There are a number of situations where we may use or disclose to other persons or entities your confidential medical information. Your confidential medical information is defined under federal law as "protected health information" ("PHI"). When we retain your confidential medical information on its computer system, it is called "electronic protected health information" ("ePHI"). This Notice applies to all PHI and ePHI related to your care that we have created or received. It also applies to any personal or general information we receive from patients, including information contained on driver’s licenses. Certain uses and disclosures will require you to sign an Acknowledgement that you received our Notice of Privacy Practices, including treatment, payment and health care operations. Any use or disclosure of your protected health information requires for anything other than treatment, payment or health care operations requires you to sign an Authorization. Certain disclosures required by law or under emergency circumstances, may be made without your Acknowledgement or Authorization. Under any circumstance, we will use or disclose only the minimum amount of information necessary from your medical records to accomplish the intended purpose of the disclosure.

We will attempt in good faith to obtain your signed Acknowledgement that you received this Notice to use and disclose your confidential medical information for the following purposes:

Treatment: We will use your medical information to make decisions about the provision, coordination or management of your health care, including diagnosing your condition and determining the appropriate treatment for that condition. It may also be necessary to share your medical information with another health care provider whom we need to consult with respect to your care. We may also disclose certain information to a pharmacist for the purpose of filling a prescription for you, to a physical therapist to provide physical therapy under appropriate circumstances, or to a facility or other providers should you require surgery or other hospital care. These are only examples of uses and disclosures of medical information for treatment purposes that may or may not be necessary in your case.

Payment: We may need to use or disclose information in your medical record to obtain reimbursement from you or your health insurance plan, or another insurer for our services rendered to you. This may also include determinations of eligibility or coverage under the appropriate health plan, pre-certification and pre-authorization of services or review of services for purposes of reimbursement. This information may also be used for billing, claims management and collection purposes together with related health care data processing through our system.

Operations: Your medical records may be used in our business planning and development operations, including improvement in our methods of operation, and general administrative functions. We may also use the information in our overall compliance planning, medical review activities, and arranging for legal and auditing functions.

There are certain circumstances under which we may use or disclose your medical information without first obtaining your Acknowledgement or Authorization. Those circumstances generally involve public health and oversight activities, law enforcement activities, judicial and administrative proceedings and in the event of death. Specifically, we are required to report to certain agencies information concerning certain communicable diseases, sexually transmitted diseases and HIV/AIDS status. We are also required to report instances of suspected or documented abuse, neglect or domestic violence. We are required to report to appropriate agencies and law enforcement officials information that you or another person are in immediate threat of danger to your health or safety as a result of violent activity. We must also provide medical record information when ordered by a court of law to do so.

Except as outlined in the above sections, your medical information will not be used or disclosed to any other person or entity without your specific Authorization, which may be revoked at any time. In particular, except to the extent disclosure has been made to governmental entities required by law to maintain the confidentiality of the information, information will not be further disclosed to any other person or entity with respect to information concerning mental health treatment, drug and alcohol abuse, HIV/AIDS, or sexually transmitted diseases which may be contained in your medical records without your specific written consent and authorization. We likewise will not disclose your medical record information to an employer for purposes of making employment decisions, to a liability insurer or attorney as a result of injuries sustained in an automobile accident, or to educational authorities, without your written authorization. Your medical information will not be disclosed for marketing purposes or sold to any third party without your authorization.

Other uses and disclosures of your medical record information not covered by this Notice or the laws that apply to us will be made only with your written permission. If you provide us with permission to use or disclose information about you, you may revoke that permission, in writing, at any time. You understand that we are unable to "take back" any disclosures that we have already made with your permission and that we are required to keep any records of the care that we provided to you.

Pa. Gastroenterology Consultants, Digestive Disease Institute, and Poplar Church Anesthesia are "affiliated entities" under the Privacy Rule. Because these three entities are subject to common ownership and control, they are designated as a single covered entity for purposes of HIPAA Privacy compliance. Your protected health information may be shared between and among these entities for purposes of treatment, payment and health care operations. Because these entities work together in providing treatment and participate in quality and utilization activities together, the Privacy Rule allows us to deliver a single Joint Notice. This Joint Notice is applicable to our service delivery site at 899 Poplar Church Road.

You have certain rights with respect to your medical record information, as follows:

1. You may request that we restrict the uses and disclosures of your medical records information for treatment, payment and operations, or restrictions involving your care or payment related to that care. We are not requ8ired to agree to the restriction; however, if we agree, we will comply with it, except with respect to emergencies, disclosure of the information to you, or if we are otherwise required by law to make a full disclosure without restriction.

2. You may also request a restriction on disclosure of protected health information to a health plan for purpose of payment or health care operations if you paid for the services out of your own pocket in full. This does not apply to services that are covered by insurance. You are required to pay cash, in full, for the services before the restriction applies.

3. With respect to ePHI, we agree to give you your ePHI in the form and format requested by you, if it is readily producible in that form or format. If it is not readily producible in the form or format requested, we will give you a readable hard copy form. Any directive given to us by you to transmit ePHI must be done in writing by you, signed and clearly identify the designated person and location to send the ePHI. We will provide you access to your PHI or ePHI within thirty (30) days from the date of request.

4. You have the right to request receipt of confidential communications of your medical information by an alternative means or at an alternative location. If you require such an accommodation, you will be charged a fee for the accommodation and will be required to specify the alternative address or method of contact and how payment will be handled.

5. You have the right to inspect, copy and request amendment to your medical records. Access to your medical records will not include psychotherapy notes contained in them, or information compiled in anticipation of or for use in a civil, criminal or administrative action or proceeding or for which your access is otherwise restricted by law. We will charge a reasonable fee for providing a copy of your medical records, or a summary of those records, at your request, which includes the cost of copying, postage, or preparation of an explanation or summary of the information.

6. We may deny any request for amendment of your PHI or ePHI if the information was not created by us (unless the originator of the information is no longer available to act on your request); is not part of the designated record set maintained by us; is not part of the information to which you have a right of access; or is already accurate and complete, as determined by us. If we deny your request for an amendment, we will give you a written denial including the reasons for the denial and the right to submit a written statement disagreeing with the denial.

7. All requests for inspection, copying and/or amending information in your medical records must be made in writing and be addressed to "Privacy Officer" at our address. We will respond to your request in a timely fashion.

8. You have a limited right to receive an accounting of all disclosures we make to other persons or entities of your medical records information except for disclosures required for treatment, payment and health care operations, disclosures that require an Authorization, disclosures incidental to another permissible use or disclosure, and otherwise as allowed by law. We will not charge you for the first accounting in any 12-month period; however, we will charge you a reasonable fee for each subsequent request for an accounting within the same 12-month period.

9. You have the right to obtain a paper copy of this notice if the notice was initially provided to you electronically, and to take one home with you if you wish.

10. All requests related to your rights herein must be made in writing and addressed to "Privacy Officer" at the address noted below.

11. You have the right to receive notification from us if any breach of your unsecured protected health information occurs.

Our Duties

We have the following duties with respect to the maintenance, use and disclosure of your medical records:

1. We are required by law to maintain the privacy of the protected health information in your medical records and to provide you with this Notice of its legal duties and privacy practices with respect to that information.

2. We are required to abide by the terms of this Notice currently in effect.

3. We reserve the right to change the terms of this Notice at any time, making the new provisions effective for all health information and medical records we have and continue to maintain. All changes in this Notice will be prominently displayed and available at our office.

Medical Identity Theft PrecautionsIn order to be vigilant and protect against medical identity theft, we request patients provide a copy of their current driver’s license to keep on file. A driver’s license contains information that falls within the definition of individually identifiable health information and is therefore PHI. Accordingly, the driver’s license and all personal information related to the driver’s license will be kept strictly confidential consistent with our HIPAA Privacy and Security policies, and as required by federal and state law.

You may file a written complaint to us or to the Secretary of Health and Human Services if you believe your privacy rights with respect to confidential information in your medical records have been violated. All complaints must be in writing and must be addressed to the Privacy Officer (in the case of a complaint to us) or to the person designated by the U.S. Department of Health and Human Services if we cannot resolve your concerns. You will not be retaliated against for filing such a complaint. More information is available about complaints on line at the government’s website:

This Notice of Privacy Practices shall not be construed as a contract or legally binding agreement. Any non-compliance with any provision of this Notice shall not be construed as a breach of contract, breach of confidentiality, invasion of privacy, misappropriation of name or likeness, violation of any consumer protection law, negligence or violation of any state law. By signing the Acknowledgment of Receipt of this Notice, you agree that the sole legal recourse for our non-compliance with this Notice is to file a written complaint to the Secretary of the U.S. Department of Health and Human Services, and that no complaint or cause of action may be filed in any federal or state court for breach of contract, breach of confidentiality, invasion of privacy, misappropriation of name or likeness, violation of any consumer protection law, negligence or violation of any state law, or under any tort theory.

All questions concerning this Notice or requests made pursuant to it should be addressed to:

Privacy Officer, PA Gastroenterology Consultants, Digestive Disease Institute and Poplar Church Anesthesia (the Affiliated Entities), 899 Poplar Church Road, Camp Hill, PA 17011, (717) 763-0430.

Effective DateThis Notice is effective April 14, 2003 and has been revised June 13, 2013, and applies to all protected health information contained in your medical records maintained by us.