Revised: November 16th, 2021
In accordance with the Health Insurance Portability and Accountability Act (HIPAA), this notice describes how health information about you may be used and disclosed, and how you can get access to your protected health information.
The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records and other personal health information and applies to health plans and those health care providers that conduct certain health care transactions electronically. The Rule requires appropriate safeguards to protect the privacy of personal health information and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization. The Rule also gives patients’ rights over their health information, including rights to examine and obtain a copy of their health records and to request corrections. The Privacy Rule is located at 45 CFR Part 160 and Subparts A and E of Part 164. The following is a summary of key elements of the Privacy Rule and not a complete or comprehensive guide to compliance. Entities regulated by the Rule are obligated to comply with all applicable requirements and should not rely on this summary as a source of legal information or advice.
Note to our Clients: This notice is not the same as your health plan’s Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Notice of Privacy Practices, which describes in detail how your health plan uses and discloses your individually identifiable health information. Your health plan has a Notice of Privacy Practices, which includes policies for use and disclosure of your information, including information that you provide to Envoy. This is managed by your health plan, not by Envoy. Envoy isn’t able to let you know of changes or updates. If you would like to read a copy of your health plan’s Notice of Privacy Practices, please ask your plan for a copy.
To summarize, this notice provides you with the following important information:
- How we may use and disclose your protected health information
- Your privacy rights in your protected health information
- Our obligations concerning the use and disclosure of your protected health information
The terms of this notice apply to all records containing your protected health information that are created or retained by our organization. We reserve the right to revise or amend our notice of privacy practices. Any revision or amendment to this notice will be effective for all of your records our organization has created or maintained in the past, and for any of your records we may create or maintain in the future. Envoy will post a copy of our most current notice in our offices in a prominent location and provide you with a copy of our most current notice.
If you have questions about this notice, please contact: Privacy Officer at: 480-584-5894
Our Commitment To Your Privacy
Envoy is dedicated to maintaining the privacy of your protected health information. In conducting our business, we will create records regarding you and the services we provide you. We are required by law to maintain the confidentiality of health information that identifies you. We are also required by law to provide you with this notice of our legal duties and privacy practices concerning your protected health information. By law, we must follow the terms of the notice of privacy practices that we have in effect at the time.
What Information is Protected:
The Privacy Rule protects all “individually identifiable health information” held or transmitted by Envoy or its business associate, in any form or media, whether paper, oral or electronic. The Privacy Rule calls this information “protected health information (PHI).” “Individually identifiable health information” is information, including demographic data, that relates to:
- The individual’s past, present or future physical or mental health or condition,
- The provision of health care to the individual, or
- The past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual. Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number).
Basic Principle: A major purpose of the Privacy Rule is to define and limit the circumstances in which an individual’s protected health information may be used or disclosed by Envoy. Envoy must not use or disclose protected health information, except either: (1) as the Privacy Rule permits or requires; or (2) as the individual who is the subject of the information (or the individual’s personal representative) authorizes in writing.
Required Disclosures: Envoy must disclose protected health information in these two situations: (a) to individuals (or their personal representatives) specifically when they request access to, or an accounting of disclosures of, their protected health information; and (b) to Human Health Services when it is undertaking a compliance investigation, compliance review, or an enforcement action.
Permitted Uses and Disclosures: Envoy is permitted, but not required, to use and disclose protected health information, without an individual’s authorization, for the following purposes or situations: (1) To the Individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.
Non-compliance with HIPAA regulations can result in:
- Civil violations with penalties ranging from $100 to $50,000 per violation with an annual maximum of $1.5 million for some violations.
- Criminal penalties that are handled by the Department of Justice with penalties ranging from fines to imprisonment.
Your Rights Regarding Your Protected Health Information.
You have the following rights regarding the protected health information that we maintain about you:
Confidential Communications: You have the right to request that our organization communicate with you about your health and related issues in a particular manner or at a certain location. For instance, you may ask that we contact you at home, rather than at work. In order to request a type of confidential communication, you must make a written request to the Envoy Privacy Officer at 4920 S Wendler Drive, Suite 115, Tempe, AZ 85282. We will agree to your request if it is reasonable.
Requesting Restrictions: You have the right to request a restriction in our use or disclosure of your protected health information for treatment, payment, or health care operations, or that we limit our disclosure of your protected health information to individuals involved in your care or the payment of your care, such as family members and friends. To request a restriction in our use or disclosure of your protected health information, you must make a detailed request including: (a) the information you wish restricted; (b) whether you are requesting to limit our practice’s use, disclosure or both; and (c) to whom you want the limits to apply. If you or someone on your behalf pays for a health care item or service in full, you can request that Envoy not disclose information about that item or service to your health plan for health payment or health care operations purposes, and we will agree to that restriction (unless the law requires us to make the disclosure). We are not required to agree to other requests; however, if we do not agree, we are bound by our agreement except when otherwise required by law, or in an emergency when the information is necessary to treat you or we terminate the restriction.
Inspection and Copies: You have the right to inspect and obtain a copy of the protected health information that may be used to make decisions about you, including patient medical records and billing record. You must submit your request in writing to our Privacy Officer at 4920 S Wendler Drive, Suite 115, Tempe, AZ 85282 to inspect and/or obtain a copy of your protected health information. Our organization may charge a fee for the costs of copying, mailing, labor, and supplies associated with your request. Our practice may deny your request to inspect and/or copy in certain limited circumstances; however, you may request a review of our denial. Reviews will be conducted by another licensed health care professional, chosen by us.
Amendment: You may ask us to amend your protected health information if you believe it is incorrect or incomplete, and you may request an amendment for as long as the information is kept by Envoy. Your request for an amendment must be made in writing and submitted to Privacy Officer at 4920 S Wendler Drive, Suite 115, Tempe, AZ 85282. You must provide us with a reason that supports your request for amendment. Our organization will deny your request if you fail to submit your request (and the reason supporting your request) in writing. Also, we may deny your request if you ask us to amend information that is:
- accurate and complete;
- not part of the protected health information kept by or for the organization;
- not part of the protected health information which you would be permitted to inspect and copy;
- and/or not created by our organization, unless the individual or entity that created the information is not available to amend the information.
Accounting of Disclosures: All of our clients have the right to request an “accounting of disclosures.” An “accounting of disclosures” is a list of certain disclosures our organization has made of your protected health information. To obtain an accounting of disclosures, you must submit your request in writing to Privacy Officer at 4920 S Wendler Drive, Suite 115, Tempe, AZ 85282. All requests for an “accounting of disclosures” must state a time period which may not be longer than six years and may not include dates before June 1, 2015. The first list you request within a 12-month period is free of charge, but we may charge you for additional lists within the same 12-month period. We will notify you of the costs involved with additional requests, and you may withdraw your request before you incur any costs.
Right to a Paper Copy of This Notice: You are entitled to receive a paper copy of our notice of privacy practices. You may ask us to give you a copy of this notice any time. To obtain a copy of this notice, contact our Privacy Officer at (480) 584-5894.
Right to File a Complaint: If you believe your privacy rights have been violated, you may file a complaint with our organization or with the Secretary of the Department of Health and Human Services. To file a complaint with Envoy, send your written complaint to: Envoy, Attn: Privacy Officer, 4920 S Wendler Drive, Suite 115, Tempe, AZ 85282. All complaints must be submitted in writing. Envoy will not penalize or otherwise take action against you for filing a complaint.