Interwell Medical Group Notice of Privacy Practices

This Notice of Privacy Practices (the “Notice”) describes the privacy practices that Interwell Medical Group and its affiliated medical practices under common ownership (each, a “Practice”) (collectively, “IMG”) has established, as well as your rights with respect to your health information. You are receiving this Notice because you are a participant in IMG’s 360 program.

IMG has designated the Practices as an affiliated covered entity (“ACE”). This ACE designation permits IMG to consolidate privacy administration over the Practices. Therefore, the Practices share a Privacy Officer and their shared privacy practices are described in this Notice. The Practices may share PHI with each of the other Practices and the vendors that provide services to a Practice (“Business Associates”), as necessary to carry out treatment, payment, and health care operations relating to the ACE.

The Practices, as of the effective date of this Notice, include:

• InterWell Health Medical Group, PLLC (this is the main one)
• Interwell Health Medical Practice of Kansas, LLC
• Interwell Medical Group of Puerto Rico, LLC
• InterWell Health Medical Group, P.C.
• InterWell Health Medical Practice of New Jersey P.C.

 

IMG’S COMMITMENT TO PRIVACY

IMG is committed to protecting the privacy of your protected health information (“PHI”). PHI refers to individually identifiable health information, regardless of form (e.g., paper, electronic, or oral), that a Practice creates or receives that relates to your physical or mental health, your health care, or payment for your health care.

The privacy protections described in this Notice reflect the requirements of federal regulations issued under the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”). The HIPAA regulations require IMG to:

• maintain the privacy of your PHI in compliance with HIPAA privacy standards and other applicable laws;
• give you this Notice outlining its legal duties and privacy practices with respect to your PHI; 
• follow the terms of the Notice that are currently in effect; and
• notify affected individuals following a breach of unsecured PHI.

 

HOW IMG MAY USE AND DISCLOSE YOUR PHI WITHOUT YOUR AUTHORIZATION

This section describes the different ways in which IMG may use and disclose your PHI without your authorization. Although not every possible use and disclosure will be listed in this Notice, all the ways that IMG is permitted to use and disclose your PHI without your authorization will fall within one of the following categories.

Please note that the use and disclosure of certain sensitive PHI (e.g., substance use disorder information, mental health information, HIV/AIDS information, venereal disease information) may be further restricted under other applicable federal or state law.

• Treatment: IMG may use and disclose your PHI in order to provide health care and related services to you and to assist other health care providers (doctors, hospitals, pharmacies, and other personnel who are also involved in providing you with medical treatment or services) in your diagnosis, treatment, referral for treatment, and coordination or management of health care or related services. For example, IMG may disclose your PHI to your primary care physician (“PCP”) without your authorization.
• Payment: IMG may use and disclose your PHI to bill and receive payment from health plans or other entities. For example, IMG may disclose your PHI to your health insurance plan so it will pay for your services.
• Health Care Operations: IMG may use and disclose your PHI in order to perform certain administrative, financial, legal, and quality improvement activities, including, but not limited to: population-based activities relating to improving health or reducing health care costs; case management and care coordination; evaluating provider performance; training activities; accreditation, certification, and licensing; auditing services; business planning and development; and general administrative activities. For example, in some cases, IMG may use or disclose your information to manage your treatment and services and contact you when necessary.
• Creation of De-Identified Health Information: IMG may use your PHI to create data that cannot be linked to you by removing certain elements from your PHI, such as your name, address, and telephone number. IMG may use this de-identified information to conduct certain business activities, such as creating summary reports.
• Business Associates: IMG may disclose your PHI to persons or entities that provide services to IMG (“Business Associates”), so long as IMG obtains written assurances that the Business Associate will comply with HIPAA and the IMG’s procedures on the use and disclosure of PHI. For example, the Business Associates may perform auditing functions, data analysis, and other administrative functions for, and on behalf of, IMG.
• Individuals Involved in Your Care or Payment for Your Care: IMG may disclose PHI about you to someone who assists in or pays for your care. Unless you write to us and specifically tell us not to, we may disclose your PHI to someone who has your permission to act on your behalf. We will require this person to provide adequate proof that he or she has your permission.
• As Required by Law: IMG may use and disclose your PHI if it is required to do so by federal, state, or local law or regulation.
• Public Health Activities: IMG may use or disclose your PHI for public health activities and purposes, such as regulatory reporting for the purpose of preventing or controlling disease, injury, or disability (e.g., reporting adverse events, vaccination efforts to avert the spread of communicable diseases).
• Abuse, Neglect, or Domestic Violence: IMG may disclose your PHI to a government authority (e.g., a social service, protective services agency) if IMG believes you are a victim of abuse, neglect, or domestic violence. IMG will inform you of such a disclosure unless informing you would place you at risk of serious harm.
• Health Oversight Activities: IMG may disclose your PHI to a health oversight agency performing activities authorized by law, such as investigations and audits. These agencies include governmental agencies that oversee the health care system, government benefit programs, and organizations subject to healthcare government regulatory programs and civil rights laws.
• Legal Proceedings: IMG may use or disclose your PHI in the course of any judicial or administrative proceeding, such as in response to a court order or other lawful process.
• Law Enforcement: IMG may disclose your PHI to government law enforcement officials as permitted or required by law. For example, IMG may disclose PHI in response to a warrant or other appropriate process, or to provide law enforcement officials information about crime victims.
• Decedents: IMG may disclose your PHI to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or as otherwise authorized by law; and to funeral directors as necessary to carry out their duties.
• Organ Procurement: IMG may disclose your PHI to respond to organ donation groups for the purpose of facilitating organ donation and transplantation.
• Research: IMG may disclose your PHI to researchers, provided measures are taken to protect your privacy in accordance with applicable law.
• To Avert a Serious Threat to Health or Safety: IMG may use or disclose your PHI when necessary to prevent or lessen a serious threat to your health and safety or the health and safety of the public or another person. Such disclosure will only be made to someone in a position to reasonably prevent or lessen the threat.
• Specialized Government Functions, Military, and Correctional Institutions: IMG may disclose your PHI to authorized federal officials to perform intelligence, counterintelligence, Presidential protection activities, and other national security activities authorized by law. If you are a member of the U.S. Armed Forces or of a foreign military, IMG may disclose your PHI as required by military command authorities or law. If you are an inmate in a correctional institution or under the custody of a law enforcement official, IMG may disclose your PHI to those parties as necessary for: the provision of your health care, maintaining the health or safety of yourself or other inmates, or ensuring the safety and security of the correctional institution or its agents.
• Workers’ Compensation: IMG may use and disclose your PHI to comply with workers’ compensation laws.

 

USES OF PHI THAT REQUIRE YOUR AUTHORIZATION

This section describes uses and disclosures of PHI that require your written authorization.

• Marketing Purposes: Except in certain circumstances authorized by law, IMG is required to obtain your written authorization before using or disclosing your PHI for marketing purposes.
• Sale of PHI: IMG is required to obtain your written authorization before disclosing your PHI for purposes that constitute a sale of PHI.
• Other Uses and Disclosures of PHI Not Listed in this Notice: Other uses and disclosures of your PHI not listed in this Notice will be made only with your written authorization, unless otherwise permitted or required by law. You may revoke an authorization at any time in writing, except to the extent that IMG has already taken action on the information disclosed.

 

YOUR RIGHTS

This section describes your rights under HIPAA and how to exercise such rights.

• Right to Request Restrictions: You have the right to request a restriction or limitation on the use and disclosure of your PHI for treatment, payment or health care operations, or to request a restriction on the PHI that IMG may disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend. IMG is not required to agree to your request in all circumstances. If IMG agrees to your request, it will comply with the requested restriction, unless the information is needed to provide you emergency treatment. To request a restriction, you must submit your request in writing to IMG at the email address noted below. Your request should state the information you want to limit; whether you want to limit IMG’s use, disclosure or both; and to whom you want the limits to apply, for example, disclosures to your spouse.
• Right to Request Confidential Communications: You have the right to request that IMG communicate with you about your PHI in a certain way or at a certain location. For example, you can ask IMG to only contact you at work or by mail to a specific address. To request confidential communications, you must submit your request in writing to IMG at the email address noted below.  IMG will accommodate all reasonable requests and will not ask you the reason for your request. Your request must clearly specify how or where you wish to be contacted.
• Right to Inspect and Copy: With certain exceptions, you have the right to inspect and obtain a copy of your PHI that is maintained by or for IMG. These records typically include medical records, billing records, case management records, as well as any other records IMG uses to make decisions about you. To obtain a copy of the PHI, you must submit your request in writing to IMG at the email address noted below. You may be charged a fee for the costs of copying, mailing or other supplies associated with your request. IMG may deny your request to inspect and/or obtain a copy in certain limited circumstances (e.g., the record requested is not a record that IMG maintains and uses to make decisions about you). If your request is denied, you will be informed in writing of the basis for the denial and how you may appeal the decision (if applicable).
• Right to Request an Amendment:  If you believe that the PHI maintained by IMG is incorrect or incomplete, you may request that IMG amend the information. You have the right to request an amendment for as long as the information is kept by or for IMG. You may submit a request for amendment in writing to IMG at the email address below. IMG may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, IMG may deny your request if you ask to amend information that: (i) was not created by IMG; (ii) is not part of the PHI maintained by or for IMG; (iii) is not part of the information that you would be permitted to inspect and copy under the law; or (iv) is accurate and complete. If the request is denied, IMG will notify you in writing of the basis for the denial. You then have a right to submit a written statement of disagreement with IMG’s decision and IMG has a right to rebut that statement. If the request is granted, IMG will forward your request to other entities that you identify that you want to receive the corrected information.
• Right to an Accounting of Disclosures: You have the right to receive an accounting of the disclosures of your PHI made by IMG (i.e., a list that shows how your PHI was shared), with the exception of certain disclosures, including those relating to treatment, payment, and health care operations, as well as disclosures made to you or consistent with your authorization. You may submit a request for an accounting of disclosures in writing to IMG at the email address below. Your request must state a time period, which may not be longer than six (6) years prior to the date on which the accounting is requested. Your request should indicate in what form you want the list (for example, on paper or electronically). The first list you request within a twelve (12) month period will be free. For additional lists, IMG may charge you for the cost of providing the list. You will be notified of any costs involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
• Breach: You have the right to be notified of the discovery of a breach of unsecured PHI.
• Right to Paper Copy of this Notice: You may ask IMG to give you a copy of this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of this Notice. To obtain a paper copy of this Notice, please contact us at the email address noted below .
• Personal Representatives: You may exercise your privacy rights through a personal representative. Your personal representative will be required to provide evidence of their authority to act on your behalf. Proof of the authority includes a power of attorney for health care purposes, a court order of appointment of the person as conservator or guardian, and parent of a minor child. IMG has the discretion to deny a personal representative access to your PHI if necessary to protect those who are vulnerable and who may be subject to abuse. 

 

PROTECTIONS FOR SENSITIVE INFORMATION

• Substance Use Disorder Records: To the extent IMG receives substance use disorder treatment records from programs subject to 42 CFR Part 2, or testimony relaying the content of such records, IMG shall not use or disclose such records in civil, criminal, administrative, or legislative proceedings against the individual who is the subject of the records, unless the use or disclosure is based on written consent, or a court order after notice and an opportunity to be heard is provided to the individual or the holder of the record, as provided in 42 CFR Part 2. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested record is used or disclosed.

• Reproductive Health Information: 
  - Prohibitions: IMG is prohibited from: using or disclosing PHI for any of the following activities: (1) to conduct a criminal, civil, or administrative investigation into or impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided; or (2) to identify any person for the purpose of conducting such investigation or imposing such liability. For example, IMG may not disclose PHI relating to your reproductive health care for purposes of investigating you, where such health care is lawful under the circumstances in which it was provided to you.
  - Attestation Required: IMG may not use or disclose PHI potentially related to reproductive health care for health oversight activities, judicial and administrative proceedings, law enforcement purposes, or to coroners or medical examiners, without obtaining a valid attestation from the person requesting the use or disclosure that the use or disclosure is not for a purpose prohibited under the law. For example, IMG may not disclose reproductive health information in response to a law enforcement inquiry without a valid attestation from the law enforcement official that the request is not for purposes prohibited under HIPAA.

 

CHANGES TO THIS NOTICE

IMG reserves the right to change its privacy practices and to apply the change to any PHI received or maintained by IMG prior to issuing a revised Notice. If a privacy practice is materially changed, the revised Notice will be available upon request and on IMG’s website.

 

COMPLAINTS

If you believe that your privacy rights have been violated, you may file a complaint with the Privacy Officer by writing to IMG at the email address listed below.

You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services (“HHS”). Complaints may be filed in writing by mail, e-mail, or via the online OCR Complaint Portal. For more information on how to file a complaint with HHS, please visit: https://www.hhs.gov/hipaa/filing-a-complaint/complaint-process/index.html.

IMG will not retaliate against you for filing a complaint.

 

REDISCLOSURES OF PHI MAY NO LONGER BE PROTECTED BY HIPAA

PHI disclosed by IMG in accordance with this Notice may be subject to redisclosure and may no longer be protected under HIPAA.

 

CONTACT US

For further information regarding this Notice and IMG’s privacy practices, please contact IMG at privacy@interwellhealth.com, attention: Privacy Officer.