Our Legal Duty

I am required by applicable federal and state laws to maintain the privacy of your Protected Health Information (PHI). I am also required to give you this notice about privacy practices in effect beginning October 24, 2022, and remaining in effect until I replace it. I reserve the right to change our privacy practices and the terms of this notice at any time, provided that such changes are permitted applicable law. I reserve the right to make the changes in my privacy practices and the new terms of our notice effective for all PHI that I maintain, including medical information I created or received before I made the changes. You may request a copy of our notice (or any subsequent revised notice) at any time.

Uses and Disclosures of Protected Health Information Without Your Authorization: In certain situations, which are described below, I must obtain your written authorization in order to use and/or disclose your PHI. However, unless the PHI is considered Highly Confidential Information and the applicable law regulating such information imposes special restrictions on me, I may use and disclose your PHI without your written authorization for the following purposes:

Treatment: I will use and disclose your PHI to provide, coordinate or manage your health care and any related services. This includes the coordination or management of our healthcare with a third party. For example, your PHI may be provided to a physician to whom you have been referred to ensure that the physician has the necessary information to diagnose or treat you. In addition, I may disclose your PHI from time to time to anther healthcare provider for the sake of consultation. In these select cases, I will make every effort to withhold any identifying information.

Payment: Your PHI will be used, as needed, to obtain payment for your healthcare services. This may include certain activities that your health insurance plan may request before it approves or reimburses for the health care services I recommend for you, You have the right to restrict disclosure of PHI to health insurance companies if the you pay out-of-pocket in full for the health care service.

Health Care Operations: I may use or disclose, as needed your PHI in order to conduct certain business and operational activities. These activities include, but are not limited to, quality assessment activities, licensing, and conducting or arranging for other business activities. For example, I may call you by name in the waiting room. I may use or disclose your PHI, as necessary, to contact you by telephone or email to remind you of your appointment.

Business Associates: I may share limited PHI with third party "business associates" that perform various activities (e.g., billing, transcription services) for the practice. Whenever an arrangement between my office and a business associate involves the use or disclosure of your PHI, I will have an agreement that contains terms that will protect the privacy of your PHI.

Research; Death; Organ Donation: I may use or disclose your PHI for research purposes in limited circumstances. I may disclose the PHI of a deceased person to a coroner, protected health examiner, funeral director or organ procurement organization for certain purposes.

Public Health and Safety: I may disclose your PHI to the extent necessary to avert a serious and imminent threat to your health or safety, or the health or safety of others. I may disclose your PHI to a government agency authorized to oversee the healthcare system or government programs or its contractors, and to public health authorities for public health purposes.

Health Oversight: I may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations and inspections. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, other government regulatory programs and civil rights laws.

Abuse or Neglect: I may disclose your PHI to a public health authority that is authorized by law to receive reports of child, elder, or some disabled individuals abuse or neglect. In this case, the disclosure will be made consistent with the requirements of applicable federal and state laws.

Food and Drug Administration: I may disclose your PHI to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations; to track products; to enable product recalls; to make repairs or replacements; or to conduct post marketing surveillance, as required.

Criminal Activity: Consistent with applicable federal and state laws, I may disclose your PHI if I believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. I may also disclose PHI if it is necessary for law enforcement authorities to identify or apprehend an individual.

Required by Law: I may use or disclose your PHI when I am required to do so by the law. For example, I must disclose your PHI to the U.S. Department of Health and Human Services upon request for purposes of determining whether I am in compliance with federal privacy laws. I may disclose your PHI when authorized by workers' compensation or similar laws.

Process and proceedings: I may disclose your PHI in response to a court or administrative order, subpoena, discovery request or other lawful process, under certain circumstances. Under limited circumstances, such as a court order, warrant or grand jury subpoena, I may disclose your PHI to law enforcement officials.

Law Enforcement: I may disclose limited information to a law enforcement official concerning the PHI of a suspect, fugitive, material witness, crime victim, or missing person. I may disclose the PHI of an inmate or other person in lawful custody to a law enforcement official or correctional institution under certain circumstances. I may disclose PHI where necessary to assist law enforcement officials to capture an individual who has admitted to participation in a crime or has escaped from lawful custody.

More Stringent State and Federal Laws: Federal law under HIPAA preempts state laws that are in conflict with Privacy Rule requirements or those that provide less stringent privacy protections. Those states that have more stringent privacy laws would preempt Federal law. Certain federal laws also are more stringent than HIPAA. I will continue to abide by these more stringent state and federal laws.

More Stringent Federal Laws: The federal laws include applicable internet privacy laws, such as the Children’s Online Privacy Protection Act and the federal laws and regulations governing the confidentiality of health information regarding substance abuse treatment.

Uses and Disclosures Based on Your Written Authorization

Other uses and disclosures of your PHI will be made only with your authorization, unless otherwise permitted or required by law as described below. You may give me written authorization to use your PHI or to disclose it to anyone for any purpose. If you give me an authorization, you may revoke it in writing at any time. Your revocation will not affect any use or disclosures permitted by your authorization while it was in effect. Without your written authorization, I will not disclose your healthcare information except as described in this notice.

Others Involved in Your Health Care: Unless you object, I may disclose to a member of your family, a relative, a close friend or any other person you identify, your PHI that directly relates to that person's involvement in your healthcare. If you are unable to agree or object to such a disclosure, I may disclose such information as necessary if I determine that it is in your best interest based on my professional judgment. I may use or disclose PHI to notify or assist in notifying a family member, personal representative, or any other person that is responsible for your care of your location, general condition, or death.

Marketing: I will not accept any payments from other organizations or individuals in exchange for making communications to you about treatments, therapies, health care providers or services unless you have given us your authorization to do so or the communication is permitted by law. In addition, we may give you promotional gifts of nominal value without obtaining your written authorization.

Sale of Protected Health Information: We will not make any disclosure of PHI that is a sale of PHI.

Psychotherapy Notes: We will not use or disclose psychotherapy notes about you without your authorization except for use by the mental health professional who created the notes to provide treatment to you or to defend myself in a legal action or other proceedings brought by you.

Uses and Disclosures of Your Highly Confidential Information: Federal and state law requires special privacy protections for certain health information about you (Highly Confidential Information), including AIDS/HIV records, Alcohol and Drug Abuse Treatment Program records, and other health information that is given special privacy protection under state or federal laws other than HIPAA.

Your Rights

Access: You have the right to review or receive copies of your PHI, with limited exceptions. You must make a request in writing to receive copies of your PHI. Copies of records are billed at $0.50 per page. This includes administrative time to complete the request and any postage required for mailed copies. If you prefer, I will prepare a summary or an explanation of your PHI for a fee. Contact me using the information listed at the end of this notice for a full explanation of our fee structure.

Accounting of Disclosures: You have the right to receive a list of instances in which I or my business associates disclosed your PHI for purposes other than treatment, payment, health care operations and certain other activities. I will provide you with the date on which I made the disclosure, the name of the person or entity to which I disclosed your PHI, a description of the PHI I disclosed, the reason for the disclosure, and certain other information. If you request this list more than once in a 12-month period, I may charge you a reasonable, cost-based fee for responding to these additional requests.

Breach Notification: When I become aware of or suspect a breach of your PHI, I will conduct a risk assessment. I will keep a written record of that risk assessment. (2) Unless I determine that there is a low probability that PHI has been compromised, I will give notice of the breach to all affected parties. (3) The risk assessment can be done by a business associate if I was involved in the breach. While the business associate will conduct a risk assessment of a breach of PHI in its control, I will provide any required notice to patients and HHS. (4) After any breach, particularly one that requires notice, I will reassess its privacy and security practices to determine what changes should be made to prevent the reoccurrence of such breaches.

Restriction Requests: You have the right to request that I place additional restrictions on my use or disclosure of your PHI. I am not required to agree to these additional restrictions, but if I do, I will abide by our agreement (except in an emergency). Any agreement I may make to a request for additional restrictions must be in writing signed by a person authorized to make such an agreement on our behalf. I will not be bound unless our agreement is so memorialized in writing.

Confidential Communication: You have the right to request that I communicate with you in confidence about your PHI by alternative means or in an alternative location. You must make your request in writing. I must accommodate your request if it is reasonable, specifies the alternative means or location, and continues to permit us to bill and collect payment from you. Other uses and disclosures not described in the Privacy Notices will be made only with authorization from the individual.

Amendment: You have the right to request that I amend your PHI. Your request must be in writing, and it must explain why the information you want amended or for certain other reasons. If I deny your request, I will provide you a written explanation. You may respond with a statement of disagreement to be appended to the information you want amended. If I accept your request to amend the information, I will make reasonable efforts to inform others, including people or entities you name, of the amendment and to include the changes in any future disclosures of the information.

Electronic Notice: If you receive this notice on my website or by electronic mail (e-mail), you are entitled to receive this notice in written form. Please contact us using the information listed at the end of this notice to obtain this notice in written form.

Questions and Concerns: If you want more information about my privacy practices or have questions or concerns, please contact me using the information below. If you believe that I may have violated your privacy rights, or you disagree with a decision I made about access to your PHI or in response to a request you made, I encourage you to share this with us directly with using the contact information below. Further, you may file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints. I will not retaliate in any way if you choose to file a complaint.

Name of Contact Person: Cassy Unkraut, MA, LPCC-S, Practice Owner

Address: 7661 Montgomery Rd Suite B, Cincinnati, OH 45036

Telephone: (513) 440-1335

Email: cassy@wovenwellnessgroup.com