Lorzing-Wilmoth Family Health NP, PLLC d/b/a The Root Care, Family Health NP
HIPAA Privacy AND SECURITY Policy
Effective Date: ____July 30,_ 2026
Introduction
This Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Policy (the “HIPAA Privacy and Security Policy” or “Policy”) shall apply to all employees, volunteers, and other individuals of Lorzing-Wilmoth Family Health NP, PLLC d/b/a The Root Care, Family Health NP (“Lorzing-Wilmoth Family Health NP, PLLC”) who have access to Protected Health Information as that term is defined under HIPAA (“PHI”) in the course of their duties (collectively, “Employees”), whether or not the Employee is directly involved in providing patient care. Employees and all relevant individuals are expected to comply with this Policy indefinitely and maintain the confidentiality of PHI even after their employment or affiliation with Lorzing-Wilmoth Family Health NP, PLLC comes to an end. Lorzing-Wilmoth Family Health NP, PLLC intends to fully comply with the HIPAA requirements, as administered by the United States Department of Health and Human Services (HHS), including HIPAA’s Privacy Rule and Security Rule. HIPAA restricts the Lorzing-Wilmoth Family Health NP, PLLC’s use and disclosure of PHI including by “business associates”. Unless otherwise defined herein, all capitalized terms shall have the meanings ascribed to them under HIPAA, as amended, including its implementing regulations at 45 C.F.R. Parts 160 to 164.
Protected Health Information (“PHI”)
“Protected health information” (“PHI”) as defined by HIPAA and its accompanying regulations (the “Privacy Standards”), shall mean individually identifiable health information, including demographic information, that is created, received, transmitted or maintained by Lorzing-Wilmoth Family Health NP, PLLC, regardless of form (oral, written, or electronic), that relates to:
· the past, present or future physical or mental health or condition of an individual;
· the provision of health care services to an individual; or
· the past, present, or future payment for the provision of health care to an individual.
For purposes of this Policy, PHI may include, but is not necessarily limited to: medical records, billing records, medical images, consultant reports, laboratory or other diagnostic testing results, customer/patient/client media and information, electronic transmissions from and to patients/client and from and to other health care providers, insurers, and authorized government agencies, information generated or maintained for the customer/patient/client by Lorzing-Wilmoth Family Health NP, PLLC and any other individually identifiable information.
“Unsecured PHI” shall mean PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary of HHS in the guidance issued under Section 13402(h)(2) of the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) on the HHS website.
Confidentiality of Records
All PHI created, received, transmitted, or maintained by Lorzing-Wilmoth Family Health NP, PLLC is confidential and remains the property of Lorzing-Wilmoth Family Health NP, PLLC. Confidentiality extends to PHI in any medium, including information that is on paper, in the computer systems of Lorzing-Wilmoth Family Health NP, PLLC, or communicated verbally.
Employees may not divulge, copy, transfer, alter, or destroy any PHI, or remove any PHI from Lorzing-Wilmoth Family Health NP, PLLC, except as authorized by Lorzing-Wilmoth Family Health NP, PLLC or its designated privacy personnel. Employees must hold in strictest confidence any and all access codes, passwords, and/or authorizations provided by Lorzing-Wilmoth Family Health NP, PLLC.
Minimum Necessary Disclosure
HIPAA requires that when PHI is used or disclosed, the amount disclosed generally must be limited to the “minimum necessary” to accomplish the purpose of the use or disclosure. The “Minimum Necessary” Standard does not apply to any of the following:
· uses or disclosures to or requests by a health care provider for treatment purposes;
· uses or disclosures made to the individual who is the subject of the information;
· uses or disclosures made pursuant to a valid authorization;
· disclosures made to the Federal Department of Health and Human Services;
· uses or disclosures required by law;
· uses or disclosures required to comply with HIPAA.
Employees must use PHI only as necessary to perform duties as assigned by Lorzing-Wilmoth Family Health NP, PLLC, or as specified in his/her job description. When using, disclosing, and/or accessing PHI, Employees may only use or access the minimum necessary PHI to perform such duties. When PHI must be shared with others, it must be shared in such a manner and with appropriate safeguards to minimize the risk of potential disclosure beyond those individuals with whom it is shared, and for the intended purpose.
Disclosures of PHI Pursuant to an Authorization
PHI may be disclosed for any purpose if an authorization that satisfies all of HIPAA’s requirements for a valid authorization is provided by the individual. All uses and disclosures made pursuant to a signed authorization must be consistent with the terms and conditions of the authorization.
Disclosures of De-identified Information and Limited Data Sets
Lorzing-Wilmoth Family Health NP, PLLC may freely use and disclose de-identified information. De-identified information is health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual. There are two ways Lorzing-Wilmoth Family Health NP, PLLC can determine that information is de-identified: either by professional statistical analysis, or by removing the 18 specific identifiers under HIPAA. Limited data sets that contain identifiable information may be used or disclosed if a Data Use Agreement is executed with the recipient in accordance with 45 CFR §164.514(e).
Disclosures of PHI to Business Associates
Employees with access to Protected Health Information (PHI) may disclose PHI to Lorzing-Wilmoth Family Health NP, PLLC’s business associates or allow business associates to create or receive PHI on behalf of the practice. However, before doing so, the practice must first obtain written assurances—typically in the form of a Business Associate Agreement (BAA)—that the business associate will appropriately safeguard the information. Before sharing PHI with any outside consultants, vendors, or contractors who meet the definition of a “business associate,” employees must first verify that a valid BAA is in place. All efforts should first be made to utilize the standard BAA template provided by Lorzing-Wilmoth Family Health NP, PLLC. In instances where a third party, vendor, or business partner proposes the use of their own BAA template, such documents must undergo a thorough legal and compliance review to ensure they provide adequate protections for Lorzing-Wilmoth Family Health NP, PLLC and align applicable regulatory requirements. No external BAA template should be accepted or executed without proper inspection and approval.
A Business Associate is any individual or entity that:
· Performs or assists in performing a function or activity on behalf of Lorzing-Wilmoth Family Health NP, PLLC that involves the use or disclosure of PHI (such as billing, data analysis, or practice management services); or
· Provides legal, accounting, consulting, IT, accreditation, or other professional services to the practice, where access to PHI is required to perform those services.
Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2)
To the extent Lorzing-Wilmoth Family Health NP, PLLC creates or maintains records subject to 42 CFR Part 2, Employees must comply with the heightened privacy protections for substance use disorder treatment records. Employees may only use or disclose such records without written consent in the following limited circumstances:
· Medical emergencies when prior consent is not possible;
· Court orders that comply with 42 CFR Part 2;
· Research purposes meeting applicable regulatory conditions;
· Audit or program evaluation by authorized agencies;
· Public health activities using non-identifying information; and
· Reporting suspected child abuse or neglect.
For all other purposes, including treatment, payment, health care operations, and disclosure to third parties, Employees must obtain the individual’s written consent before using or disclosing substance use disorder treatment records. Substance use disorder records shall not be used or disclosed in any legal proceeding against the individual without written consent or a court order complying with 42 CFR Part 2. Prior to any release of substance use disorder records, Employees must verify that proper consent has been obtained and that heightened 42 CFR Part 2 protections are satisfied.
Substance Use Disorder Counseling Notes
“SUD Counseling Notes” means notes recorded by a substance use disorder clinician analyzing the conversation in a substance use disorder counseling session that the clinician voluntarily maintains separately from the rest of the patient’s substance use disorder treatment and medical record. SUD Counseling Notes require a separate, specific written consent from the individual and may not be used or disclosed based upon a general consent for treatment, payment, and health care operations. Employees must maintain SUD Counseling Notes separately from other records and must not use or disclose such notes without first obtaining specific written patient consent in accordance with 42 CFR Part 2.
Compliance Obligations Under 42 CFR Part 2
Lorzing-Wilmoth Family Health NP, PLLC must honor requests from individuals for restrictions on the use and disclosure of their substance use disorder records and provide an accounting of disclosures made without consent upon request. The designated privacy personnel are responsible for documenting and processing such requests.
Requests for Requested Confidential Communications
Individuals may request to receive communications regarding their PHI by alternative means or at alternative locations. For example, an individual may ask to be called only at work rather than at home. Such requests shall be honored if, in the sole discretion of Lorzing-Wilmoth Family Health NP, PLLC, the requests are reasonable. However, Lorzing-Wilmoth Family Health NP, PLLC shall accommodate such a request if the individual clearly provides information that the disclosure of all or part of that information could endanger the individual.
Disclosure Restrictions for Patient-Self-Paid Services
To protect patient privacy and uphold the integrity of patient-provider financial arrangements, Employees must not disclose information regarding services that have been paid for fully out-of-pocket by patients to health plans, when the patient has requested confidentiality. This applies to any service for which the patient has paid in full without using insurance benefits and has requested that the information not be shared. This practice aligns with the patient’s right under the HIPAA to request restrictions on the disclosure of PHI particularly in cases where the patient has paid in full and requested that the information not be disclosed to their health plan.
Employees are expected to honor reasonable requests for confidential communication and ensure that such services remain private, unless disclosure is otherwise required by law.
Access to Protected Health Information and Requests for Amendment
Under the HIPAA, individuals have the right to access and obtain copies of their PHI that Lorzing-Wilmoth Family Health NP, PLLC (or its business associates) maintains in what is called a “Designated Record Set.” Individuals also have the right to request an amendment to their PHI if they believe it is inaccurate or incomplete. All requests for access or amendment must be submitted in writing and will be reviewed in accordance with our Notice of Privacy Practices. A Designated Record Set includes:
· Medical and billing records used to make decisions about an individual’s care.
· Any other records maintained by or for the practice that are used, in whole or in part, to make decisions about individuals.
Patients have the right to access their Protected Health Information (PHI), subject to certain exclusions such as psychotherapy notes and information compiled for legal proceedings. Requests for access must be made in writing and Lorzing-Wilmoth Family Health NP, PLLC will respond to such requests in a timely manner, consistent with applicable New York and federal law. If access is granted, records will be provided in the format requested, including electronic copies when available and feasible. Patients may be charged a reasonable fee to cover the cost of labor, supplies, postage, and the preparation of summaries or explanations, if requested.
If a request is denied, the patient will receive a written explanation and may have the right to request a review of the denial by a licensed health care professional not involved in the initial decision.
Employees must understand and respect these rights. If an individual inquires about accessing or amending their records, please direct them to the appropriate staff member to assist with this request. Lorzing-Wilmoth Family Health NP, PLLC will document and retain the Designated Record sets subject to access by individuals and the titles of the persons responsible for receiving and processing these requests, as required by CFR § 164.530(j) and § 164.524.
Personal Representatives
Personal representatives have the same rights as the individual regarding their PHI under the Privacy Rule at 45 CFR 164.502(g). They can access, amend, and authorize disclosures of the individual's health information. Examples of personal representatives include:
· Parents or legal guardians for minors
· Legal guardians for mentally incompetent adults
· Individuals with health care power of attorney for specific treatments
· Executors of estates for deceased individuals
However, there are exceptions where parents are not considered personal representatives for their minor children:
· When minors can consent to certain health services without parental approval under state law
· When another person is legally authorized to consent to the minor's health care
· When parents agree to a confidential relationship between the minor and the health care provider
In cases of abuse, neglect, or endangerment, Lorzing-Wilmoth Family Health NP, PLLC may choose not to treat a person as the individual’s personal representative if doing so would not be in the best interests of the individual.
Administrative Safeguards
Lorzing-Wilmoth Family Health NP, PLLC has implemented appropriate administrative, technical, and physical safeguards (including, but not limited to, Lorzing-Wilmoth Family Health NP, PLLC’s Notice of Privacy Practices, as attached hereto and hereby incorporated by reference) to protect the privacy of PHI and to safeguard PHI from any intentional or unintentional uses or disclosures that are in violation of the policies and procedures of Lorzing-Wilmoth Family Health NP, PLLC. Employees must strictly comply with all applicable federal and state laws and regulations, and all policies and procedures established by Lorzing-Wilmoth Family Health NP, PLLC relating to the confidentiality and protection of PHI.
Technical and Physical Safeguards and Firewall
An analysis of all the Lorzing-Wilmoth Family Health NP, PLLC’s information networks and systems will be conducted on a periodic basis to document the threats and vulnerabilities to stored and transmitted information. The analysis will examine the types of threats—internal or external, natural or artificial, electronic and non-electronic—that affect the ability to manage the information resource. Finally, the analysis will also include an evaluation of the information assets and the technology associated with its collection, storage, dissemination and protection. From the combination of threats, vulnerabilities, and asset values, an estimate of the risks to the confidentiality, integrity and availability of the information will be determined. Based on the periodic assessment, measures will be implemented that reduce the impact of the threats by reducing the amount and scope of the vulnerabilities. All computer equipment and network systems are assets of Lorzing-Wilmoth Family Health NP, PLLC and are expected to be protected from misuse, unauthorized manipulation, and destruction. These protection measures may be physical and/or software based on the following:
· Installed Software: All software packages that reside on computers and networks within the company must comply with applicable licensing agreements and restrictions.
· Virus Protection: Virus checking systems approved by the Lorzing-Wilmoth Family Health NP, PLLC must be deployed using a multi-layered approach (desktops, servers, gateways, etc.) that ensures all electronic files are appropriately scanned for viruses. Users are not authorized to turn off or disable virus checking systems.
· Access Controls: Electronic access to PHI is controlled to ensure appropriate levels of access by Employees. The designated privacy personnel will ensure that Employees who have access to PHI will be adequately trained on its privacy and security policies and procedures. To ensure security for systems accessing Protected Health Information (PHI), each user or Employee must have a unique ID, and access is protected by strong passwords and other measures like auto-locking after failed login attempts or inactivity. Data sent over networks, especially emails containing PHI, must be encrypted to prevent unauthorized access, and remote access to the network must be done through a secure virtual private network (VPN). All other network access options to these systems are strictly prohibited. Employees must ensure that computers and devices used to access PHI are secured to prevent unauthorized viewing or access.
· Removable Media Use: Employees can use company-provided removable media (like thumb drives, SD cards, and CDs) for job functions. All media must be secured and encrypted per HIPAA guidelines. Patient-provided media should be uploaded via a secure company device. Employees need prior authorization from the designated privacy or security official to transfer any removable media containing PHI.
· Secure Disposal: Employees are responsible for the secure disposal of PHI. Any documents or files containing PHI must be securely destroyed (shredded if paper, or permanently deleted if electronic) to prevent unauthorized access.
· Employee Hiring and Offboarding Precautions: Lorzing-Wilmoth Family Health NP, PLLC will promptly disabling system access and devices when someone leaves. All devices and media containing PHI must be tracked and handled securely.
· Remote Access and Mobile Use: Employees must follow this Policy when working remotely to ensure the protection of PHI. PHI should never be stored on mobile devices unless they are password-protected, encrypted, and never left unattended in unsecured areas. Employees are responsible for securing from theft any property of Lorzing-Wilmoth Family Health NP, PLLC, including company devices and data.
· Technology Use and Internet Access: Employees of Lorzing-Wilmoth Family Health NP, PLLC must use company- provided technology and internet access for authorized business purposes only, ensuring that PHI is handled securely. The use of personal devise to access Lorzing-Wilmoth Family Health NP, PLLC’s networks or PHI, is prohibited unless specifically authorized and compliant with security standards, including encryption and antivirus standards, including encryption and antivirus protections. Remote access to PHI must be conducted through secure connections, such as VPNs, with devices protected by passwords and updated security software.
· PHI Storage: PHI must be stored securely and only accessed by authorized individuals. It should not be downloaded, printed, or left exposed where it could be compromised.
General Email Guidance
Employees are expected to exercise caution and discernment with email commendations’ is essential that all emails are read thoroughly before reacting. If there is any doubt about email’s legitimacy, the Employee should delete it as email can always be resent. In cases where a suspicious link is clicked, the Employee should immediately screenshot the email and send it to the designated privacy personnel. Employees must not:
· open any email with a suspicious subject or sender.
· reply to, open attachments from, or click on URLs from unknown and untrusted sources.
· use their company email address for personal communications.
· ever send personal/sensitive information via email – e.g. passwords, credit card numbers, social security numbers, or account numbers.
Employees should:
· check for misspellings, grammatical errors, and abnormal spacing that may be indicative of a phishing email.
· check links by using your mouse to hover over the hyperlink to determine if the URL makes sense with the sender – e.g. matching the sender’s name to the URL, whether there’s a foreign name or location in the URL, etc.
· report any suspicious emails – even if not sure – to the appropriate privacy personnel by sending a screen shot. Further follow up may occur if deemed appropriate.
· delete the email after it’s been screenshot and sent to the appropriate privacy personnel.
block the sender
Security Incident Reporting
Employees of Lorzing-Wilmoth Family Health NP, PLLC are expected to report discovered or suspected security incidents which include but are not limited to the following:
· Loss or suspected compromise of user credentials or physical access devices (including passwords, tokens, keys, badges, smart cards, or other means of identification and authentication);
· Suspected malware infections, including viruses, Trojans, spyware, worms, or any anomalous reports or messages from anti-virus software or personal firewalls;
· Loss or theft of any device that contains Lorzing-Wilmoth Family Health NP, PLLC’s information (other than public information), including computers, laptops, tablet computers, smartphones, USB drives, disks, or other storage media;
· Suspected entry (hacking) into Lorzing-Wilmoth Family Health NP, PLLC’s network or systems by unauthorized persons;
· Any breach or suspected breach of PHI;
· Any attempt by any person to obtain passwords in person or by phone, email, or other means (sometimes called social engineering, or in the case of email, phishing); and
· Any other situation that appears to violate this Policy or otherwise create undue risks to Lorzing-Wilmoth Family Health NP, PLLC’s information assets.
Lorzing-Wilmoth Family Health NP, PLLC maintains various forms of monitoring and surveillance to detect cyber incidents, but employees may be the first to notice a problem. Early detection and response can mitigate damages and minimize further risk to Lorzing-Wilmoth Family Health NP, PLLC’s. Treat any information regarding cyber incidents as confidential and do not share it, internally or externally, without specific authorization.
Compromised Devices
If an Employee becomes aware of a compromised computer or other device, they should immediately deactivate (or unplug) any network connections without powering down the equipment to preserve valuable information. They must then promptly notify the designated personnel at Lorzing-Wilmoth Family Health NP, PLLC.
Breach
“Breach” shall be defined as the acquisition, access, use, or disclosure of PHI in a manner not permitted under HIPAA and its implementing regulations which compromise the security or privacy of the PHI. If an unauthorized use or disclosure of PHI occurs, the security or privacy of PHI is presumed to have been compromised unless Lorzing-Wilmoth Family Health NP, PLLC demonstrates that there is a low probability that the PHI has been compromised. This determination is made through a risk assessment of at least the following factors:
· The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification;
· The unauthorized person who used the PHI or to whom the disclosure was made;
· Whether the PHI was actually acquired or viewed; and
· The extent to which the risk to the PHI has been mitigated.
Other considerations in evaluating a breach include contractual and legal obligations, risk of identity theft or fraud, risk of physical harm, risk of hurt, humiliation, or damage to reputation, and the number of individuals affected. A use or disclosure of PHI that does not include the identifiers listed at 45 CFR § 164.514(e)(2), date of birth, and zip code does not compromise the security or privacy of the protected health information. Breach excludes:
· Any unintentional acquisition, access, or use of protected health information by a workforce member or person acting under the authority of a covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under HIPAA and its implementing regulations.
· Any inadvertent disclosure by a Person with access and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted under HIPAA and its implementing regulations.
· A disclosure of PHI where Lorzing-Wilmoth Family Health NP, PLLC has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.
Breach Notification Requirements
Employees of Lorzing-Wilmoth Family Health NP, PLLC will comply with the requirements of the HITECH Act and its implementing regulations with respect to notifications in the event of a breach of unsecured PHI. As a result, if an Employee becomes aware of a potential breach of unsecured PHI, the Employee shall contact the designated privacy personnel at Lorzing-Wilmoth Family Health NP, PLLC. Promptly after a report of suspected breach of unsecured PHI, the designated privacy personnel together with the legal team shall direct and undertake an investigation and risk assessment to determine if a breach of unsecured PHI occurred and the scope of such breach. The investigation will utilize the HITECH Act: Breach Investigation Checklist/Worksheet attached as Appendix A to determine the outcome. Business associates must cooperate with the Lorzing-Wilmoth Family Health NP, PLLC in investigating and mitigating impact if there is a breach. There is a reportable breach only if all of the following have occurred, as determined by the designated privacy personnel:
· There is a violation of the HIPAA Privacy Rules involving “unsecured” PHI.
· The violation involved unauthorized access, use, acquisition, or disclosure of unsecured PHI.
· The violation resulted in a compromise of the security or privacy of the PHI.
· No exception applies under applicable law.
If the designated privacy personnel together with the legal team determines that there is a low probability that the PHI was compromised, Lorzing-Wilmoth Family Health NP, PLLC will document the determination in writing and keep the documentation on file. Lorzing-Wilmoth Family Health NP, PLLC shall, following the discovery of a breach of unsecured PHI that is required to be reported, notify each individual whose unsecured PHI has been, or is reasonably believed by Lorzing-Wilmoth Family Health NP, PLLC to have been, accessed, acquired, used, or disclosed as a result of such breach as well as the Secretary of HHS.
For a breach of unsecured PHI involving 500 or more residents of a state or jurisdiction, Lorzing-Wilmoth Family Health NP, PLLC shall notify prominent media outlets serving the state or jurisdiction. For a breach of unsecured PHI involving 500 or more individuals, Lorzing-Wilmoth Family Health NP, PLLC shall notify the Secretary of HHS contemporaneously with the notice to affected individuals and in the manner specified on the HHS website.
The above notices shall be provided without unreasonable delay and in no case later than 60 days after discovery of the breach and shall comply with the requirements of the HITECH Act and its implementing regulations with respect to the content and method of notification. A business associate is required to do the same. For breaches affecting fewer than 500 individuals, Lorzing-Wilmoth Family Health NP, PLLC must still notify HHS, but it can do so on an annual basis (within 60 days after the end of the calendar year of the breach).
Mitigation of Harmful Effects
Under the Privacy Standards, Lorzing-Wilmoth Family Health NP, PLLC has a duty to mitigate, to the extent practicable, any harmful effect that is known to Lorzing-Wilmoth Family Health NP, PLLC arising out of a use or disclosure of PHI in violation of its policies and procedures or the Privacy Standards by Lorzing-Wilmoth Family Health NP, PLLC, its Employees, or its Business Associates. Employees who become aware of any activity by an individual or entity that may jeopardize the confidentiality of PHI must promptly report such activity to Lorzing-Wilmoth Family Health NP, PLLC designated privacy personnel.
Training
All Employees of Lorzing-Wilmoth Family Health NP, PLLC as well as any business associates and subcontractors engaged by Lorzing-Wilmoth Family Health NP, PLLC, shall undergo training regarding the handling, security, and compliance requirements of PHI as stipulated by this Policy. Such training shall occur upon initial employment or engagement and annually thereafter to ensure familiarity with the privacy practices and obligations under HIPAA and other applicable laws. Business associates and other subcontractors must expressly agree to comply with Lorzing-Wilmoth Family Health NP, PLLC’s HIPAA Privacy and Security Policy, including participation in mandatory training sessions. Non-compliance with training requirements, or this Policy may result in disciplinary action, including termination of employment or contractual agreements as deemed appropriate by Lorzing-Wilmoth Family Health NP, PLLC.
Social Media
Employees of Lorzing-Wilmoth Family Health NP, PLLC are strictly prohibited from sharing any PHI on social media platforms. This includes any identifiable patient information or images that could compromise patient confidentiality. Employees must also make it clear that any views expressed on social media are theirs alone and do not represent the views of Lorzing-Wilmoth Family Health NP, PLLC Any content related to Lorzing-Wilmoth Family Health NP, PLLC or services must be approved by designated privacy personnel before being posted on official social media channels. Violations of this provision may result in disciplinary action, including termination.
Complaint Process
Lorzing-Wilmoth Family Health NP, PLLC has created a complaint process for its Employees and other individuals to make complaints concerning the policies and procedures of Lorzing-Wilmoth Family Health NP, PLLC and its compliance with such policies and procedures. Complaints can be filed at ______________________________________ [INSERT ADDRESS]. Note: Lorzing-Wilmoth Family Health NP, PLLC is a telemedicine practice offering services solely online. Complaints also can be filed with the Secretary of the U.S. Department of Health and Human Services at the below address. There will be no retaliation for filing a complaint.
Office for Civil Rights
U.S. Department of Health and Human Services
200 Independence Avenue, S.W., Room 509F HHH Bldg.
Washington, D.C. 20201
Customer Response Center: (800) 368-1019
Fax: (202) 619-3818
TDD: (877) 696-6775
Email: OCRComplaint@hhs.gov
Website: www.hhs.gov/ocr/privacy/hipaa/complaints/
Individual Rights
An individual is entitled to certain rights under HIPAA. Such individual rights are set forth in, and administered in accordance with, Lorzing-Wilmoth Family Health NP, PLLC ’s Notice of Privacy Practices, as attached hereto and hereby incorporated by reference.
Non-Retaliation
Lorzing-Wilmoth Family Health NP, PLLC will not discriminate, intimidate, threaten, coerce, discriminate against, or take any other retaliatory action against any individual or Employee for exercising his/her right to file a complaint with the designated privacy personnel of Lorzing-Wilmoth Family Health NP, PLLC, or with the Secretary of the United States Department of Health and Human Services. Lorzing-Wilmoth Family Health NP, PLLC will not intimidate, threaten, coerce, discriminate against, or take any other retaliatory action against any individual or Employee for testifying, assisting, or participating in an investigation, compliance review, proceeding, or hearing regarding an alleged violation under HIPAA and the Privacy Standards.
Non-Waiver of Rights
In addition, Lorzing-Wilmoth Family Health NP, PLLC may not require an individual or Employee to waive his/her rights under HIPAA and/or the Privacy Rule as a condition of the provision of treatment, payment, enrollment in a health plan, or eligibility benefits. Employees may be required to sign a written acknowledgement confirming his/her understanding of this entire HIPAA Policy.
Administrative Sanctions
Any violation of this policy, any other Lorzing-Wilmoth Family Health NP, PLLC policy or procedure relating to the protection of PHI, or any applicable federal or state law, may subject Employees to disciplinary action. Based upon the facts and circumstances surrounding any violation, disciplinary action may include, but is not necessarily limited to, verbal warning, written warning, and/or suspension or termination from employment. An employee’s responsibility to safeguard the confidentiality of PHI continues after termination of his/her employment.
Amendments
No third-party rights are intended to be created by this Policy. Lorzing-Wilmoth Family Health NP, PLLC reserves the right to amend or change this Policy at any time (and even retroactively) without notice. To the extent this Policy establishes requirements and obligations above and beyond those required by HIPAA, the Policy shall be aspirational and shall not be binding upon the Lorzing-Wilmoth Family Health NP, PLLC.
Privacy Notice
The designated privacy personnel will maintain Lorzing-Wilmoth Family Health NP, PLLC’s Notice of Privacy Practices that describes the uses and disclosures of PHI that may be made by Lorzing-Wilmoth Family Health NP, PLLC; the individual’s rights with respect to use and disclosure of PHI; and Lorzing-Wilmoth Family Health NP, PLLC’s legal duties with respect to the PHI.
Further Information
If an Employee or any individual has any questions or need further assistance regarding or would like to submit a complaint or request you may contact Lorzing-Wilmoth Family Health NP, PLLC