Your health information, and what we do with it

We are required by law to:

• Make sure that health information about you is used and disclosed only as this notice describes, or as the law allows or requires.
• Give you this notice when you first become a patient, and whenever you ask for it.
• Notify you if your health information was breached in a way that affects its security or privacy.
• Abide by the terms of this notice as it stands.

We do not use or disclose your health information for fundraising, and we do not sell it.

For your treatment

We use your information to plan and deliver your care, and we share it with the people involved in that care — for example a laboratory processing your panels, a pharmacy compounding a prescription, a specialist you are referred to, or an imaging or treatment center.

For payment

We use and disclose information to bill you or a third party for services, to confirm coverage, to document medical necessity, and to maintain records of the services and charges associated with your visits.

For our health care operations

We use information to run and improve the practice: reviewing quality and outcomes, training and supervising staff, auditing our work, licensing and credentialing, business planning, and arranging appointment reminders.

Reminders and care information

We may contact you to confirm or remind you of an appointment, or to tell you about treatment alternatives, health-related benefits and services, or case management that may be of interest to you.

People involved in your care

With your agreement — or when we can reasonably judge it to be in your best interest — we may disclose relevant information to a family member, relative, close friend, or other person you identify who is involved in your care or the payment for your care. If you are not present or able to agree, we will use professional judgment about what is in your best interest.

Where this notice applies

This notice covers health information wherever the practice holds it — in our Grapevine clinic, in paper and electronic records, in our scheduling and patient portal, in billing and membership records, in phone, fax, and email communications, and in what you share through our website forms. Everyone who works for or with the practice follows it.

Communications

We may reach you by phone, email, or the patient portal, and may leave a brief message limited to appointment details. Our phone line is call only — no text. If you ask us to use unencrypted email, we will do so after explaining the risk. Please send records, imaging, and lab reports by portal or fax, not through website forms.

Safeguarding your information

We limit access to the team members who need it, train our staff on patient privacy, keep paper records and devices secured in the office, verify identity before releasing information, and require our vendors to protect your information by written agreement.

How long we keep records

We keep patient medical records for a minimum of seven years after your last visit, the period Texas rules require, and longer for minors. Records are held in both our office files and the patient portal, and the same period applies to both.

Texas law

Texas law may give you added protection — for example for certain sensitive information and electronic disclosures. Where Texas law is stricter than federal law, we follow Texas law. Where required, we will tell you before disclosing your information electronically.

In the situations below, the law lets us use or disclose health information without your written permission. We limit each disclosure to the minimum necessary.

• Required by law. When a federal, state, or local law requires the use or disclosure.
• Public health. To prevent or control disease, injury, or disability — for example reporting a communicable disease to a health authority.
• Abuse, neglect, domestic violence. To a government authority authorized to receive such reports, when we believe you may have been a victim.
• Health oversight. To agencies that audit, investigate, inspect, license, or discipline us and others in the health system.
• Judicial and administrative proceedings. In response to a court order, warrant, subpoena, or similar process, subject to the conditions the law sets.
• Law enforcement. For limited purposes the law specifies, such as identifying a suspect or responding to a legal process.
• Decedents and donation. To a coroner, medical examiner, or funeral director, or for organ, eye, or tissue donation.
• Research. When a research protocol has approved privacy protections, such as an institutional review board waiver.
• Serious threat. When necessary to prevent or lessen a serious and imminent threat to your health or safety or that of another person.
• Workers' compensation. As the law permits for a workers' compensation claim.
• Product safety and FDA. To report adverse events, product problems, or to enable a recall.
• Specialized government functions. Military and national security purposes, protective services for public officials, correctional institutions, and certain federal law enforcement activities.
• Our service providers. To vendors who perform services for us — hosting and storage, email delivery, scheduling and booking, billing, and document handling — each bound by contract to protect the information and use it only for the job we hired them to do.

For anything this notice does not already describe, we will ask you to sign a written authorization that says what may be shared, with whom, and for how long. Common examples:

• Marketing or promotional communications unrelated to your treatment, payment, or our operations.
• Any sale of health information.
• Most disclosures of your information to your employer.
• Most uses or disclosures of psychotherapy notes, if we keep them.
• Disclosures to an attorney, insurer, or third party for a purpose not covered above.

You may revoke a signed authorization at any time by telling us in writing. Revoking it does not undo disclosures we already made while it was in effect.

• See and get a copy. You may inspect and obtain a copy of the information in your record, and where readily producible, an electronic copy. We will respond within 30 days, with one 30-day extension if we tell you why. We may charge a fee based on our cost of making copies and mailing them.
• Ask us to correct it. If you believe information in your record is incomplete or inaccurate, you may ask us to amend it. Send the request in writing, say what should change, and why. We will tell you our decision in writing; if we deny part of a request, we will explain why and how you may add a statement of disagreement.
• Get a list of disclosures. You may request an accounting of disclosures we made for the six years before your request. Some disclosures — those for treatment, payment, our operations, and a few others — are not included.
• Ask for restrictions. You may ask us not to use or disclose certain information for treatment, payment, or our operations. We are not required to agree, except that we must honor a request to withhold information from your health plan when you pay out of pocket in full for a service.
• Choose how we contact you. You may ask us to reach you by a particular method or at a particular place — for example, only at a certain phone number or only by email. Tell us what you need and we will accommodate it where practical.
• Get a paper copy. Ask us for a printed copy of this notice and we will give you one, even if you already have an electronic version.
• Opt out of fundraising. We do not send fundraising communications, so there is nothing to opt out of.
• Get help in the language you prefer. Tell us what you need and we will arrange interpretation or translation where we can.

Send your request to our Privacy Officer using the contact details below. Please include:

• Your full name, current address, and a phone number or email where we can reach you.
• What you are asking for — to see, receive a copy of, correct, restrict, or list disclosures of specific information.
• The time period or provider the request covers, if you know it.
• Proof of identity, and if you are acting for someone else, proof of your authority to do so.

Our phone line is call only — no text messages. For records requests, email or fax is usually the fastest way to reach us, and we may confirm your identity by phone before releasing anything.

We may change this notice at any time. A revised version takes effect on the date it says, and applies to all information we hold at that point, including information you gave us before the change. The current version is always posted on this page and available in the office and on request.

Tell us. Complaints go to our Privacy Officer at the address, phone, or email below. We will not retaliate against you in any way for filing a complaint — including by refusing, delaying, or reducing the care we provide.

You also have the right to file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. Write to: Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, D.C. 20201, call 1-800-368-1019, or use the online form at hhs.gov/ocr. We will not retaliate for a complaint filed there either.

If anything in this notice is unclear, or you would like to speak to someone about it, contact our Privacy Officer.