See what personalized healthcare can look like with our suite of services, targeting the needs of your employees.
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Healthstat and its contracted clinical staff are required by law to protect the privacy of health information about you and that can be identified with you, which we call “protected health information” or “PHI” for short that we hold, develop or receive from other sources. We are also required to give you this Notice about our privacy practices, our legal duties, and your rights concerning your PHI. We must follow the privacy practices that are described in this Notice. We reserve the right to change the terms of this Notice and to make new provisions effective for all PHI that we maintain by posting the revised Notice in our clinics, making copies of the revised Notice available upon request, and posting the revised Notice on our website.
You may request a copy of our Notices at any time. For more information about our privacy practices, or for additional copies of this Notice, please contact us using the information listed at the end of this Notice.
1. Uses and Disclosures of PHI Without Your Authorization. We may use and disclose PHI about you without your authorization in the following circumstances:
To provide healthcare treatment to you: We may use and disclose PHI about you to provide, coordinate or manage your health care and related services. This may include communicating with other health care providers regarding your treatment and coordinating and managing your health care with others.
For example, we may use and disclose PHI about you when you need a prescription, lab work, an x-ray, or other health care services. In addition, we may use and disclose PHI about you when referring you to another health care provider. We will provide your physician or a subsequent health care provider with copies of various reports that should assist him or her in treating you.
For example: Information obtained by a Healthstat clinician will be recorded in your chart and used to determine the course of treatment that should work best for you. Members of your health care team will then record the actions they took and their observations. In that way, your healthcare providers will know how you are responding to treatment.
To obtain payment for services: Generally, we may use and give your PHI to others to obtain payment for services provided to you by us. Specifically, we may share portions of medical information about you with billing departments and insurance companies, health plans and their agents which provide you coverage. For example, we may need to share information with your health plan(s) about your condition, supplies used, and services you received (such as labs). The information is given to our billing department and your health plan so we can be paid or you can be reimbursed.
For healthcare operations: We may use and disclose PHI in performing business activities, which we call “health care operations”. These “health care operations” allow us to improve the quality of care we provide and reduce health care costs. We may disclose PHI to another company that provides “health care operations” services for us, such as transcription services companies. If so, we will have a written contract to ensure that this company also protects the privacy of your PHI. Examples of the way we may use or disclose PHI about you for “health care operations” include the following:
Under other circumstances: We may use and/or disclose PHI about you for a number of circumstances in which you do not have to consent, give authorization or otherwise have an opportunity to agree or object. Those circumstances include:
2. You can object to certain uses and disclosures. Unless you object, we may use or disclose PHI about you in the following circumstances:
If you would like to object to our use or disclosure of PHI about you in the above circumstances, please call or write to us at the address listed below.
3. Use of PHI for Appointments. We may use and/or disclose PHI to contact you to provide a message to you about an appointment you have for treatment or medical care. For example, we may leave a message on your answering machine about an upcoming or missed appointment or we may send a postcard if we cannot contact you by phone to notify you that you need to reschedule.
4. ANY OTHER USE OR DISCLOSURE OF PHI ABOUT YOU REQUIRES YOUR WRITTEN AUTHORIZATION. Under any circumstances other than those listed above, we will ask for your written authorization before we use or disclose PHI about you. Any use or disclosure of psychotherapy notes, uses and disclosures of PHI for marketing purposes and disclosures that constitute the sale of PHI require your written authorization. If you sign a written authorization allowing us to disclose PHI about you in a specific situation, you can later cancel your authorization in writing by contacting us at the address below. If you cancel your authorization in writing, we will not disclose PHI about you after we receive your cancellation, except for disclosures which were being processed before we received your cancellation. We may disclose your medical information to a family member, friend or other person to the extent necessary to help with your healthcare or with payment for your healthcare, but only if you agree that we may do so.
Although your health record is the physical property of the health care practitioner or facility that compiled it, the information belongs to you.
1. Restrictions on Uses and Disclosures. You have the right to request restrictions on disclosures of your PHI to your health plan for health services or items for which you paid out-of-pocket in full, and we must comply with such request. You have the right to request that we restrict other uses and disclosures of PHI about you, and we are not required to agree to those requested restrictions. However, even if we agree to your request, in certain situations your restrictions may not be followed. These situations include emergency treatment, disclosures to the Secretary of the Department of Health and Human Services, and uses and disclosures described above. You may send a written request for a restriction to the address shown below.
2. Method of Communication. You have the right to request how and where we contact you about PHI. For example, you may request that we contact you at your work address or phone number or by email. We must accommodate reasonable requests, but, when appropriate, may condition that accommodation on your providing us with information regarding how payment, if any, will be handled and your specification of an alternative address or other method of contact. You may request alternative communications by submitting a request in writing to the address shown below. If we have all or any portion of your health information in an electronic format, you may request an electronic copy of those records or request that we send an electronic copy to any person or entity you designate in writing.
3. Access. You have the right to request to see and receive a copy of PHI contained in clinical, billing and other records used to make decisions about you. We may charge you related fees depending on materials, shipping costs, and staff time necessary to comply with your request, as allowed under applicable law. Instead of providing you with a full copy of the PHI, we may give you a summary or explanation of the PHI about you, if you agree in advance to the form and cost of the summary or explanation. There are certain situations in which we are not required to comply with your request. Under these circumstances, we will respond to you in writing, stating why we will not grant your request and describing any rights you may have to request a review of our denial. You may request to see and receive a copy of PHI by submitting a request in writing to the address shown below.
4. Amendment of PHI. You have the right to request that we make amendments to clinical, billing and other records used to make decisions about you. Your request must be in writing and must explain your reason(s) for the amendment. We may deny your request if: 1) the information was not created by us (unless you prove the creator of the information is no longer available to amend the record); 2) the information is not part of the records used to make decisions about you; 3) we believe the information is correct and complete; or 4) you would not have the right to see and copy the record as described in paragraph 3 above. We will tell you in writing the reasons for the denial and describe your rights to give us a written statement disagreeing with the denial. If we accept your request to amend the information, we will make reasonable efforts to inform others of the amendment, including persons you name who have received PHI about you and who need the amendment. You may request an amendment of PHI about you by submitting a request in writing to the address shown below.
5. Listing of Disclosures. If you ask our contact person in writing, you have the right to receive a written list of certain of our disclosures of PHI about you. You may ask for disclosures made up to six (6) years before your request. We are required to provide a listing of all disclosures except the following:
The list will include the date of the disclosure, the name (and address, if available) of the person or organization receiving the information, a brief description of the information disclosed, and the purpose of the disclosure. If, under permitted circumstances, PHI about you has been disclosed for certain types of research projects, the list may include different types of information. If you request a list of disclosures more than once in 12 months, we can charge you a reasonable fee. You may send a written request for disclosures, including the date range, to the address shown below.
6. Patient Rights
Access: With limited exceptions, you have the right to look at a copy of your medical information. We will use the format you request unless we cannot practicably do so. You must make a request in writing to obtain access to your medical information. You may obtain a form to request access by using the contact information listed at the end of this Notice. You may also request access by sending us a letter to the address at the end of this Notice. We may charge you related fees depending on material, shipping costs, and staff time necessary to comply with your request, as allowed under applicable law.
Advance Directives: You have the right to direct all healthcare providers to comply with your “advance directives”.
An advance directive is a document by which a person makes provision for healthcare decisions in the event that, in the future, he/she becomes unable to make those decisions.
There are two main types of advance directive – the “Living Will” and the “Durable Power of Attorney for Health Care”.
There are also hybrid documents which combine elements of the Living Will with those of the Durable Power of Attorney.
Disclosure Accounting: You have the right to receive a list of instances in which we disclosed your medical information for purposes other than treatment, payment, healthcare operations and certain other activities, for at least 6 years, but not before April 14, 2003. If you request this accounting more than once in a 12-month period, we may charge you a reasonable, cost-based fee for responding to these additional requests.
Restriction: You have the right to request that we place additional restrictions on our use or disclosure of your medical information. We are not required to agree to these additional restrictions, but if we do, we will abide by our agreement, except in an emergency.
Alternative Communication: You have the right to request that we communicate with you about your medical information by alternative means or to alternative locations. You must make your request in writing. Your request must specify the alternative means or location, and provide a satisfactory explanation on how payments will be handles under the alternative means or location you request.
Amendment: You have the right to request that we amend your medical information. Your request must be in writing, and it must explain why the information should be amended. We may deny your request under certain circumstances.
Electronic Notice: If you receive a Notice of Privacy Practices by our website or by electronic mail or email, you are entitled to receive one in written form.
Notification of a Breach of Your Unsecured Medical Information. You have the right to be notified in the event that we discover an unauthorized disclosure of your medical information.
Questions and Complaints
If you want more information about privacy practices or have questions or concerns, please contact your clinic or the office as indicated in the Notice of Privacy Practices.
If you feel that we may have violated your privacy rights, or you disagree with a decision we made about access to your medical information or in response to a request you made to amend or restrict the use or disclosure of your medical information or want us to communicate with you by alternative means or alternative locations, you may complain to us at the office that provided you with this notice. You also may submit a written compliant to the U.S. Department of Health and Human Services. We will provide you with the address to file your complaint with the U.S. Department of Health and Human Services upon request.
8. Notification of a Breach of Your Unsecured PHI. You have the right to be notified in the event that we discover a breach of unsecured PHI involving your medical information.
To the extent your employer (or, in certain cases, your spouse’s or parent’s sponsoring employer (herein, “the employer”) maintains a wellness program which involves a voluntary health risk assessment, biometric screening, or other medical examination, the following provisions apply to such wellness program(s) and the PHI gathered through such wellness program(s):
1. Voluntary Program. Healthstat has been engaged by the employer to help administer a voluntary wellness program that the employer sponsors, which program is available to all similarly-situated employees. The program is offered by the employer according to federal rules permitting employer-sponsored wellness programs that seek to improve employee health or prevent disease. If you choose to participate in the wellness program you may be asked to complete a voluntary health risk assessment or "HRA" that asks a series of questions about your health-related activities and behaviors and whether you have or had certain medical conditions (e.g., cancer, diabetes, or heart disease) and/or will also be asked to complete a biometric screening, which may include a blood test for systolic BP, diastolic BP, blood glucose, triglycerides, total cholesterol, HDL, LDL, and other standard measurements of health. These tests may also determine your body mass index, susceptibility to or identification of chronic disease(s) (such as diabetes), tobacco use, and whether you have had a physical examination within the last year.
a) Incentives. You are not required to complete the HRA or to participate in the biometric screening or other medical examinations. However, employees who choose to participate in the wellness program may receive an incentive for completing the required conditions, which conditions may include reaching certain health goals, engaging in certain activities, and/or periodic visits to the onsite clinic. Although you are not required to complete the HRA or participate in the biometric screening, only individuals who do so will receive the incentive determined and communicated to you by the employer. (Please consult with the employer regarding what incentives (if any) apply.)
b) “Genetic Information” (ex. family medical history). If an HRA asks an employee about the employee’s manifestations of health conditions, this does not involve any inquiry into the employee’s genetic information; however, asking the same question of the spouse or dependent involves an inquiry into the family medical history (i.e. genetic information) of the employee. To the extent that the HRA asks about this “genetic information” and is incentivized by a premium differential (or otherwise tied to a health plan), a spouse or dependent of an employee may still receive an incentive even if you do not answer those portions of the HRA. You are not required to disclose your children’s genetic information, including their medical history and genetic test results, as a condition to receiving an incentive under the wellness program. The employer sponsor may not deny your spouse or children health insurance benefits for their refusal (or your refusal on their behalf) to answer questions regarding genetic information.
Therefore, certain questions in the HRA may grant spouses and dependents the option to “choose not to answer” when the response is tied to a premium differential or otherwise incentivized and part of a health plan. Please consult with the employer regarding the nature of its HRA program, the incentives involved, and your ability to skip certain questions. NOTE - FAILURE TO ANSWER SUCH QUESTIONS MAY AFFECT HEALTHSTAT’S OUTREACH ASSOCIATED WITH THE WELLNESS PROGRAM SINCE DATA WILL BE MISSING FROM THE PERSON’S HEALTH PROFILE.
Note: regardless of the above, in certain circumstances, an employer may incentivize disclosures of “genetic information” (ex. family medical history) as part of a disease management program so long as the information requested represents the minimum amount of information necessary to determine if the program (and any related incentives) are medically appropriate for the individual. For example, if the employer is sponsoring a diabetes management program, then it can ask who has diabetes.
c) Reasonable Alternative Standard. To the extent the wellness program requires you to (a) engage in activities that you may not be able to complete because of a health condition or (b) achieve certain health outcomes, such as reducing health risk factors, if you are unable to participate in any of the health-related activities or achieve any of the health outcomes required to earn an incentive, you may be entitled to a reasonable accommodation or an alternative standard. You may request a reasonable accommodation or an alternative standard by contacting your human resources department and/or Healthstat.
The information from your HRA and the results from your biometric screening will be used to provide you with information to help you understand your current health and potential risks and may also be used to offer you services through the wellness program or onsite clinic, such as counseling regarding health risks or tobacco cessation. You also are encouraged to share your results or concerns with your own doctor.
2. Protections from Disclosure of Medical Information. As explained in this Notice, we are required by law to maintain the privacy and security of your PHI. Although the wellness program and the employer may use aggregate information it collects to design a program based on identified health risks in the workplace, Healthstat will never disclose any of your personal information either publicly or to the employer, except as necessary to respond to a request from you for a reasonable accommodation needed to participate in the wellness program, as otherwise permitted in our Notice of Privacy Practices (ex. disclosing your participation so the employer can administer the program incentive), or as otherwise expressly permitted by law.
Your health information will not be sold, exchanged, transferred, or otherwise disclosed except to the extent permitted by law to carry out specific activities related to the wellness program, and you will not be asked or required to waive the confidentiality of your health information as a condition of participating in the wellness program or receiving an incentive. Anyone who receives your information for purposes of providing you services as part of the wellness program will abide by the same confidentiality requirements. The only individual(s) who will receive your PHI are the healthcare providers at the employer’s onsite clinic or other individuals allowed to have such information under the Notice of Privacy Practices or as allowed by law, in order to provide you with services under the wellness program or administer the wellness program and any group health plan of which it is a part.
In addition, all medical information obtained through the wellness program will be maintained separate from your personnel records, information stored electronically will be encrypted, and no information you provide as part of the wellness program will be used in making any employment decision. Appropriate precautions will be taken to avoid any data breach, and in the event a data breach occurs involving information you provide in connection with the wellness program, we will notify you in accordance with the law.
You may not be discriminated against in employment because of the medical information you provide as part of participating in the wellness program, nor may you be subjected to retaliation by the employer if you choose not to participate (though you will not receive any incentives if you fail to participate and/or meet program conditions or, when appropriate, a reasonable alternative standard). If you have questions or concerns regarding this Notice, or about protections against discrimination and retaliation, please contact your human resources department. You acknowledge and agree, however, that Healthstat is not responsible for the actions of the employer and you agree to hold Healthstat harmless for and covenant not to sue Healthstat regarding any damages arising from illegal or negligent actions of the employer related to or arising from the wellness program.
If you think we have violated your privacy rights, or you want to complain to us about our privacy practices, you may contact our Privacy Office at the address shown below. You may also send a written complaint to the United States Secretary of the Department of Health and Human Services. If you file a complaint, we will not take any action against you or change our treatment of you in any way.
This Notice of Privacy Practices is effective on 3/13/18.