This notice describes how Tristán Associates may use and disclose your "Protected Health Information" (PHI) (i.e. personal medical information), and how you can get access to this information. This Notice of Privacy Practices is in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Introduction

At Tristán Associates, we are committed to treating and using your PHI responsibly. This Notice of Privacy Practices describes the personal information we collect, and how and when we use or disclose that information. It also describes your rights as they relate to your PHI. This Notice is effective 14 April 2003, and applies to all PHI as defined by federal HIPAA regulations.

Understanding Your Health Record/Information

Each time you visit Tristán Associates; a record is made of your visit. Typically, this record contains your symptoms, examination and test results, and diagnoses. This information, often referred to as your health or medical record or PHI, serves as:

• a means of communication among the many health professionals who contribute to your care,
• a legal document describing the care you received,
• a means by which you or a third-party payer can verify that services billed were actually provided,
• a tool in educating health professionals,
• a source of data for medical research,
• a source of information for public health officials charged with improving the health of this state and the nation,
• a source of data for our facility planning and marketing, and
• a tool with which we can assess and continually work to improve the care we render and the outcomes we achieve.

Your PHI Rights

Although your PHI record is the physical property of Tristán Associates, the information belongs to you. You have the right to:

• obtain a paper copy of Tristán Associates Notice of Privacy Practices upon request,
• inspect and copy your PHI as required by 45 CFR 164.524,
• amend your PHI as required by 45 CFR 164.528,
• obtain an accounting of disclosures of your PHI as required by 45 CFR 164.528,
• request communications of your PHI by alternative means or at alternative locations,
• request a restriction on certain uses and disclosures of your PHI as required by 45 CFR 164.522, and
• revoke your authorization to use or disclose your PHI except to the extent that action has already been taken.

Our Responsibilities

Tristán Associates is required to:

• maintain the privacy of your PHI,
• offer you this notice as to our legal duties and privacy practices with respect to information we collect and maintain about you,
• abide by the terms of this Notice,
• notify you if we are unable to agree to a requested restriction, and
• accommodate reasonable requests you may have to communicate PHI by alternative means or at alternative locations.

We reserve the right to change our practices and to make the new provisions effective for all PHI information we maintain. Should our practices change, the amended notice shall be placed on our website, and shall be available upon request.

For More Information or to Report a Problem

If you have questions or need additional information, please contact Tristán Associates' Privacy/Compliance Officer, at 717-652-5840.

If you believe your privacy rights have been violated, you can file a written complaint with Tristán Associates Privacy/Compliance Officer or with the Office for Civil Rights, US Department of Health and Human Services. There will be no retaliation for filing a complaint with either the Privacy/Compliance Officer or the Office for Civil Rights. The address for the OCR is listed below:

Office for Civil Rights
US Department of Health and Human Services
200 Independence Avenue, SW
Room 509F, HHH Building
Washington, DC 20201

Examples of Disclosures of PHI for Treatment, Payment and Health Operations

We will use your PHI for treatment.

For example: One of our radiologists will interpret your examination or procedure and develop a report of the results that will be sent to your family/referring doctor. We may request reports of or images from a previous imaging study performed elsewhere.

We will use your PHI for payment.

For example: A bill may be sent to you or a third-party payer. The information on or accompanying the bill may include your PHI (i.e. information that identifies you, as well as your diagnosis, procedures and supplies used).

We will use your PHI for regular health operations.

For example: We may send you appointment reminders. Members of the radiology staff, Compliance Committee, or the OSHA/ Nurse representative may use your PHI record to assess the care and outcomes in your case and others like it. This information will then be used in an effort to continually improve the quality and effectiveness of the healthcare and service we provide.

Business associates: There are some services provided in our organization through contacts with business associates. Examples include certain laboratory tests, companies that provide and maintain our equipment, and companies that perform audits of our practice. When these services are contracted, we may disclose your health information to our business associates, to the extent necessary so that they can perform the job we've asked them to do. However, we require our business associates to appropriately safeguard your PHI.

Notification: We may use or disclose PHI to notify, or to assist in notifying a family member, personal representative, or another person responsible for your care, of your location and general condition.

Communication with family: Health professionals, using their best judgment, may disclose to a family member, other relative, close personal friend or any other person you identify, PHI relevant to that person's involvement in your care or payment related to your care.

Research: With your prior consent, we may disclose your PHI to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your PHI.

Marketing: With your prior consent, we may contact you to provide information about treatment alternatives or other health-related benefits and services that may be of interest to you.

Food and Drug Administration (FDA): We may disclose to the FDA PHI relative to adverse events with respect to drug reactions, product and product defects, imaging equipment defects, or post-marketing surveillance information to enable product recall, repair or replacement.

Workers compensation: We may disclose PHI to the extent authorized by and necessary to comply with laws relating to workers compensation or other similar programs established by law.

Public health: As required by law, we may disclose your PHI to public health or legal authorities charged with preventing or controlling disease, injury or disability.

Correctional institutions: Should you be an inmate of a correctional institution, we may disclose to the institution or agents thereof PHI necessary for your health and the health and safety of other individuals.

Law enforcement: We may disclose PHI for law enforcement purposes as required by law or in response to a valid subpoena.

Federal law makes provision for your PHI to be released to an appropriate health oversight agency, public health authority or attorney, provided that a work force member or business associate believes in good faith that we have engaged in unlawful conduct or have otherwise violated professional or clinical standards and are potentially endangering one or more patients, workers or the public.

Effective Date: 14 April 2003