Privacy Notice

Cavallaro Family Practice Notice of Privacy Practices

As Required by the Privacy Regulations Created Under the Health Insurance Portability & Accountability Act of 1996 (HIPAA)

This Notice describes how medical information about you (as a patient of Cavallaro Family Practice) may be used and disclosed, and how you can get access to this information. Please review this Notice carefully.

A. Our Commitment to Your Privacy

Cavallaro Family Practice is dedicated to maintaining the privacy of your Protected Health Information. "Protected Health Information" or "PHI" is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition, the provision of health care to you, or the payment for your health care. In conducting our business, we will create records regarding you and the treatment and services we provide to you. We are required by law to maintain the confidentiality of health information that identifies you.

This Notice of Privacy Practices describes how we may use and disclose your Protected Health Information to carry out treatment, payment and health care operations and for other purposes that are permitted or required by law. It also describes your rights to access and control your PHI. We reserve the right to revise or amend this Notice of Privacy Practices. Any revision or amendment to this Notice will be effective from the date of revision or amendment forward. Each Care Center will post a copy of our current Notice in our offices in a visible location at all times, and you may request a copy of our most current Notice at any time. You may also review a copy on Cavallaro Family Practice website.

B. How We May Use and Disclose Your Protected Health Information (PHI)

The following are examples of the types of uses and disclosures of your Protected Health Information by your Cavallaro Family Practice physician and other treatment providers and our office staff. These uses and disclosures are permitted under HIPAA and other applicable laws and regulations and may be made without your specific written authorization.

1. Treatment: We will use and disclose your PHI to provide, coordinate, and manage your health care and any related services.

This includes the coordination or management of your health care with another provider. For example, we may disclose your PHI

to another physician who may be treating you or to whom you have been referred to ensure that the physician has the necessary information to diagnose or treat you. In addition, we may ask you to have laboratory tests (such as blood or urine tests), and we may receive and use the results to help us reach a diagnosis. We might use your PHI in order to write a prescription for you, or we might disclose your PHI to a pharmacy when we order a prescription for you.

2. Payment: Cavallaro Family Practice may use and disclose your PHI in order to bill and collect payment for the services and items you may receive from us. For example, we may contact your health insurer to certify that you are eligible for benefits (and for what range of benefits), and we may provide your insurer with details regarding your treatment to determine if your insurer will cover, or pay for, your treatment. We also may use and disclose your PHI to obtain payment from third parties that may be responsible for such costs, such as family members or to other health care providers and entities to assist in their billing and collection efforts.

3. Health Care Operations: may use and disclose your PHI to operate our business. For example, Cavallaro Family Practice may use your PHI to evaluate the quality of care you received from us, or to conduct cost-management and business planning activities

for Cavallaro Family Practice. We may disclose your PHI to other health care providers and entities to assist in their health care operations. We will share your PHI with third party "business associates" that perform various activities (for example, billing or transcription services) for our practice. Whenever an arrangement between Cavallaro Family Practice and a business associate involves the use or disclosure of your PHI, we will have a written contract that contains terms that will protect the privacy of your PHI.

4. Public Health Activities: For example, we may disclose PHI to report information about births, deaths, various diseases, adverse events and product defects to government officials in charge of collecting that information; to prevent, control, or report disease, injury or disability as permitted by law; to conduct public health surveillance, investigations and interventions as permitted or required by law; or to notify a person who has been exposed to a communicable disease or who may be at risk of contracting or spreading a disease as authorized by law.

5. Health Oversight: We may disclose your PHI to a health oversight agency for activities authorized by law. For example, we may disclose PHI to assist the government or other health oversight agency with activities including audits; civil, administrative or criminal investigations, proceedings or actions; or other activities necessary for the government to monitor government programs, compliance with civil rights laws and the health care system in general.

6. Legal Proceedings: We may disclose your PHI in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), or in certain conditions in response to a subpoena, discovery request or other lawful process.

7. Law Enforcement/Criminal Activity: We may disclose PHI, so long as applicable legal requirements are met, for law enforcement purposes. For example, we may disclose PHI when a law requires that we report information to government agencies and law enforcement personnel about victims of abuse, neglect, or domestic violence; when dealing with gunshot or other wounds; or for the purpose of identifying or locating a suspect, fugitive, material witness or missing person.

8. Coroners, Funeral Directors, and Organ Donation: We may disclose PHI to a coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose PHI to a funeral director, as authorized by law, in order to permit the funeral director to carry out its duties. We may disclose such information in reasonable anticipation of death. PHI may also be used and disclosed for cadaveric organ, eye or tissue donation purposes.

9. Research: Research is defined as a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. In limited circumstances, we may use or disclose PHI to conduct medical research.

10. Military Activity and National Security: If you are a member of U.S. or foreign military forces (including veterans) and if required by the appropriate authority, we may use or disclose PHI for activities deemed necessary by appropriate military command authorities; for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits; or to foreign military authority if you are a member of that foreign military services. We may also disclose your PHI to federal officials for intelligence and national security activities authorized by law.

11. Workers' Compensation: We may disclose your PHI as authorized to comply with workers' compensation laws and other similar legally-established programs.

12. Inmates: We may use or disclose your PHI to correctional institutions or law enforcement officials if you are an inmate or under the custody of a law enforcement official. Disclosure for these purposes would be necessary for the institution to provide health care services to you; for the safety and security of the institution; and/or to protect your health and safety or the health and safety of other individuals.

13. To Avoid Harm: In order to avoid a serious threat to the health or safety of you, another person or the public, we may provide PHI to law enforcement personnel or persons able to prevent or lessen such harm.

14. Appointment Reminders and Health-Related Benefits or Services: We may use and disclose PHI to provide appointment reminders or give you information about treatment alternatives, or other health care services or benefits we offer. Please let us know if you do not wish to have us contact you for these purposes, or you would rather we contact you at an alternate telephone number or address.

15. Immunizations: We may disclose an immunizations list to schools required to obtain proof of immunization prior to admitting the student, so long as we have obtained and documented the patient's or patient's legal representative's "informal agreement" to the disclosure.

16. Decedents: In certain circumstances, we may disclose PHI about a decedent to family and others involved in the decedent's health care or payment for health care. Other disclosures may require written authorization from the executor or administrator of the decedent's estate.

The following are additional examples of the types of uses and disclosures of your Protected Health Information by your Cavallaro Family Practice physician and other treatment providers and our office staff. These uses and disclosures are permitted under HIPAA, but require you to have an opportunity to object or agree prior to the disclosure.

Others Involved in Your Health Care or Payment for your Care: Unless you object, we may disclose to a member of your family, a relative, a close friend or any other person you identify, your PHI that directly relates to that person's involvement in your health care or payment for your health care. If you are not present or able to agree or object to the use or disclosure of the PHI, then your physician may, using professional judgment, determine whether the disclosure is in your best interest. We may use or disclose PHI to notify or assist in notifying a family member, personal representative or any other person that is responsible for your care of your location, general condition or death. Finally, we may use or disclose your PHI to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in your health care.

C. Circumstances Requiring Your Written Authorization for Use and Disclosure

Other than as stated in this Notice, we will not use and disclose your PHI without your written authorization. You can later revoke your authorization in writing except to the extent we have already acted in reliance on your authorization.

D. Your Privacy Rights

You have the following rights regarding the PHI we maintain about you:

1. Inspect and Copy: In most cases, you have the right to look at or get copies of your PHI that we maintain, but you must make the request in writing. If we don't have your PHI but we know who does, we will tell you how to get it. We will respond to you within 30 days after receiving your written request. In certain situations, we may deny your request. If we do, we will tell you in writing our reasons for the denial and explain your right to have the denial reviewed when applicable. If you request a copy of your information, we may charge you reasonable fees for the costs of copying, mailing or other costs incurred by us in complying with your request. Instead of providing the PHI you requested, we may provide you with a summary or explanation of the PHI as long as you agree to that and to the cost in advance. Note also that, you have the right to access your PHI in an electronic format (to the extent we maintain the information in such a format) and to direct us to send the e-record directly to a third party. We may charge for the labor costs to transfer the information; and charge for the costs of electronic media if you request that we provide you with such media.

*Please note: If you are the parent or legal guardian of a minor, certain portions of the minor's records may not be accessible to you. For example, records relating to care and treatment to which the minor is permitted to consent himself/herself (without your consent) may be restricted unless the minor patient provides an authorization for such disclosure. **

2. Request a Restriction: This means you may ask us, in writing, not to use or disclose any part of your PHI for the purposes of treatment, payment or health care operations. We will consider your request but we are not legally required to accept it, except in the following circumstance. You have the right to ask us to restrict the disclosure of your PHI to your health plan for a service we provide to you where you have directly paid us (out of pocket, in full) for that service, in which case we are required to honor your request. If we accept your request for a restriction, we will put any limits in writing and abide by them except in emergency situations. Under certain circumstances, we may terminate our agreement to a restriction.

3. Confidential Communications: You have the right to request that Cavallaro Family Practice communicate with you about your health and related issues in a particular manner or at a certain location. For instance, you may ask that we contact you by telephone at home, rather than work, or at a particular address. We must agree to your request so long as we can easily abide by it in the manner you requested.

4. Amendment: You may ask us to amend your health information if you believe it is incorrect or incomplete, so long as the information is maintained in our records. You must submit your request in writing and provide us with a reason that supports your request for amendment. We will respond within 60 days of receipt of your written request. We may deny your request if you ask us to amend information that is in our opinion: (a) accurate and complete; (b) not part of the PHI kept by or for Cavallaro Family Practice; (c) not part of the PHI which you would be permitted to inspect and copy; or (d) not created by Cavallaro Family Practice, unless the individual or entity that created the information is not available to amend the information.

5. Accounting of Disclosures: You have the right to get a list of instances in which we have disclosed your PHI. The list will not include uses or disclosures made for purposes of treatment, payment, or health care operations, those made pursuant to your written authorization, or those made directly to you or your authorized representative. The list also will not include uses and disclosures made for national security purposes, or to corrections or law enforcement personnel. We will respond within 60 days of receiving your written request. The list we will give you will include disclosures made in the last six years unless you request

a shorter time. The list will include the date of the disclosure, to whom PHI was disclosed (including the address, if known), a description of the information disclosed, and the reason for the disclosure. We will provide one list during any 12-month period without charge, but if you make more than one request in the same year, we will charge you a reasonable fee for each additional request.

6. Breach of PHI: Cavallaro Family Practice will notify individuals following a breach of their unsecured PHI. A breach means the acquisition,

access, use, or disclosure of unsecured PHI in a manner not permitted under HIPAA and that compromises the security or privacy of the PHI.

7. The Right to Get This Notice by E-Mail: You have the right to get a copy of this Notice by e-mail. Even if you have agreed to receive notice via e-mail, you also have the right to request a paper copy of this Notice.

E. Other Activities Involving the Use and Disclosure of Your PHI

Marketing Communications: We will obtain your written authorization prior to using or disclosing your PHI for marketing purposes. However, we are permitted to provide you with marketing materials in a face-to-face encounter, without obtaining a marketing authorization. We are also permitted to give you a promotional gift of nominal value, if we so choose, without obtaining a marketing authorization. In addition, as long as we are not paid to do so, we may communicate with you about products or services relating to your treatment, case management or care coordination, or alternative treatments, therapies, providers or care settings. We may use or disclose PHI to identify health-related services and products that may be beneficial to your health and then contact you about the services and products
2. Sale of PHI: We will disclose your PHI in a manner that constitutes a sale only upon receiving your prior authorization. Sale of PHI does not include a disclosure of PHI for public health purposes; research; treatment and payment purposes; sale, transfer, merger or consolidation of all or part of our business and for related due diligence activities; to the individual; as required by law; or for any other purpose permitted by and in accordance with HIPAA.

3. Fundraising Activities: We may use certain information (name, address, telephone number, dates of service, age and gender) to contact you for the purpose of various fundraising activities. If you do not want to receive future fundraising requests, please write to the Privacy Officer at the below address.

4. Incidental Uses and Disclosures: Incidental uses and disclosures of information may occur. An incidental use or disclosure

is a secondary use or disclosure that cannot reasonably be prevented, is limited in nature, and that occurs as a by-product of an otherwise permitted use or disclosure. However, such incidental uses or disclosure are permitted only to the extent that we have applied reasonable safeguards and do not disclose any more of your PHI than is necessary to accomplish the permitted use or disclosure. For example, disclosures about a patient within the office that might be overheard by persons not involved in your care would be permitted.

5. Business Associates: We may engage certain persons or companies to perform certain of our functions on our behalf and

we may disclose certain PHI to these persons or companies. For example, we may share certain PHI with our billing company or computer consultant in order to facilitate our health care operations or payment for services provided in connection with your care. We will require our business associates to enter into an agreement to keep your PHI confidential and to abide by certain terms and conditions.

F. How to Complain About Our Privacy Practices

If you think that we may have violated your privacy rights, or you disagree with a decision we made about access to your PHI, you may file a complaint with the Privacy Officer listed below. You also may send a written complaint to the Secretary of the Department of Health and Human Services at 200 Independence Ave., S.W., Room 615F, Washington, DC 20201. We will take no retaliatory action against you if you file a complaint about our privacy practices.

If you have any questions about this Notice or any complaints about our privacy practices, please contact our HIPAA Privacy Officer at:

Cavallaro Family Practice
432 Ganttown Road Suite 202
Sewell, NJ 08080