Notice of Privacy Practices

[LEGAL REVIEW NEEDED] The boxed header above is the language HIPAA requires to appear prominently. Confirm the exact required wording, formatting, and placement with counsel, and confirm which legal entity (or entities) this Notice covers. Whitestone Health is an alliance of independent practices; counsel must confirm whether this is a joint Notice under an Organized Health Care Arrangement (OHCA) or whether each practice issues its own Notice.

Our commitment

We are required by law to maintain the privacy of your protected health information (“PHI”), to provide you with this Notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect.

How we may use and disclose your health information

We may use and disclose your PHI for the following purposes without your written authorization:

• Treatment. To provide, coordinate, or manage your health care, including sharing information among the providers involved in your care.
• Payment. To obtain payment for the services we provide, such as billing and claims with your health plan.
• Health care operations. For activities necessary to run our practice, such as quality assessment and staff training.
• As required by law. When federal, state, or local law requires the use or disclosure.
• Public health and safety. To prevent or reduce a serious threat, or for permitted public-health activities.

[LEGAL REVIEW NEEDED] Confirm the complete list of permitted uses and disclosures and the required descriptions for each, including special categories that need tailored language (for example, psychotherapy notes, substance-use records under 42 CFR Part 2 if applicable, services to minors and guardianship/consent rules, and any applicable New Jersey state privacy protections that are stricter than HIPAA). The ABA discipline serves children; minor-consent handling must be reviewed.

Uses and disclosures that require your authorization

Most uses and disclosures of psychotherapy notes, uses and disclosures for marketing, and disclosures that are a sale of PHI require your written authorization. We will also obtain your authorization for other uses not described in this Notice, and you may revoke an authorization in writing.

[LEGAL REVIEW NEEDED] Confirm the authorization-required categories and revocation procedure match current regulations and the practices’ actual operations.

Your rights

You have the following rights regarding your PHI:

• To request access to and a copy of your records.
• To request a correction (amendment) of your records.
• To request an accounting of certain disclosures.
• To request restrictions on certain uses and disclosures.
• To request confidential communications (for example, by a specific phone number).
• To receive a paper copy of this Notice, even if you agreed to receive it electronically.
• To be notified if a breach of your unsecured PHI occurs.

[LEGAL REVIEW NEEDED] Confirm the exact wording, scope, and any limits of each patient right, and the procedures and timelines a patient must follow to exercise them, against current regulations.

Our duties

We are required to maintain the privacy of your PHI and to notify affected individuals following a breach of unsecured PHI. We must abide by the terms of the Notice currently in effect. We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have as well as any we receive in the future.

How to file a complaint

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against for filing a complaint.

[LEGAL REVIEW NEEDED] Add the practice’s designated Privacy Officer contact and complaint procedure, and the current Office for Civil Rights filing address/portal details.

Effective date

This Notice is effective as of the “Last updated” date shown above.

[LEGAL REVIEW NEEDED] Set and confirm the official effective date with counsel before this Notice is presented to patients or published in production.

Contact us

For questions about this Notice or to exercise your rights, please contact us. Please do not include sensitive medical details in a website form.

[LEGAL REVIEW NEEDED] Add the designated Privacy Officer’s name, mailing address, phone, and email here.