Notice of Privacy Practices

Effective Date: September 1, 2018

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAYBE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Potomac Plastic Surgery PLLC (“PPS”) is committed to protecting your medical information. We are required by law to:

• Maintain the privacy of your medical information;
• Give you a notice of our legal duties and privacy practices with respect to your medical information; and
• Follow the terms of the notice currently in effect.

What is this document?
This Notice of Privacy Practices describes how we may use and disclose your medical information. It also describes your rights to
access and control your medical information.

What does this Notice cover?
This Notice of Privacy Practices applies to all of your medical information used to make decisions about your care that we generate or maintain, including sensitive information such as mental health, communicable disease and drug and alcohol abuse information. It applies to your medical information in written and electronic form. Different privacy practices may apply to your medical information that is created or kept by other people or entities.

Who does this Notice cover?
This Notice of Privacy Practices will be followed by all PPS employees; any health care professional who provides treatment to you at PPS; and any member of a volunteer group that provides services at PPS.

What will you do with my medical information?
The following categories describe the ways that we may use and disclose your medical information without obtaining your prior written authorization. Not every use or disclosure in a category will be listed.

If you are concerned about a possible use or disclosure of any part of your medical information, you may request a restriction. Your right to request a restriction is described in the section below regarding patient rights.

Treatment. We will use your medical information to provide you with medical treatment and services.

We maintain medical information about our patients in an electronic medical record that allows us to share medical information for treatment purposes. This facilitates access to medical information by other health care providers who provide care to you.

Example: Your medical information may be disclosed to doctors, nurses, technicians, students or other personnel who are involved in taking care of you.

We may disclose your medical information for the treatment activities of any other health care providers.

Example: We may send a copy of your medical record to a physician who needs to provide follow-up care.

Payment. We may use medical information about you for our payment activities. Common payment activities include, but are not limited to:

• Determining eligibility or coverage under a plan; and
• Billing and collection activities.

Example: Your medical information may be released to an insurance company to obtain payment for services.

We may disclose medical information about you to another health care provider or covered entity for its payment activities.

Example. We may send your health plan coverage information to an outside laboratory that needs the information to bill for tests that it provided to you.

Operations. We may use your medical information for operational or administrative purposes. These uses are necessary to run our business and to make sure patients receive quality care. Common operation activities include, but are not limited to:

• Conducting quality assessment and improvement activities;
• Including your identifying information in our facility directory;
• Reviewing the competence of health care professionals;
• Arranging for legal or auditing services;
• Business planning and development;
• Business management and administrative activities; and
• Communicating with patients about our services.

Examples: (1) We may use your medical information to conduct internal audits to verify that billing is being conducted properly. (2) We may use your medical information to contact you for the purposes of conducting patient satisfaction surveys or to follow-up on the services we provided.

We may disclose medical information about you to another health care provider or covered entity for its operation activities
under certain circumstances.

Health Information Exchange. We may participate in a health information exchange (HIE). Generally, an HIE is an organization in which providers exchange patient information in order to facilitate health care, avoid duplication of services (such as tests) and to reduce the likelihood that medical error will occur. By participating in a HIE, we may share your health information with other providers that participate in the HIE or participants of other health information exchanges. If you do not want your medical information to be available through the HIE, you must request a restriction using the process outlined below.

Communicable Diseases. District of Columbia law only permits disclosure of communicable disease information, (such as HIV, AIDS, Hepatitis, etc.) under the following circumstances: (i) with the patient’s written authorization; (ii) if release is ordered by a court; (iii) if release is required by the State Department of Health to protect the public; (iv) if release is made to a person exposed to such diseases; (v) if release is required to health professionals, appropriate state agencies or a court to enforce District of Columbia law; (vi) if release is required for statistical purposes without patient identity, (vii) if release is required to health care providers and related parties for diagnosis and treatment purposes; or (viii) when the patient is an inmate in the custody of the Department of Corrections or related party and such release is necessary to (a) prevent serious and imminent threat to a person or the public, or (b) permit law enforcement authorities to identify an individual suspect of having escaped from a correctional institution.

Business Associates. We may disclose your medical information to other entities that provide a service to us or on our behalf that requires the release of patient medical information. However, we only will make these disclosures if we have received satisfactory assurance that the other entity will properly safeguard your medical information.

Example: We may contract with another entity to provide transcription or billing services.

Treatment Alternatives. We may use and disclose your medical information to tell you about or recommend possible treatment options or alternatives that may be of interest to you.

Individuals Involved in Your Care or Payment for Your Care. We may release medical information about you to a friend, family member or legal guardian who is involved in your medical care. We may tell your family or friends your condition and that you are in the hospital. In addition, we may disclose medical information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.

Health-Related Benefits and Services. We may use and disclose medical information to tell you about health-related benefits or services that may be of interest to you.

Research. We may use and disclose medical information about you to researchers. In most circumstances, you must sign a separate form specifically authorizing us to use and/or disclose your medical information for research. However, there are certain exceptions. Your medical information may be disclosed without your authorization for research if the authorization requirement has been waived or altered by a special committee that is charged with ensuring that the disclosure will not pose a great risk to your privacy or that measures are being taken to protect your medical information. Your medical information also may be disclosed to researchers to prepare for research as long as certain conditions are met. Medical information regarding people who have died can be released without authorization under certain circumstances. Limited medical information may be released to a researcher who has signed an agreement promising to protect the information released.

Organ and Tissue Donation. If you are an organ donor, we may release medical information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

Can you ever use and disclose my medical information without my authorization? Yes. The following categories describe the ways that we may be required to use and disclose your medical information without your authorization. Not every use or disclosure in a category will be listed.

Required by Law. We may disclose your medical information when required to do so by federal, state or local law.

Examples: (1) We may release your medical information for workers’ compensation or similar programs. (2) We are required by law to report cases of suspected abuse and neglect. These reports may include your medical information.

Public Safety. We may use and disclose medical information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure would only be to someone able to help prevent the threat.

Public Health. We may disclose medical information about you for public health activities intended to:

• Prevent or control disease, injury or disability;
• Report births and deaths;
• Report abuse, neglect or violence as required by law;
• Report reactions to medications or problems with products;
• Notify people of recalls of products they may be using; or
• Notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.

Food and Drug Administration (FDA). We may disclose to the FDA and to manufacturers health information relative to adverse events with respect to food, supplements, product and product defects, or post-marketing surveillance information to enable product recalls, repairs or replacements.

Health Oversight Activities. We may disclose medical information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure.

Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose medical information about you in response to a court or administrative order. In limited circumstances, we may disclose medical information about you in response to a subpoena or discovery request.

Law Enforcement. We may release medical information if asked to do so by law enforcement official:

• In response to a court order, warrant, summons or other similar process;
• To identify or locate a suspect, fugitive, material witness, or missing person;
• About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement;
• About a death we believe may be the result of criminal conduct;
• About criminal conduct at the hospital; and
• In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location
  of the person who committed the crime.

Coroners, Medical Examiners and Funeral Directors. We may release medical information to a coroner or medical examiner.

National Security and Intelligence Activities. We may release medical information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

Protective Services for the President and Others. We may disclose medical information about you to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.

Military/Veterans. We may disclose your medical information as required by military command authorities, if you are a member of the armed forces.

Inmates. If you are an inmate of a correctional facility or under the custody of a law enforcement official or agency, we may release your medical information to the correctional facility or law enforcement official or agency.

What if you want to use and/or disclose my medical information for a purpose not described in this Notice?
We must obtain a separate, specific authorization from you to use and/or disclose your medical information for any purpose not covered by this notice or the laws that apply to us.

If you provide us with authorization to use or disclose your medical information, you may revoke the authorization, in writing, at any time. If you revoke your authorization, we will not use or disclose your medical information for the reasons covered by your authorization. However, your revocation will not apply to disclosures already made by us in reliance on your authorization.

Your authorization is required for the following purposes:

• Psychotherapy notes. We must obtain your authorization to use or disclose notes maintained by a mental health professional about a counseling session.
• Sale of Medical Information. We must obtain your authorization virtually any time we intend to sell your medical information, with minor exceptions.
• Marketing. We must obtain your authorization to communicate with you about a particular product or service virtually any time we are paid to make the communication, with minor exceptions.
• Fundraising. We must obtain your authorization to contact you or utilize your health information for fundraising purposes.

What are my rights regarding my medical information?
You have the rights described below in regard to the medical information that we maintain about you. You are required to submit a written request to exercise any of these rights. You may contact our medical record department or Privacy Official to obtain a form that you can use to exercise any of the rights listed below.

Right to Inspect and Copy. You have the right to inspect and obtain a copy of medical information used to make decisions about your care. We will provide you with access to your medical information in the form or format requested if it is available in such format. Unless State law provides you a free copy, you may be charged for copying the PHI, including supplies, whether in paper or electronic form and postage if the copy is requested to be mailed.

We may deny your request to inspect and/or copy your medical information in certain circumstances. If you are denied access, you may request that the denial be reviewed. A licensed health care professional chosen by us will review your request and the denial. The person conducting the review will not be the person who denied your original request. We will comply with the outcome of the review.

Right to Amend. If you feel that medical information that we created is incorrect or incomplete, you may submit a request for an amendment for as long as we maintain the information. You must provide a reason that supports your amendment request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask to amend information that:

• We did not create, unless the person or entity that created the information is not available to make the amendment;
• Is not part of the medical information that we maintain;
• Is not part of the information that you would be permitted to inspect and copy; or
• Is accurate and complete.

Right to an Accounting of Disclosures. You have the right to request one free “accounting of disclosures” every 12 months. This is a list of certain disclosures we made of your medical information. There are several categories of disclosures that we are not required to list in the accounting. For example, we do not have to keep track of disclosures that are authorized. Your request must state a time period, which may not be longer than 6 years and may not include dates before April 14, 2003.

If you request more than one accounting in a 12-month period, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to Request Restrictions. You have the right to request a restriction or limitation on the medical information we use or disclose about you unless our use and/or disclosure is required by law. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. You can request a restriction if you do not want us to disclose your medical information to an HIE.

We are not required to agree to your request unless you are requesting a restriction on the disclosure of information to your health plan and you pay out of pocket for the medical treatment provided. If we agree to a restriction, we will comply with your request unless the information is needed to provide emergency treatment to you.

In your request, you must indicate:

• The type of restriction you want and the information you want restricted; and
• To whom you want the limits to apply, for example, your spouse.

Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail.

We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to a Paper Copy of This Notice. You have the right to a paper copy of this notice. Copies of this notice always will be available in our medical record department.

Can you change this notice?
We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for medical information we already have about you as well as any information we receive in the future. Copies of the current notice will be posted at PPS and will be available for you to pick up on each visit to PPS.

What happens if my medical information is used by or disclosed to a person or entity that should not have access to it?
We are required to notify you of any acquisition, access, use, or disclosure of your medical information that is inconsistent with the federal law governing the protection of medical information (known has HIPAA).

What if I have questions or need to report a problem?
If you believe your privacy rights have been violated, you may file a complaint with us or with the Office of Civil Rights of the Department of Health and Human Services. To file a complaint with us, or if you would like more information about our privacy practices, contact our Privacy Official at 202-800-2085 or by web at www.potomacplasticsurgery.com.

The Privacy Official’s mailing address is 2311 M Street NW, Suite 501, Washington, DC, 20037.

To file a complaint with the Office of Civil Rights of the Department of Health and Human Services, you must submit the complaint within 180 days of when you knew or should have known of the circumstance that led to the complaint. The complaint must be
submitted in writing. Information on how to file a complaint can be located on the Office of Civil Rights website at:
http://www.hhs.gov/ocr/privacy/index.html or our Privacy Official can provide you with current contact information. You will not be penalized for filing a complaint.