NOTICE OF PRIVACY PRACTICES

We are required by law to:

• Maintain the privacy of your PHI to the extent required by state and federal law;
• Give you this Notice explaining our legal duties and privacy practices with respect to your PHI;
• Notify you in the event of a breach of your PHI; and
• Follow the terms of the version of this Notice that is currently in effect.

A. For Treatment. We may use and disclose your PHI to provide you with health care treatment and related services, including coordinating and managing your health care. We may disclose medical information about you to physicians, nurses, or other health care providers and personnel who are involved in providing health care to you both within and outside of UEI. For example, should your care require referral to or treatment by another physician outside of UEI, we may provide that physician with your PHI in order to aid the physician in their treatment of you. Some uses and disclosures for treatment purposes also include the following:

B. For Payment. We may use and disclose your PHI as requested by your health plan, insurer, or other third-party payor, to obtain payment for treatment or services that we provide to you. This may include the disclosure of your PHI to obtain prior authorization for treatment and procedures from your insurance plan. For example, we may send a claim for payment to your insurance company, and that claim may have a code on it that describes the services that have been rendered to you. However, if you pay for an item or service entirely out-of-pocket and request that we not disclose that item or service to your health plan, then we will follow that restriction on disclosure unless otherwise required by law (see Section V(D) for more detail).

C. For Health Care Operations. We may use and disclose your PHI for our health care operations. These uses and disclosures are necessary to operate and manage our practice and to promote quality care. Uses and disclosures for health care operations include:

D. Business Associates. We may disclose your PHI to certain vendors, otherwise referred to as “business associates,” with whom we contract to provide services on our behalf. Our business associates are required to appropriately safeguard our patients’ PHI.

E. Individuals Involved in Your Care or Payment for Your Care. We may disclose your PHI to a friend or family member who is involved in your health care, as well as to someone who helps pay for your care, but we will do so only as allowed by state or federal law (with an opportunity for you to agree or object when required under the law), or in accordance with your prior authorization.

F. As Required or Permitted by Law. We may use and disclose your PHI as required or permitted by federal, state, or local law. Uses and disclosures required or permitted by law include, but are not limited to, the following:

G. Special Privacy Protections for Substance Use Disorder Information: Records relating to substance use disorder are subject to special protections under federal law. In some cases, UEI may receive or maintain these records about you. UEI will only use or disclose your substance use disorder records with your written consent or as otherwise permitted or required by applicable law.

UEI will not use or share your substance use disorder records, or any testimony about those records, in legal proceedings against you unless you have given written consent or we receive a court order and you have been notified and allowed to respond. The court order must be accompanied by a subpoena or another legal requirement that compels disclosure.

A. Psychotherapy Notes, Marketing and Sale of Medical Information. Most uses and disclosures of “psychotherapy notes,” uses and disclosures of medical information for marketing purposes, and disclosures that constitute a “sale of medical information” under HIPAA require your authorization.

A. Right to Inspect and Copy. Under most circumstances, you have the right to inspect and/or copy your PHI that we have in our possession, which generally includes your medical and billing records. To inspect or copy your PHI, you must submit your request to do so in writing to the UEI Privacy Officer at the address listed in Section VII below. We will act on your request within 15 business days of receiving your written request.

If you request a copy of your information, we may charge a reasonable fee for the costs of copying, mailing, or certain supplies associated with your request. The fee we may charge will be the amount allowed by applicable law.

If your requested medical information is maintained in an electronic format (e.g., as part of an electronic medical record, electronic billing record, or other group of records maintained by UEI that is used to make decisions about you) and you request an electronic copy of this information, then we will provide you with the requested medical information in the electronic form and format requested, if it is readily producible in that form and format. If it is not readily producible in the requested electronic form and format, we will provide access in a readable electronic form and format as agreed to by UEI and you.

In certain very limited circumstances allowed by law, we may deny your request to review or copy your medical information. We will give you any such denial in writing. If you are denied access to medical information, you may request that the denial be reviewed. Another licensed health care professional chosen by UEI will review your request and the denial. The person conducting the review will not be the person who denied your request. We will abide by the outcome of the review.

B. Right to Amend. If you feel the medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by UEI. To request an amendment, your request must be in writing and submitted to the UEI Privacy Officer at the address listed in Section VII below. In your request, you must provide a reason as to why you want this amendment. If we accept your request, you will be notified in writing. UEI will respond to your request written request for an amendment within 60 days of receiving the request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that (i) was not created by us (unless you provide a reasonable basis for asserting that the person or organization that created the information is no longer available to act on the requested amendment), (ii) is not part of the information kept by UEI, (iii) is not part of the information which you would be permitted to inspect and copy, or (iv) is accurate and complete. If we deny your request, we will notify you of that denial in writing.

C. Right to an Accounting of Disclosures. You have the right to request an “accounting of disclosures” of your medical information. This is a list of the disclosures we have made for up to six years before the date of your request of your medical information, but does not include disclosures for Treatment, Payment, or Health Care Operations (as described in Sections III A, B, and C of this Notice) or disclosures made pursuant to your specific authorization (as described in Section IV of this Notice), or certain other disclosures.

To request a list of accounting, you must submit your request in writing to the UEI Privacy Officer at the address outlined in Sections VII below. We will act upon your request for an accounting within 60 days after we receive your written request.

Your request must state a time period, which may not be longer than six years. Your request should indicate in what form you want the list (for example, on paper or electronically). The first list you request within twelve months will be free. For additional lists, we may charge you a reasonable fee for the costs of providing the list. We will notify you of the cost involved, and you may choose to withdraw or modify your request at that time before any costs are incurred.

D. Right to Request Restrictions. You have the right to request a restriction or limitation on our use or disclosure of your PHI for treatment, payment, or health care operations. You also have the right to request a restriction or limitation on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. You may not request a restriction of a disclosure that is required by law.

We will attempt to accommodate all reasonable requests for restrictions, but we are not obliged to agree to a restriction (except as otherwise noted in this paragraph).

As required by law, we will honor your request not to disclose certain PHI to a health plan, insurer, or other third-party payor for payment or health care operations if the PHI relates only to services you have fully paid for out-of-pocket. Please note that this restriction may have unintended consequences. For example, other providers (such as a pharmacy filling a prescription) may need this information, and you will be responsible for notifying them of the restriction. In addition, a restriction may also affect your health plan’s willingness to cover the cost of related services. If you choose not to pay for those services out-of-pocket, your plan may deny payment because the restricted information cannot be shared.

To request a restriction, you must make your request in writing to the UEI Privacy Officer at the address listed in Section VII of this Notice below. In your request, you must specifically tell us (1) what information you want to limit, (2) whether you want us to limit our use, disclosure, or both, and (3) to whom you want the limits to apply.

E. Right to Request Confidential Communications. You have the right to ask us to communicate with you in a specific way or at a certain location. For example, you may ask that we contact you only at home and not at work, or only at work and not at home. To make a specific request regarding confidential communications, you must submit a request in writing to the UEI Privacy Officer at the address listed in Section VII below. We will not ask why you are making the request, and we will make every effort to accommodate reasonable requests. However, some requests may not be possible. Your request must clearly state how and where you would like us to contact you.

F. Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. To obtain a copy of this Notice, you must make your request by writing to the UEI Privacy Officer at the address outlined in Section VI below.

G. Right to Breach Notification. We are required to notify you if your PHI is breached. A breach is an unpermitted use or disclosure of PHI in which there is more than a low probability that such PHI has been compromised.