Notice Of Privacy Practices
Unless your Provider provides you with a different Notice of Privacy Practices prior to or at your scheduled appointment, this Notice of Privacy Practices will govern.
Last Updated: April 2024
As you know, in order to provide audio/visual virtual introductory chat sessions with Providers (each, a “Session”), Providers made available on Persana’s Platform (“Providers”) must collect and create information about you and your health. This Notice of Privacy Practices (this “Notice”) describes how protected health information (“PHI”) about you may be used and disclosed. PHI is information regarding your past, present, or future health care services that can be used to identify you. For example, information you provide when scheduling your Session, providing your medical history, or during your Session with Providers may be considered PHI.
Providers are required by law, including the Health Insurance Portability and Accountability Act (“HIPAA”), to maintain the privacy of PHI and are required by HIPAA to provide you with this Notice. Providers will comply with the terms as stated. This Notice describes how Providers use and disclose your health information and explains certain rights you have regarding this information. If there is a breach of your unsecured PHI, Providers will notify you in accordance with federal and state law. Unless otherwise defined, all capitalized terms have the same meaning as in HIPAA and its implementing regulations.
This Notice also describes how you can access and amend your PHI. Please review it carefully. If you have any questions, please contact the Provider directly.
How Providers Use and Disclose Your Health Information
Providers protect your health information to the best of their ability from inappropriate use and disclosure. They will use and disclose your health information only for the purposes listed below:
Uses and Disclosures for Treatment, Payment, and Health Care Operations Without Your Consent or Authorization.
Providers may use and disclose your PHI in order to provide care or treatment to you, obtain payment for services provided to you, and conduct their Health Care Operations as detailed below. Listed below are some examples of how Providers may use and disclose your information.
(a) Treatment and Care Management. Providers may use and disclose health information about you to facilitate treatment provided to you by other health care providers and them. For example, Providers may discuss your health condition with other doctors involved in your care in order to obtain the information necessary to understand your past and current treatment. To the extent you receive services from multiple providers, your information may be shared among your providers.
(b) Payment. Providers may use and disclose health information about you in order to get paid for the services they provide to you and to assist other providers in getting paid for the services they render to you.
(c) Health Care Operations. Providers may use and disclose health information about you to carry out Health Care Operations, which include care management, quality improvement activities, evaluating their own performance, and resolving any complaints or grievances you may have. Providers may also use and disclose your health information to assist other health care providers in performing Health Care Operations.
(d) Appointments or Information. Providers may contact you to provide appointment reminders or information about treatment.
Other Uses and Disclosures Without Your Consent or Authorization.
Providers may also use and disclose your health information without your specific written authorization for the following purposes:
(a) Pursuant to a Data Use Agreement. We may use or disclose your PHI as part of a Limited Data Set (“LDS”) if we enter into a Data Use Agreement with the LDS recipient. An LDS is PHI that excludes most direct identifiers, such as your name, address, and Social Security number.
(b) As Required by Law. Providers may use and disclose your health information when required by state, federal, or local law.
(c) Public Health Activities. Providers may disclose your health information to public health authorities or other agencies and organizations conducting public health activities, such as organizations responding to the COVID-19 pandemic.
(d) Victims of Abuse, Neglect, or Domestic Violence. Providers may disclose your health information to an appropriate government agency if they believe you are a victim of abuse, neglect, or domestic violence, and you agree to the disclosure, or the disclosure is required or permitted by law. Providers will let you know if they disclose your health information for this purpose unless they believe that notifying you would place you or another person at risk of serious harm.
(e) Health Oversight Activities. Providers may disclose your health information to health oversight agencies, such as state departments of health, for activities authorized by law, such as audits, investigations, and inspections of us.
(f) Judicial and Administrative Proceedings. Providers may disclose your health information in the course of any judicial or administrative (legal) proceeding in response to an appropriate order of a court or other administrative body.
(g) Law Enforcement Purposes. Providers may disclose your health information to the police or law enforcement officials as required or permitted by law, as requested by a court order or a grand jury or an administrative subpoena.
(h) Deceased Individuals Providers may disclose your health information to a coroner, medical examiner, or funeral director as necessary if you pass away and as authorized by law.
(i) Organ, Eye, or Tissue Donations. Providers may disclose your health information to organ procurement organizations and similar entities for the purpose of assisting them in organ, eye, or tissue procurement, banking, or transplantation.
(j) Research. If Providers perform research, Providers may use or disclose your health information for research purposes, such as studies comparing the benefits of alternative treatments received by our patients or investigations into how to improve care delivery. Providers will use or disclose your health information for research purposes only with the required Institutional Review Board approval (if applicable to the research), which must follow a special approval process.
(k) Health or Safety. Providers may use or disclose your health information to prevent or lessen a threat to your health or safety or that of the general public. Providers may also disclose your health information to disaster relief organizations such as the Red Cross or to other organizations participating in bioterrorism countermeasures.
(l) Specialized Government Functions. Providers may use or disclose your health information to provide assistance for certain types of government activities. If you are a member of the armed forces of the United States or a foreign country, Providers may disclose your health information to appropriate military authority as is deemed necessary. Providers may also disclose your health information to federal officials for lawful intelligence or national security activities.
(m) Workers’ Compensation. Providers may use or disclose your health information as permitted by the laws governing the workers’ compensation program or similar programs that provide benefits for work-related injuries or illnesses.
(n) Business Associate Agreements. A Business Associate is a person or entity that performs certain functions or services that involve the use or disclosure of your personal health information on behalf of a covered entity (Providers are a covered entity; Persana is their Business Associate). Your health information may be used or disclosed to a Business Associate, such as Persana, only if Provider obtains satisfactory assurances from the Business Associate that the Business Associate will safeguard your health information from any misuse and will use the information only for certain limited permitted purposes.
(o) Individuals Involved in Your Care. Unless prohibited by state law, Providers may disclose your health information to a family member, relative, or close personal friend assisting you in receiving health care services. Providers will disclose your health information to these individuals only if you tell them to do this or if they can reasonably infer that you do not object.
Uses and Disclosures With Your Authorization.
Providers will not use or disclose your health information for any purpose not specified in this Notice unless they obtain your express written authorization or the authorization of your legally appointed representative.
If you give Providers your authorization to share PHI, you may revoke it at any time by providing us with a written notice stating that you wish to revoke your authorization, in which case they will no longer use or disclose your health information for the purpose you authorized, except to the extent that they have relied on your prior authorization to provide your care.
Special Treatment of Alcohol and Drug Abuse Records.
Health information that Providers may receive about you from federally assisted alcohol or drug treatment programs may be subject to special protection under state or federal law. If your health information is protected by a federal or state law, Providers will not disclose this information except where required by, and in full compliance with, federal or state law.
Other State Laws.
To the extent that you reside in a state that provides additional protections for medical information or a subset of treatment information, Providers will protect your information in accordance with state law.
Your Rights Regarding Your Health Information
You have the following rights regarding your health information:
Right to Inspect and Copy.
You have the right to inspect or request a copy of health information about you that Providers maintain. Your request should describe the information you want to review and the format in which you wish to review it, which Providers will reasonably request. Providers may refuse to allow you to inspect or obtain copies of this information in certain limited cases. If permitted by federal and state law, Providers may charge you a fee for copies of your record.
Right to Request Amendments.
You have the right to request changes to any health information Providers maintain about you if you state a reason why this information is incorrect or incomplete. However, Providers do not have to agree to make the changes you request. If Providers do not agree with the requested changes, Providers will notify you in writing and inform you how to have your objection included in our records. If changes are made to your record, it does not mean that Providers will destroy or rewrite your previous records, but Providers will add an addendum to your current records to reflect your changes.
Right to an Accounting of Disclosures.
You have the right to receive a list of the disclosures of your health information by Providers. The list will not include disclosures made for certain purposes, including disclosures for treatment, payment, or Health Care Operations, or disclosures you authorized in writing. Your request should specify the period covered by your request, which cannot exceed six years. The first time you request a list of disclosures in any 12-month period, it will be provided at no cost. If you request additional lists within the 12-month period, Providers may charge you a nominal fee.
Right to Request Restrictions.
You have the right to request restrictions on the ways in which Providers use and disclose your health information for treatment, payment, and Health Care Operations, or disclose this information to disaster relief organizations or individuals who are involved in your care. Although Providers do not have to agree to the restrictions you request, Providers would be bound by any restrictions to which you both agree.
Right to Request Confidential Communications.
You have the right to ask Providers to send health information to you in a different way or at a different location if the request is reasonable and you believe that you may be endangered by our ordinary form of communication. For example, if you are afraid that someone living with you may open your mail, resulting in harm, you may ask Providers to mail your health information to an alternate address. Your request for an alternate form of communication should also specify where and/or how Providers should contact you.
Right to Paper Copy of Notice.
You have the right to receive a paper copy of this Notice at any time. You may obtain a paper copy of this Notice by writing to your Provider.
Complaints
If you believe your privacy rights have been violated, you may file a complaint with your Provider by writing to them directly. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services. Providers will not penalize or retaliate against you for filing a complaint.
Changes to This Notice
Providers may change the terms of this Notice at any time. If the terms of this Notice are changed, the new terms will apply to all of your health information, whether created or received by us before or after the date on which this Notice is changed. Any updates to this Notice will be emailed to you and prominently displayed within 60 days of the date on which they become effective.