HIPAA Notice of Privacy Practices (NPP)

Protected Health Information

Protected Health Information, often called PHI, means information that identifies you and relates to your past, present, or future physical or mental health, healthcare services, or payment for healthcare. PHI may exist in paper form, electronic systems, images, billing files, clinical notes, prescription information, laboratory data, or spoken communication.

Examples of PHI may include your name, address, date of birth, medical record number, diagnosis, treatment history, medications, allergies, laboratory and imaging results, procedure notes, care plans, insurance information, billing information, appointment history, discharge instructions, and information received from other doctors, hospitals, pharmacies, laboratories, or health plans.

How We May Use and Disclose Your Health Information

AV Community Clinic may use and disclose your health information without your written authorization for treatment, payment, healthcare operations, and other purposes allowed or required by law.

Treatment

We may use and share your health information to provide, coordinate, or manage your medical care. This may include communication among physicians, nurses, pharmacists, therapists, laboratory staff, imaging specialists, consulting clinicians, and other professionals involved in your care. For example, a physician may review your medication history before ordering treatment, or a specialist may receive your test results to support diagnosis and follow-up care.

Payment

We may use and disclose health information to bill and collect payment for services provided to you. This may include sending information to a health plan, Medicare, Medicaid, workers' compensation program, billing vendor, or other payer. The information may include your diagnosis, treatment dates, procedures, medications, insurance coverage, and documentation needed to support payment or prior authorization.

Healthcare Operations

We may use and disclose health information for activities necessary to operate AV Community Clinic. These activities may include quality review, patient safety work, credentialing, staff training, compliance review, auditing, licensing, accreditation, case management, business planning, legal services, information technology support, and internal review of care delivery.

Other Uses and Disclosures Allowed by Law

We may use or disclose your health information when federal, state, or local law permits or requires it. These situations may include public health reporting, disease control, injury prevention, product recalls, reporting of certain wounds or conditions, and reporting suspected abuse, neglect, or domestic violence when authorized or required by law.

We may disclose health information to health oversight agencies for audits, investigations, inspections, licensure reviews, certification activities, and other oversight functions. We may also disclose information in response to a court order, subpoena, discovery request, administrative proceeding, or other lawful process when legal requirements are met.

We may disclose health information to law enforcement officials in limited circumstances, including when required by law, to comply with a court order, to identify or locate a person, to report certain injuries, or to address a serious threat to health or safety. We may disclose information to coroners, medical examiners, and funeral directors when needed for their legal duties.

We may use or disclose health information for workers' compensation claims and similar programs that provide benefits for work-related injury or illness. We may also use or disclose information for research when approved through required legal and ethical review, or when the information has been properly de-identified.

Family Members, Representatives, and Hospital Directory

Unless you object or the law requires a different process, we may share limited health information with a family member, personal representative, caregiver, or another person involved in your care or payment for your care when the information is directly relevant to that person's involvement. If you are unable to tell us your preference, we may use professional judgment to decide whether disclosure is in your best interest.

When you are admitted as a patient, AV Community Clinic may maintain a hospital directory with limited information, such as your name and location within the facility. This helps staff respond to people who ask for you by name. You may request that your information not be included in the directory.

Uses That Require Written Authorization

AV Community Clinic will ask for your written authorization before using or disclosing your health information for purposes not described in this Notice, unless the use or disclosure is otherwise allowed or required by law.

Written authorization is generally required for most uses and disclosures of psychotherapy notes, uses or disclosures of PHI for marketing purposes when required by HIPAA, and disclosures that constitute the sale of PHI. If you sign an authorization, you may revoke it in writing at any time. The revocation will not affect actions already taken in reliance on the authorization.

Your Rights Regarding Your Health Information

You have specific rights under HIPAA and other applicable laws. These rights may be subject to legal limits, identity verification, and written request requirements.

• Right to inspect and obtain a copy. You may request access to medical and billing information used to make decisions about your care. You may request a paper or electronic copy when available.
• Right to request an amendment. You may ask AV Community Clinic to amend health information you believe is incorrect or incomplete. The request must explain why the amendment is needed.
• Right to an accounting of disclosures. You may request a list of certain disclosures of your health information made by AV Community Clinic. This accounting does not include all disclosures, such as disclosures for treatment, payment, healthcare operations, or disclosures you authorized.
• Right to request restrictions. You may ask us to limit how we use or disclose your health information. We are not required to agree to every request, except in specific circumstances required by law.
• Right to restrict disclosure to a health plan. If you pay out of pocket in full for a healthcare item or service, you may request that we not disclose information about that item or service to your health plan for payment or healthcare operations.
• Right to confidential communications. You may ask us to contact you in a specific way or at a specific location, such as by mail to another address or by phone at a particular number.
• Right to choose a personal representative. If someone has legal authority to act for you, AV Community Clinic will treat that person as your personal representative after appropriate verification.
• Right to breach notification. You have the right to be notified if a breach of unsecured protected health information affects you.
• Right to a paper copy. You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

How to Request Medical Records

Requests for access to medical records are handled through AV Community Clinic Information Management. Records may be available through the patient portal, and some records may also be provided by mail, fax, secure electronic delivery, or in-person pickup when allowed by policy and law. AV Community Clinic may require a completed authorization form, identity verification, and processing time before releasing records.

For assistance with medical record requests, contact Health Information Management at (661) 942-2391. AV Community Clinic currently advises patients to allow 5 to 7 business days for processing medical record requests.

Our Privacy and Security Safeguards

AV Community Clinic uses administrative, technical, and physical safeguards to protect health information. These safeguards are designed to limit access to PHI to authorized workforce members and business associates who need information for permitted work.

Safeguards may include identity verification, role-based access, password controls, secure electronic systems, audit logging, privacy and security training, locked or restricted storage for paper materials, vendor agreements, incident review, and breach response procedures. AV Community Clinic also uses policies and training to support the HIPAA minimum necessary standard when that standard applies.

Business Associates

AV Community Clinic may work with outside companies or individuals that perform services involving health information. These may include billing companies, software vendors, legal counsel, consultants, transcription services, document storage services, claims support vendors, and other service partners. When HIPAA requires it, AV Community Clinic enters into business associate agreements that require these parties to protect PHI and use it only for permitted purposes.

Fundraising and Communications

AV Community Clinic may contact patients or former patients about fundraising activities as permitted by law. Any fundraising communication will include information about how to opt out of receiving future fundraising communications. Choosing not to receive fundraising communications will not affect your care, payment status, or access to services.

AV Community Clinic may also contact you about appointments, test follow-up, care instructions, patient experience matters, health-related services, or administrative issues connected to your care.

Changes to This Notice

AV Community Clinic may revise this Notice when privacy practices, legal requirements, organizational operations, or patient rights change. A revised Notice may apply to health information already held by AV Community Clinic, as well as information received or created in the future. The current Notice will be available through AV Community Clinic and may be provided in paper form upon request.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with AV Community Clinic or with the U.S. Department of Health and Human Services Office for Civil Rights. AV Community Clinic will not retaliate against you for filing a complaint, asking questions about privacy practices, or exercising your HIPAA rights.

Complaints should describe the concern, the date or approximate date of the event, the type of information involved, and the department or location connected to the concern if known. A privacy complaint does not have to use legal language. It only needs to explain what happened and why you believe your health information or privacy rights were affected.

Privacy Contact Information

For questions about this Notice, requests involving your HIPAA rights, medical record access, or privacy concerns, please contact AV Community Clinic: