CHIMES
NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY
This Notice of Privacy Practices (“Notice”) is given to you by Chimes to describe the ways in which Chimes may use and disclose your health information (called “protected health information” or “PHI”) and to notify you of your rights with respect to PHI in the possession of Chimes, its affiliates or contractors. PHI is information that may identify you and that relates to your past, present, or future physical or mental health or condition; the provision of health care products and services to you; or the payment for such services.
Chimes protects the privacy of PHI, which also is protected from disclosure by state and federal law. In certain circumstances, pursuant to this Notice, individual authorization, or applicable laws and regulations, PHI can be used by Chimes or disclosed to other parties. Below are categories describing these uses and disclosures, along with some examples to help you better understand each category.
Chimes has designated itself as a hybrid entity under the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and this Notice applies to those functions of Chimes that have been designated as being covered by HIPAA. As a result, this Notice only applies when Chimes is providing treatment; it does not apply to other functions of Chimes such as certain school functions and training services, including the Chimes School.
Chimes is required by law to maintain the privacy of your PHI, to provide individuals with notice of the legal duties and privacy practices with respect to PHI, and to abide by the terms described in this Notice. Chimes reserves the right to change the terms of this Notice and of its privacy policies, and to make the new terms applicable to all of the PHI it maintains. Before Chimes makes an important change to its privacy policies, it will promptly revise this Notice and post a new Notice in registration and admitting areas.
Uses and Disclosures of PHI for which Authorization is Not Required
Chimes may use or disclose your PHI for the purposes of treatment, payment, and health care operations, described in more detail below, without obtaining written authorization from you.
FOR TREATMENT: Chimes may use and disclose PHI in the course of providing, coordinating, or managing your medical treatment, including the disclosure of PHI to other providers. These types of uses and disclosures may take place between physicians, nurses and other health care professionals who are involved in your care. For example, if you are being treated by a primary care physician, Chimes may need to disclose PHI to that physician.
FOR PAYMENT: Chimes may use and disclose PHI in order to collect payment for the health care services provided to you. For example, Chimes may need to give PHI to the state Medicaid Department or other health plan in order to be reimbursed for the services provided to you. Chimes may also disclose PHI to other health care providers and health plans for the payment activities of such providers or health plans.
FOR HEALTH CARE OPERATIONS: Chimes may use and disclose PHI as part of its operations, including for quality assessment and improvement, such as evaluating the treatment and services you receive and the performance of our staff in caring for you. Other activities include training, underwriting activities, compliance and risk management activities, planning and development, and management and administration. Chimes may disclose PHI to doctors, nurses, consultants, and others for review. These disclosures help make sure that Chimes is complying with all applicable laws and is continuing to provide health care at a high level of quality. Chimes may also disclose PHI to other health care providers and plans for certain of their operations, including their quality assessment and improvement activities, credentialing, peer review activities, and health care fraud and abuse detection or compliance, provided that those other providers and plans have, or have had in the past, a relationship with the individual who is the subject of the information.
In addition to using or disclosing PHI for treatment, payment and health care operations, Chimes may use and disclose PHI without your written authorization under the following circumstances:
BUSINESS ASSOCIATES: Chimes may use or disclose your PHI with outside companies that perform services for us, such as accreditation, billing services, legal, computer systems, or auditing services. These outside companies are called “Business Associates,” and they are required by HIPAA and by contract to keep your medical information confidential.
INDIVIDUALS INVOLVED IN YOUR CARE: Chimes may share your PHI with a family member, guardian, or other individuals who are involved in your care, or who help pay for your care. If you have any objection to sharing your PHI in this way, please contact Chimes’ Privacy Official, whose contact information is listed at the end of this Notice.
TO YOU OR YOUR PERSONAL REPRESENTATIVE: Chimes may disclose your PHI to you or to a representative appointed by you or designated by applicable law.
AS REQUIRED BY LAW AND LAW ENFORCEMENT: Chimes may use or disclose PHI when required by law, Chimes may also disclose PHI when ordered to do so in a judicial or administrative proceedings; in response to subpoenas or discovery requests; to identify or locate a suspect, fugitive, or missing person; when dealing with gunshot and other wounds; about criminal conduct; to report a crime, its location, the victims, or the identity, description, or location of a person who committed a crime; or for other law enforcement purposes.
JUDICIAL AND ADMINISTRATIVE PROCEEDINGS: Your PHI may be disclosed in response to a court or administration order, subpoena, discovery request, or other lawful process.
FOR PUBLIC HEALTH ACTIVITIES AND PUBLIC HEALTH RISKS: Chimes may disclose PHI to government officials in charge of collecting information about births and deaths; preventing and controlling disease; reports of child abuse or neglect and of other victims of abuse, neglect, or domestic violence; reactions to medications; or product defects or problems. Chimes may also disclose PHI to notify a person who may have been exposed to a communicable disease or may be at risk of contracting or spreading a disease or condition.
FOR HEALTH OVERSIGHT ACTIVITIES: Chimes may disclose PHI to the government for oversight activities authorized by law, such as audits; investigations; inspections; licensure or disciplinary actions; and other proceedings, actions, or activities necessary for monitoring the health care system, government programs, and compliance with civil rights laws.
CORONERS, MEDICAL EXAMINERS, AND FUNERAL DIRECTORS: Chimes may disclose PHI to coroners, medical examiners, and funeral directors for the purpose of identifying a decedent, determining a cause of death, or otherwise as necessary to enable these parties to carry out their duties consistent with applicable law.
ORGAN, EYE, AND TISSUE DONATION: Chimes may release PHI to organ procurement organizations to facilitate organ, eye, and tissue donation and transplantation.
RESEARCH: Under certain limited circumstances, Chimes may use and disclose PHI for medical research purposes. A researcher may have access to information that identifies you only through the special review process, or with your written permission. Researchers may only contact you if they have been given approval to do so by the special review process. You will only become a part of one of these research projects if you agree to do so and sign a consent form.
TO AVOID A SERIOUS THREAT TO HEALTH OR SAFETY: Chimes may use and disclose PHI to law enforcement personnel or other appropriate persons in order to prevent or lessen a serious threat to the health or safety of a person or the public.
SPECIALIZED GOVERNMENT FUNCTIONS: Chimes may use and disclose PHI of military personnel and veterans under certain circumstances as required by military command authorities. Chimes may also disclose PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities; for the provision of protective services to the President or other authorized persons or foreign heads of state; or to conduct special investigations.
WORKERS’ COMPENSATION: Chimes may disclose PHI to comply with workers’ compensation or other similar laws that provide benefits for work-related injuries or illnesses.
HEALTH-RELATED BENEFITS AND SERVICES; LIMITED MARKETING ACTIVITIES: Chimes may use and disclose PHI to inform you of treatment alternatives or other health-related benefits and services that may be of interest or benefit.
FUNDRAISING: Chimes may contact you to raise funds for Chimes; however you have the right to elect not to receive such communications.
DISASTER RELIEF: Chimes may disclose medical information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.
DISCLOSURES FOR HIPAA COMPLIANCE INVESTIGATIONS: Chimes must disclose your PHI to the Secretary of the U.S. Department of Health and Human Services (the “Secretary”) when requested by the Secretary in order to investigate compliance with privacy regulations issued under HIPAA.
Other Uses and Disclosures of PHI for Which Authorization Is Required
Other types of uses and disclosures of your PHI not described above will be made only with your written authorization, which you have the limited right to revoke in writing. Your PHI may not be used or disclosed for marketing purposes or sold by Chimes without your prior written authorization. If you sign a written authorization permitting uses and disclosures of your PHI other than those described in this Notice, you may revoke your authorization by submitting a written request to Chimes’ Privacy Official at any time. However, Chimes is unable to retract or invalidated any uses or disclosures that were made with your permission before you revoked your authorization.
HIPAA provides additional protection for psychotherapy notes, and most uses or disclosures of psychotherapy notes require your written permission. Psychotherapy notes are the personal notes of a mental health professional about a private or group counseling session.
In addition, other types of information may have greater protection under federal or state law, including but not limited to HIV/AIDS and other communicable disease information, genetic information, mental health information, or information about developmental disabilities. For this type of information, we may be required to get your written permission before disclosing it to others.
You have the following rights regarding your PHI
You have the following rights regarding your PHI. All requests must be submitted in writing to Chimes’ Privacy Official. Please contact the Privacy Official for additional information regarding any of these rights. The contact information for the Privacy Official can be found at the end of this Notice.
You may request that Chimes restrict the use and disclosure of your PHI. Chimes is not required to agree to any restrictions you request; but, if we do, we will be bound by the restrictions to which we agree, except in emergency situations. To request restrictions, you must make your request in writing. In your request, you must tell us: (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply (for example, disclosures to your spouse).
You have the right to request that communications of PHI to you from Chimes be made by particular means or at particular locations. For instance, you might request that communications be made at your work address, or by e-mail rather than regular mail. Your requests must be in writing and sent to the Privacy Official. Chimes will accommodate your reasonable requests without requiring you to provide a reason.
Generally, you have the right to inspect and/or copy your PHI in the possession of Chimes within a Designated Record Set. Chimes will inform you of the extent to which your request has or has not been granted. In some cases, Chimes may provide you a summary of the PHI you request if you agree in advance to such a summary and any associated fees. If you request copies of your PHI or agree to a summary of your PHI, Chimes may impose a reasonable fee to cover copying, postage, and related costs. If Chimes denies access to your PHI, we will explain the basis for the denial and your opportunity to have the denial reviewed by a licensed health care professional (who was not involved in the initial denial decision) designated as a reviewing official. If Chimes does not maintain the PHI you request, but we know where that PHI is located, we will tell you how to redirect your request.
If you believe that your PHI, maintained by Chimes in a Designated Record Set, contains an error or needs to be updated, you have the right to request that Chimes correct or supplement your PHI. Your request must be made in writing and it must explain why you are requesting an amendment to your PHI. Within sixty (60) days of receiving your request (unless extended by an additional thirty (30) days), Chimes will inform you of the extent to which your request has or has not been granted. Chimes generally can deny your request if your request relates to PHI that is (i) not created by Chimes; (ii) not part of the records Chimes maintains; (iii) not subject to being inspected by you; or (iv) is accurate and complete. If your request is denied, Chimes will give you a written denial that explains the reason for the denial and your rights to: (i) file a statement disagreeing with the denial; (ii) submit a request that any future disclosures of the relevant PHI be made with a copy of your request and Chimes’ denial attached, if you do not file a statement of disagreement; and (iii) complain about the denial.
You generally have the right to request and receive a list of certain types of disclosures of your PHI that Chimes has made during the six (6) years prior to your request. The list will not include disclosures (i) for which you have provided a written authorization; (ii) for treatment, payment, and health care operations; (iii) made to you; (iv) for a Chimes patient directory or to persons involved in your health care; (v) for national security or intelligence purposes; (vi) to correctional institutions or law enforcement officials; or (vii) of a limited data set. You should submit any such request to the Privacy Official, and within sixty (60) days of receiving your request (unless extended by an additional thirty (30) days), Chimes will respond to you regarding the status of your request. Chimes will provide the first accounting you request in any 12-month period free of charge. Chimes may impose a reasonable, cost-based fee for each subsequent request for accounting within the 12-month period. Chimes will notify you of the fee in advance and provide you with an opportunity to withdraw or modify your request.
You have the right to receive PHI in an electronic format, if electronic medical records are in use.
You have the right to receive a paper copy of this notice upon request even if you have agreed to receive this notice electronically. You can view a copy of this notice on Chimes’ website, chimes.org/notices-and-policies/notice-of-privacy-practices/. To obtain a paper copy of this notice, please contact the Privacy Official, whose contact information is provided at the end of this Notice.
You have the right to receive notice in the event of a breach of confidentiality. As required by law, Chimes will notify you of any breach of your PHI that is unsecured, as defined by law
You have the right to opt out of fundraising communications.
You have the right to restrict disclosures of PHI to health plans or other payors if you have paid for services out of pocket in full.
Changes to this Notice
We reserve the right to change this Notice and make the new Notice apply to health information we already have as well as any information we receive in the future. We will post a copy of the new Notice on our website. The Notice will contain the effective date on the final page.
Complaints
You may complain to Chimes if you believe your privacy rights with respect to your PHI have been violated by contacting Chimes’ Privacy Official, whose contact information provided at the end of this Notice, and submitting a written complaint. Chimes will not penalize you or retaliate against you for filing a complaint regarding our privacy practices.
You also have the right to file a complaint with the Secretary of the Department of Health and Human Services. To submit a complaint to the Department of Health and Human Services, you must contact the Office for Civil Rights of the Department of Health and Human Services, Hubert H. Humphrey Building, 200 Independence Avenue, SW, Room 509F, Washington, D.C. 20201. Further information and regional contact information is also available on the Office for Civil Rights’ website at www.hhs.gov/ocr/hipaa.
Contact Information
If you have any questions about this Notice, please contact the Chief Compliance Officer at the address/phone number provided below:
Chimes
Attn: Kathleen McPeake
Chief Compliance Officer
4815 Seton Drive
Baltimore, MD 21215
410.358.8908
Effective: 6/11/2019
