1 · Protected Health Information

"Protected health information" (PHI) means any individually identifiable information about your past, present, or future physical or mental health, the care you receive, or the payment for that care, that is created or received by the Practice.

2 · Use and Disclosure for Treatment, Payment, and Operations

Treatment. The Practice may share your PHI with pharmacies, laboratories, other treating clinicians, and similar parties as needed to coordinate your care.

Payment. The Practice may use your PHI to bill and collect for services. The Practice does not submit insurance claims on your behalf; on request the Practice will provide an itemized superbill for you to submit to an out-of-network insurer if you choose.

Healthcare Operations. The Practice may use your PHI for internal operations such as quality review, compliance, and routine administrative work.

Other Routine Uses. The Practice may use your PHI to remind you of appointments, send refill notices, or notify you of treatment alternatives.

3 · California-Specific Protections (CMIA)

In addition to HIPAA, the California Confidentiality of Medical Information Act (Civ. Code §§56–56.37) and Health & Safety Code §123115 provide additional confidentiality for psychiatric records and psychotherapy notes. The Practice will not disclose psychotherapy notes for any purpose other than treatment without your separate written authorization, except where disclosure is mandated by law.

4 · Disclosures Without Authorization (Required or Permitted by Law)

The Practice may disclose your PHI without your authorization when:

• required by federal, state, or local law;
• necessary to prevent or report public-health risks, communicable disease, or vital events;
• reporting suspected abuse, neglect, or domestic violence;
• responding to a court order, subpoena, or other lawful process;
• cooperating with a health-oversight investigation, audit, or licensing action;
• necessary to prevent a serious and imminent threat to your health or safety or that of another person (including the Tarasoff duty to warn under California law);
• responding to law-enforcement, coroner, military, national-security, correctional, or workers'-compensation requirements as permitted by law.

5 · Disclosures You Authorize

The Practice will not disclose your PHI for any purpose not described above without your separate written authorization. You may revoke that authorization at any time, except to the extent the Practice has already acted in reliance on it.

6 · Your Rights

• Inspect and copy. You may inspect and obtain a copy of your records, subject to limited exceptions (for example, where access could endanger you or another person). Reasonable copying fees may apply.
• Request amendments. You may request that the Practice amend information you believe is incorrect or incomplete.
• Request restrictions. You may request that the Practice restrict certain uses or disclosures. The Practice is not required to agree, but if it does, it will honor the agreed restriction except in an emergency.
• Accounting of disclosures. You may request a list of disclosures made for purposes other than treatment, payment, or healthcare operations.
• Confidential communications. You may request that the Practice contact you in a particular way (for example, by phone only, or only at a specific address).
• Paper copy. You may request a paper copy of this notice at any time.

7 · The Practice's Duties

The Practice is required by law to maintain the privacy of your PHI and to provide this notice of its privacy practices. The Practice will abide by the terms of the notice currently in effect. The Practice reserves the right to revise this notice; revisions will apply to all PHI it maintains and will be made available on its website and on request.

8 · Complaints

If you believe your privacy rights have been violated, you may file a complaint with the Practice or with the U.S. Department of Health and Human Services. You will not be retaliated against for filing a complaint. Direct complaints to:

Gordon Wong MD, MPH — Privacy Officer
gordon@gordonwongmd.com
(650) 521-6111

9 · Effective Date

This notice is effective as of the date of your signature below.