STATEMENT OF PRIVACY PRACTICES

Our office is dedicated to protecting the privacy rights of our patients and the confidential information entrusted to us. The commitment of each employee to ensure that your health information is never compromised is a principal concept of our practice. We may, from time to time, amend our privacy policies and practices, but will always inform you of any changes that may affect your rights.

PROTECTING YOUR HEALTHCARE INFORMATION

We use and disclose the information we collect from you only as allowed by the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act and the State of GA. This includes issues relating to your treatment, payment, and our healthcare operations. Your personal health information will never be otherwise given to anyone, even family members, without your written consent. You, of course, may give written authorization for us to disclose your information to anyone you choose, for any purpose. Our offices and electronic systems are secure from unauthorized access and our employees are trained to make certain that the confidentiality of your records is always protected. Our privacy policy and practices apply to all former, current and future patients, so you can be confident that your protected health information will never be improperly disclosed or released. The HIPAA officer for this practice is Farrah Fang, MD.

COLLECTING PROTECTED HEALTH INFORMATION:

We will only request personal information needed to provide our standard of quality healthcare, implement payment activities, conduct normal health practice operations, and comply with the law. This may include your name, address, telephone numbers, social security number, employment data, medical history, health records, etc. While most of the information will be collected from you, we may obtain information from third parties if deemed necessary. Regardless of the source, your personal information will always be protected to the full extent of the law.

DISCLOSURE OF PROTECTED HEALTH INFORMATION:

As stated above, we may disclose information as required by law. We are obligated to provide information to law enforcement and governmental officials under certain circumstances. We will not use your information for marketing purposes without your written consent. We may use and/or disclose your health information to communicate reminders about your appointments including voicemail messages, answering machine messages, and postcards.

PATIENT RIGHTS:

You have the right to request copies of your healthcare information, to request copies in a variety of formats, and to request a list of instances in which we, or our business associates, have disclosed your protected information for uses other than stated above. All such requests must be in writing. We may charge for your copies in an amount allowed by law. If you believe your rights have been violated, we urge you to notify us immediately. You can also notify the U.S. Department of Health and Human Services. We thank you for being a patient at our office. Please let us know if you have any questions concerning your privacy rights and the protection of your personal health information.

NOTICE OF PRIVACY PRACTICES AND POLICIES:

As required by federal legislation, this notice describes how healthcare information about you may be used and disclosed and how you can obtain access to this information. Please review it carefully. This Notice applies to all of the paper and electronic records of your care maintained by Farrah Fang MD, whether created by myself, my personnel or records acquired from outside resources such as other clinicians involved in your care and laboratory reports.

WAYS THE PRACTICE MAY USE AND DISCLOSE YOUR INFORMATION:

The following categories describe ways that I use and share your confidential information. Confidential information includes Protected Health Information (PHI) (information that could be used to identify you). Not every use or disclosure in a category is listed. However, all of the ways I am permitted to use and disclose information will fall within one of the following categories:

A. Disclosures which require authorization: Psychotherapy notes are handled separately under HIPAA and have additional protections. Specifically, the regulations state that in most instances a practice must obtain an authorization for any use or disclosure of psychotherapy notes. No authorization is needed to carry out treatment, payment, or healthcare operations and the uses listed in routine situations. All other circumstances require a valid authorization from you for use and disclosure. Confidential information may be released for payment and healthcare operations only to health insurance plans and their agents and business associates of the practice. This can be restricted, in some instances, by patients. The definition of health insurance plan does not include life insurance companies, automobile insurance companies, or workers’ compensation carriers. These are not covered under HIPAA. Therefore, if you would like information submitted to one of these companies, an authorization will be required, unless I am otherwise required by state or federal law. I will also obtain an authorization from you before using or disclosing: a) PHI in a way that is not described in this Notice. b) PHI for marketing purposes. c) PHI in a way that is considered a sale of PHI.

B. Routine situations: 1) For treatment. I may use information about you to provide you with medical treatment or services. Treatment is when I provide, coordinate, or manage your healthcare and other services related to your healthcare. An example of treatment is when I consult with another healthcare provider, such as your primary care physician. 2) For payment. I may use and disclose information about you so that the treatment and services you receive at the practice may be billed and payment may be collected from you, an insurance company, or a third party (including a collection agency if necessary). For example, I may give your health insurance plan information about services you received at the practice so your health insurance plan will pay my practice or reimburse you for the services. I may also tell your health insurance plan about a treatment you are going to receive in order to obtain prior approval or to determine whether your plan will cover the treatment. 3) For healthcare operations. I may use and share information about you for administrative functions necessary to run my practice and promote quality care. I may share information with business associates who provide services necessary to run my practice, such as transcription companies or billing services. I will contractually bind these third parties to protect your information as I would. Also, I may permit your health insurance plan or other providers to review records that contain information about you to assist them in improving the quality of service provided to you. 4) Communicating with you and others involved in your care. My practice may contact you to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to you. In certain situations, I may share information about you with a friend or family member who is involved in your care or payment for your care unless you have requested that such disclosures not occur and I have agreed. Information disclosed will be directly relevant to such a person's involvement with your care or payment related to your care. Whenever possible, this person will be identified by you. However, in emergencies or other situations in which you are unable to indicate your preference, I may need to share information about you with other individuals or organizations to coordinate your care or notify your family.

C. Special Situations: 1) As required by law. I will disclose information about you when required to do so by federal, state or local law. For example, I may release information about you in response to a valid court subpoena. 2) Health oversight activities. I may disclose information to a health oversight agency for activities authorized by law. These oversight activities include, for example: audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the healthcare system, government programs, and compliance with civil rights laws. 3) For judicial or administrative proceedings. If you are involved in a court proceeding and a request is made for information about the professional services that you have received within my practice and the records thereof, such information may be privileged under state law, and I will not release information without the written authorization of you or your legal representative, or in instance of issuance. This may also be the case in the instance of a court subpoena requiring provision of such information of which you have been properly notified and in response to which you have not opposed the court subpoena within the legally specified format and timeframe, or in the instance of the issuance of a court order compelling me to provide Protected Health Information (PHI). This privilege does not apply when you are being evaluated for a third party or where the evaluation is court ordered. You will be informed in advance if this is the case. 4) To avert serious threats to health or safety. I may disclose your confidential mental health information to any person without authorization if I believe reasonably that disclosure will avoid or minimize imminent danger to your health or safety, or the health or safety of any other individual. These disclosures may be to law enforcement officials to respond to a violent crime or to protect the target of a violent crime. For example, a threat of harming another individual may be reported to appropriate authorities. 5) Worker’s compensation. If you file a worker's compensation claim, with certain exceptions, I must make available, at any stage of the proceedings, all PHI information in our possession that is relevant to that particular injury in the opinion of the Georgia Department of Labor and Industries, to your employer, your representative, and the Department of Labor and Industries upon request. 6) Public health risks. I may disclose information about you for public health activities. These activities generally include, but are not limited to, the following: i. To prevent or control disease, injury, or disability. ii. To report child abuse or neglect. iii. To report adult and domestic abuse. iv. To report reactions to medications or problems with products. v. To notify people of recalls of products they may be using. vi. To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition. vii. To notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect, or domestic violence. 7) Law enforcement. I may release information about you if asked to do so by a law enforcement official: i. In response to a court order, subpoena, warrant, summons, or similar process. ii. To identify or locate a suspect, fugitive, material witness, or missing person. iii. If you are suspected to be a victim of a crime, generally with your permission. iv. About a death we believe may be the result of criminal conduct. v. About criminal conduct at the hospital. vi. In emergency circumstances, to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime. 8) Other special circumstances. When the use and disclosure without your consent or authorization is allowed under other sections of the Section 164.512 of the Privacy Rule and the states’ confidentiality law. This includes certain narrowly-defined disclosures to law enforcement agencies (see above), to a health oversight agency (such as HHS or a state department of health), to a coroner or medical examiner, for public health purposes related to disease or FDA-regulated products, or for specialized government functions such as a fitness for military duties, eligibility for VA benefits and national security and intelligence.

YOUR RIGHTS AS A PATIENT:

In addition to provisions by the practice to protect your confidential information, you are entitled to six specific rights as a patient (assistance is available at MedicalMine Inc): 1. You have the right to request restrictions on certain uses and disclosures. You have the right to request a restriction or limitation on the use and sharing of information about you for treatment, payment, administrative functions, or with individuals involved in your care. To request restrictions, you must make your request in writing to me. In your request, you must tell me: (1) what information you want to limit; (2) whether you want to limit use, disclosure, or both; and (3) to whom you want it to apply. I am not required to agree to your request. If I agree, I will comply with your request unless the information is needed to provide you with emergency treatment. 2. You have the right to receive confidential communications. You have the right request that we communicate with you in a certain way or at a certain location. For example, you can ask that we only contact you at work or at a post office box. To request confidential communications, you must make your request in writing to me. Your request must specify how or where you wish to be contacted. I will not ask you the reason for your request. I will seek to accommodate all reasonable requests. 3. You have the right to inspect and obtain copies. You have the right to review and obtain copies of information that may be used to make decisions about your care. Usually, this includes medical and billing records, but does not include psychotherapy notes, information compiled in reasonable anticipation of a legal action or proceeding; and confidential information related to certain laboratory tests under Clinical Laboratory Improvement Amendments (CLIA). To inspect and copy information that may be used to make decisions about you, you must submit your request to me in writing. You may be charged a fee for the costs of copying, mailing or other supplies associated with your request. In the following circumstances I may deny your request to inspect and copy information: a. I have determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of you or another person. b. The information makes reference to another person (unless the other person is a healthcare provider) and I have determined, in the exercise of professional judgment that the access requested is reasonably likely to cause substantial harm to the other person. c. The request for access is made by your representative and I have determined, in the exercise of professional judgment, that the provision of access to your personal representative is reasonably likely to cause substantial harm to you or another person. If you are denied access, you may request a review of the denial by another licensed medical practitioner. I will comply with the outcome of the review. 4. You have the right to amend confidential information. If you feel that the information I have about you is incorrect or incomplete, you may ask me to amend the information. You have the right to request an amendment for as long as the information is kept by or for my practice. To request an amendment, your request and a reason that supports your request must be made in writing and submitted to me. I may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, I may deny your request if you ask me to amend information that: a. Was not created by my practice, unless the person or entity that created the information is no longer available to make the amendment. In such instances I would consider the request. b. Is not part of the information kept by or for my practice. c. Is not part of the information which you would be permitted to inspect and copy. d. Is accurate and complete. 5. You have the right to receive an accounting of disclosures of confidential information. You may ask to receive an accounting of certain disclosures made about you that were not related to the routine uses listed above. To request this list or accounting of disclosures, you must submit your request in writing to me. Your request must state a time period that may not be longer than six (6) years and indicate what format you want the list (for example on paper or in an electronic file). The first list you request will be free. For additional lists, I may charge you the cost of providing the list. I will notify you of the estimated cost involved and you may choose to withdraw or modify your requests because any costs are incurred. Disclosures do not have to be made when those disclosures are: a. To carry out treatment, payment and healthcare operations. b. To individuals of confidential information about them. c. As a result of assigned authorization. d. For the practice’s directory or to persons involved in your care. e. For national security or intelligence purposes. f. To correctional institutions or law enforcement officials. 6. You have the right to obtain a paper copy of this Notice upon request. Even if you have requested an electronic copy, I will provide you with a paper copy of this Notice at your request. 7. You have the right to restrict disclosures when you have paid for your care out of pocket. You have the right to restrict certain disclosure of PHI to a health plan when you pay out of pocket in full for my services. 8. You have the right to be notified if there is a breach of your unsecured PHI. You have a right to be notified if: (a) there is a breach (a use or disclosure of your PHI in violation of the HIPAA privacy rule) involving your PHI; (b) PHI has not been encrypted to government standards; and (c) my risk assessment fails to determine that there is a low probability that your PHI has been compromised.

MY PRACTICE'S DUTIES:

In addition to your rights as a patient, my practice has duties to protect your confidential information and inform you of changes to protection measures. I am required by law to maintain the privacy of confidential information and provide you with notice of my legal duties and privacy practices with respect to such information. I am required to abide by the terms of this Notice currently in effect.

CHANGES TO THIS NOTICE:

I reserve the right to revise or change provisions on this notice. I will make the new Notice provisions effective for all confidential information I maintain. I will promptly revise and distribute my Notice whenever there is a change to the uses or disclosures, your rights, and my duties, or other privacy practices stated in this Notice. I will mail updates of my notice to all active patients. Patients who are inactive at the time of mailing may receive an updated copy at their next scheduled appointment. A copy of the current Notice will be available throughout my practice. The Notice will contain the effective date on the top of the first page.

COMPLAINTS:

If you believe your privacy rights have been violated, you may file a complaint with me or with the Secretary of the Department of Health and Human Services, 800-368-1019. All complaints must be submitted or verified in writing. You have specific rights under the Privacy Rule. You will not be penalized for filing a complaint.

OTHER USES OF INFORMATION:

Other uses and disclosures of information not covered by this notice or the laws that apply to my practice will be made only with your written permission. If you provide my practice with specific permission to use or disclose information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, I will no longer use or disclose information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures that have already been made with your permission and that I am required to retain our records of the care that we provided to you.

PRIVACY OFFICER:

I am the privacy officer for my practice. You may contact me with questions or comments at: Farrah Fang, MD, 6100 Lake Forrest Drive, Suite 330, Atlanta, GA 30328, (678) 827-3282.