Effective Date: April 25, 2014
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please read it carefully.
It is the policy of Denver Back Pain Specialists, LLC that we will adopt, maintain and comply with our Notice of Privacy Practices, which shall be consistent with HIPAA and Colorado State law. We understand that the privacy of your personal information is important to you. As your physician, we believe your right to privacy is a fundamental part of your treatment; as such, we want you to understand our privacy practices and procedures. Should you have any questions regarding these policies please do not hesitate to ask our privacy officer who can be reached at (303) 327-5511.
Information We Collect About You
We collect personal information about you and your family as part of our registration process, during the course of your care, and from other health care entities you utilize such as hospitals, laboratories, other physicians, imaging facilities and your insurance company. This personal information includes items such as your name, address, phone number, birth date, social security number, employer, health history, insurance policy and coverage information and any information you provide via our website. During the course of your treatment we will collect health information regarding diagnosis, treatment plans, progress and any test results or films.
How Your Information Is Used
The personal and health information gathered may be used and disclosed with your general consent for purposes of treatment, payment, or routine healthcare operations. This means we may send your information to other physicians or facilities involved in your treatment as well as to your insurance company or a collection agency to obtain payment. Any other uses of your information require a signed
authorization by you, the patient or guardian and can be revoked in at any time with a written request. Denver Back Pain Specialists, LLC does not sell patient information to marketing or pharmaceutical companies. In certain cases of public health interest we may be required to disclose certain information to local, state or national health organizations or government agencies.
Appointment Reminders. We may contact you to provide appointment reminders or information about treatment alternatives or other health related-benefits and services that may be of interest to you.
Any uses or disclosures of protected health information for marketing activities will be done only after a valid authorization is in effect. It is the policy that provided this organization does not receive any payment for making these type of communications, patients may be contacted to provide information about products or services related to their treatment, case management or care coordination, or to direct or recommend other treatments, therapies, health care providers or settings of care that may be of interest. It is the policy to similarly describe products or services provided by this organization and tell patients which health plans it participates in. It is the policy that where appropriate this organization may also encourage patients to maintain a healthy lifestyle and get recommended tests, recommend participation in a disease management program, provide small gifts, provide information about government sponsored health programs or encourage patients to purchase a product or service during an encounter, for which this organization may be paid. This organization may receive compensation that covers the cost of reminding patients to take and refill medications, or otherwise communicate about a drug or biologic that is currently prescribed. This organization will not otherwise use or disclose patient medical information for marketing purposes or accept any payment for other marketing communications without patient prior written authorization. The authorization will disclose whether this organization receives any compensation for any marketing activity, and that it will stop any future marketing activity to the extent the patient revokes that authorization.
De-Identified Data and Limited Data Sets
It is our policy to disclose de-identified data only if it has been properly de-identified by a qualified statistician or by removing all the relevant identifying data. We will make use of limited data sets, but only after the relevant identifying data have been removed and then only to organizations with whom we have adequate data use agreements and only for research, public health, or health care operations purposes.
Minimum Necessary Use and Disclosure of Protected Health Information
It is our policy that for all routine and recurring uses and disclosures of PHI (except for uses or disclosures made 1) for treatment purposes, 2) to or as authorized by the patient or 3) as required by law for HIPAA compliance such uses and disclosures of protected health information must be limited to the minimum amount of information needed to accomplish the purpose of the use or disclosure. It is also the policy that non-routine uses and disclosures will be handled pursuant to established criteria. It is also the policy of this organization that all requests for protected health information (except as specified above) must be limited to the minimum amount of information needed to accomplish the purpose of the request.
Judicial and Administrative Proceedings
It is our policy that information be disclosed for the purposes of a judicial or administrative proceeding only when: accompanied by a court or administrative order or grand jury subpoena; when accompanied by a subpoena or discovery request that includes either the authorization of the individual to whom the information applies, documented assurances that good faith effort has been made to adequately notify the individual of the request for their information and there are no outstanding objections by the individual, or a qualified protective order issued by the court. If a subpoena or discovery request is submitted to us without one of those assurances, we will seek to notify the individual, obtain his or her authorization, or obtain a qualified protective order before we disclose any information. In no case will we disclose information other than that required by the court order, subpoena, or discovery request.
Safeguarding Your Personal and Health Information
Notification of changes will be available at the front desk prior to the effective date of any changes, and on our website. We will post the most current notice of privacy practices in our “waiting room” area, and to have copies available for distribution at our reception desk.
Your Right to Restrict Use of Information
You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend.
Access to Protected Health Information by the Individual
It is our policy that access to protected health information must be granted to the person who is the subject of such information when such access is requested, or at the very least within the time frames required by the HIPAA Privacy Rule or State law, whichever is more stringent. Access may be granted as either physical or electronic copies or inspection based upon the preference of the patient. It is our policy to inform the person requesting access, of the location of protected health information if we do not physically possess such PHI but have knowledge of its location.
It is the policy to review all requests and determine that access does not create endangerment or is contrary to HIPAA or State law.
It is the policy to provide electronic copies of protected health information maintained electronically in one or more designated record sets in the form and format requested by the patient if these are readily reproducible and if not in a mutually agreeable form and format, or in paper form if a mutually agreeable form and format is not available.
It is the policy to provide electronic copies to third parties at the patient’s specific direction where such request is in writing.
It is the policy to provide by email, electronic copies to the patient or a third party at the patient’s specific direction using unencrypted email only after the patient has been advised of the risks of such use and has acknowledged in writing these risks.
It is our policy that wherever possible we will encourage the patient to receive copies by the use of encrypted transmission. It is the policy of Denver Back Pain Specialists that all other electronic transmissions will only be done using secure transmission technology including but not limited to email, text messaging and so forth.
It is the policy to only charge a reasonable cost based fee to the patient for paper or electronic copies; where applicable this cost based fee may include the cost of skilled labor to assemble and create an electronic copy and/or the cost of media requested by the patient for the copy.
Amendment of Incomplete or Incorrect Protected Health Information
It is the policy of Denver Back Pain Specialists, LLC., that all requests for amendment of incorrect protected health information maintained by this organization will be considered in a timely fashion. If such requests demonstrate that the information is actually incorrect, this organization will allow amending language to be added to the appropriate document and this addition will be done in a timely fashion. It is also the policy of this organization that notice of such corrections will be given to any organization with which the incorrect information has been shared. It is the policy to deny amendment requests where the protected health information is accurate or has not been created by us. In cases of denial it is the policy to allow the patient the opportunity to provide a statement of denial that will be inserted in the medical record.
Access by Personal Representatives
It is the policy of our office that access to protected health information must be granted to personal representatives of individuals as though they were the individuals themselves, except in cases of abuse where granting said access might endanger the individual or someone else. We will conform to the relevant custody status and the strictures of state, local, case, and other applicable law when disclosing information about minors to their parents.
It is the policy of Denver Back Pain Specialists that an accounting of all disclosures subject to such accounting of protected health information be given to individuals whenever such an accounting is requested and within the time frames required by law.
Verbal Permission and Decedent Friends and Family Access
It is our policy that a patient may grant limited access to friends or family who are not legal personal representatives based upon verbal permission by the patient. Such verbal permission shall be documented and periodically confirmed with the patient. It is the policy to provide friends and family of a deceased patient limited access to protected health information under the same circumstances that disclosures of this information would have been made when the patient was alive when these individuals were involved in payment or providing care for the patient and Denver Back Pain Specialists is unaware of any expressed preference to the contrary.
Prohibited Activities-No Retaliation or Intimidation
It is our policy that no employee or contractor may engage in any intimidating or retaliatory acts against persons who file complaints or otherwise exercise their rights under HIPAA regulations. It is also the policy of this organization that no employee or contractor may condition treatment, payment, enrollment or eligibility for benefits on the provision of an authorization to disclose protected health information except as expressly authorized under the regulations.
Cooperation with Privacy Oversight Authorities
It is the policy of this Denver Back Pain Specialists that oversight agencies such as the Office for Civil Rights of the Department of Health and Human Services be given full support and cooperation in their efforts to ensure the protection of health information within this organization. It is also the policy of this organization that all personnel must cooperate fully with all privacy compliance reviews and investigations.