It is the policy of our practice that all physicians and staff preserve the integrity and the confidentiality of protected health information (PHI) pertaining to our patients. The purpose of this policy is to ensure that our practice and its physicians and staff have the necessary medical and PHI to provide the highest quality medical care possible while protecting the confidentiality of the PHI of our patients to the highest degree possible. Patients may provide information to our practice and its physicians and staff for purposes of treatment, payment and healthcare operations (TPO). To that end, our practice and its physicians and staff will:
1. Collect, use and disclose PHI only in conformance with state and federal laws and current patient covenants and/or authorizations, as appropriate. Our practice and its physicians and staff will not use or disclose PHI for uses outside of practice's TPO, such as marketing, employment, life insurance applications, etc. without an authorization from the patient.
2. Use and disclose PHI to remind patients of their appointments unless they instruct us not to.
3. Recognize that PHI collected about patients must be accurate, timely, complete, and available when needed. Our practice and its physicians and staff will implement reasonable measures to protect the integrity of all PHI maintained about patients.
4. Recognize that patients have a right to privacy. Our practice and its physicians and staff respect the patient's individual dignity at all times. Our practice and its physicians and staff will respect patient's privacy to the extent consistent with providing the highest quality medical care possible and with the efficient administration of the facility.
5. Act as responsible information stewards and treat all PHI as sensitive and confidential. Consequently, our practice and its physicians and staff will:
Treat all PHI data as confidential in accordance with professional ethics, accreditation standards, and legal requirements.
Not disclose PHI data unless the patient (or his or her authorized representative) has properly authorized the release or the release is otherwise authorized by law.
Recognize that, although our practice "owns" the medical record, the patient has a right to inspect and obtain a copy of his/her PHI. In addition, patients have a right to request an amendment to his/her medical record if he/she believes his/her information is inaccurate or incomplete in their medical records in accordance with the law and professional standards.
We will permit patients access to their medical records when their written requests are approved by our practice. If we deny their request, then we must inform the patients that they may request a review of our denial. In such cases, we will have an on-site healthcare professional review the patients' appeals.
6. All physicians and staff of our practice will adhere to any restrictions concerning the use or disclosure of PHI that patients have requested and have been approved by our practice.
7. When the patient has requested to inspect their PHI and his/her request has been accepted, the Privacy Officer or other authorized practice representative should accompany the patient to a private area to inspect his/her records and remain with the patient during inspection. After the patient inspects the record, the Privacy Officer will note in the record the date and time of the inspection, and whether the patient made any requests for amendments or changes to the record. When the patient's request to copy his/her PHI has been accepted, the medical records department should copy his/her record within 10 days.