Notice of Privacy Practices
As required by federal and state law, as well as the Professional and Ethical Compliance Code for Behavior Analysts, this notice serves to inform you of Blue Sprig Pediatrics, Inc. (Blue Sprig) legal and ethical responsibilities, as well as your rights, with respect to using and disclosing the protected health information (PHI) of your child.
Our Commitment to Your Privacy
Blue Sprig is committed to protecting the PHI of your child and your family. PHI includes, but is not limited to, assessment results, diagnostic reports, treatment plans, and data collected during the course of treatment. Blue Sprig employees have an ethical and legal obligation to protect the privacy of your health information. The terms of this notice apply to all records containing your PHI that are created or retained by our practice. We reserve the right to revise or amend this Notice of Privacy Practices. Any revision or amendment to this notice will be effective for all of your records that our practice has created or maintained in the past, and for any of your records that we may create or maintain in the future. This Notice is posted in our offices in a visible location and on our website at all times. Blue Sprig is required to provide you with a copy of this Notice of Privacy Practices and abide by the use and disclosure terms outlined below.
1. Blue Sprig Use and Disclosure of PHI
Blue Sprig may use or disclose your PHI when authorized by you to do so. We may disclose your PHI without your consent if mandated by law or where permitted by law for a valid purpose such as those outlined below. 1.1 Treatment.
Blue Sprigemployees may use your PHIto treat your child. For example, we may ask you to submit previous assessment results, and we may use the results to help us reach a diagnosis or to develop a treatment plan. Blue Sprigemployees may also disclose your PHIto other Blue Sprigemployees for quality care purposes. In such situations, the amount of information disclosed will be the minimum necessary. Employment at Blue Sprigdoes not assume the right to use or disclose your child’s PHI. 1.2 Treatment Options.
Blue Sprigmay use and disclose your child’s PHI in order to inform you of potential treatment options and alternatives. 1.3 Consultation.
To ensure your child receives the highest quality treatment possible, Blue Sprigemployees may seek consultation with other professionals. In such situations, your consent will be requested and/or the disclosure of your PHI will be limited to the minimum necessary. 1.4 Appointment Reminders.
Blue Sprig may use and disclose information to contact you as a reminder that you have an appointment. We will usually call you on the phone number provided to us and leave a message for you if required. However, you may request that we provide reminders with certain restrictions. We will endeavor to accommodate all reasonable requests. 1.5 Health-Related Benefits and Services.
Blue Sprigmay use and disclose PHI to inform you about health-related benefits and services that may be of interest to you. 1.6 Protection From Harm.
If a Blue Sprigemployee believes your child has been the victim of abuse, neglect, or domestic violence, we may disclose PHI as required to do so by law to protect, or prevent potential harm to, your child. 1.7 Health Care Entities.
We may disclose your PHI to health care entities for quality review purposes. In such situations, the disclosure of health information is limited to the minimum that is necessary to achieve the desired purpose. 1.8 Health Care Operations.
Use and disclosure of your child’s PHI may be necessary to operate our business. For example, we may use your child’s PHI to evaluate the quality of care you receive from us, or to conduct business planning activities for our practice. 1.9 Business Associates.
Often, contractors, subcontractors, and other outside persons, and companies that are not employees of Blue Sprigmay need access to your PHI when providing services. We call these entities “business associates.” To protect your health information, Blue Sprigrequires our business associates to protect and verify the protection of your information.
- We may use and disclose your PHI to obtain payment for services. The disclosure of PHIis limited to the minimum that is necessary to obtain payment.
2. Blue Sprig Use and Disclosure of PHI in Special Circumstances
The following categories describe unique scenarios in which we may use or disclose your child’s PHI. 2.1 Public Health Activities.
Blue Sprigmay disclose your PHI to public health authorities that are authorized by law to collect information for the purpose of:
2.2 Law Enforcement.
- Maintaining vital records, such as births and deaths.
- Preventing or controlling disease, injury, or disability.
- Notifying a person regarding potential exposure to a communicable disease.
- Notifying a person regarding a potential risk for spreading or contracting a disease or condition.
- Reporting reactions to drugs or problems with products or devices.
- Notifying individuals if a product or device they may be using has been recalled.
- Notifying appropriate government agencies and authorities regarding the potential abuse or neglect of an adult Client (including domestic violence); however, we will only disclose this information if the Client agrees or we are required or authorized by law to disclose this information.
- Notifying your employer under limited circumstances related primarily to workplace injury or illness or medical surveillance.
Blue Sprigmay disclose your PHI in the following situations:
2.3 Workers Compensation. Blue Sprigmay disclose PHI to the extent authorized by and to the extent necessary to comply with workers compensation laws. 2.4 Funeral Directors. Blue Sprigmay release PHI to a medical examiner, coroner, or funeral director so they may perform their jobs. 2.5 Research. Blue Sprigmay use and disclose your PHI to researchers when the information does not directly identify your child or when a waiver has been issued by an Institutional Review Board that has reviewed the research proposal for compliance with standards to ensure the privacy of your PHI.
- In response to a court or warrant, summons, court order, subpoena or similar legal process, if authorized under state or federal law;
- To protect the victim of a crime if, under certain circumstances, we are unable to obtain the person’s agreement;
- To report a death we believe has resulted from criminal conduct;
- To report criminal conduct at our clinics;
- To identify or locate a suspect, material witness, fugitive or missing person;
- In emergency circumstances to report a crime, the location of the crime or victim(s), or the description, identity, or location of the perpetrator;
- To authorized federal officials for intelligence, counterintelligence, and other national security authorized by law; or
- To federal officials in order to protect the President, other officials or foreign heads of state.
3. Client Rights You have the right to inspect and obtain a copy of your child’s medical record and partake in actions that protect the accuracy and privacy of the PHI contained within the record. These actions are listed below.
3.1 Request of Records. You have the right to inspect and obtain a copy of medical information that may be used to make decisions about the care of your child. Note that this does not include psychotherapy notes. To request a copy of your child’s health information, please submit your request in writing by emailing firstname.lastname@example.org. As part of Blue Sprig’s commitment to the environment, we will provide you with an electronic copy of your records for a small fee (cost of a USB and labor costs). You will receive your requested records within 30 days of the request. We may deny your request to inspect and copy in certain limited circumstances. In these circumstances, you have the right to request a review of the denial by a healthcare professional not involved in the initial request. 3.2 Amendment. If you feel that PHIin your child’s records is incorrect, you may ask us to amend the information. We will amend the information if it was created by us and if sufficient evidence is submitted that clearly challenges the accuracy of the information. We cannot amend PHIif it was not created or retained by us, it is not part of the medical information kept by Blue Sprig, it is not part of the information which you would be permitted to inspect and copy, or if we believe the information is accurate and the submitted evidence does not support the claim of incorrect information. 3.3 Right to Accounting Disclosures. You have the right to request an accounting of disclosures of your child’s PHI made by Blue Sprig. We are not required to list disclosures made for the following reasons:
To request an accounting of disclosures, please submit your request in writing by emailing email@example.com. 3.4 Copy of Notice of Privacy Practices. You will have access to this document at all times but if you would like a paper copy of this document, please submit your request in writing by emailing firstname.lastname@example.org. 3.5 Request Restrictions. You have the right to request a limitation on the use, disclosure, or communication of your child’s PHI. You also have the right to request a limit on the information we communicate to someone who is involved in the care of your child and how we communicate with you about your child’s PHI. Please submit a written request to our privacy officer at 7500 San Felipe, Suite 990, Houston, TX, 77063 and outline what information you want to limit and to whom you want the limits to apply. 3.6 Receive Notice of a Breach. We are required to notify you of any breaches of unsecured PHI as soon as possible but no later than 60 days following the discovery of the breach. The notice will include a brief description of the breach including a description of the type of PHI involved in the breach, steps taken by Blue Sprigto investigate, mitigate losses, and protect against future breaches, steps that should be taken by you to protect you from potential harm as a result of the breach, and contact information should you have questions about the breach. 3.7 Complaints. If you believe you or your child’s privacy rights have been violated, we encourage you to file a written complaint with our privacy officer at 7500 San Felipe, Suite 990, Houston, TX, 77063. You may also file a health information privacy complaint with the United States Department of Health and Human Services. The complaint must be made in writing by mail, fax, email, or via the OCR Complaint portal and must be filed within 180 days of when you knew the act or omission occurred. For more information, please go to https://www.hhs.gov/hipaa/
- For treatment, payment, and health care operations purposes; however, if the disclosures were made through an electronic health record, you have the right to request an accounting for such disclosures that were made during the last 3 three years.
- Those that were authorized by you.
- To create a limited data set.
- Those made directly by you.