Notice of Privacy Practices

About This Notice

Smiles of Cary is required by the federal Health Insurance Portability and Accountability Act (HIPAA) to protect the privacy of your health information, to give you this notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect.

“Protected health information” means information that identifies you and relates to your past, present or future dental or medical condition, the care we provide you, or payment for that care. It includes your chart, your radiographs and images, your treatment plan, and your billing and insurance records.

This notice applies to every dentist, hygienist, assistant, administrative team member, student, volunteer and contractor working at our office, and to the records we keep about you.

How We Use and Disclose Your Information for Treatment, Payment and Health Care Operations

We may use and disclose your protected health information for the following three purposes without your written authorization.

For Treatment

We use your information to provide, coordinate and manage your dental care. For example, we may send your radiographs and treatment notes to an oral surgeon, endodontist or orthodontist we are referring you to, share your medical history with an anesthesia provider, send an impression or digital scan to a dental laboratory that will fabricate your crown, or contact your physician about a medication that affects your dental treatment.

For Payment

We use and disclose your information to bill and collect payment for the care we provide. For example, we may send a claim with your diagnosis and the procedures performed to your dental benefit plan, provide information a plan needs to determine eligibility or to pre-authorize treatment, or give an account to a collection agency if a balance goes unpaid.

For Health Care Operations

We use and disclose your information to run the practice and keep the quality of care high. For example, we may review records to evaluate the performance of our clinical team, use your information in training our staff and students, arrange audit, legal or accounting services, or contact you to ask how your visit went.

We may greet you by name in the reception area, call your name when it is time for your appointment, and speak with you in a treatment room where another person could overhear. We take reasonable steps to limit what is said and who can hear it.

Other Uses and Disclosures We May Make Without Your Authorization

Federal law permits or requires us to use or disclose your protected health information without your written authorization in the following circumstances. In each case we disclose only what the law permits.

1. When required by law. Where a federal, state or local law requires the disclosure.
2. Public health activities. To report disease, injury, vital events, and reactions to medications or problems with products, and to help with product recalls.
3. Victims of abuse, neglect or domestic violence. To a government authority authorised to receive such reports.
4. Health oversight. To agencies conducting audits, investigations, inspections and licensure activities.
5. Judicial and administrative proceedings. In response to a court or administrative order, or to a subpoena or discovery request where the required assurances about notifying you or protecting the information have been given.
6. Law enforcement. To identify or locate a suspect, fugitive, material witness or missing person, to report a crime on our premises, and in the other narrow circumstances the rule allows.
7. Coroners, medical examiners and funeral directors. To allow them to carry out their duties, including identification.
8. Organ, eye and tissue donation. To organisations that handle procurement or transplantation.
9. Research. Where an institutional review board or privacy board has approved a waiver, or in the limited preparatory and decedent-research circumstances the rule permits.
10. To avert a serious threat to health or safety. To someone able to help prevent or lessen the threat.
11. Specialised government functions. Military and veterans activities, national security and intelligence, protective services, and correctional institutions and custodial situations.
12. Workers’ compensation. As authorised by, and to the extent necessary to comply with, workers’ compensation and similar programmes.
13. Business associates. To companies that perform services for us and need your information to do so — for example our practice management software provider, our billing service, our dental laboratory, our IT support and our shredding service. Each of them signs a written agreement requiring them to protect your information as we do.

People Involved in Your Care

Unless you object, we may disclose to a family member, relative, close friend or anyone else you identify the information directly relevant to that person’s involvement in your care or in payment for your care, and we may tell them your general condition or location. If you are not present, or are unable to agree or object, we will use our professional judgement about what is in your best interest. We may also disclose information to a disaster relief organisation so your family can be notified.

Appointment Reminders and Treatment Alternatives

We may contact you to remind you that you have an appointment, to tell you about treatment alternatives, and to tell you about health-related benefits or services that may interest you. Contact may be by telephone, voicemail, letter, text message or email. Tell us if you would prefer we did not, or would prefer a different method — see Your Rights.

Fundraising

[PRACTICE TO SUPPLY: confirm whether the practice conducts any fundraising. 45 CFR 164.520(b)(1)(iii)(A) requires a separate fundraising statement, including the individual’s right to opt out of receiving fundraising communications, only if the practice may contact patients to raise funds. If it does not, this sub-section should be deleted rather than left in.]

Uses and Disclosures That Require Your Written Authorization

Uses and disclosures not described in this notice will be made only with your written authorization. In particular, your written authorization is required for:

• Most uses and disclosures of psychotherapy notes, where we hold any.
• Uses and disclosures for marketing purposes, including any communication for which we receive payment from a third party whose product or service is being described.
• Any disclosure that is a sale of your protected health information.

We do not sell your protected health information.

You may revoke an authorization at any time, in writing, delivered to the contact named in Who to Contact. Revoking it stops any further use or disclosure under that authorization. It cannot undo a use or disclosure we already made while it was in force, and it does not affect information we are required to keep as a record of the care we provided.

Your Rights Regarding Your Health Information

You have the following rights over the health information we hold about you. To exercise any of them, make your request in writing to the contact named in Who to Contact.

1. To request restrictions. You may ask us to restrict how we use or disclose your information for treatment, payment or health care operations, or to a person involved in your care. We are not required to agree to a restriction, but if we do agree we will follow it except in an emergency.
   • One restriction we must honour: if you pay in full, out of pocket, for a specific item or service, and you ask us not to disclose the information about that item or service to your health plan for payment or operations purposes, we must agree, unless the law requires the disclosure.
2. To receive confidential communications. You may ask us to communicate with you about your health matters in a particular way or at a particular place — for example only by mail, only at a work address, or with no message left on a voicemail. We will accommodate reasonable requests and will not ask you why.
3. To inspect and copy your record. You may inspect and obtain a copy of the dental and billing records we use to make decisions about your care, for as long as we maintain them. If we hold the record electronically, you may ask for an electronic copy, and you may ask us to transmit a copy to a person you name. We may charge a reasonable, cost-based fee. In limited circumstances we may deny access, and where the law provides for it you may ask that the denial be reviewed.
4. To amend your record. If you believe information we hold about you is incorrect or incomplete, you may ask us to amend it, and you must tell us the reason. We may deny the request — for example if we did not create the information, or if we determine the record is accurate and complete. If we deny it, you may file a written statement of disagreement, which we will keep with the record.
5. To an accounting of disclosures. You may ask for a list of the disclosures we made of your information in the six years before your request, other than disclosures for treatment, payment and health care operations, disclosures you authorised, and the other categories the rule excludes. The first accounting in any twelve-month period is free; we may charge a reasonable, cost-based fee for further requests, and we will tell you the cost before we incur it so you can withdraw or modify your request.
6. To a paper copy of this notice. You may ask for a paper copy at any time, even if you agreed to receive it electronically. Ask at the front desk and we will give you one.
7. To be notified of a breach. We will notify you if a breach occurs that compromises the privacy or security of your unsecured protected health information.
8. To choose someone to act for you. If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise these rights and make choices about your information. We will verify their authority before we act.

[PRACTICE TO SUPPLY: the practice’s stated turnaround for access and amendment requests, and its copying fee schedule. HIPAA sets an outer limit of 30 days for access with one 30-day extension, but the figure published here should be the practice’s own confirmed commitment, checked against North Carolina requirements — no timeline is stated above because none may be invented.]

Our Duties

We are required by law to:

• Maintain the privacy and security of your protected health information.
• Give you this notice of our legal duties and privacy practices with respect to your information.
• Follow the terms of the notice that is currently in effect.
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your information.

We will not use or disclose your information for any purpose other than those described in this notice without your written authorization.

We may change our privacy practices and make the new notice effective for all the protected health information we already hold as well as information we receive in the future. If we make a material change, we will post the revised notice on this page with a new effective date, display a copy in the office, and make paper copies available at the front desk on request.

How to Complain

If you believe your privacy rights have been violated, you may complain to us, to the Secretary of the U.S. Department of Health and Human Services, or to both. You may complain to both at the same time, and you do not have to complain to us first.

Complaining to the Practice

Put your complaint in writing and give it or send it to the contact named in Who to Contact, or telephone the office and ask to speak to that person. Describe what happened and when, as fully as you can. We will look into it and respond to you.

[PRACTICE TO SUPPLY: how quickly the practice commits to acknowledge and to respond to a privacy complaint, and in what form — no timeline is stated here because none may be invented.]

Complaining to the U.S. Department of Health and Human Services

File a written complaint with the Office for Civil Rights. A complaint must generally be filed within 180 days of when you knew the act complained of occurred, though that period can be extended for good cause.

Who to Contact

For more information about this notice, to exercise any of the rights described in it, or to make a complaint, contact our Privacy Officer.

[PRACTICE TO SUPPLY: a monitored postal or electronic destination for written requests and authorization revocations, if it is not the office address above]

Information about how this website itself handles the information you send us — which is a different question from the one this notice answers — is in our Privacy Policy.