Notice of Privacy Practices

We are required by law to maintain the privacy and security of your PHI. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your PHI. We must follow the duties and privacy practices described in this Notice and give you a copy of it.

We will not use or share your PHI other than as described in this Notice unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. For more information visit the US Department of Health and Human Services.

The Provider may use or disclose PHI for the purposes of treatment, payment, and health care operations without your written permission in most cases. Examples of our use or disclosure of your PHI include the following:

• For Treatment. This includes such things as obtaining verbal and written information about your medical condition and treatment from you, as well as from others, such as doctors and nurses who give orders to allow us to provide treatment to you. We may give your PHI to the hospital, the dispatch center or other health care providers involved in your treatment.  We may transfer your PHI via radio or telephone. . 
• For Payment. This includes any activities we must undertake in order to get reimbursed for the services we provide to you, including submitting bills to insurance companies (either directly or through a third-party billing company), medical necessity determinations and reviews, and collecting outstanding accounts.
• For Health Care Operations. This includes quality assurance activities, licensing, and training programs to ensure that our personnel meet our standards of care and follow established policies and procedures, as well as certain other management functions (examples include, but are not limited to, obtaining legal and financial services, conducting business planning, processing grievances and complaints, creating reports that do not individually identify you for data collection purposes).

We may also contact you to provide you with a reminder of any scheduled appointments, or to provide information about other services/programs we provide.

In addition to the situations described above, the Provider is permitted to use or disclose PHI without your written authorization or opportunity to object in certain situations, unless otherwise prohibited by state law, which include: 

• For the treatment, payment, or health care operations activities of another health care provider who treats you (such as your hospital).
• For health care and legal compliance activities.
• To business associates that perform various functions on our behalf or to provide certain types of services.
• To a family member, other relative, close personal friend, or other individual involved in your care if we obtain your verbal agreement to do so or if we give you an opportunity to object to such a disclosure and you do not raise an objection. In certain circumstances where we are unable to obtain your agreement (because you are not present or are incapacitated) we may, in our professional judgment, determine that disclosure to your family member, relative, or friend is in your best interest. In such a situation, we will disclose only health information relevant to that person’s involvement in your care. We may also disclose health information to your family, relatives, or friends if we infer from the circumstances that you would not object. For example, we may assume you agree to our disclosure of your PHI to your spouse when your spouse has called the ambulance for you or accompanies you in the ambulance.
• To a public health authority in certain situations, as required by law (such as to report a birth, death, disease, abuse, neglect, or domestic violence).
• For health oversight activities, including audits or government investigations, inspections, disciplinary proceedings, and other administrative or judicial actions undertaken by the government (or its contractors) by law to oversee the health care system.
• For judicial and administrative proceedings, as required by a court or administrative order, or in some cases in response to a subpoena or other legal process. 
• For law enforcement activities in limited situations, such as when responding to a warrant or when the information is needed to locate a suspect or stop a crime.
• For military, national defense and security, and other special government functions.
• To avert a serious threat to the health and safety of a person or the public at large. 
• For workers’ compensation purposes, and in compliance with workers’ compensation laws. 
• To coroners, medical examiners, and funeral directors for identifying a deceased person, determining cause of death, or as necessary to carry out their duties, as authorized by law. If you are an organ donor, to an organization that handles organ procurement or organ, eye, or tissue transplantation, or to an organ donation bank, as necessary to facilitate organ donation and transplantation. 
• For research projects, but this will be subject to strict oversight and approvals. In a manner that does not personally identify you or reveal who you are.

Other uses or disclosures of your PHI not described above will only be made with your written authorization. For example, in general and subject to specific conditions, we will not use or disclose your psychiatric notes except for use in our treatment, payment, or healthcare operations purposes; we will not use or disclose your PHI for marketing; and we will not sell your PHI, unless you give us a written authorization. You may revoke written authorizations at any time, so long as the revocation is in writing. Once we receive your written revocation, it will only be effective for future uses and disclosures. It will not be effective for any PHI that may have been used or disclosed in reliance upon the written authorization and prior to receiving your written revocation.

As a patient, you have several rights with respect to your PHI, including:

The Right to Access, Copy, or Inspect Your PHI. You have the right to inspect and copy certain types of your PHI. We will provide you with access to this PHI within 30 days of your request, unless we notify you in writing that we need an additional 30 days (45 CFR 164.524(b)(2)).  If the PHI you request is maintained electronically, and you request an electronic copy, we will provide a copy in the electronic format you request if the PHI can be readily produced in that format. If the PHI cannot be readily produced in that format, we will work with you to come to an agreement on format. If we cannot agree to an electronic format, we will provide you with a paper copy. Provider strongly recommends that any electronic transmission of your PHI to you be encrypted, but we will transmit your PHI to you unencrypted upon your request. 

To inspect and copy your PHI, please contact our Privacy Officer (as set forth below). If you request a copy of the PHI, we may charge a reasonable fee for you to copy any PHI that you have the right to access, in accordance with 45 CFR 164.524(c)(4). We may deny your request to inspect and copy your PHI in certain limited circumstances. If you are denied access to your PHI, we will provide a written denial, and you may request that the denial be reviewed by submitting a written request to our Privacy Officer. 

The Right to Receive Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. To request confidential communications, please contact our Privacy Officer. Your request must specify how or where you wish to be contacted. We will accommodate all reasonable requests. 

The Right to Amend Your PHI. You have the right to ask us to amend PHI that we may have about you. We will generally amend your PHI within 60 days of your request and will notify you when we have amended the PHI. We are permitted by law to deny your request to amend your PHI only in certain circumstances, like when we believe the PHI you have asked us to amend is correct. If you wish to request that we amend the PHI that we have about you, please contact our Privacy Officer. 

The Right to Request an Accounting. You may request an accounting from us of certain disclosures of your PHI that we have made in the six years prior to the date of your request. We are not required to give you an accounting of uses or disclosures for purposes of treatment, payment, or health care operations, or when we share your PHI with our business associates, such as our billing company or a medical facility from/to which we have transported you. We are also not required to give you an accounting of our uses and disclosures of PHI for which you have given written authorization. If you wish to request an accounting, please contact our Privacy Officer. 

The Right to Request that We Restrict the Uses and Disclosures of Your PHI. You have the right to request that we restrict how we use and disclose your PHI. Except as provided below, the Provider is not required to agree to any restrictions you request. However, any restrictions agreed to by the Provider in writing are binding on the Provider. We will comply with any restriction request if (1) except as otherwise required by law, the disclosure is to a health plan for purposes of carrying out payment or health care operations (and is not for purposes of carrying out treatment), and (2) the PHI pertains solely to a health care item or service for which the health care provider involved has been paid in full by you or another person. To request restrictions, please contact our Privacy Officer. 

The Right to Be Notified of a Breach. You have the right to be notified in the event that we (or a business associate) discover a breach of unsecured PHI.

HIPAA generally does not preempt other laws that give individuals greater privacy protection. Therefore, if any state or federal privacy law requires us to provide you with more privacy protection, then we will also follow that law in addition to HIPAA.

If we maintain a website, we will prominently post a copy of this Notice on our web site. If you allow us, we will forward you this Notice by electronic mail instead of on paper and you may always request a paper copy of the Notice. 

The Provider reserves the right to change the terms of this Notice at any time, and the changes will be effective immediately and will apply to all PHI that we maintain. Any material changes to the Notice will be promptly posted in our facilities and posted to our website, if we maintain one. You can get a copy of the latest version of this Notice by Contacting our Privacy Officer.

You also have the right to complain to us or to the Secretary of the United States Department of Health and Human Services (“Secretary”) if you believe your privacy rights have been violated. You will not be retaliated against in any way for filing a complaint with us or the Secretary. To file a complaint with the Provider, or if you have any questions or comments regarding this Notice, please contact our Privacy Officer. Please note that all complaints filed with the Provider must be submitted in writing.

Certain health information we maintain may be subject to federal confidentiality protections for Substance Use Disorder (SUD) patient records under 42 CFR Part 2, in addition to the protections provided under the Health Insurance Portability and Accountability Act (HIPAA). SUD records are afforded special confidentiality protections and generally may not be used or disclosed without your written consent, except as expressly permitted or required by law. In some circumstances, HIPAA would allow use or disclosure of health information without authorization, but federal SUD confidentiality laws may require your consent before such information may be shared.

When permitted by law and where appropriate consent has been obtained, SUD records may be used and disclosed for treatment, payment, and healthcare operations, or as otherwise allowed under 42 CFR Part 2. Any disclosures will be limited to the minimum necessary and consistent with applicable federal requirements.
 

You have the right to: Provide or withhold written consent for the use and disclosure of your SUD records, including the right to revoke consent as permitted by law. Request restrictions on certain disclosures of your SUD records. Opt out of fundraising communications if SUD records are used for fundraising purposes

Federal law prohibits the use or disclosure of SUD records, or testimony regarding such records, in civil, criminal, administrative, or legislative proceedings against you without your written consent or a qualifying court order. If you have questions about how your SUD records are used or disclosed, or about your rights under federal confidentiality laws, please contact our Privacy Officer using the information provided in this Notice.

You are receiving this notice because your healthcare provider participates in Contexture (formerly Health Current), a non-profit, non-governmental health information exchange (HIE). It will not cost you anything and can help your doctor, healthcare providers, and health plans better coordinate your care by securely sharing your health information. 

In a paper-based record system, your health information is mailed or faxed to your doctor, but sometimes these records are lost or don't arrive in time for your appointment. If you allow your health information to be shared through the HIE, your doctors are able to access it electronically in a secure and timely manner. 

The following types of health information may be available: hospital records, medical history, medications, allergies, lab test results, radiology reports, clinic and doctor visit information, health plan enrollment and eligibility, and other information helpful for your treatment. 

People involved in your care will have access to your health information, including your doctors, nurses, other healthcare providers, health plan and any organization or person working on behalf of your healthcare providers and health plan. They may access your information for treatment, care coordination, care or case management, transition of care planning and population health services. You may permit others to access your health information by signing an authorization form. Contexture may also use your health information as required by law and as necessary to perform services for healthcare providers, health plans and others participating with Contexture. The Contexture Board of Directors can expand the reasons why healthcare providers and others may access your health information in the future as long as the access is permitted by law. For more information, visit Contexture. 

Contexture does receive behavioral health information, including substance abuse treatment records. Federal law gives special confidentiality protection to substance abuse treatment records from federally assisted substance abuse treatment programs. Contexture keeps these protected substance abuse treatment records separate from the rest of your health information. 

Contexture will only share the substance abuse treatment records it receives from these programs in two cases: 

• (1) medical personnel may access this information in a medical emergency, or
• (2) you may sign a consent form giving your healthcare provider or others access to this information. 

Federal and state laws, such as HIPAA, protect the confidentiality of your health information. Your information is shared using secure transmission. Contexture has security measures in place to prevent someone who is not authorized from having access. Each person has a username and password, and the system records all access to your information.

You have the right to: 

• (1) Ask for a copy of your health information that is available through Contexture—contact your healthcare provider and you can get a copy within 30 days. 
• (2) Request to have any information in the HIE corrected—if any information in the HIE is incorrect, you can ask your healthcare provider to correct the information. 
• (3) Ask for a list of people who have viewed your information through Contexture—contact your healthcare provider and you can get a copy within 30 days. Please let your healthcare provider know if you think someone has viewed your information who should not have. You have the right under article 27, section 2 of the Arizona Constitution and Arizona Revised Statutes title 36, chapter 38 to keep your health information from being shared electronically through Contexture. You may "opt out" of having your information available for sharing through Contexture. 
  • To opt out: 
    • (1) Contact the Privacy Officer and an opt-out form will be provided. After you submit the form, your information will not be available for sharing through Contexture. Caution: If you opt out, your health information will NOT be available to your healthcare providers even in an emergency. 
    • (2) You may exclude some information from being shared. For example, if you see a doctor and you do not want that information shared with others, you can prevent it. On the Opt Out Form, fill in the name of the healthcare provider for the information that you do not want shared with others. Caution: If that healthcare provider works for an organization (like a hospital or a group of physicians), all your information from that hospital or group of physicians may be blocked from view.
    • (3) If you opt out today, you can change your mind at any time by completing an Opt Back In Form that you can obtain from your healthcare provider. 
    • (4) If you do nothing today and allow your health information to be shared through Contexture, you may opt out in the future. 

If you do nothing, your information may be securely shared through Contexture.