Official websites covered: www.northstaremergencycenter.com and www.nstartec.com.
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
1. Who This Notice Applies To
This Notice applies to NorthStar Emergency Center and members of its workforce who create or maintain your protected health information ("PHI") in connection with care provided by NorthStar.
[LEGAL REVIEW REQUIRED: Identify every physician group, contractor, affiliated covered entity, and organized healthcare arrangement participant that will use this joint Notice. If independent clinicians are not covered by this Notice, say so clearly. List all covered service locations.]
This Notice does not describe the independent privacy practices of an organization that is not covered by this Notice.
2. Your Rights
When it comes to your health information, you have certain rights. This section explains those rights and some of our responsibilities.
Get an Electronic or Paper Copy of Your Medical Record
- You may ask to inspect or receive an electronic or paper copy of your medical record and other health information we maintain about you, subject to limited legal exceptions.
- We generally will provide access within 30 days after receiving your request. If we need an extension permitted by law, we will explain the reason and expected completion date in writing.
- We may charge a reasonable, cost-based fee as permitted by law.
- If we deny access, we will explain the reason in writing and tell you whether you may request review of the decision.
Submit a request to [HEALTH INFORMATION MANAGEMENT/RECORDS CONTACT AND METHOD].
Ask Us to Correct Your Medical Record
- You may ask us to correct or amend health information you believe is inaccurate or incomplete.
- We may deny the request in certain circumstances, but we will explain the reason in writing, generally within 60 days.
- You may submit a written statement of disagreement if we deny the request, as permitted by law.
Submit a written request explaining the requested correction to [PRIVACY OFFICER OR RECORDS CONTACT].
Request Confidential Communications
- You may ask us to contact you in a particular way—for example, only at a certain telephone number—or to send mail to a different address.
- We will accommodate reasonable requests. We may ask you to specify an alternative address or method.
Ask Us to Limit What We Use or Share
- You may ask us not to use or disclose certain health information for treatment, payment, or healthcare operations.
- We generally are not required to agree, and we may decline when the request could affect your care or another lawful need.
- If you pay for a healthcare item or service out of pocket in full, you may ask us not to disclose information about that item or service to your health plan for payment or healthcare operations. We will agree unless a law requires disclosure.
- If we agree to a restriction, we will follow it except when the information is needed for emergency treatment or another legal exception applies.
Get a List of Certain Disclosures
- You may request an accounting of certain disclosures of your health information made during the six years before your request.
- The accounting generally will not include disclosures for treatment, payment, or healthcare operations; disclosures you authorized or asked us to make; and certain other disclosures excluded by law.
- We will provide one accounting in a 12-month period without charge. We may charge a reasonable, cost-based fee for additional accountings within that period after telling you the cost and giving you an opportunity to withdraw or modify the request.
Get a Copy of This Notice
You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically. We will provide one promptly.
Choose Someone to Act for You
- If a person has legal authority to act for you, such as a guardian, medical power of attorney, or other personal representative, that person may exercise your rights and make choices about your health information.
- We will verify the person's identity and authority before acting.
- Special rules may apply to minors, parents, guardians, and personal representatives under Texas and federal law.
Receive Notice of Certain Breaches
We will notify you as required by law if a breach occurs that may have compromised the privacy or security of your unsecured PHI.
File a Complaint Without Retaliation
If you believe your privacy rights were violated, you may complain to NorthStar using the contact information at the end of this Notice.
You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR):
- Online: https://www.hhs.gov/hipaa/filing-a-complaint/
- Mail: Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Washington, D.C. 20201
- Phone: 1-800-368-1019
- TDD: 1-800-537-7697
NorthStar will not retaliate against you for filing a complaint or exercising a privacy right.
3. Your Choices
For certain health information, you may tell us your choices about what we disclose. Tell us if you have a clear preference in the situations below.
Family, Friends, and Others Involved in Your Care
We may disclose relevant health information to a family member, friend, caregiver, or other person involved in your care or payment for care when you agree, do not object, or when we reasonably infer from the circumstances that you do not object.
If you cannot tell us your preference—for example, because you are unconscious—we may disclose information if we determine that doing so is in your best interest and is permitted by law. We may also disclose information when necessary to lessen a serious and imminent threat to health or safety.
Disaster Relief
We may disclose limited information to an organization assisting with disaster relief so family or others responsible for your care can be notified about your location, condition, or death, as permitted by law.
Facility Directory
[CHOOSE AND CUSTOMIZE: If NorthStar does not maintain a facility directory, state: “NorthStar does not maintain a public patient directory.” If it does, describe the information included and the patient's right to restrict or opt out.]
Marketing and Sale of PHI
We will obtain your written authorization before using or disclosing PHI for marketing when HIPAA requires authorization. We will not sell your PHI without written authorization except where law permits otherwise.
Psychotherapy Notes
Most uses and disclosures of psychotherapy notes, if NorthStar maintains them, require your written authorization, except in limited circumstances permitted by law.
Fundraising
[CHOOSE AND CUSTOMIZE: “NorthStar does not contact patients for fundraising” OR describe permitted fundraising communications and how a person can opt out.] You may opt out of fundraising communications at any time.
Written Authorization
Other uses and disclosures not described in this Notice will be made only with your written authorization unless law permits or requires otherwise. You may revoke an authorization in writing at any time, except to the extent we already relied on it.
4. How We May Use and Disclose Your Health Information
HIPAA permits or requires us to use and disclose PHI in the following ways. Other laws may impose additional conditions.
Treat You
We may use and disclose your health information to healthcare professionals and organizations involved in your treatment and care coordination.
Example: We may share information with a hospital, specialist, ambulance service, laboratory, radiologist, pharmacy, or other provider involved in your care.
Run Our Organization
We may use and disclose your health information for healthcare operations, including quality assessment, patient safety, credentialing, training, auditing, compliance, legal services, business planning, and improving care.
Example: We may review treatment records to evaluate quality and train our workforce.
Bill for Services
We may use and disclose your health information to bill and obtain payment from health plans, insurers, responsible parties, or others involved in payment.
Example: We may provide diagnosis and service information to your health plan to process a claim.
Business Associates
We may disclose PHI to vendors that perform functions or services for us involving PHI, such as billing, records storage, legal, technology, or quality services. We require business associates to safeguard PHI through written agreements when HIPAA requires them.
Public Health and Safety Activities
We may disclose health information for public health and safety purposes permitted or required by law, such as:
- Preventing or controlling disease
- Reporting certain injuries, births, deaths, or diseases
- Reporting adverse reactions or product problems
- Supporting product recalls
- Preventing or reducing a serious and imminent threat
- Reporting suspected abuse, neglect, or domestic violence to an authorized authority
Research
We may use or disclose health information for research when an institutional review board or privacy board approves a waiver, when information is prepared as a limited or de-identified data set under legal requirements, or when you provide written authorization.
Comply With the Law
We will disclose information when federal or state law requires it, including to HHS to demonstrate HIPAA compliance. If Texas or another applicable law provides greater privacy protection, we will follow the more protective requirement.
Organ and Tissue Donation
We may disclose health information to organ-procurement organizations or other entities involved in organ, eye, or tissue donation and transplantation.
Medical Examiner, Coroner, and Funeral Director
We may disclose health information to a coroner, medical examiner, or funeral director as permitted or required by law.
Workers' Compensation
We may disclose health information for workers' compensation or similar programs as authorized by law.
Health Oversight
We may disclose information to health-oversight agencies for activities authorized by law, such as audits, inspections, licensure, investigations, and disciplinary actions.
Law Enforcement and Other Government Requests
We may disclose health information for certain law-enforcement purposes, correctional-institution functions, military or veterans' activities, national security, protective services, or other government functions when applicable legal requirements are met.
Judicial and Administrative Proceedings
We may disclose health information in response to a court or administrative order, subpoena, discovery request, or other lawful process when the conditions required by HIPAA and other law are satisfied.
Avert a Serious Threat
We may use or disclose health information when necessary to prevent or lessen a serious and imminent threat to a person or the public, consistent with law and ethical standards.
5. Substance Use Disorder Records — 42 CFR Part 2
To the extent NorthStar creates, receives, or maintains substance use disorder ("SUD") patient records protected by 42 CFR Part 2, additional protections may apply.
- Part 2 records generally may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your written consent or a court order and subpoena or other legal mandate that meets Part 2 requirements.
- If you provide a valid consent for treatment, payment, or healthcare operations, certain recipients that are HIPAA covered entities or business associates may redisclose the records as HIPAA permits, subject to Part 2 limitations.
- SUD counseling notes maintained separately from the rest of a record generally require specific consent for use or disclosure, except where law permits otherwise.
- You may file a complaint with NorthStar or HHS OCR concerning a possible Part 2 violation. We will not retaliate against you.
[LEGAL REVIEW: Determine whether NorthStar is itself a federally assisted Part 2 program. If yes, this may need to be a combined HIPAA/Part 2 patient notice with additional program-specific language. If NorthStar only receives Part 2 records, verify the precise language and workflows.]
6. More Protective Laws and Sensitive Records
Texas and federal laws may provide additional protection for certain information, including mental-health records, SUD records, genetic information, communicable-disease information, information about minors, and other sensitive records. We will obtain consent or authorization when required and will follow the more protective applicable law.
[COUNSEL: Insert specific descriptions required by Texas law and NorthStar's actual services.]
7. Electronic Health Information and Health Information Exchange
We may create, receive, maintain, or transmit health information electronically, including through electronic health records, secure exchanges, laboratories, radiology services, billing systems, or other providers involved in care.
[CUSTOMIZE: Describe participation in any health information exchange, patient portal, electronic prescribing network, or emergency-access system and any opt-out right that applies.]
8. Our Responsibilities
- We are required by law to maintain the privacy and security of your PHI.
- We must follow the duties and privacy practices described in the Notice currently in effect.
- We will provide you a copy of this Notice and make it available on our website and at our facility as required.
- We will notify you following a breach of unsecured PHI when required by law.
- We will not use or disclose your health information other than as described in this Notice unless you authorize us in writing or law permits or requires the use or disclosure.
- If you revoke an authorization in writing, we will stop future uses or disclosures covered by that authorization except to the extent we already relied on it or another legal basis applies.
9. Changes to This Notice
We may change the terms of this Notice and make the revised Notice apply to all PHI we maintain, including information created or received before the change. When we make a material change, we will post the revised Notice at our facility and on our website and make copies available upon request. The Notice will state its effective date.
10. Questions, Requests, and Complaints
Contact our privacy official for questions, record requests, restrictions, confidential communications, amendments, accountings, copies of this Notice, or complaints:
NorthStar Emergency Center Attn: [PRIVACY OFFICIAL NAME OR TITLE] 9920 Cypresswood Dr Houston, TX 77070 Phone: [PRIVACY PHONE] Email: [HIPAA PRIVACY EMAIL] Medical-record request method: [PORTAL/FORM/ADDRESS/FAX]
Do not use ordinary email to send sensitive health information unless NorthStar specifically instructs you to use an approved secure method.
Contact details pending: Phone and designated legal or privacy contact fields remain marked with brackets until NorthStar provides the approved information.