NOTICE OF PRIVACY PRACTICES

I. Pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), this notice describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.

II. I am legally required to safeguard the privacy of your Protected Health Information (PHI), which includes information that can be used to identify you, and that I have created or received about your past, present, or future health or condition; the provision of health care to you; or the payment for this health care. I am required by law to provide you with this Notice about my privacy practices, and such Notice must explain how, when, and why I might “use” or “disclose” your PHI. “Use” of PHI occurs when I share, examine, utilize, apply, or analyze such information within my practice. PHI is “disclosed” when it is released, transferred, given to, or otherwise divulged to a third party outside my practice. With some exceptions I may not use or disclose any more of your PHI than is necessary to accomplish the purpose for which the use or disclosure is made. I am legally required to follow the privacy practices described in this notice.

However, I reserve the right to change the terms of this Notice and my privacy practices at any time. Any changes will apply to PHI already on file with me. Before I make any important changes to my policies, I will promptly change this Notice and post a new copy of it in my office and on my website. You can also request a copy of this Notice from me, or you can see a copy in my office.

III. How I may use and disclose your PHI. Legally, I may or must use or disclose your PHI for a variety of reasons. For some uses or disclosures I need your prior authorization; for others I do not. In this section I have listed the different categories of uses and disclosures with illustrative examples.

A. Uses and disclosures relating to treatment, payment, or health care operations do not require your prior written consent.

1. For treatment. I may disclose your PHI to physicians, psychiatrists, and other licensed health care providers whose services are involved in your care.

2. To obtain payment for treatment. I may disclose your PHI to bill and collect payment for treatment and services I provide to you. For example, I can send your PHI to your insurance company or health plan to get paid for health care services I have provided to you. I may also provide your PHI to my business associates, such as billing companies, claims processing companies, and other entities that process my health care claims.

3. For health care operations. I may disclose your PHI to operate my practice. For example, I might use your PHI to evaluate the quality of health care services that you receive, or to evaluate the performance of the health care professionals who provide services to you. I may also provide your PHI to my accountants, attorneys, consultants, and others to make sure I am complying with applicable laws.

4. Other disclosures. I may disclose your PHI in unusual circumstances, if, for example, you need emergency medical treatment, as long as I seek your consent after treatment is rendered; or if I try to get your consent but you are unconscious, in severe pain, or otherwise unable to communicate with me and I believe you would consent to such treatment if you were able to do so.

B. I may use or disclose your PHI without your consent or authorization for the following reasons:

1. When disclosure is required by federal, state, or local law; for judicial and administrative proceedings; or to law enforcement. For example, the law requires me to report information to government agencies and law enforcement personnel about victims of abuse or neglect.

2. Public health activities, such as reports of death to the county coroner.

3. For health oversight activities, such as cooperating with the government when it investigates or inspects a health care provider or organization.

4. For research purposes.

5. To avoid harm, such as disclosing information to law enforcement officials concerning a serious threat to the health or safety of an individual or the public.

6. For specific government functions, such as national security or conducting intelligence operations.

7. For workers’ compensation purposes.

8. For appointment reminders and health related benefits or services.

C. You may object to certain uses and disclosures to your family, friends, or others. I may provide your PHI to a family member, friend, or other person you indicate is involved in your care or in the payment for your health care unless you object in whole or in part. I may obtain this consent retroactively in emergency situations.

D. Any uses or disclosures of your PHI not described in Sections A, B, and C, above, require your prior written authorization. If you choose to sign an authorization to disclose your PHI you can later revoke that authorization and stop me from making any further uses and disclosures of your PHI, to the extent that I have not taken action in reliance on your authorization. You must make this revocation in writing, and sign it yourself.

IV. You have the following rights regarding your PHI:

A. You have the right to request that I limit my uses and disclosures of your PHI. I am not legally required to accept your request, but if I do so I will ask that you put those limits in writing, and I will abide by them except in emergency situations. You may not limit the uses and disclosures I am legally required or allowed to make.

B. You have the right to choose how I send PHI to you. You may ask that I send information to you at an alternate address (at your home, for instance, rather than at your place of business) or by an alternate mode (by email, for example, rather than by a postal service). As long as I can easily provide the PHI to you in the format or by the mode you request, I will comply with that request.

C. You have the right to see and obtain copies of your PHI in most cases, but you must make this request in writing. I will respond within 30 days of receiving your written request. If I do not have your PHI but know who does, I will tell you how to obtain it. If I provide copies of your PHI I will charge you not more than $0.25 per page. Instead of providing the PHI you requested, I may instead provide you with a summary or explanation of the PHI, as long as you agree to have the summary instead of the full PHI, and also agree to the costs in advance. In certain circumstances I may deny your request, in which case I will do so in writing, providing my reasons for denial and explaining your right to have my denial reviewed.

D. You have the right to obtain a list of the disclosures I have made. Such a list will include the date of each disclosure, the name of the person or entity to whom the PHI was disclosed, the address of the person or entity if I know it, a description of the information disclosed, and the reason I made the disclosure. The list will not include uses or disclosures to which you have already consented, such as those for treatment, payment, or health care operations, either to you directly or to your family. The list also will not include uses and disclosures made for the purposes of national security, or made to corrections or law enforcement personnel, or disclosures made before 15 April 2003. From that date forward the list will include disclosures made in the last six years before I receive your request, unless you stipulate a shorter time frame. I will provide the list to you at no charge unless you make more than one request in a single year, in which case I will charge you for the time I spend on the second and subsequent lists based on my usual and customary fees at the time you make the request. I will respond to your request for an accounting of disclosures within 60 days of receiving your request.

E. You have the right to correct or update your PHI. If you believe there is a mistake in your PHI, or that an important piece of information is missing, you have the right to request that I correct the existing information or add the missing information. You must make such a request in writing, along with your reason for making the request. I will respond within 60 days of receiving your request. I may deny your request in writing if the PHI is (i) correct and complete, (ii) not created by me, (iii) not allowed to be disclosed, or (iv) not part of my records. My written denial will state the reasons for the denial and explain your right to file a written statement of disagreement with the denial. If you do not file such a statement you have the right to request that your request and my denial be attached to all future disclosures of your PHI. If I approve your request I will make the changes to your PHI, tell you that I have done so, and inform others who need to know about the changes to your PHI.

F. You have the right to receive this notice by email, and if you elect to do so you may still request a paper copy.

V. How to complain about my privacy practices. If you think that I have violated your privacy rights, or if you disagree with a decision I have made about access to your PHI, you may file a complaint with me directly, as indicated in Section VI, below. You may also send a written complaint to the Secretary of the Department of Health and Human Services, 200 Independence Avenue S. W., Washington, D.C., 20201. I will take no retaliatory action against you if you file a complaint about my privacy practices.

VI. The person to contact for information about this notice, or to complain about my privacy practices, is William A. Henkin, Ph.D., 1801 Bush Street, Suite #111, San Francisco CA 94109, tel: 415-923-1150.

VII. This notice is effective 14 April 2003, and was last reviewed on 1 January 2011.