Notice of Privacy Policies

This notice describes how medical information about you may be used and disclosed and how you can get access to this information.  Please review it carefully.

The mental health providers at 34A State Street are independent practitioners.  Although we may share office space and other supplies and equipment, our businesses are not legally related to one another.  All providers here have agreed to abide by the practice policies described below. Your provider, Dr. Dayton Walsh, has agreed to abide by the privacy practices described below.  

I.  Uses and Disclosures for Treatment, Payment, and Health Care Operations  

Your Provider may use or disclose your protected health information (PHI) for treatment, payment, health care operations, and business associates purposes. To help clarify these terms, here are some definitions: 

  • “PHI” refers to information in your health record that could identify you. It may be information about your past, present, or future health or conditions, or personal history, or the tests and treatment you got from this provider or others, or about payment and billing for health care.

  • “Use” applies only to activities within your Provider’s office, such as sharing, employing, applying, utilizing, examining, and analyzing information that identifies you.

  • “Disclosure” applies to activities outside of your Provider’s office, such as releasing, transferring, or providing access to information about you to other parties.

  • “Treatment, Payment, Health Care Operations, and Business Associates”

– Treatment is the provision, coordination, or management of your health care and other services related to your health care. An example of treatment would be when your Provider consults with another health care provider, such as your family physician or another psychologist.

- Payment is when your Provider obtains reimbursement for your healthcare.  Examples of payment are when your Provider discloses your PHI to your health insurer to obtain reimbursement for your health care or to determine eligibility or coverage.

- Health Care Operations are activities that relate to the performance and operation of your Provider’s practice.  Examples of health care operations are quality assessment and improvement activities, business-related matters such as audits and administrative services, and case management and care coordination.

- Business Associates refer to other businesses your provider may hire to assist them in carrying out their business operations (for example, billing service to track, print, and mail bills). To protect your privacy, these businesses have agreed in their contract with your Provider to protect the privacy of your PHI.

II.  Uses and Disclosures Requiring Authorization 

Your Provider may use or disclose PHI for purposes besides those described above when your appropriate authorization is obtained. An “authorization” is written permission above and beyond the general consent that permits only specific disclosures.  In those instances when your Provider is asked for information for purposes outside of treatment, payment, business associates, and health care operations, they will obtain an authorization from you before releasing this information. You may revoke all such authorizations at any time, provided each revocation is in writing. You may not revoke an authorization to the extent that (1) your Provider has relied on that authorization; or (2) if the authorization was obtained as a condition of obtaining insurance coverage, and the law provides the insurer the right to contest the policy.

III.  Uses and Disclosures with Neither Consent nor Authorization

Your Provider may use or disclose PHI without your consent or authorization in the following circumstances: 

  • As required by Law: Your Provider may disclose information about you (PHI) without your authorization when required to do so by federal, state or local law. For example, your Provider may be required to disclose some of your PHI to government agencies to show that your Provider is complying with the privacy laws.

  • Victims of Abuse or Neglect: Your Provider can share your PHI when reporting suspected victims of abuse or neglect. Your Provider is legally mandated to take steps to protect minors, elderly or dependent adults and to inform the proper authorities if there is suspected or risk of abuse or neglect.

  • Health Oversight: If there is an inquiry or complaint about your Provider’s professional conduct to a health oversight organization (for example, the New York State Board for Psychology), your Provider must furnish your PHI relevant to this inquiry to the appropriate health oversight organization

  • Judicial, Lawsuits, or Administrative Proceedings: If you are involved in a court proceeding and a request is made for information about the professional services that your Provider has provided you and/or the records thereof, such information is privileged under state law, and your Provider must not release this information without your written authorization, or a court or administrative order, subpoena or other lawful process. This privilege does not apply in response to a court or administrative order, or in response to a subpoena. Your Provider must attempt to inform you (or your lawyer) in advance if this is the case.

  • Serious Threat to Health or Safety: Your Provider may disclose your PHI to protect you or others from a serious threat of harm by you.

  • Worker’s Compensation: If you file a worker’s compensation claim, and your Provider is treating you for the issues involved with that complaint, then your Provider must furnish PHI about you to programs that provide benefits for work-related injury or illnesses.

  • Public Health Purposes: Your provider may disclose some of your PHI to agencies that investigate diseases, disabilities, or injuries.

  • Law Enforcement: Your provider may release your PHI for law enforcement purposes in limited circumstances.

  • Relating to decedents: Your provider may disclose your PHI to coroners, medical examiners, or funeral directors, and to organizations relating to organ, eye, or tissue donations or transplants.

  • Inmates: if you are an inmate of a correctional facility, your Provider may disclose the necessary PHI to the institution or agents of the institution for your health and the health and safety of others.

  • Special Government Functions: Your Provider may have to disclose your PHI as required for special government functions such as military, national security, and presidential protective services.

IV.  Patient's Rights and Health Care Provider's Duties

Patient’s Rights:

Right to Request Restrictions – You have the right to request restrictions on certain uses and disclosures of your PHI. However, your Provider is not required to agree to a restriction you request. 

Right to Receive Confidential Communications by Alternative Means and at Alternative Locations – You have the right to request and receive confidential communications of PHI by alternative means and at alternative locations. (For example, you may not want a family member to know that you are seeing a therapist.  Upon your request, your Provider will send your bills to another address. Your Provider will say “yes” to all reasonable requests.

Right to Inspect and Copy – You have the right to inspect or obtain a copy (or both) of PHI in your Provider’s mental health and billing records used to make decisions about you for as long as the PHI is maintained in the record. Your Provider may deny your access to PHI under certain circumstances, but in some cases, you may have this decision reviewed. On your request, your Provider will discuss with you the details of the request and denial process. 

Right to Amend – You have the right to request an amendment of PHI for as long as the PHI is maintained in the record. Your Provider may deny your request.  On your request, your Provider will discuss with you the details of the amendment process. 

Right to an Accounting – You generally have the right to receive an accounting of most disclosures of PHI for which you have neither provided consent nor authorization (as described in Section III of this Notice) for six years prior to the date you ask. The first list you request within a 12-month period will be free. Your Provider may charge you for the costs of providing additional lists within a12-month period. On your request, your Provider will discuss with you the details of the accounting process.

Right to get a copy of this Notice of Privacy Practices – You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically.

Right to choose someone to act for you – If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI. Let your Provider know when this is the case. Your Provider then will make sure the person has this authority and can act for you before they take any action.

For Certain Health Information, you can tell your Provider your choices about what information to share – If you want your Provider to share your health information with your family, close friends, or others involved in your care, tell your Provider to whom and what information to share. Your provider will follow your instructions, as long as it is not against the law. In case of an emergency and your Provider cannot ask if you disagree, your Provider can share information if they believe that it is what you would have wanted or it is in your best interest. If your Provider does share information in an emergency, your Provider will tell you as soon as possible. If you don’t approve, your Provider will stop, as long as it is not against the law.

Health Care Provider’s Duties:

Your Provider is required by law to maintain the privacy of PHI and to provide you with a notice of their legal duties and privacy practices with respect to PHI.

Your Provider will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.

Your Provider reserves the right to change the privacy policies and practices described in this notice. Unless they notify you of such changes, however, they are required to abide by the terms currently in effect. 

If your Provider revises their policies and procedures, they will make a copy of them available to you, and you can discuss them with your Provider.

V.  Questions and Complaints

If you have questions about this notice, disagree with a decision your Provider makes about access to your records, or have other concerns about your privacy rights, you may contact your Provider directly.  

If you believe that your privacy rights have been violated and wish to file a complaint with your Provider, you may send your written complaint to your Provider at 34A State St, Pittsford, NY 14534. You may also send a written complaint to the Secretary of the U.S. Department of Health and Human Services.  Your Provider can provide you with the appropriate address upon request.

You have specific rights under the Privacy Rule. Your Provider will not retaliate against you for exercising your right to file a complaint.

For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html