Privacy Policy

References to “we,” “us,” and “our” mean the members of the Graham Healthcare Group Affiliated Covered Entity (ACE). An affiliated covered entity is a group of organizations under common ownership or control who designate themselves as a single ACE for purposes of compliance with the Health Insurance Portability and Accountability Act (HIPAA). The Graham Healthcare Group ACE, and its employees and workforce members involved in your care, are bound to follow this Notice of Privacy Practices (“Notice”). Members of the ACE will share PHI with each other for treatment, payment, and health care operations as permitted by HIPAA and this Notice.

For a complete list of the Graham Healthcare Group ACE, please contact the Privacy Office.

When it comes to your health information, you have certain rights. This section explains your rights and our responsibilities.

Get an electronic or paper copy of your medical record

You can ask to see or get an electronic or paper copy of your medical record and other health information.
We will provide a copy or summary within 30 days of your request.
A reasonable, cost-based fee may apply. For home health patients, we will provide a copy free of charge at your next visit or within 4 business days, whichever comes first.

Ask us to correct your medical record

• You can request corrections if you believe your health information is incorrect or incomplete.
• If we deny your request, we’ll provide a written explanation within 60 days.

Request confidential communications

• You may ask us to contact you in a specific way (e.g., phone, mail) or at a different address.
• We will agree to all reasonable requests.

Ask us to limit what we use or share

• You can request limits on use or sharing of health information. We may deny if it affects your care.
• If you pay for a service out-of-pocket in full, you can request we not share that information with your insurer. We will comply unless required by law.

Get a list of disclosures

• You can request a list of disclosures from the past six years (excluding treatment, payment, and operations).
• One disclosure list per year is free; additional requests may incur a cost-based fee.

Get a copy of this privacy notice

You can request a paper copy of this Notice at any time, even if you’ve agreed to receive it electronically.

Choose someone to act for you

• If you’ve given someone medical power of attorney or have a legal guardian, that person may exercise your rights.
• We will verify authority before acting on their instructions.

File a complaint if you feel your rights are violated

You can complain to us using the information on page 1 or file a complaint with the U.S. Department of Health and Human Services
Office for Civil Rights at 200 Independence Avenue, S.W., Washington, D.C. 20201, call (877) 696-6775, or visit
hhs.gov/ocr/privacy/hipaa/complaints.
We will not retaliate against you.

For certain health information, you can tell us your choices about what we share.

You have the right to tell us to:

• Share information with family, close friends, or others involved in your care.
• Share information in a disaster relief situation.
• Include your information in a hospital directory.

If you are unable to communicate preferences, we may share information in your best interest or to lessen a serious health or safety threat.

We never share your information without written permission for:

• Marketing purposes
• Sale of your information
• Most sharing of psychotherapy notes

Fundraising: We may contact you for fundraising, but you can opt out at any time.

Below are examples of how we use and disclose health information. Some categories, such as HIV, genetic, substance abuse, and mental health records, may have additional state or federal protections.

Treatment

We use your information and share it with other professionals who are treating you. Example: A doctor treating you for an injury asks another doctor about your overall health.

Health Care Operations

We use and share your information to run our practice, improve your care, and contact you when necessary. Example: We use your health information to manage treatment and services.

Payment

We use and share your information to bill and receive payment. Example: We share your information with your health insurance plan so it will pay for your services.

Public Health and Safety

• Preventing disease
• Helping with product recalls
• Reporting adverse reactions to medications
• Reporting suspected abuse, neglect, or domestic violence
• Preventing or reducing a serious threat to health or safety

We can also use or share your information for health research.

Comply with the law

We will share your information when required by state or federal law, including with HHS to confirm HIPAA compliance.

Organ and tissue donation

We may share your information with organ procurement organizations.

Medical examiner or funeral director

We may share information when an individual dies.

Workers’ compensation, law enforcement, and government requests

• For workers’ compensation claims
• For law enforcement purposes
• With health oversight agencies
• For government functions (military, national security, protective services)

Lawsuits and legal actions

We may share information in response to court orders, administrative orders, or subpoenas.

• We are required by law to maintain the privacy and security of your protected health information.
• We will notify you promptly if a breach occurs that may compromise your information.
• We must follow the practices described in this Notice and provide you a copy.
• We will not share your information outside these terms unless you authorize in writing. You may revoke authorization at any time.
• Phone numbers collected for SMS messaging will not be shared with third parties without your consent.

More information: HIPAA Notice of Privacy Practices

Exclusion for Phone Numbers & SMS Consent

Phone numbers collected for SMS messaging will not be shared with third-party providers without your explicit consent, except as required by law.
We are committed to confidentiality and regulatory compliance.

Changes to This Notice

We may change the terms of this Notice, which will apply to all information we hold. The new Notice will be available upon request, in our office, and on our website.