HIPAA Notice of Privacy Practices

1. Our Legal Duties

Order-CS is required by law to:

• Maintain the privacy of your protected health information (PHI)
• Provide you with this notice of our legal duties and privacy practices
• Follow the terms of the notice that is currently in effect
• Notify you following a breach of your unsecured PHI

We reserve the right to change the terms of this notice at any time. Any new notice will be effective for all PHI that we maintain, including PHI created or received before the change. We will post a revised notice on our website and make paper copies available upon request.

2. Uses & Disclosures of Your Health Information

We may use and disclose your PHI for the following purposes without your written authorization:

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your care. This includes sharing information with your prescriber to verify prescriptions, performing medication therapy management (MTM) reviews, screening for drug-drug interactions and contraindications, and consulting with other healthcare providers involved in your care.

Payment

We may use and disclose your PHI to obtain payment for the services we provide. This includes billing your insurance plan, processing payment transactions, determining eligibility and coverage, conducting utilization review, and managing your account.

Healthcare Operations

We may use and disclose your PHI for our healthcare operations, including quality assessment and improvement activities, reviewing the competence and qualifications of healthcare professionals, conducting training programs, accreditation and licensing activities, internal audits, and compliance monitoring.

Required by Law

We may use and disclose your PHI when required to do so by law, including judicial and administrative proceedings, law enforcement purposes, public health activities (such as reporting adverse events to FDA MedWatch and MHRA), and to health oversight agencies for lawful oversight activities.

Public Interest and Other Permitted Disclosures

We may disclose your PHI for public interest purposes as authorized by law, including reporting abuse, neglect, or domestic violence to appropriate authorities; for workers’ compensation programs; for coroners, medical examiners, and funeral directors; for organ and tissue donation; for research purposes (subject to approval by an institutional review board); to avert a serious threat to health or safety; and for military and veterans activities, national security, and intelligence purposes.

3. Disclosures Requiring Your Authorization

The following uses and disclosures of your PHI require your written authorization:

• Marketing: We will not use or disclose your PHI for marketing purposes without your written authorization, except for face-to-face communications or promotional gifts of nominal value
• Sale of PHI: We will not sell your PHI without your written authorization (45 CFR § 164.508(a)(4))
• Psychotherapy Notes: Most uses and disclosures of psychotherapy notes require your authorization (§ 164.508(a)(2))
• Substance Use Disorder Records: Records governed by 42 CFR Part 2 require separate, more restrictive authorization

You may revoke an authorization at any time in writing, except where we have already acted in reliance on your authorization.

4. Your Individual Rights

Right to Access Your Health Information

You have the right to inspect and obtain a copy of your PHI maintained in a designated record set. We will respond to your request within 30 days. We may charge a reasonable fee for copying, mailing, or other supplies. If we maintain your PHI electronically, you have the right to request an electronic copy.

Right to Request Amendment

You have the right to request that we amend your PHI that you believe is incorrect or incomplete. We will respond within 60 days. We may deny your request if the information is accurate and complete, was not created by us, or is not part of the designated record set. You have the right to submit a statement of disagreement if we deny your request.

Right to an Accounting of Disclosures

You have the right to request an accounting of disclosures we have made of your PHI for purposes other than treatment, payment, healthcare operations, and certain other exceptions. The accounting covers the six-year period prior to your request. We will provide one accounting per 12-month period at no charge.

Right to Request Restrictions

You have the right to request that we restrict how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree to your request, except that we must agree to a request to restrict disclosure of PHI to a health plan if you have paid out-of-pocket in full for the item or service.

Right to Confidential Communications

You have the right to request that we communicate with you about your PHI by alternative means or at alternative locations. We will accommodate reasonable requests.

Right to a Paper Copy of This Notice

Even if you have agreed to receive this notice electronically, you have the right to receive a paper copy of this notice at any time upon request.

5. Breach Notification

In the event of a breach of your unsecured PHI, we will notify you without unreasonable delay and in no case later than 60 days after discovery of the breach. The notification will include:

• A brief description of the breach, including the date discovered and date of the breach (if known)
• The types of PHI involved
• Steps you should take to protect yourself from potential harm
• A description of what we are doing to investigate, mitigate, and prevent future breaches
• Contact information for you to ask questions or obtain additional information

If the breach affects 500 or more individuals, we will also notify prominent media outlets in the affected area and notify the Secretary of the U.S. Department of Health and Human Services.

6. Amendment to This Notice

We reserve the right to change the terms of this notice at any time. Any revised notice will be effective for all PHI that we already maintain, as well as PHI we create or receive in the future. We will post the revised notice on our website at order-cs.help/hipaa-notice-of-privacy-practices and make paper copies available upon request.

7. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). We will not retaliate against you for filing a complaint.

To File a Complaint With Order-CS

To File a Complaint With HHS

8. Acknowledgment of Receipt