NOTICE OF PRIVACY PRACTICES

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

MERAKEY TOTAL HEALTH OBLIGATIONS

Merakey Total Health (“MTH”) understands that you and your family’s health information is very personal. We strive to protect our patient’s privacy. MTH is required by law to:

• Maintain the privacy of protected health information (“PHI”);
• Give you this notice of our legal duties and privacy practices regarding health information about you; and
• Follow the terms of our notice that is currently in effect.

---

USE OF PERSONAL HEALTH INFORMATION

The following describes the ways we may use and disclose PHI. Except for the purposes described below, we will use and disclose PHI only with your written permission. You may revoke such permission at any time by writing to our practice Privacy Officer.
Treatment: We may use and disclose PHI for your treatment and to provide you with treatment-related health care services. For example, we may disclose PHI to doctors, nurses, technicians, or other personnel, including people outside our office, to coordinate your care or to plan a course of treatment for you.
Payment: We may use and disclose PHI so that we or others may bill and receive payment from you, an insurance company, or a third party for the treatment and services you received. For example, we may disclose information regarding your medical procedures and treatment to your insurance company to arrange payment for the services provided to you.
Health Care Operations: We may use and share your PHI for health care operations purposes. We may use your PHI to conduct an evaluation of the treatment and services provided or to review staff performance. We may disclose your PHI for education and training purposes to doctors, nurses, technicians, medical students, residents, fellows, and others. We also may share information with other entities that have a relationship with you (for example, your health plan) for their health care operation activities.
Health Information Exchanges: We participate in initiatives to facilitate electronic sharing of patient information, including, but not limited to, Health Information Exchanges (“HIEs”). HIEs involve coordinated information sharing among HIE members for purposes of treatment, payment, and health care operations. If you wish to opt out of this information sharing, please contact the MTH Privacy Officer as described below. You may also opt out of Pennsylvania’s state-wide HIE by completing and submitting this OPT-OUT OR OPT-BACK-IN FORM.  
Individuals Involved in Your Care or payment for your care: When appropriate, we may share your PHI with a family member or other person if they are involved in your care or paying for your care. We also may notify your family about your location or general condition or disclose such information to an entity assisting in a disaster relief effort.
Communicating with You: We will use your PHI to communicate with you about important topics, including appointments, your care, treatment options and other health related services, and payment for your care. We may contact you at the email, phone number or address that you provide, including via text messages, for these communications. We encourage all patients to sign up for our Access Patient Portal, which may be used to send and receive communications conveniently and securely and to share preferences for how we contact you.
Business Associates: At times, we need to disclose your PHI to persons or organizations outside of MTH who assist us with our payment, billing activities, and health care operations. We require these Business Associates and their subcontractors to appropriately safeguard your PHI.
Military and Veterans: If you are a member of the armed forces, we may release PHI as required by military command authorities. We also may release PHI to the appropriate foreign military authority if you are a member of a foreign military.
Inmates or Individuals in Custody: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release PHI to the correctional institution or law enforcement official. This release would be if necessary: (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) the safety and security of the correctional institution.
Law Enforcement: We may release PHI if asked by a law enforcement official if the information is: (1) in response to a court order, subpoena, warrant, summons or similar process; (2) limited information to identify or locate a suspect, fugitive, material witness, or missing person; (3) about the victim of a crime even if, under certain very limited circumstances, we are unable to obtain the person’s agreement; (4) about a death we believe may be the result of criminal conduct; (5) about criminal conduct on our premises; and (6) in an emergency to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime.
Other Uses and Disclosures: We may be permitted or required by law to make certain other uses and disclosures of your PHI without your authorization. Subject to applicable law, we may release your PHI:

• For any purpose required by international, federal, state or local law;
• For public health activities, including required reporting of disease (including cases of HIV or AIDS), injury, birth and death, for required public health investigations, and to report adverse events or enable product recalls;
• To government agencies if we suspect child or elder adult abuse or neglect. We may also release your PHI to government agencies if we believe you are a victim of abuse or neglect;
• To your employer when we have provided screenings and health care at their request for occupational health and safety;
• To a government oversight agency conducting audits, investigations, inspections, and related oversight functions;
• In emergencies, when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person;
• If required by a court or administrative order, subpoena, or discovery request for law enforcement purposes, including to law enforcement officials to identify or locate suspects, fugitives or witnesses, or victims of crime;
• To provide legally required notices of unauthorized access to or disclosure of your health information;
• To coroners, medical examiners, and funeral directors;
• If necessary to arrange organ or tissue donation or transplant;
• For national security, intelligence, or protective services activities; and
• For purposes related to your workers' compensation benefits.

---

USES AND DISCLOSURES OF PERSONAL HEALTH INFORMATION BASED ON WRITTEN AUTHORIZATION

Other than as outlined above, we will not use or disclose your PHI for any other purpose unless you have signed an authorization permitting the use or disclosure. If you do give us an authorization, you may revoke it at any time by submitting a written revocation to our Privacy Officer and we will no longer disclose PHI under the authorization, but disclosure that we have already made in reliance on your authorization before you revoked it will not be affected by the revocation.

There are times when a signed authorization form is required for uses and disclosures of your PHI, including:

• Uses and disclosures of psychotherapy notes (with few exceptions)
• Uses and disclosures for marketing purposes
• Disclosures that constitute the sale of PHI
• For health research
• To comply with the law
• To share HIV/AIDS related information, except as permitted by applicable state law

The confidentiality of substance use disorder, mental health treatment, and HIV-related information maintained by us is specifically protected by state and/or federal law and regulations. Generally, we may not disclose such information unless you consent in writing, the disclosure is allowed by a court order, or in other limited, regulated circumstances.

We will not disclose any HIV-related information about you, except in situations where you have provided us with a written consent allowing the release or where we are authorized or required by state or federal law to make the disclosure. We may contact you by mail, e-mail or text to provide information about treatment alternatives or other health-related benefits and services that may be of interest to you. However, we must obtain your prior written authorization for any marketing of products and services that are funded by third parties. You have the right to opt-out by notifying us in writing.

---

PATIENT RIGHTS

You have the following rights regarding your PHI:
Right to Inspect and Copy your Medical Record: Generally, you can access and inspect paper or electronic copies of certain PHI that we maintain about you. To inspect and copy this PHI, you must make your request, in writing, to any of our Office Managers. We have forms you may use to make your request. We have up to 30 days to make your PHI available to you and we may charge you a reasonable fee for the costs of copying, mailing or other supplies associated with your request. We may not charge you a fee if you need the information for a claim for benefits under the Social Security Act or any other state of federal needs-based benefit program. We may deny your request in certain limited circumstances. If we do deny your request, you have the right to have the denial reviewed by a licensed healthcare professional who was not directly involved in the denial of your request, and we will comply with the outcome of the review. You may readily access much of your PHI without charge using the Access Patient Portal.
Right to Amend your Medical Record: You can request changes to certain PHI that we maintain about you that you think may be incorrect or incomplete. All requests for changes must be in writing, signed by you or your personal representative, and state the reasons for the request. If we decide to make a change, we may also notify others who have copies of the information about the change. Note that even if we accept your request, we may not delete any information already documented in your medical record.
Right to Notice of a Breach: You have the right to be notified upon a breach of any of your unsecured Protected Health Information.
Right to an Accounting of Disclosures: You can ask for an accounting of certain disclosures made by us of your PHI. This request must be in writing and signed by you or your personal representative. This does not include disclosures made for purposes of treatment, payment, or health care operations or for certain other limited exceptions. You may readily access information about PHI disclosures using the Access Patient Portal.
Right to Restrict Use or Disclosure of PHI: You can request restrictions or limitations on the PHI we use or disclose for treatment, payment, or health care operations. We are not required to agree but will attempt to accommodate reasonable requests when appropriate.
Right to Request Confidential Communications: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. We will accommodate reasonable requests. You must request such confidential communication in writing to the Privacy Officer.
Right to a Paper Copy of this Notice: You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. You may obtain a copy of this notice online at www.merakeytotalhealth.org.

---

CHANGES TO THIS NOTICE

This Notice is effective November 1, 2023.
We reserve the right to change this notice and make the new notice apply to PHI we already have, as well as any information we receive in the future. We will post a copy of our current notice at our office and online.

---

FILE A COMPLAINT

---

FOR FURTHER INFORMATION

---