eternalHealth Privacy Practices
This Notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
This Notice of Privacy Practices describes how eternalHealth may use and disclose your Protected Health Information (“PHI”) in accordance with applicable law, including the Health Insurance Portability and Accountability Act (“HIPAA”), regulations promulgated under HIPAA including the HIPAA Privacy and Security Rules. It also describes your rights to access and control your PHI. PHI is about you, including demographic information, that may identify you and that relates to any of the following:
- Your past, present or future physical or mental health or condition;
- The provision of health care to you; and
- The past, present, or future payment for the provision of health care to you.
We Are Legally Required to Safeguard your Protected Health Information
We are required by law to:
- Provide you with a copy of this Notice of Privacy Practices;
- Maintain the privacy of your PHI;
- Comply with the duties and privacy practices described in this Notice; and
- Notify you following a breach that may have compromised the security or privacy of your PHI.
How We May Use and Disclose Your PHI
The law allows us to use and disclose your PHI for certain purposes without obtaining your written authorization. This section provides examples of each of these circumstances.
Uses and Disclosures for Treatment, Payment, and Health Care Operations
- Treatment: We may use or disclose your PHI for you to obtain treatment. For example, your physician may send us information regarding your diagnosis so we can arrange additional services.
- Payment: We may use or disclose your PHI to provide payment for the treatment you receive. For example, we send information to your vision plan to complete payment for your eye care.
- Health Care Operations: We may use or disclose your PHI for our health care operations. For example, we may use your PHI to conduct audits or to gauge the quality of care provided by the providers in our provider networks.
Your Rights to make Choices about Certain Disclosures
For certain PHI, you can tell us what your choices are about what information we share. If you have a preference about how we share your information in the situations listed below, let us know. If you tell us clearly what your preferences are, we will follow your preferences:
In these circumstances, you have the right and choice to request that we:
- Share information with your family, named close friends, or anyone who helps pay for your care; and
- Share information during a disaster relief situation.
If you are unable to indicate a preference (e.g., if you are unconscious) we may proceed to share your information after determining that to do so is in your best interest. Additionally, we may share your information when needed to lessen a serious and imminent threat posed to health or safety.
Other Uses and Disclosures of Your PHI that Do Not Require Authorization
We are also allowed to disclose your PHI without your authorization in the following circumstances:
- To Comply with the Law. We disclose PHI when we are required to do so by federal, state or local law.
- For Public Health Activities. For example, we disclose PHI when we report to a public health authority for purposes such as public health surveillance or public health investigations. If directed by that health authority, we’ll also disclose your PHI to a foreign government agency that is collaborating with the public health authority.
- For Reports About Victims of Abuse, Neglect, or Domestic Violence. We will disclose your PHI in these reports only if we are required or authorized by law to do so, or if you otherwise agree.
- To Health Oversight Agencies. We will provide your PHI as requested to government agencies with the authority to investigate or audit our operations.
- For Lawsuits and Disputes. If you’re involved in a lawsuit or dispute, we may disclose your PHI in response to a subpoena or court or administrative order. We may also disclose your PHI in response to a subpoena, discovery request, or other lawful process filed by someone else involved in the dispute, but only if the party seeking your PHI provides us with satisfactory assurances that you’ve been given notice of the request, and that the party seeking your PHI has obtained a protective order for the information requested.
- To Law Enforcement. Under certain limited circumstances, we may disclose your PHI to law enforcement officials. For example, disclosures may be made in response to a warrant or subpoena or for the purpose of identifying or locating a suspect, witness or missing persons or to provide information about victims of crimes.
- To Coroners, Medical Examiners and Funeral Directors. We may disclose your PHI to facilitate the duties of these individuals.
- For Purposes of Organ Procurement. We may disclose your PHI to facilitate organ donation and transplantation.
- For Research Purposes. Under certain circumstances, we may disclose your PHI to researchers who are conducting a specific research project. For certain research activities, an Institutional Review Board (“IRB”) or Privacy Board may approve uses and disclosures of your PHI without your authorization.
- To Avoid Harm. We may disclose your PHI to someone who can help prevent a serious threat to your health and safety or the health and safety of another person or the public.
- For Special Government Functions. For example, we may disclose your PHI to authorized federal officials for intelligence and national security activities that are authorized by law.
- Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose your PHI to the correctional institution or law enforcement official if necessary to provide you with health care, protect the health and safety of others, or provide for the safety of the correctional institution.
- For Workers’ Compensation Purposes. We may provide your PHI to comply with workers’ compensation laws.
Impact of Other Laws
State and other federal laws may have additional requirements that we must follow or may be more stringent than HIPAA regarding the use and disclosure of your PHI. If there are specific, more restrictive requirements, even for some of the purposes described above, we may not disclose your PHI without your written permission as required by such laws.
Uses and Disclosures of PHI Requiring Your Authorization
Use and disclosures of your PHI for other purposes may be made only with your written authorization and unless we have your authorization we will not:
- Use or disclose your PHI for marketing purposes; and
- Share psychotherapy notes (to the extent we have any).
If you give us written authorization for a use or disclosure of your PHI, you may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose your PHI for the purposes specified in the written authorization, except to the extent we have already taken action in reliance on the authorization, or if your authorization was obtained as a condition of you obtaining insurance coverage and the law allows us to contest a claim or the policy . To revoke an authorization, make a written request to our Privacy Officer, using the contact information below.
We Will Never Sell your PHI for marketing purposes.
Your Rights Regarding Your PHI
You have the following rights regarding your PHI. All requests or communications to us to exercise your rights discussed below must be submitted in writing to the Privacy Officer at the contact information listed below.
The Right to Choose How We Communicate with You
- You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address.
- We will consider all reasonable requests and must agree to the request if you clearly state we could endanger you by not agreeing.
The Right to Access and Receive Copies of Your PHI
- Subject to certain exceptions, you may look at and copy your PHI if you make this request in writing. You may ask for a paper copy or, if your PHI is maintained electronically, an electronic copy of your PHI. We may deny your request in certain limited circumstances. If we deny your request, we will tell you in writing and let you know if you may request a review of the denial. We reserve the right to charge you a fee authorized by law to complete your request. Alternatively, we may provide you with a summary or explanation of your PHI, if you agree to that and to the cost, in advance.
The Right to Amend Your PHI
- If you believe the PHI we have about you is incomplete or incorrect, you may ask us to amend it. Any such request must be made in writing and must tell us why you think the amendment is appropriate.
- We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. Additionally, we may deny your request if you ask us to amend information that:
- is not part of the medical information kept by or for eternalHealth;
- was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
- is already accurate and complete.
- If we deny your request, you have the right to file a statement of disagreement with us, which will become part of your record with us.
The Right to Get a List of the Disclosures We Have Made
- You have the right to request an accounting of disclosures we make of your PHI. Please note that certain disclosures need not be included in the accounting we provide to you. Your request must state a time period, which may not go back more than six years. If you request this accounting more than once in a 12-month period, we may charge you a reasonable fee.
The Right to Request Limits on Uses and Disclosures of Your PHI
- You have the right to request that we limit how we use or disclose your information. Except under limited circumstances, we are not required to agree to your request, but if we do, we will abide by our agreement (except in an emergency).
The Right to Get a Paper Copy of This Notice
- Changes to the Terms of this Notice: We reserve the right to make changes to this Notice as permitted by law and to make the revised Notice effective for PHI we already have about you as well as any information we obtain in the future, as of the effective date of the revised Notice. The new Notice will be available upon request, on our website, and we will mail a copy to you.
If you believe your privacy rights have been violated, you may file a complaint with eternalHealth or with the Secretary of the federal Department of Health and Human Services Office of Civil Rights.
You can file a complaint with the Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling +1 (877) 696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.
To file a complaint with us, you must make that complaint in writing and send it to our Privacy Officer using the contact information below. You may also contact our Privacy Officer if you have questions or comments about our privacy practices. We will not retaliate against you for filing a complaint.
For more information about any of our privacy practices, to exercise your privacy rights, or to file a complaint, contact our privacy officer at:
eternalHealth Privacy Officer
376 Boylston St.
Boston, MA 02116
+1 (857) 557-6007