Notice of Privacy Practices 

Effective Date: April/15/2023

Introduction

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE READ IT CAREFULLY. 

I. Our Legal Responsibility to Protect Your PHI

By law, OneStep Clinic is required to maintain the privacy and security of your PHI, which includes any information that can be used to identify you or details about your health, healthcare services, or payment for such services. This Notice explains our privacy practices, including how and when we may use or share your PHI. We are legally obligated to follow the terms outlined in this Notice and may update it as necessary. Any updates will apply to existing and future PHI in our records. You may request a copy of this Notice at any time or view it in our office. It is in compliance with the Health Insurance Portability and Accountability Act (HIPAA) and other applicable laws. 

II. Uses and Disclosures of Your PHI

OneStep Clinic may use or disclose your PHI for various purposes, some requiring your authorization and others not. Below are examples of how your PHI may be used or shared.

A. Uses and Disclosures Not Requiring Your Written Authorization

1. Treatment – We may use or share your PHI to provide healthcare services, including coordination with other healthcare providers. For example, we may disclose your PHI to a psychiatrist involved in your care.

2. Healthcare Operations – We may use your PHI to ensure effective operations, such as quality assessments or compliance reviews. For example, we may share your PHI with our legal or compliance advisors.

3. Payment – We may use and disclose your PHI for billing and payment collection from insurers or other responsible parties. For instance, we may send your PHI to your insurance provider to obtain payment for services.

4. Emergency Situations – If you need urgent treatment and are unable to communicate your consent, we may use or disclose your PHI as necessary.

5. Appointment Reminders: We may contact you to provide appointment reminders or to reschedule appointments. These reminders may be sent via phone, email, or text message.

6. Communication with Individuals Involved in Your Care: With your consent, we may disclose your healthcare information to family members, friends, or other individuals involved in your care. This would be done to facilitate your treatment or to notify them about your condition, location, or general well-being.

B. Additional Disclosures Permitted Without Your Authorization

In specific situations, we may disclose your PHI without your consent, including:

1. Legal Requirements – Disclosures mandated by federal, state, or local laws or court orders.

2. Preventing Harm – When necessary to prevent a serious threat to your safety or the safety of others.

3. Mandatory Reporting – Reporting of suspected abuse or neglect of children, elders, or dependent adults as required by law.

4. Public Health and Oversight – Disclosures to public health authorities, health oversight agencies, and in compliance with government functions, such as for military or national security needs.

5. Workers’ Compensation – Disclosures necessary to comply with workers' compensation laws.

C. Disclosures Requiring Your Opportunity to Object

• Involvement of Family or Friends – We may share your PHI with family members, friends, or others you identify as involved in your care or responsible for payment, unless you object.

D. Disclosures Requiring Your Written Authorization

For any use or disclosure not covered by this Notice, we will seek your written authorization. You may revoke your authorization in writing at any time, which will apply to future disclosures.

III. Your Rights Regarding Your Protected Health Information (PHI)

You have the following rights concerning your PHI:

1. Access and Copies – You may request to view or obtain copies of your PHI. We will respond within 30 days and may charge a fee for copies.

2. Request Restrictions – You may ask us to limit the use or disclosure of your PHI. While we may not be required to agree, if we do, we will document the restriction.

3. Confidential Communication – You can request that we communicate with you through alternate means or at an alternate location, such as your work address.

4. Accounting of Disclosures – You may request a list of disclosures made of your PHI outside of treatment, payment, and healthcare operations for the past six years (excluding disclosures made before April 15, 2003). The first request within a 12-month period is free; additional requests may incur a fee.

5. Amendments – If you believe your PHI is incorrect or incomplete, you may request an amendment. We may deny requests in specific situations but will inform you in writing of our reasons. If approved, we will update your PHI and notify relevant parties.

6. Receive a Paper Copy of This Notice – You have the right to receive a copy of this Notice in paper form, even if you previously agreed to receive it electronically.

7. Protection of Substance Use Information: We understand the sensitive nature of substance use information and are committed to protecting the confidentiality of your substance use-related medical information. Federal laws and regulations, such as 42 CFR Part 2, provide additional protections for substance use disorder information. We will comply with these regulations and limit the disclosure of your substance use information, except as required by law or with your written consent.

8. Right to File a Complaint: If you believe your privacy rights have been violated, you have the right to file a complaint with our Privacy Officer or with the Secretary of the Department of Health and Human Services. Filing a complaint will not affect your care or treatment. There will be no retaliation for filing a complaint. 

IV. Our Responsibilities

We are committed to:

• Protecting the privacy and confidentiality of your healthcare information.

• Providing you with this Notice of Privacy Practices and following its terms.

• Notifying you in the event of a breach of your unsecured medical information.

• Abiding by the terms of the Notice currently in effect.

V. Contact Information

If you have any questions, concerns, or would like further information about our privacy practices, please contact our Privacy Officer at:

OneStep Clinic, 20 Jackson Drive, Cranford, NJ 07016 Phone: 848-283-9393, Fax: 716-237-3923

VI. Changes to this Notice

We reserve the right to modify this Notice of Privacy Practices at any time. Any material changes will be promptly posted in our office and on our website, if applicable.