Patient Privacy

Our pledge regarding your medical information

Sound Inpatient Physicians, and/or its affiliates, (“Sound”) is dedicated to protecting your medical information. A federal regulation, known as the “HIPAA Privacy Rule,” requires that we provide detailed notice in writing of Sound’s privacy practices. Your Protected Health Information (“PHI”) is information that identifies you and that relates to your past, present, or future health or condition, the provision of health care to you, or payment for that health care. We are required by law to maintain the privacy of your PHI and to give you this Notice about Sound’s privacy practices that explains your rights as our patient and how, when, and why we may use or disclose your PHI.

This Notice tells you about the ways in which we may use and disclose medical information about you. It also describes your rights and certain obligations we have regarding the use and disclosure of your medical information. We are required by law to: (i) make sure your medical information is protected; (ii) give you this Notice describing our legal duties and privacy practices with respect to your medical information; and (iii) follow the terms of the Notice that is currently in effect.

How we may use and disclose medical information about you

The following sections describe different ways we may use and disclose your medical information. We abide by all applicable laws related to the protection of this information. Not every use or disclosure will be listed. All of the ways we are permitted to use and disclose information, however, will fall within one of the following categories:

Treatment. We may use or disclose medical information about you to provide you with medical treatment or services.

For example, we may use and disclose PHI when you need a prescription, lab work, x-ray, or other health care services. We may also use and disclose PHI about you when referring you to another health care provider. For example, if you are referred to a specialist physician, we may disclose PHI to the physician regarding whether you are allergic to any medications. We may also disclose PHI about you for the treatment activities of another health care provider. For example, we may send a report about your care from us to an outside physician so that the other physician may treat you following your discharge from the hospitalist program.

We may also share medical information about you with other Sound or hospital personnel or non-Sound health care providers, agencies, or facilities in order to provide or coordinate the different things you need, such as prescriptions, lab work and x-rays, or transportation.

Payment. We may use and disclose your medical information so that we can bill and collect payment for the treatment and services provided to you.

For example, we may send your insurance company a bill for services or release certain medical information to your health insurance company so that it can determine whether your treatment is covered under the terms of your health insurance policy. We also may use and disclose your medical information for billing, claims management, and collection activities. We may also disclose your medical information to another health care provider or to a company or health plan required to comply with the HIPAA Privacy Rule for the payment activities of that health care provider, company, or health plan. For example, we may allow a health insurance company to review your medical information relating to their enrollees to determine the insurance benefits to be paid for their enrollees’ care.

Health care operations. We may use and disclose your medical information in performing certain business activities which are called health care operations. Some examples of these operations include our business, accounting, and management activities. These health care operations also may include quality assurance, utilization review, and internal auditing, such as reviewing and evaluating the skills, qualifications, and performance of health care providers. If another health care provider, company, or health plan that is required to comply with the HIPAA Privacy Rule has or once had a relationship with you, we may disclose medical information about you for certain health care operations of that health care provider, company, or health plan. For example, health care operations may include assisting with the legal compliance activities of that provider, company, or plan.

• Business associates. We may contract with individuals and entities (business associates) to perform various functions on our behalf or to provide certain types of services. To perform these functions or to provide the services, business associates may receive, create, maintain, use or disclose your medical information. We require business associates to agree in writing to contract terms designed to appropriately safeguard your information. For example, we may disclose your medical information to a business associate for claims administration purposes.
• Communications to you. We may use or disclose medical information in order to contact you to follow up after you are discharged from a hospitalist program, to tell you about or recommend possible treatment options or alternatives that may be of interest to you, or, subject to certain limitations, to inform you about health-related benefits or services that may be of interest to you.
• Communications to others if you agree or do not object. We may also use or disclose your medical information in the following circumstances. However, except in emergency situations, we will inform you of our intended action prior to making any such uses and disclosures and will, at that time, offer you the opportunity to object.

Notifications to family/friends. We may disclose medical information to your relatives, close friends, or any other person identified by you if the medical information is directly related to that person’s involvement in your care or payment for your care. If you are unable to agree or object to such a disclosure, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgment. We may also use and disclose your health information for the purpose of locating and notifying your relatives or close personal friends of your location, general condition or death, and to organizations that are involved in those tasks during disaster situations.

Other uses and disclosures authorized by the HIPAA Privacy Rule. Other uses and disclosures of medical information not covered by this Notice will be made only with your written authorization. Most uses and disclosures of psychotherapy notes and most uses and disclosures for marketing purposes fall within this category and require your authorization before we may use your medical information for these purposes. Additionally, with certain limited exceptions, we are not allowed to sell or receive anything of value in exchange for your medical information without your written authorization. If you provide us authorization to use or disclose medical information about you, you may revoke (withdraw) that authorization, in writing, at any time. However, uses and disclosures made before your withdrawal are not affected by your action and we cannot take back any disclosures we may have already made with your authorization.

• Required by law. We may use or disclose your medical information as required by federal, state, or local law if the disclosure complies with the law and is limited to the requirements of the law.
• Public health activities. We may disclose your medical information to public health authorities or other authorized persons to carry out certain activities related to public health, including to:
  • Prevent or control disease, injury, or disability or report disease, injury, birth, or death;
  • Report child abuse or neglect;
  • Report information regarding the quality, safety, or effectiveness of products or activities regulated by the federal Food and Drug Administration;
  • Notify a person who may have been exposed to a communicable disease in order to control who may be at risk of contracting or spreading the disease; or
• Report to employers, under limited circumstances, information related primarily to workplace injuries or illness or workplace medical surveillance.

• Abuse, neglect, or domestic violence. We may disclose your medical information to proper government authorities if we reasonably believe that you (or others) have been or may be a victim of domestic violence, abuse, or neglect.
• Health oversight. We may disclose your medical information to a health oversight agency for oversight activities including, for example, audits, investigations, inspections, licensure and disciplinary activities, and other activities conducted by health oversight agencies to monitor the health care system, government health care programs, and compliance with certain laws.
• Legal proceedings. We may disclose your medical information as expressly required by a court or administrative tribunal order in compliance with state law in response to subpoenas, discovery requests, or other legal processes when we receive satisfactory assurances that efforts have been made to advise you of the request or to obtain an order protecting the information requested.
• Law enforcement. We may disclose your medical information to law enforcement officials under certain specific conditions where the disclosure is:
  • About a suspected crime victim if the person agrees or, under limited circumstances, we are unable to obtain the person’s agreement because of incapacity or emergency;
  • To alert law enforcement of a death that we suspect was the result of criminal conduct;
  • In response to authorized legal process or required by law;
  • To identify or locate a suspect, fugitive, material witness, or missing person;
  • About a crime or suspected crime committed on our premises; or
  • In response to a medical emergency not occurring on our premises, if necessary to report a crime.

• Coroners, medical examiners, or funeral directors. We may disclose your medical information regarding decedents to a coroner, medical examiner, or funeral director so that they may carry out their jobs. We may also disclose such information to a funeral director in reasonable anticipation of death.
• Organ donation. We may disclose your medical information to organizations that help procure, locate, and transplant organs in order to facilitate organ, eye, or tissue donation and transplantation.
• Threat to health or safety. In limited circumstances, we may disclose your medical information when we have a good faith belief that the disclosure is necessary to prevent a serious and imminent threat to the health or safety of a person or to the public.
• Specialized government functions. We may disclose your medical information for certain specialized government functions, such as military and veteran activities, national security and intelligence activities, protective services for the president and others, medical suitability determinations, and for certain correctional institutions or in other law enforcement custodial purposes.
• Compliance review. We are required to disclose your medical information to the Secretary of the United States Department of Health and Human Services when requested by the Secretary to review our compliance with the HIPAA Privacy Rule.
• Workers’ compensation. We may disclose your medical information in order to comply with laws relating to workers’ compensation or other similar programs.
• Research. For research purposes under certain limited circumstances for research projects that have been evaluated and approved through an approval process that takes into account your need for privacy. We must obtain a written authorization to use and disclose your medical information for research purposes except in situations where a research project meets specific, detailed criteria established by the HIPAA Privacy Rule to ensure the privacy of your medical information.
• Emergencies. We may use or disclose your medical information in an emergency treatment situation in compliance with applicable laws and regulations.
• With your written authorization. Your written authorization generally will be obtained before we use or disclose psychotherapy notes about you that may be in our possession. Psychotherapy notes are separately filed notes about your conversations with a mental health professional during a counseling session; summary information about your mental health treatment does not constitute psychotherapy notes. In addition, your written authorization will be obtained for uses and disclosures of your medical information for marketing purposes and disclosures that constitute a sale of your medical information, unless use and disclosure are permitted without your authorization. Except as described in this Notice, all other uses and disclosures of your medical information will be made only with your written authorization. If you have authorized us to use or disclose your medical information, you may revoke your authorization at any time, except to the extent we have taken action based on the authorization (e.g., you cannot revoke with respect to disclosures that have already been made).
• Additional uses and disclosures of your medical information. We may use or disclose your medical information without your authorization (permission) to the following individuals, or for other purposes permitted or required by law, including:
  • To tell you about, or recommend, possible treatment alternatives
  • To inform you of benefits or services we may provide
  • In the event of a disaster, to organizations assisting in a disaster relief effort so that your family can be notified of your condition and location
  • To authorized federal officials for intelligence, counterintelligence, or other national security activities
  • To the military if you are a member of the armed forces and we are authorized or required to do so by law
  • To authorized federal officials so they may conduct special investigations or provide protection to the U.S. President or other authorized persons
  • To governmental, licensing, auditing, and accrediting agencies
  • To a correctional institution as authorized or required by law if you are an inmate or under the custody of law enforcement officials
  • For public health purposes
  • To law enforcement officials as authorized or required by law
• Limited Data Set/Minimum Necessary. The amount of health information used or disclosed in accordance with the above provisions will be limited, to the to the extent practicable, to a limited data set, or if needed by Sound, to the minimum necessary to accomplish the intended purpose of the use, disclosure or request, respectively. Sound commits to complying with any guidance issued in the future that relates to the minimum necessary use or disclosure of your medical information.

Your rights regarding medical information about you

The HIPAA Privacy Rule gives you several rights with regard to your medical information. You have the following rights, however, regarding medical information we maintain about you:

Right to inspect and copy. With certain exceptions, you have the right to inspect and/or receive a copy of your medical and billing records or any other of our records that are used by us to make decisions about you. You have the right to request that we send a copy of your medical or billing records to a third party. You are required to submit your request in writing to your caregiver or the appropriate medical records department. We may charge you a reasonable fee for providing you a copy of your records. We may deny access, under certain limited circumstances, and in some cases, a denial of access may be reviewable.

Right to request an amendment. If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as such information is kept by or for us. You are required to submit your request in writing to the Sound Privacy Officer as explained at the end of this Notice, with an explanation as to why the amendment is needed. If we accept your request, we will tell you we agree and we will amend your records. We cannot change what is in the record. We add the supplemental information by an addendum. With your assistance, we will notify others who have the incorrect or incomplete medical information. If we deny your request, we will give you a written explanation of why we did not make the amendment and explain your rights.

We may deny your request if the medical information (i) was not created by Sound; (ii) is not part of the medical and billing records accessible to Sound; (iii) is not part of the information which you would be permitted to inspect and copy; or (iv) is determined by us to be accurate and complete.

Right to an accounting of disclosures. You have the right to request a list of certain disclosures of your medical information made by us during a specified period of up to six years prior to the request, except disclosures: (i) for treatment, payment or health care operations, unless, as of the date required by the HITECH Act and only to the extent that Sound uses or maintains an electronic health record (EHR) for you, such disclosures are made through your EHR (in which case the list of disclosures will be limited to those made in the three years prior to the date of your request, subject to certain restrictions); (ii) made to you; (iii) to persons involved in your care or for the purpose of notifying your family or friends of your whereabouts; (iv) for national security or intelligence purposes; (v) made pursuant to your written authorization; (vi) incidental to another permissible use or disclosure; (vii) for certain notification purposes (including national security, intelligence, correctional, and law enforcement purposes); or (viii) made before April 14, 2003. If you wish to make such a request, please contact Sound’s Privacy Officer. The first accounting that you request in a 12-month period will be free, but we may charge you for our reasonable costs of providing additional lists in the same 12-month period. We will tell you about these costs, and you may choose to cancel your request at any time before costs are incurred.

Right to request restrictions. You have the right to request a restriction or limitation of the medical information we use or disclose about you for treatment, payment or health care operations, or that we disclose to those who may be involved in your care or payment for your care. In the instances where you have paid for health care items or services out-of-pocket in-full, we are required upon request to restrict disclosures of your medical information to your health plan. In all other instances, while we will consider a patient’s restriction request, we are not required to agree to it. If we do agree to your request, we will comply with your request except as required by law or for emergency treatment. To request restrictions, you must make your request in writing on our Request for Additional Restrictions on Communication Form to Sound’s Privacy Officer at the address listed on the last page of this Notice.

Right to request confidential communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. If you want us to communicate with you in a special way, you will need to give us details about how to contact you. You also will need to give us information as to how billing will be handled. We will honor reasonable requests. However, if we are unable to contact you using the requested ways or locations, we may contact you using any information we have.

Right to be notified in the event of a breach. We will notify you if your medical information has been “breached,” which means that your medical information has been used or disclosed in a way that is inconsistent with law and results in it being compromised.

Right to a paper copy of this notice. You have the right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. Copies of this Notice will be available electronically at www.soundphysicians.com, or by contacting the Sound Privacy Officer as explained at the end of this Notice.

Future changes to Sound’s privacy practices and this nNotice

We reserve the right to change Sound’s privacy practices and this Notice. We reserve the right to make the revised or changed Notice effective for medical information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice on the Sound Physicians website. In addition, at any time you may request a copy of the Notice currently in effect.

Use of unsecure electronic communications. If you choose to communicate with us or any of your providers via unsecure electronic communication, such as regular e-mail or text message, we may respond to you in the same manner in which the communication was received and to the same e-mail address or account from which you sent your original communication. Before using any unsecure electronic communication to correspond with us, note that there are certain risks, such as interception by others, misaddressed/misdirected messages, shared accounts, messages forwarded to others, or messages stored on unsecured, portable electronic devices. By choosing to correspond with us via unsecure electronic communication, you are acknowledging and agreeing to accept these risks.

Additionally, you should understand that use of email is not intended to be a substitute for professional medical advice, diagnosis or treatment. Email communications should never be used in a medical emergency.

Questions or complaints

If you believe that your privacy rights have not been followed as directed by applicable law or as explained in this Notice, you may file a complaint with us. Please send any complaint to the Sound Physicians Privacy Officer at the address provided below. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services. You will not be penalized for filing a complaint.

If you have questions or would like more information, please contact:

Michelle O’Neill, Chief Compliance & Privacy Officer
Sound Inpatient Physicians, Inc.
1222 Demonbreun St., Suite 1601
Nashville, TN 37203

855-768-6363