Privacy Policy

HIPAA NOTICE OF PRIVACY PRACTICES

Evolve Direct Primary Care
Effective Date: June 1, 2019
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION PLEASE REVIEW IT CAREFULLY
If you have any questions about this notice, please contact Megan Leser, DNP, Chief of Operations at (844) 322-4222.

WHO WILL FOLLOW THIS NOTICE:
• Evolve Direct Primary Care
This HIPAA Notice of Privacy Practices (this “Notice”) describes our privacy practices.

OUR PLEDGE REGARDING HEALTH INFORMATION:
We understand that health information about you and your health care is personal. We are committed to protecting health information about you. We create a record of the care and services you receive from us. We need this record to provide you with quality care and to comply with certain legal requirements. This Notice applies to all of the records of your care generated by this health care practice, whether made by your personal doctor or others working in this office. This Notice will tell you about the ways in which we may use and disclose health information about you. We also describe your rights to the health information we keep about you and describe certain obligations we have regarding the use and disclosure of your health information. We are required by law to:

maintain the privacy of your protected health information;
provide you with a copy of this Notice of our legal duties and privacy practices with respect to your protected health
information;
abide by the terms of this Notice that are currently in effect; and
notify affected individuals following a breach of unsecured protected health information.

CRISP
We have chosen to participate in the Chesapeake Regional Information System for our Patients, Inc. (CRISP), a statewide health information exchange in order to provide faster access, better coordination of care and assist providers and public health officials in making more informed decisions. You may “opt-out” and disable all access to your health information available through CRISP by calling 1-877-952-7477 or completing and submitting an Opt-Out form to CRISP by mail, fax or through their website at www.crisphealth.org.

HOW WE MAY USE AND DISCLOSE HEALTH INFORMATION ABOUT YOU:
The following categories describe different ways that we use and disclose health information. For each category of uses or disclosures, we will explain what we mean and provide some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

For Treatment. We may use health information about you to provide you with health care treatment or services. We may disclose health information about you to doctors, nurses, technicians, health students, or other personnel who are involved in taking care of you. They may work at the following locations when it is related to your care and treatment: our offices, at the hospital, at another doctor’s or health care provider’s office, a clinical lab, pharmacy, radiology office or similar places where you may receive treatment or care. For example, a physician treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. In addition, the physician may need to tell the dietitian at the hospital if you have diabetes so that appropriate meals can be arranged. We may also disclose health information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status, and location.

For Payment. We may use and disclose health information about you so that the treatment and services you receive
from us may be billed to, and payment collected from you, an insurance company, or a third party. For example, we may need to disclose information about your office visit so your health plan will pay us or reimburse you for the visit. We may also inform your health plan about a treatment you are going to receive to obtain prior approval or to determine whether your plan will cover the treatment.

For Health Care Operations. We may use and disclose health information about you for operations of our health care practice. These uses and disclosures are necessary to manage our practice and make sure that all of our patients receive quality care. For example, we may use health information to review our treatment and services and to evaluate the performance of our staff in caring for you. We may also combine health information about many patients to decide what additional services we should offer; what services are not needed; whether certain new treatments are effective; or to compare our services with others to see where we can make improvements. We may remove
information that identifies you from this set of health information so others may use it to study health care delivery without learning the identity of our specific patients.

Portal. If you sign up to use our self-service portal, we may use and disclose health information to: contact you; provide you with test results; refill medications; provide education about your illness; and schedule office appointments.

Appointment Reminders. We may use and disclose health information to contact you as a reminder that you have an appointment. Please let us know if you do not wish to have us contact you concerning your appointment, or if you wish to have us use a different telephone number or address to contact you for this purpose. Research. Under certain circumstances, we may use and disclose health information about you for the following research purposes:

Research in General. We may use or disclose your health information for a research project. For example, a research project may involve comparing the health and recovery of all patients who received one medication to those who received another, for the same condition. All research projects, however, are subject to a special approval process. This process evaluates a proposed research project and its use of health information, trying to balance the research needs with patients’ need for privacy of their health information. Before we use or disclose health information for this type of research project, the project will have been approved through this research approval process.

Reviews Preparatory to Research. We may use and disclose health information about you to people preparing to conduct a research project. For example, we may help potential researchers look for patients with specific health needs, so long as the health information they review does not leave our facility. We will always ask for your specific permission if the researcher will have access to your name, address, or other information that reveals who you are, or who will be involved in your care.

Limited Data Set. We may use or disclose a limited data set for research purposes if we enter into a data use agreement with the limited data set recipient. A “limited data set” is your health information that excludes certain direct identifiers of you, your relatives, employers or household members. For example, the following types of identifiers would be excluded: names, postal information other than town, city, State and zip code; fax numbers, telephone numbers, e-mail addresses, social security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate/license numbers; vehicle identifiers and serial numbers including license plate numbers, device identifiers and serial numbers, Web Universal Resource Locators (URLs), internet protocol (IP) address numbers, biometric identifiers including finger and voice prints, and full face photographic images and any comparable images.

As Required by Law. We will disclose health information about you when required to do so by federal, state, or local law.

To Avert a Serious Threat to Health or Safety. We may use and disclose health information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.

Military and Veterans. If you are a member of the Armed Forces or have been separated or discharged from military services, we may release health information about you as required by military command authorities or the Department of Veterans Affairs as may be applicable. We may also release health information about foreign military personnel to the appropriate foreign military authorities.

Workers’ Compensation. We may release health information about you for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.

Public Health Risks. We may disclose health information about you for public health activities. These activities
generally, includes the following:

to prevent or control disease, injury or disability;
to report births and deaths;
to report child abuse or neglect;
to report reactions to medications or problems with products;
to notify people of recalls of products they may be using;
to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;
to notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect, or domestic violence. We will only make this disclosure if you agree or when required or authorized by law.

Health Oversight Activities. We may disclose health information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits; civil, administrative or criminal investigations; inspections; licensure or disciplinary actions; and civil, administrative or criminal proceedings or actions or other
activities necessary for the appropriate oversight of the health care system, government benefit programs,
government regulatory programs and compliance with civil rights laws.
Judicial and Administrative Proceedings. If you are involved in a lawsuit or a dispute, we may disclose health
information about you in response to a court or administrative order. We may also disclose health information about
you in response to a subpoena, discovery request, or other lawful processes by someone else involved in the dispute if
we receive satisfactory assurance that you have been given notice.
Law Enforcement. We may release health information if asked to do so by a law enforcement official:

as required by law to report certain wounds or physical injuries;
in response to a court order, subpoena, warrant, summons or similar process;
to identify or locate a suspect, fugitive, material witness, or missing person;
about the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement;
about a death we believe may be the result of criminal conduct;
about criminal conduct at our facilities; or
in an emergency, circumstances to report a crime; the location of the crime or victim(s); or the identity, description, or location of the person who committed the crime.

Coroners, Medical Examiners, and Funeral Directors. We may release health information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release health information about patients to funeral directors as necessary to carry out their duties.

Organ or Tissue Donation. We may use or disclose health information to organ procurement organizations or other entities engaged in the procurement, banking or transplantation of cadaveric organs, eyes or tissue for the purpose of facilitating organ, eye or tissue donation and transplantation.

Correctional Institutions, Law Enforcement Custodial Situations. We may disclose to a correctional institution or law enforcement official having lawful custody of an inmate or other individual health information about such inmate or individual provided the information is necessary for health care, the health or safety of the person or other inmates, the health or safety of officers or employees at the correctional institution or those involved in transporting the individual, or for the administration, safety, security and good order of the correctional institution.

National Security and Intelligence Activities. We may release health information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

Protective Services for the President and Others. We may disclose health information about you to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.

YOUR RIGHTS REGARDING HEALTH INFORMATION ABOUT YOU:

You have the following rights regarding the health information we maintain about you.

Right to Inspect and Copy. You have the right to inspect and to obtain a copy of your health information that may be used to make decisions about your care. Usually, this includes health and billing records. To inspect and to obtain a copy of your health information that may be used to make decisions about you, you must submit your request in writing to the Practice Manager or Billing Manager. If you request a copy of the information, we will charge a fee for the costs of copying, mailing, or other supplies and services associated with your request. However, if your health information is kept electronically and you request an electronic copy of your health information, we will provide access in the electronic form and format requested by you if it is readily producible in such form and format; or, if not, we will provide a readable electronic form and format as agreed to by you and us.

We may deny your request to inspect and to obtain a copy of your health information in certain very limited circumstances. If you are denied access to your health information, you may request that the denial be reviewed. Another licensed health care professional chosen by our practice, but who did not participate in the original decision to deny access, will review your request and the denial. We will comply with the outcome of the review.

Right to Amend. If you feel that health information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as we keep the information. To request an amendment your request must be made in writing and submitted to the Privacy Official. You must provide
a reason that supports your request for an amendment.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

was not created by us, unless the person or entity that created the information is no longer available to make the
amendment;
is not part of the health information kept by or for our practice;
is not part of the information which you would be permitted to inspect and copy; or
is accurate and complete.

If you elect to exercise your right to amend your health information, you will be provided with our office’s Form to Request Amendment to Health Information.

Any amendment we make to your health information will be disclosed to those with whom we disclose information as previously specified.

Right to an Accounting for Disclosures. You have the right to request a list accounting for any disclosures of your the health information we have made, except for: uses and disclosures for treatment, payment, and health care operations, as previously described; disclosures to you; disclosures incident to a use or disclosure otherwise permitted or required by the Privacy Rule; disclosures pursuant to a valid authorization; disclosures to persons involved in your care; disclosures for national security or intelligence purposes; disclosures to correctional institutions or law enforcement officials; and disclosures that occurred prior to April 14, 2003.

To request this list of disclosures, you must submit your request in writing to the Privacy Official. Your request must state a time period which may not be longer than six years and may not include dates before April 14, 2003. The first list you request within a 12-month period will be free. For additional lists, we will assess a fee of $30.00. You may choose to withdraw your request at this point if you do not wish to pay the fee. We will mail you a list of disclosures in paper form within 30 days of your request or notify you if we are unable to supply the list within that time period and by what date we can supply the list. This date will not exceed a total of 60 days from the date you made the request.

Right to Request Restrictions. You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a limit on the health information we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend. For example, you could ask that we restrict a specified nurse from accessing your information, or that we do not disclose information to your spouse about a surgery you had.

We are not required to agree to your request for restrictions if it is not feasible for us to ensure our compliance or believe it will negatively impact the care we may provide you. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment. If the information is disclosed to a health care provider for emergency treatment, we will request that the health care provider not further use or disclose the information. However, we must agree to your request to restrict disclosure of health information to your health plan if: (i) the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and (ii) the health information pertains solely to a health care item or service for which you, or a person on your behalf, has paid us in full. To request a restriction, you must make your request in writing to the Privacy Official on our Form to Request Restrictions. For example, in your request, you must tell us what information you want to limit and to whom you want the limits to apply.

Right to Request Confidential Communications. You have the right to request that we communicate with you about health matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail to a post office box.

To request confidential communications, you must make your request in writing to the Privacy Official on our form, Request for Confidential Handling of Health Information. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to a Paper Copy of This Notice. You have the right to obtain a paper copy of this Notice at any time. To obtain a copy, please request it from the Practice Manager or Designated Administrative Staff.

Changes to this Notice. We reserve the right to change this Notice. We reserve the right to make the revised or changed notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current notice in our facility. The notice will contain on the first page, in the top right-hand corner, the effective date.

Complaints. All complaints must be submitted in writing to the Privacy Official on the Privacy Complaint form. You will not be penalized for filing a complaint. If you believe your privacy rights have been violated, you may file a complaint with:

Evolve Direct Primary Care
Megan Leser, DNP, Chief of Operations
509 S. Cherry Grove, Suite C
Annapolis, MD, 21401

A complaint may also be filed with the Secretary of the Department of Health and Human Services. The complaint must be filed with the Secretary within 180 days of when you know or should have known of the act or omission, unless this time limit is waived by the Secretary for good cause shown. Authorization and Other Uses of Health Information. You will be required to sign an authorization to use or disclose your health information for certain marketing activities unless the communication is made face-to-face or involves a
promotional gift of nominal value. Other uses and disclosures of health information not covered by this notice or the laws that apply to us will be made only with your written authorization. If you provide us permission to use or disclose health information about you, you may revoke that permission, in writing, at any time. If you revoke your permission,
we will no longer use or disclose health information about you for the reasons covered by your written authorization. Please be aware that we are not able to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided to you.