Notice of Privacy Practices

This notice describes how health information about you may be used and disclosed and how you can get access to your health information. Please review this notice carefully.

A. PURPOSE OF THIS NOTICE

This Notice of Privacy Practices ("Notice") describes the privacy practices of Hanh Ngan Hoang MD, a Professional Medical Corporation, and its physicians, nurses and other personnel ("we", "us" or "our practice").

This Notice tells you how we may use and disclose the protected health information that you have given to us or that we have learned about you when you are a patient in our system. It also tells you about your rights and our legal duties concerning the use and disclosure of your health information.

By federal and state law, we must follow the terms of the Notice of Privacy Practices that we have in effect at the time.

B. HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION

The following categories describe the different ways in which we may use and disclose your protected health information ("PHI").

1. Treatment. We may use and disclose your PHI to diagnose and treat your illness. We may also disclose your PHI to other health care providers involved in your treatment.

2. Payment. We may use and disclose your PHI in order to bill and collect payment for the services and items provided to you. For example, we may contact your health insurer to certify that you are eligible for benefits and we may provide your insurer with details regarding your treatment to determine if your insurer will cover, or pay for, your treatment. We also may use and disclose your PHI to obtain payment from third parties, such as family members, that may be responsible for such costs.

3. Health care operations. We may use or disclose your information for certain activities that are necessary to operate our practice and ensure that our patients receive quality care. For example, we may use your PHI to evaluate the competence of our staff or to conduct cost-management and business planning activities of our practice.

4. Appointment reminders. We may use and disclose your PHI to contact you and remind you of an appointment.

5. Release of information to family/friends. We may provide your health information to individuals, such as family and friends, who are involved in your care or who assist in taking care of you. We may do this if (1) you tell us we can do so, (2) you know we are sharing your health information with these people and you do not object, or (3) we can reasonably infer that you do not object to the disclosure.

For example, we may assume you agree to our disclosure of your information to your spouse if your spouse comes with you into the exam room during treatment.

If you are not able to approve or object to disclosures, we may make disclosures to a particular individual (such as a family member or friend), that we feel are in your best interest and that relate to that person’s involvement in your care. For example, we may tell someone who comes with you to the hospital that you suffered a heart attack and provide updates on your condition. We may also make similar professional judgments about your best interests that allow another person to pick up such things as filled prescriptions or medical supplies.

C. OTHER PERMITTED USES DISCLOSURES OF HEALTHCARE INFORMATION

1. Disclosures required by law. We will disclose your PHI when we are required to do so by federal, state or local law.

2. Public health disclosures. We may disclose your PHI to public health authorities that are authorized by law to collect information for the purpose of

• maintaining vital records, such as births and deaths,
• reporting child abuse or neglect,
• preventing or controlling disease, injury or disability,
• notifying a person regarding potential exposure to a communicable disease, or at risk of contracting or spreading a disease or condition,
• reporting reactions to drugs or problems with products or devices,
• notifying individuals if a product or device they may be using has been recalled,
• notifying your employer under limited circumstances related primarily to workplace injury or illness or medical surveillance.

3. Abuse and neglect reporting. We may disclose your Health Information to a government authority that is permitted by law to receive reports of abuse, neglect or domestic violence.

4. Health oversight activities. We may disclose your PHI to a health oversight agency for activities authorized by law. Oversight activities include investigations, inspections, audits, surveys, licensure and disciplinary actions; civil, administrative and criminal procedures or actions; or other activities necessary for the government to monitor government programs, compliance with civil rights laws and the health care system in general.

5. Judicial and administrative proceedings. We may use and disclose your PHI in response to a court or administrative order, if you are involved in a lawsuit or similar proceeding. We also may disclose your PHI in response to a discovery request, subpoena or other lawful process by another party involved in the dispute, but only if we have made an effort to inform you of the request or to obtain an order protecting the information the party has requested.

6. Law enforcement. We may release PHI if asked to do so by a law enforcement official:

• regarding a crime victim in certain situations, if we are unable to obtain the person’s agreement, concerning a death we believe has resulted from criminal conduct,
• regarding criminal conduct at our offices,
• in response to a warrant, summons, court order, subpoena or similar legal process,
• to identify/locate a suspect, material witness, fugitive or missing person, an emergency, to report a crime (including the location or victim(s) of the crime, or the description, identity or location of the perpetrator).

7. Serious threats to health or safety. We may use and disclose your PHI when necessary to reduce or prevent a serious threat to your health and safety or the health and safety of another individual or the public. Under these circumstances, we will only make disclosures to a person or organization able to help stop or reduce the threat.

8. Military. We may disclose your PHI if you are a member of U.S. military forces (including veterans) and if required by the appropriate authorities.

9. National security. We may disclose your PHI to federal officials for intelligence and national security activities as authorized by law. We also may disclose your PHI to federal officials in order to protect the president, other officials or foreign heads of state, or to conduct investigations.

10. Inmates. We may disclose your PHI to correctional institutions or law enforcement officials if you are an inmate or under the custody of a law enforcement official. Disclosure for these purposes would be necessary: (a) for the institution to provide health care services to you, (b) for the safety and security of the institution, and/or (c) to protect your and others' health and safety.

11. Workers’ compensation. We may release your PHI for workers’ compensation and similar programs as authorized or required by law. These programs provide benefits for work-related injuries or illness.

12. Deceased patients. We may release PHI to a medical examiner or coroner to identify a deceased individual or to identify the cause of death. If necessary, we also may release information in order for funeral directors to perform their jobs.

13. Organ and tissue donation. If you are an organ donor, we may release your PHI to organizations that obtain, bank or transplant organs, eyes or tissue, as necessary to facilitate organ or tissue donation and transplantation.

14. Research. We may use or disclose your PHI for research without your consent or authorization if an Institutional Review Board or Privacy Board approves a waiver of authorization for disclosure.

D. WHEN WRITTEN AUTHORIZATION IS REQUIRED

1. Other uses and disclosures. Other uses and disclosures of Health Information not covered by this Notice will be made only with your written authorization.

2. Special privacy protections. Federal and state laws require special privacy protections for certain subsets of your PHI, including (a) your psychotherapy notes, mental health and developmental disabilities; (b) alcohol and drug abuse prevention, treatment and referral; (c) HIV/AIDS testing, diagnosis or treatment; (d) sexually-transmitted diseases; (e) genetic testing; (f) child abuse and neglect; (g) domestic abuse of an adult with disability; and (h) sexual assault. In order for us to disclose this information for a purpose other than those permitted or required by law, we must have your written authorization.

3. Revocation of your authorization. You may withdraw any written authorization by delivering a written statement to your physician. If you revoke your authorization, we will no longer use or disclose your health information as allowed by your written authorization, except to the extent that we have already relied on your authorization.

E. YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION

You have certain rights regarding your health information which we list below. In each of these cases, if you want to exercise your rights, you must do so in writing.

1. Right to request confidential communications. You have the right to request that we communicate with you about your health and related issues in a particular manner or at a certain location. For instance, you may ask that we contact you at home, rather than work. In order to request a type of confidential communication, you must make a written request to our Privacy Officer specifying the requested method of contact or the location where you wish to be contacted. We will accommodate reasonable requests. You do not need to give a reason for your request.

2. Right to request restrictions. You have the right to request a restriction in our use or disclosure of your PHI for treatment, payment or health care operations. Additionally, you have the right to request that we restrict our disclosure of your PHI to only certain individuals involved in your care or the payment for your care, such as family members and friends. We are not required to agree to your request; however, if we do agree, we are bound by our agreement except when otherwise required by law, in emergencies or when the information is necessary to treat you.

Your request must describe in a clear and concise fashion:

• the information you wish restricted,
• whether you are requesting to limit our practice’s use, disclosure or both,
• whom you want the limits to apply.

3. Right to inspect and copy. You have the right to inspect and obtain a copy of the PHI that may be used to make decisions about you, including patient medical records and billing records, but not including psychotherapy notes. You must submit your request in writing to our Privacy Officer in order to inspect and/or obtain a copy of your PHI. We may charge a fee for the costs of copying, mailing, labor and supplies associated with your request. We may deny your request to inspect and/or copy in certain limited circumstances; however, you may request a review of our denial. Another licensed health care professional chosen by us will conduct reviews.

4. Right to amend your records. You may ask us to amend your health information if you believe it is incorrect or incomplete. To request an amendment, your request must be made in writing and submitted to our Privacy Officer. You must provide us with a reason that supports your request for amendment. We will deny your request if you fail to submit your request (and the reason supporting your request) in writing. Also, we may deny your request if you ask us to amend information that is, in our opinion, (a) accurate and complete; (b) not part of the PHI kept by or for the practice; (c) not part of the PHI which you would be permitted to inspect and copy; or (d) not created by our practice, unless the individual or entity that created the information is not available to amend the information.

5. Right to accounting of disclosures. You have the right to request a list and description of certain non-routine disclosures we have made of your PHI for purposes not related to treatment, payment or operations. Use of your PHI as part of the routine patient care in our practice is not required to be documented – for example, the doctor sharing information with the nurse; or the billing department using your information to file your insurance claim. In order to obtain an accounting of disclosures, you must submit your request in writing to our Privacy Officer. All requests for an “accounting of disclosures” must state a time period, which may not be longer than six (6) years from the date of disclosure. The first list you request within a 12-month period is free of charge, but our practice may charge you for additional lists within the same 12-month period. We will notify you of the costs involved with additional requests, and you may withdraw your request before you incur any costs.

6. Right to a paper copy of this Notice. You are entitled to receive a paper copy of our Notice of Privacy Practices. You may ask us to give you a copy of this Notice at any time. To obtain a paper copy of this Notice, contact our Privacy Officer.

7. Right to be notified of a breach. You have the right to be notified if there is a breach – a compromise to the security or privacy of your health information – due to your health information being unsecured. We will notify you within 60 days of discovery of a breach.

8. Right to file a complaint. If you believe your privacy rights have been violated, you may file a complaint with our practice or with the Secretary of the Department of Health and Human Services. To file a complaint with our practice, submit your complaint to our Privacy Officer in writing. We will not retaliate against you for filing a complaint.

F. TERMS OF THIS NOTICE

This Notice is effective on October 1, 2013.

The terms of this Notice apply to all records containing your PHI that are created or retained by our practice. We reserve the right to revise or amend this Notice of Privacy Practices. Any revision or amendment to this Notice will be effective for all of your records that we have created or maintained in the past, and for any of your records that we may create or maintain in the future. We will post a copy of our current Notice on our web site https://www.hanhhoangmd.com/privacypractices and you may request a copy of our most current Notice at any time.

G. PRIVACY OFFICER

If you have questions about this Notice or our health information privacy policies, please contact our Privacy Officer.

Privacy Officer
Hanh Hoang MD, a Professional Medical Corporation
210 N. Jackson Ave, Suite 10
San Jose, CA 95116
Phone:(408) 258-7000