Notice of Privacy Practice

NOTICE OF PRIVACY PRACTICES

Effective Date: July 3, 2017
Last Updated: April 1, 2023
THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.

CONTACT INFORMATION
If you have any questions about this Notice or would like to submit a comment or request, please contact our Privacy Officer:
Piedmont Community Health Plan- Attn: Privacy Officer
2136 Atherholt Rd. Lynchburg, VA 24501
Phone: (434) 947-4463, Opt. 2; Toll Free: 1-800-400-7247

OUR PLEDGE REGARDING HEALTH INFORMATION
HealthWorks Clinic, LLC (“HealthWorks”) provides a range of services, such as occupational medicine, wellness services and Employee Assistance Programs. We create a record of the care and services you receive from us. We need this record to provide you with quality care and to comply with certain legal requirements. This Notice will explain your rights to access the health information we keep about you and our obligations regarding the use and disclosure of your health information.
We are required by law to make sure that your health information is kept private. We are also required to give you this notice of our legal duties and privacy practices with respect to your health information and to follow the terms of the notice that is currently in effect.

HOW WE MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU
The following categories describe the different ways that we may use and disclose your health information without your written authorization. We include some examples for each category but cannot list every possible scenario.
For Treatment: We may use or share your health information to provide you with health care treatment or services. For example, we may share health information about you with other professionals who are treating you, including doctors, nurses, technicians, and other people involved in your care. We may also disclose your health information to providers outside of HealthWorks who provide services related to your care.
For Payment: We may disclose your health information to bill and collect payment for the services we provide to you. For example, we may send a bill to your insurance company that may contain information that identifies you, your diagnosis, the services rendered, and other information. We may tell your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment. We may also provide your information to our business associates and employees responsible for processing our insurance claims.
For Health Care Operations: We may use and disclose your health information to run our practice and improve your care. For example, we may use your health information to manage the services you receive or to monitor the quality of our health care services.
Family and Friends: We may disclose your health information to a family member, friend, or any other person if you identify that person as being involved with your care or payment for care. Generally, we will obtain your verbal agreement before using or disclosing PHI in this way. However, under certain circumstances, such as in an emergency, we may make these disclosures without your express agreement if we feel, in our professional judgment, that it is in your best interest.
Emergency Treatment: We may disclose your health information if you require emergency treatment or are unable to communicate with us. We may also disclose your health information to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status, and location.
As Required by Law: We may disclose your health information for law enforcement purposes and as required by federal, state, or local law. For example, the law may require us to report instances of abuse, neglect, or domestic violence or to disclose your health information to assist law enforcement in locating a suspect, fugitive, material witness, or missing person. We will inform you or your representative if we disclose your health information because we believe you are a victim of abuse, neglect, or domestic violence, unless we determine that informing you or your representative would place you at risk.
Legal Proceedings: We may provide your health information if required by an order in a legal or administrative proceeding (to the extent such disclosure is expressly authorized), and in certain conditions in response to a subpoena, discovery request, or other lawful process.
Workers’ Compensation: We may release your health information to comply with workers’ compensation laws or similar programs. These programs provide benefits for work-related injuries or illness.
Serious Threat to Health or Safety: We may use and disclose your health information when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.
Public Health Activities: We may disclose your health information for public health purposes. For example, we may disclose your health information to a public health authority that is permitted by law to collect or receive such information for the purpose of controlling disease, injury, or disability. In certain circumstances, we may disclose your health information to your employer if we provide healthcare at the request of your employer for purposes related to medical surveillance of the workplace or to evaluate whether you have a work-related illness or injury.
Health Oversight Activities: We may disclose your health information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, licensure, and disciplinary actions. These activities are necessary for oversight of the health care system, government programs, and compliance with civil rights laws.
Business Associates. We may share your health information with outside persons or entities that perform services on our behalf, such as auditing or legal services. The law requires our Business Associates to protect your health information in the same way we do.
Specialized Government Activities: If you are active military or a veteran, we may release your health information as required by military command authorities or the Department of Veterans Affairs as may be applicable. We may also be required to disclose PHI to authorized federal officials for the conduct of intelligence or other national security activities.
Coroners, Health Examiners, and Funeral Directors: We may release your health information to a coroner or health examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release your health information to funeral directors as necessary to carry out their duties.

OTHER USES OF HEALTH INFORMATION
Except as described above, we may not use or disclose your health information without your written permission. In addition, we are legally required to obtain your written permission before releasing the following categories of information:
Psychotherapy Notes: We must receive your written consent to disclose psychotherapy notes, except for certain treatment, payment, or health care operations activities.
Marketing and Sale of Health Information: We must receive your written consent for any disclosure of your health information for marketing purposes or for any disclosure which is considered a sale of protected health information.
Substance Use Disorder Records: Except in limited circumstances, we are required to obtain your written consent before disclosing “substance use disorder records”, as defined by federal law (42 CFR Part 2). These records are subject to heightened protection.
You may revoke your authorization in writing, at any time, but we are unable to take back any disclosures that we have already made with your permission.

YOUR RIGHTS REGARDING HEALTH INFORMATION ABOUT YOU
You have the following rights regarding your health information:
Right to Access: You have the right to inspect and obtain a copy of your health information for as long as we maintain your medical record. Usually, this includes health and billing records. You must submit requests for access to your health information in writing to the Privacy Officer listed at the top of this Notice. We may charge a reasonable fee for the cost of copying, mailing, or other supplies and services associated with your request. We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to health information, you may request that the denial be reviewed.

Right to Request Amendment: If you feel that health information about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment to your health information for as long as we maintain your medical record. To request an amendment, your request must be made in writing and submitted to the Privacy Officer listed on the top of this Notice. You must provide an explanation to support the amendment you request. We may deny your request for an amendment if it is not in writing or does not include an adequate explanation. We may also deny your request if you ask us to amend information that: (1) we did not create, (2) is not part of your medical record that we maintain, (3) is not information that you are permitted to inspect and copy, or (4) we determine your health information is accurate and complete. We will generally decide
to grant or deny your request within 60 days, but in some instances, we may ask for an extension of no more than 30 days. If we deny your request, you have a right to submit a written statement disagreeing with the denial.

Right to an Accounting of Disclosures: You have the right to request a list of the disclosures we have made of your health information (other than those for treatment, payment, or health care operations purposes). To request this list, you must submit your request in writing to the Privacy Officer listed at the top of this Notice. Your request must state the time period for the disclosures, which may not be earlier than six (6) years from the date of your request. We will provide one accounting a year for free, but will charge a reasonable, cost-based fee if you ask for another one within 12 months.
Right to Request Restrictions: You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a restriction on the health information we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend. However, we are not legally required to agree to your request for restrictions. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment. To request a restriction, you must make your request in writing to the Privacy Officer listed at the top of this Notice. Your request must specify (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply.

Right to Request Confidential Communications: You have the right to request that we communicate with you about health matters in a certain way or at a certain location. For example, you may request that we call you only at your home number, and not on your work number. To request confidential communications, you must make your request in writing to the Privacy Officer listed at the top of this Notice. We will not ask you the reason for your request and we will accommodate all reasonable requests.
Right to Restrict Disclosure for Services Paid in Full: You have the right to restrict the disclosure of your health information to your health insurance company if the information pertains to health care services for which you have paid in full directly to us. You must make this request in writing to the Privacy Officer listed at the top of this Notice.

Right to Notice of Breach: You have the right to be notified if we or one of our business associates become aware of a data breach involving your health information.

Right to a Paper Copy of This Notice: You have the right to obtain a paper copy of this notice at any time upon request. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice.

CHANGES TO THIS NOTICE
We reserve the right to change this notice. We reserve the right to make the revised notice effective for health information we already have about you as well as any information we will receive in the future. We will post a copy of the current notice in our facility. The notice will contain the effective date at the top of the first page. Each time you schedule treatment or health care services, you may request and obtain a copy of the current notice in effect.

COMPLAINTS
If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services (“HHS”). To file a complaint with us, contact the Privacy Officer listed at the top of this Notice. All complaints must be submitted in writing. We support your right to your health information privacy. We will not retaliate in any way if you choose to file a complaint with us or with HHS.

ACKNOWLEDGEMENT OF RECEIPT OF THIS NOTICE
We will request that you sign a separate form acknowledging you have received a copy of this notice. If you choose, or are not able to sign, a staff member will sign their name and date. This acknowledgement will be filed with your records.