Notice of Privacy Practices

Inspect or receive a copy of your records

You may ask to inspect or obtain an electronic or paper copy of the medical and billing records and other information about you that we maintain in a designated record set. Please submit a written request describing the records you need and your preferred format. We will provide the information in the requested form and format when readily producible, or work with you on an alternative permitted by law.

We generally respond within 30 days. If a permitted extension is necessary, we will explain the reason and expected completion date in writing. We may charge a reasonable, cost-based copying fee allowed by law; we will not charge for inspecting your records. If access is denied, we will explain the reason in writing and any right you have to request a review. Certain information, such as separately maintained psychotherapy notes, may be excluded from the right of access.

Request a correction

You may ask us in writing to amend health information you believe is incorrect or incomplete and explain why. We generally act on an amendment request within 60 days. If a legally permitted extension is needed, we will notify you in writing. We may deny a request in circumstances allowed by law, but we will explain the decision and how you may submit a statement of disagreement.

Request confidential communications

You may ask us to contact you in a particular way or at an alternative location, such as calling a specific number or mailing correspondence to a different address. We will accommodate reasonable requests. Tell us how and where you wish to be contacted; you do not need to explain the reason.

Ask us to limit use or disclosure

You may ask us not to use or share certain information for treatment, payment, or healthcare operations. We are not required to agree to every request. If we agree, we will follow the restriction, subject to legal exceptions such as necessary emergency treatment.

If you pay for a healthcare item or service out of pocket in full, you may ask us not to disclose information about that item or service to your health plan for payment or healthcare operations. We will honor that request unless disclosure is required by law. Please tell us before the information is sent to the plan.

Obtain an accounting of disclosures

You may request a list of certain disclosures made during the six years before your request, or a shorter period you specify. The accounting identifies the recipients, information disclosed, dates, and purposes as required by law. It generally excludes disclosures for treatment, payment, healthcare operations, disclosures to you or made with your authorization, and other exceptions established by law.

One accounting in a 12-month period is free. We may charge a reasonable, cost-based fee for another request within that period, after telling you the cost and giving you an opportunity to withdraw or change the request.

Receive a copy of this notice

You may request a paper copy at any time, even if you agreed to receive the notice electronically. We will provide it promptly. The current notice is also available on this website.

Have a representative act for you

A person with legal authority to make healthcare decisions for you, such as a healthcare agent or legal guardian, may exercise applicable privacy rights on your behalf. We will verify the person's authority and follow applicable law, including exceptions intended to protect you from abuse, neglect, or endangerment.

Make a complaint without retaliation

You may complain to the practice or to the U.S. Department of Health and Human Services if you believe your privacy rights have been violated. We will not retaliate against you, deny care, or penalize you for making a complaint. Contact details appear below under “Questions and Complaints.”

Family, friends, and people involved in your care

You may tell us whether we may share information relevant to a family member's, friend's, or another person's involvement in your care or payment for care. We may also share appropriate information for disaster-relief notification. When you are available and able to decide, we will give you an opportunity to agree or object, as required by law.

If you cannot tell us your preference, we may use professional judgment to share information that is in your best interest, when permitted by law. We may also share information when legally permitted to reduce a serious and imminent threat to health or safety.

Uses requiring written authorization

We will obtain your written authorization for uses and disclosures that require it, including most uses or disclosures of separately maintained psychotherapy notes, marketing that requires authorization, and the sale of protected health information. Other uses and disclosures not described in this notice will require your written authorization unless otherwise permitted or required by law.

You may revoke an authorization in writing by contacting our Privacy Contact. Revocation does not undo actions already taken in reliance on the authorization, and other legal exceptions may apply.

Fundraising communications

If we contact you for fundraising, you may opt out of further fundraising communications. Your choice will not affect your treatment or payment arrangements. If any fundraising communication would use substance use disorder records protected by 42 CFR Part 2, we will first provide a clear opportunity to choose not to receive those communications, as required by law.

Treatment and coordination

We may use and share information to provide, coordinate, or manage your healthcare. For example, a treating physician may discuss relevant history or test results with another clinician involved in your care, a pharmacy, or a laboratory.

We may contact you about appointments, treatment alternatives, or health-related services relevant to your care, as permitted by law and consistent with applicable communication preferences.

Payment

We may use and share information to bill for services and obtain payment. For example, information may be needed to prepare a bill or resolve a payment question. Where applicable, information may be provided to a health plan or another responsible payer, subject to your rights and legal restrictions. This notice does not determine whether the practice participates in a particular insurance plan.

Healthcare operations and service providers

We may use and share information to operate the practice, evaluate quality, coordinate services, conduct training, carry out compliance activities, and manage our business. For example, we may review records to assess the quality of care.

Service providers performing functions for us may receive information needed for those functions. Where required, business associate agreements obligate them to safeguard the information and limit its use and disclosure.

Public health and safety

We may disclose information as permitted or required for public health activities, such as disease reporting, product recalls, reporting medication reactions, reporting suspected abuse or neglect, and preventing or reducing a serious threat to health or safety. We follow the conditions that apply to each disclosure.

Research

Information may be used or disclosed for health research only when applicable legal requirements are satisfied, such as your authorization or an appropriate waiver or other permitted basis. This provision does not enroll you in a study.

Legal requirements and health oversight

We may disclose information when required by law, including to the Department of Health and Human Services to evaluate compliance with health privacy requirements. We may also disclose information for legally authorized oversight activities, including audits, inspections, licensing, or investigations.

Donation, death-related services, and government functions

When legally permitted, information may be shared with organ-procurement organizations, coroners, medical examiners, or funeral directors. Information may also be disclosed for workers' compensation, specified law-enforcement purposes, or authorized government functions such as military activities and national security, subject to applicable restrictions.

Courts and legal proceedings

We may disclose information in response to a qualifying court or administrative order, or a subpoena or other lawful process that meets applicable privacy requirements. A request for records does not by itself remove privacy protections. Additional restrictions apply to substance use disorder records, as described below.

Substance use disorder records

If we receive or maintain substance use disorder patient records protected by 42 CFR Part 2, we follow the additional restrictions that apply to those records. Where permitted and based on an appropriate consent, such records may be used or shared for treatment, payment, and healthcare operations. Applicable Part 2 protections continue to govern their use.

We will not use or disclose those records, or testimony describing their contents, in a civil, criminal, administrative, or legislative investigation or proceeding against you without your written consent or a qualifying court order and subpoena or other legally required process. A court order must satisfy Part 2 requirements. These protections apply even when another provision of this notice permits a disclosure of other health information.

If protected Part 2 information is used for fundraising, you will receive the advance notice and choice described above. You may raise a Part 2 privacy concern with the practice or with the HHS Office for Civil Rights.

Arizona law and other protections

When Arizona law or another applicable law provides greater privacy protection than HIPAA, we follow the more protective requirements. Mental health records and communicable-disease information, including HIV-related information, may be subject to additional restrictions under Arizona law. We obtain any additional authorization required and disclose such information only when an applicable legal exception permits it.

For example, when authorization is the basis for releasing confidential HIV-related information, Arizona law requires an authorization that specifically addresses that information; a general medical-record release is not sufficient. See A.R.S. § 36-664 and A.R.S. § 36-509.

Information shared with other recipients

Information disclosed as permitted by law may be redisclosed by a recipient and may no longer be protected by HIPAA if the recipient is not subject to it. Other laws, including applicable Part 2 and Arizona confidentiality rules, may continue to limit redisclosure.