PATIENT PRIVACY

All patients of the Podiatry Associates of Southeast Texas have a right to receive a notice of our privacy policies and procedures. This notice will be provided to all patients on their first visit to the Podiatry Associates of Southeast Texas after April 14, 2003. The notice will be posted in the Podiatry Associates of Southeast Texas's reception area in a location accessible to all patients and on our web site.

1. Right to Request Restrictions

1.1 General Statement. Patients have a right to request that the Podiatry Associates of Southeast Texas restrict the uses or disclosures of patient health information to carry out treatment, payment or health care operations, and have a right to request that the Podiatry Associates of Southeast Texas restrict disclosures made to family, relatives and close personal friends.

1.2 Written Request. Patients who request restrictions on the use or disclosure of their health information will be asked to fill out the Restriction Request Form.

1.3 Procedure. If the Podiatry Associates of Southeast Texas receives a written request to restrict the uses and disclosures of patient health information, the request will be referred to the privacy officer for handling. The privacy officer will notify the patient in writing within a reasonable time as to whether the Podiatry Associates of Southeast Texas will agree to the restriction. If the privacy officer advises the patient that it will not agree to the restriction, no further action is necessary. If the Podiatry Associates of Southeast Texas advises the patient that it will abide by the restriction, a notation will be made prominently in the patient's chart, and the Podiatry Associates of Southeast Texas will abide by that restriction from that date forward.

1.4 Disclosures Required by Law. The Podiatry Associates of Southeast Texas will not agree to restrict disclosures of health information that are required by law.

1.5 Termination of Restrictions. If the Podiatry Associates of Southeast Texas has agreed to a restriction on uses or disclosures of health information, it may terminate that agreement by advising the patient in writing that the termination will only be effective with respect to health information created or received after written notification to the patient. As to health information created or received prior to that date, the restriction must be followed.

1.6 Documentation. All patient requests for restrictions, along with the Podiatry Associates of Southeast Texas's response thereto, shall be kept for a minimum of six (6) years from the date of the document(s).

2. Right to Confidential Communications

2.1 General Statement. Patients have a right to request reasonable accommodations in receiving communications of their health information by alternative means or at alternative locations.

2.2 Written Request. Patients who request confidential communications will be asked to fill out the Request for Confidential Communications form.

2.3 Procedure. Upon receipt of a request for confidential communications, the privacy officer will evaluate the request. If the request is reasonable, the privacy officer will note the request prominently in the patient's chart and adhere to the request. For example, if the patient requests that all communications be sent to an address different than the patient's home address, the Podiatry Associates of Southeast Texas will adhere to that request and note it in the patient's chart. If the request is not reasonable, the privacy officer will notify the patient that the request has been rejected.

2.4 Conditions to Providing Confidential Communications. As a condition to providing confidential communications at the patient's request, the Podiatry Associates of Southeast Texas may require that the patient provide assurances as to how payment for services will be provided.

2.5 No Demand for Explanations. The Podiatry Associates of Southeast Texas may not require an explanation from patients as to the reason for requesting confidential communications.

2.6 Documentation. All patient requests for confidential communications, along with the Podiatry Associates of Southeast Texas's response thereto, shall be kept for a minimum of six (6) years from the date of the document(s).

3. Right to Access

3.1 General Statement. Patients have a right to inspect and obtain a copy of their health information except as noted herein.

3.2 Procedure. The Podiatry Associates of Southeast Texas may require that the patient request in writing to have access to his/her health information. Upon receipt of such a request, the Podiatry Associates of Southeast Texas will provide the patient with an opportunity to inspect his or her health information within the following time frames:

• For records that are maintained on site, the Podiatry Associates of Southeast Texas will provide access within 30 days from the receipt of the request from the patient;
• For records not maintained on site, the Podiatry Associates of Southeast Texas will provide access within 60 days of the date of receipt of the request from the patient.

3.2.1 The Podiatry Associates of Southeast Texas will provide the patient with the health information in readable hard copy form. The Podiatry Associates of Southeast Texas may provide the patient with a summary of the health information in lieu of providing access to the records themselves if and only if the patient agrees to receiving a summary and the patient agrees in advance to paying the fees imposed, if any, for the Podiatry Associates of Southeast Texas providing the summary.

3.2.2 The Podiatry Associates of Southeast Texas will provide a convenient time and place for the patient to inspect his/her health information or to obtain a copy of the information. This may include simply mailing a copy of the information to the patient if that is acceptable to the patient.

3.2.3 The Podiatry Associates of Southeast Texas may charge a reasonable, cost-based fee for providing the patient with access to his/her health information. That fee may include copying charges, including the cost of supplies for and labor of copying. The Podiatry Associates of Southeast Texas may also charge postage if the patient has requested that the information be mailed. If the patient has agreed to a summary, the Podiatry Associates of Southeast Texas may charge the costs of preparing the summary.

3.2.4 All requests by patients for access to health information will be referred to the privacy officer. In those circumstances in which access to health information is denied, the privacy officer will determine if some part of the patient's record may be disclosed without objection. If so, that portion of the record may be disclosed. As to all other parts of the record for which access is denied, the privacy officer will provide a timely, written denial to the patient stating the basis for the denial and, if applicable, the patient's right to have the denial reviewed. The written notice must also explain to the patient that they may complain regarding the denial of access either to the Podiatry Associates of Southeast Texas or to the Secretary of HHS. This notice will include the name, title and telephone number of the privacy officer.

3.2.5 All documentation regarding patient requests for access and any denials thereof, or any other documentation maintained under this subsection, must be retained by the Podiatry Associates of Southeast Texas for a minimum of six (6) years from the date of the document(s).

3.3 Denial of Access.

3.3.1 Unreviewable grounds for denial. The Podiatry Associates of Southeast Texas may deny patients access to health information that is created, maintained or is otherwise subject to the Clinical Laboratory Improvements Amendments of 1988 (CLIA) to the extent that providing access would be prohibited by that law, or where such information is made exempt under the CLIA law. In addition, a patient who is part of a research program may have his/her right of access temporarily suspended for as long as the research is in progress, provided that the patient has agreed to the denial of access at the time that he/she consented to participate in the research.

3.3.2 Reviewable grounds for denial of access.

3.3.2.1 The Podiatry Associates of Southeast Texas may deny the patient access to his/her health information if the Podiatry Associates of Southeast Texas reasonably believes that such access is likely to endanger the life or physical safety of the patient or another person, or that the information makes reference to another person and the Podiatry Associates of Southeast Texas believes that allowing access may cause substantial harm to that person.

3.3.2.2 The Podiatry Associates of Southeast Texas may deny access to a guardian, conservator or parent where the Podiatry Associates of Southeast Texas believes that such person is likely to cause substantial harm to the patient or another person by having access to the patient's health information.

3.3.2.3 If access to the patient's health information is denied for the above reasons, the patient has a right to have the denial reviewed by a licensed health care professional designated by the Podiatry Associates of Southeast Texas as a reviewing official. This health care professional must be someone who did not participate in the original decision to deny access. The Podiatry Associates of Southeast Texas will abide by the decision of that reviewing health care professional, to either grant or deny access to the patient.

4. Right to Amend

4.1 General Statement. Patients have a right to request that the Podiatry Associates of Southeast Texas amend their health information.

4.2 Procedure. The Podiatry Associates of Southeast Texas will follow the following procedures when a request to amend is received from a patient.

4.2.1 Written request. Patients who request amendments or corrections to their health information will be asked to fill out the Request for Correction/Amendment of Health Information form. The requests will be referred to the privacy officer.

4.2.2 Response to the patient's request. After a reasonable investigation, the privacy officer will determine whether the practice will grant or deny the request to amend. The privacy officer will respond in writing to the patient's request within 60 days from the date of the request by either granting the amendment, or advising the patient of the denial of the request, as described below.

4.2.2.1 Acceptance of amendment. If the Podiatry Associates of Southeast Texas accepts the patient's request for amendment, it will amend the patient's record and provide an appropriate link or reference to the location of the amendment. The Podiatry Associates of Southeast Texas will also make reasonable efforts to provide the amendment within a reasonable time to those persons identified by the patient as having received health information about the patient and who need the amendment, and those persons, including business associates, who the Podiatry Associates of Southeast Texas knows may have relied upon the information that is subject to the amendment.

4.2.2.2 Denial of amendment. If the Podiatry Associates of Southeast Texas determines to deny an amendment, it must provide the patient with a timely, written denial stating the basis for the denial, the patient's right to submit a statement disagreeing with the denial and how the patient may file that statement. In addition, the Podiatry Associates of Southeast Texas must inform the patient that he/she may request that the Podiatry Associates of Southeast Texas provide a copy of the patient's request for amendment and the denial with any future disclosures of health information regarding the patient. The Podiatry Associates of Southeast Texas must advise the patient that he/she is entitled to make a complaint and how such complaints may be submitted to the Podiatry Associates of Southeast Texas or Secretary of HHS. This notice must include the name or title and telephone number of the Podiatry Associates of Southeast Texas's privacy officer. If the patient, upon denial of the request to amend, submits a written statement disagreeing with the denial, the Podiatry Associates of Southeast Texas must include such statement with the patient's records and include that statement with any subsequent disclosure of the patient's health information to which the disagreement relates.

4.2.3 The Podiatry Associates of Southeast Texas may deny a patient's request for amendment if the privacy officer determines that the health information subject to the request -

• was not created by the Podiatry Associates of Southeast Texas;
• is not part of the patient's chart;
• would not be available for inspection under the provisions of this Manual; or
• is accurate and complete.

4.3 Documentation. All patient requests to amend their health information, along with the Podiatry Associates of Southeast Texas's response thereto, shall be kept for a minimum of six (6) years from the date of the document(s).

5. Right to an Accounting

5.1 General Statement. Patients have a right to receive an accounting of disclosures of their health information made by the Podiatry Associates of Southeast Texas and its business associates in the six (6) years prior to the date the accounting is requested.

5.2 Procedure. Patients requesting an accounting will be asked to make the request in writing. All requests for an accounting will be referred to the privacy officer. In responding to such requests, the privacy officer will follow the following procedures:

5.2.1 The privacy officer will respond to the patient's request no later than 60 days from the receipt of the request by providing the patient with a written accounting using the form in Appendix G.

5.2.2 The Podiatry Associates of Southeast Texas will retain a copy of all requests for accountings from patients as well as the accounting provided by the Podiatry Associates of Southeast Texas to the patient for a minimum of six (6) years from the date of the document(s).

5.3 Suspension of the Right to an Accounting. The Podiatry Associates of Southeast Texas may temporarily suspend the patient's right to receive an accounting of disclosures made to a health oversight agency or a law enforcement official for the time specified by that agency or official if giving the accounting would impede the agency's activities.

5.4 Exceptions. Patients shall have no right to an accounting as to disclosures -

• To carry out treatment, payment or health care operations (as defined in Appendix H);
• To the patient;
• Incident to a use or disclosure otherwise permitted by this Manual or the HIPAA Privacy Rules;
• Pursuant to an authorization signed by the patient;
• To correctional institutions or law enforcement officials; or
• That occurred prior to April 14, 2003.

6. Waivers of Patient Rights and Non-Retaliation

6.1 No Waivers of Privacy Rights. No patient or prospective patient will be asked to waive their rights under the HIPAA Privacy Rules as a condition to receiving health care services from the Podiatry Associates of Southeast Texas.

6.2 Non-Retaliation Policy. Podiatry Associates of Southeast Texas personnel will not intimidate or retaliate against patients who seek to inquire about, enforce or complain regarding their rights under the HIPAA Privacy Rules or this Manual.