7, 2020, the effective date.  This Notice is also available to any member of the public and is posted within our reception area.  Every effort will be made to obtain a signed Receipt of Notice of Privacy Practices from each patient that will be kept on file. If the patient refuses to sign the form, it will be noted that the Notice was given, but the patient refused to or could not sign the Receipt.

We understand that your medical or PHI (“protected health information”) is confidential, and we are committed to maintaining its privacy. We are required by law to maintain the privacy of our patients’ protected health information and to provide patients with notice of our legal duties and privacy practices with respect to protected health information. We are required to abide by the terms of this Notice when we use or disclose your PHI and are also required by law to notify you if you are affected by a breach of your secured PHI.

HOW WE MAY USE AND DISCLOSE MEDICAL INFORMATION OR PHI ABOUT YOU

Treatment Purposes.  Your PHI may be used and disclosed by those involved in your care to provide, coordinate, or manage your health care treatment and related services.  In addition, we may contact individuals through telephone, mail, and email with appointment reminders and utilize facsimile transmission for specific authorizations and prescription refills through pharmacies.  WE may also disclose your PHI to other providers involved in your treatment.

Payment Purposes.  We may use and disclose PHI to obtain payment for the treatment services provided.  For example, we send PHI to Medicare, Medicaid, your health insurer, HMO, or other company or program to pay for your health care so they can determine if they should pay the claim.  We will only disclose the minimum amount of PHI necessary for collection purposes if it becomes necessary to use collection processes due to a lack of payment for services.

Health Care Operations.  We may also disclose PHI to other healthcare providers when such PHI is required for them to treat you, receive payment for services they render to you, or conduct certain healthcare operations, such as quality assessment and improvement activities and peer review.  We may share your PHI with third parties that perform various business activities, such as an outside billing company, appointment reminder service, or electronic practice management vendor, provided we have a written contract with the business that requires it to safeguard the privacy of your PHI.

Disclosure to Family, Close Friends, and Other Caregivers.  In an emergency, we may disclose PHI to those involved in a patient’s care when the patient approves or when the patient is not present or cannot approve when such disclosure is deemed appropriate in the professional judgment of the practice or such as necessary.  When the patient is absent, we determine whether the law requires the disclosure of the patient’s PHI. If so, disclose only the information directly relevant to the person’s involvement with the patient’s health care.

Disclosures Required by Law.  As behavioral health providers, it is our practice to adhere to more stringent privacy requirements for disclosures without an authorization.  However, we may also use or disclose PHI about you without your prior authorization, such as specific requirements and as required by law.

Public Safety.  We may disclose your PHI if necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.  If PHI is disclosed, for this reason, it will be disclosed to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.  We may disclose PHI to a state or local agency that is authorized by law to receive reports of abuse or neglect.

Public Health.  If required, we may use or disclose your PHI for mandatory public health activities to a public health authority authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, or if directed by a public health authority, to a government agency that is collaborating with that public health authority.

Health Oversight Activities.  We may use and disclose your PHI to state agencies and federal government authorities, such as through audits, investigations, and inspections, when required and authorized by law.  Oversight agencies seeking this information include government agencies and organizations that provide financial assistance to the program (such as third-party payors based on your prior consent) and peer review organizations performing utilization and quality control.  We may use and disclose your PHI to assist others in determining your eligibility for public benefit programs and to coordinate the delivery of those programs.  Oversight agencies seeking this information include government agencies and organizations that provide financial assistance to the program (such as third-party payors based on your prior consent) and peer review.

Judicial and Administrative Proceedings.  We may use and disclose your PHI in judicial and administrative proceedings pursuant to a subpoena, court order, administrative order, or similar process.  Efforts may be made to contact you before disclosure of your PHI to the party seeking information.

Law Enforcement. We may use or disclose PHI to law enforcement to locate someone who is missing, to identify a crime victim, to report a death, to report criminal activity at our offices, or in an emergency.

Specialized Government Functions.  We may review requests from US military command authorities if you have served as a member of the armed forces, authorized officials for national security and intelligence reasons, and to the Dept of State for medical suitability determinations, and disclose your PHI based on your written consent, mandatory disclosure laws and the need to prevent serious harm.

Work-Related Injuries.  We may use or disclose PHI to an employer to evaluate work-related injuries.

Medical Emergencies.  We may use or disclose your PHI in a medical emergency situation to medical personnel only in order to prevent serious harm or to provide treatment in an emergency situation.  Our staff will try to provide you with a copy of this notice as soon as reasonably practicable after resolving the emergency.

Deceased Patients.  We may disclose PHI regarding deceased patients as mandated by state law or to a family member or friend involved in your care or payment for care before death.  A release of information regarding deceased patients may be limited to an executor or administrator of a deceased person’s estate of the person identified as next-of-kin.  PHI of persons that have been deceased for more than fifty (50) years is not protected under HIPAA.

Uses and Disclosures Required by Law – DON NOT APPLY TO PRACTICE.  We may disclose information as required by law for the following purposes, although generally, these do not apply to Lumera:  marketing and research studies; fundraising; coroner or medical examiner and funeral directors for death certificate; disclosures to facilitate organ, eye, and tissue donations.

USES AND DISCLOSURES REQUIRING YOUR WRITTEN AUTHORIZATION

For any purpose other than the described above, we will only use or disclose your PHI when you give us your written authorization.  For instance, we will obtain your written authorization before we send your PHO to your employer or health plan sponsor for understanding and related purposes for a life insurance company or to the attorney representing the other party in litigation in which you are involved.

Highly Confidential Information.  Federal and Kentucky law requires special privacy protections for highly confidential information about you.  Highly Confidential Information consists of PHI related to psychotherapy notes; mental health and developmental disabilities services; alcohol and drug abuse services; medication management and health services;  HIV/AIDS testing, diagnosis or treatment; venereal disease(s); genetic testing; child abuse and neglect; domestic abuse of an adult with a disability; or sexual assault.  For us to disclose your Highly Confidential Information for a purpose other than those permitted by law, we must obtain your written authorization.

YOUR RIGHTS REGARDING YOUR PHI

Right to Receive an Accounting of Disclosures.  You have the right to request an accounting of disclosures we have made of your PHI for purposes other than treatment, payment, and health care operations or release made pursuant to your authorization.  If you request an account more than once during a twelve (12) month period, we will charge you $25.  A request for disclosures must be made in writing to the Chief Compliance Officer.

Right to Inspect and Copy Your PHI.  You have the right to inspect or get a copy of your medical record file and billing records maintained by us.  In some circumstances, we may deny you access to a portion of your records.  If you desire access to your records, submit your request in writing to the Chief Compliance Officer.  A reasonable fee not to exceed the limits allowed under Kentucky law will be charged for the copying and mailing.

Right to Amend Your Records.  You have the right to request that we amend PHI maintained in your medical record file or billing records.  If you desire to amend your records, please submit your request in writing to the Chief Compliance Officer.  We are not required to agree with your request to amend.

Right to Receive Confidential Communications.  We accommodate all reasonable requests to keep communications confidential and to allow you to receive your PHI by alternative means of communication or an alternative location.  A request for confidential communications must be in writing, specify an alternative address or another method of contact, and provide information about how payment will be handled. The request should be submitted to the Chief Compliance Officer.  We will determine the reasonableness based on the administrative difficulty of compiling the request.  We will reject a request due to administrative difficulty if no independently verifiable method of communication (such as a mailing address or published telephone number) is provided for communications; or if the requestor has not provided information on how payment will be handled.

Authorization.  We obtain written authorization from a patient or a patient’s representative for the use or disclosure of PHI for reasons other than treatment, payment, or healthcare operations.  We will not, however, get authorization for the benefit of disclosure of PHI specifically allowed under the Privacy Rule in the absence of authorization.  We do not condition treatment of a patient on the singing of authorization, except disclosure necessary to determine payment of claim (excluding authorization for the use or disclosure of psychotherapy notes); or provision of healthcare solely for the purpose of creating PHI for disclosure to a third party (pre-employment or life insurance exams).  Specific written authorization is required to disclose or release mental health treatment notes, alcoholism treatment, drug abuse treatment, or HIV/Acquired Immune Deficiency Syndrome (AIDS) information.

Right to Revoke Your Authorization.  You have the right to revoke your written authorization, except to the extent that we have taken action in reliance upon it, by submitting your request in writing to the Chief Compliance Officer.

Paper Copy of this Notice.  You have the right, even if you have agreed to receive notices electronically, to obtain a paper copy of this notice.  To do so, please submit a request to the Chief Compliance Officer at the address below.

Effective Date and Changes to this Notice.  This Notice is effective August 1, 2022.  We reserve the right to revise this Notice at any time.  If we change this Notice, we may make the new notice terms effective for all PHI we maintain, including any information created or received before issuing the new Notice. Any further Notice will be posted in the reception area of Lumera Healthcare, LLC. 

For further Information on Complaints.  If you have questions, are concerned that your privacy rights have been violated, or disagree with a decision made about access to your PHI, you may contact our Chief Compliance Officer, who serves as the contact person for all issues regarding the Privacy Rule.  Complaints must be addressed to the attention of the Chief Quality and Accreditation Office at Lumera Healthcare, LLC; 5050B  Village Square Drive, Paducah, KY, 42001. Telephone (270) 534-5128.  Written complaints may also be filed with the Secretary of the U.S. Department of Health and Human Services at 200 Independence Avenue SW, Washington, D.C., 20201.  Complaints must name the practice, describe the acts or omissions that are the subject of the complaint, and must be filed within 180 of the time you became aware of should have become aware of the violation.  We will not retaliate or take any adverse action against you if you file a complaint.