This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully. For a Spanish version of our Notice of Privacy Practices, please click here.
Effective Date: March 1, 2018
We* are required by law to protect the privacy of your health information. We are also required to provide you this notice, which explains how we may use information about you and when we can give out or “disclose” that information to others. You also have rights regarding your health information that are described in this notice.
We are required by law to abide by the terms of this notice. The terms “information” or “health information” in this notice include any information we maintain that reasonably can be used to identify you and that relates to your physical or mental health condition, the provision of health care to you, or the payment for such health care. We will comply with the requirements of applicable privacy laws related to notifying you in the event of a breach of your health information.
We have the right to change our privacy practices and the terms of this notice. If we make a material change to our privacy practices, and if we maintain a website, we will post a copy of the revised notice on our website www.medexpress.com. We will also post a copy in our centers. The notice will also be available upon request. We reserve the right to make any revised or changed notice effective for information we already have and for information that we receive in the future.
What Are Your Rights
The following are your rights with respect to your health information:
You have the right to ask to restrict uses or disclosures of your information for treatment, payment, or health care operations. You also have the right to ask to restrict disclosures to family members or to others who are involved in your health care or payment for your health care. Please note that while we will try to honor your request and will permit requests consistent with our policies, we are not required to agree to any restriction other than with respect to certain disclosures to health plans as further described in this notice.
You have the right to request that we not send health information to health plans in certain circumstances if the health information concerns a health care item or service for which you or a person on your behalf has paid us in full. We will agree to all requests meeting the above criteria and that are submitted in a timely manner.
You have the right to ask to receive confidential communications of information in a different manner or at a different place (for example, by sending information to a P.O. Box instead of your home address). We will accommodate reasonable requests. In certain circumstances, we will accept your verbal request to receive confidential communications, however, we may also require you confirm your request in writing. In addition, any request to modify or cancel a previous confidential communication request must be made in writing. Mail your request to the address listed below.
You have the right to see and obtain a copy of certain health information we maintain about you such as medical records and billing records. If we maintain a copy of your health information electronically, you will have the right to request that we send a copy of your health information in an electronic format to you. You can also request that we provide a copy of your information to a third party that you identify. In some cases you may receive a summary of this health information. You must make a written request to inspect or obtain a copy your health information or have your information sent to a third party. Mail your request to the address listed below. In certain limited circumstances, we may deny your request to inspect and copy your health information. If we deny your request, you may have the right to have the denial reviewed. We may charge a reasonable fee for any copies.
You have the right to ask to amend certain health information we maintain about you such as medical records and billing records if you believe the information is wrong or incomplete. Your request must be in writing and provide the reasons for the requested amendment. Mail your request to the address listed below. If we deny your request, you may have a statement of your disagreement added to your health information.
You have the right to receive an accounting of certain disclosures of your information made by us during the six years prior to your request. This accounting will not include disclosures of information made: (i) for treatment, payment, and health care operations purposes; (ii) to you or pursuant to your authorization; and (iii) to correctional institutions or law enforcement officials; and (iv) other disclosures for which federal law does not require us to provide an accounting.
You have the right to a paper copy of this notice. You may ask for a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. If we maintain a website, we will post a copy of the revised notice on our website. You may also obtain a copy of this notice on our website, medexpress.com/notice-of-privacy-practices.
How We Use or Disclose Information
We must use and disclose your health information to provide that information:
- To you or someone who has the legal right to act for you (your personal representative) in order to administer your rights as described in this notice; and
- To the Secretary of the Department of Health and Human Services, if necessary, to make sure your privacy is protected.
We have the right to use and disclose health information for your treatment, to bill for your health care and to operate our business. For example, we may use or disclose your health information:
For Payment. Your PHI will be used and/or disclosed, as needed, to help obtain payment for your services. These uses are often required to obtain payment from third parties such as your insurance company. A third party may include an insurance company, health plan, or in the case of pre-employment evaluations, your employer, if the services are being paid for by your employer. Many services require prior authorization from the insurance company, and your PHI may be disclosed to obtain this authorization for such services before they are rendered.
For Treatment. We may use or disclose health information to provide you and your family with quality care and aid in your treatment or the coordination of your care. For example, we may disclose information to your physicians or hospitals to help them provide medical care to you.
For Health Care Operations. We may use or disclose health information as necessary to operate and manage our business activities related to providing and managing your health care. For example, we may use your health information to perform quality control reviews, internal investigations, performance reviews, patient safety activity, and training of new employees. We might also analyze data to determine how we can improve our services.
To Provide You Information on Health Related Programs or Products such as alternative medical treatments and programs or about health-related products and services, subject to limits imposed by law.
For Reminders. We may use or disclose health information to send you reminders about your care, such as appointment reminders with providers who provide medical care to you or reminders related to medicines prescribed for you.
We may use or disclose your health information for the following purposes under limited circumstances:
As Required by Law. We may disclose information when required to do so by law.
To Persons Involved With Your Care. We may use or disclose your health information to a person involved in your care or who helps pay for your care, such as a family member, when you are incapacitated or in an emergency, or when you agree or fail to object when given the opportunity. If you are unavailable or unable to object, we will use our best judgment to decide if the disclosure is in your best interests.
Special rules apply regarding when we may disclose health information to family members and others involved in a deceased individual’s care. We may disclose health information to any persons involved, prior to the death, in the care or payment for care of a deceased individual, unless we are aware that doing so would be inconsistent with a preference previously expressed by the deceased.
For Public Health Activities such as reporting or preventing disease outbreaks to a public health authority. We may also disclose your information to the Food and Drug Administration (FDA) or persons under the jurisdiction of the FDA for purposes related to safety or quality issues, adverse events or to facilitate drug recalls.
For Reporting Victims of Abuse, Neglect or Domestic Violence to government authorities that are authorized by law to receive such information, including a social service or protective service agency. For Health Oversight Activities to a health oversight agency for activities authorized by law, such as licensure, governmental audits and fraud and abuse investigations.
For Judicial or Administrative Proceedings such as in response to a court order, search warrant or subpoena.
For Law Enforcement Purposes. We may disclose your health information to a law enforcement official for purposes such as providing limited information to locate a missing person or report a crime.
To Avoid a Serious Threat to Health or Safety to you, another person, or the public, by, for example, disclosing information to public health agencies or law enforcement authorities, or in the event of an emergency or natural disaster.
For Specialized Government Functions such as military and veteran activities, national security and intelligence activities,and the protective services for the President and others.
For Workers’ Compensation as authorized by, or to the extent necessary to comply with, state workers’ compensation laws that govern job-related injuries or illness.
For Research Purposes such as research related to the evaluation of certain treatments or the prevention of disease or disability, if the research study meets federal privacy law requirements.
To Provide Information Regarding Decedents. We may disclose information to a coroner or medical examiner to identify a deceased person, determine a cause of death, or as authorized by law. We may also disclose information to funeral directors as necessary to carry out their duties.
For Organ Procurement Purposes. We may use or disclose information to entities that handle procurement, banking or transplantation of organs, eyes or tissue to facilitate donation and transplantation.
To Correctional Institutions or Law Enforcement Officials if you are an inmate of a correctional institution or under the custody of a law enforcement official, but only if necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
To Business Associates that perform functions on our behalf or provide us with services if the information is necessary for such functions or services. Our business associates are required, under contract with us and pursuant to federal law, to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract and permitted by law.
Health Information Exchanges. MedExpress may share your PHI to and through one or more Health Information Exchanges (HIEs) for which it partners in accordance with applicable law for treatment, care coordination and related purposes. HIE is the electronic movement of health-related information among organizations such as health care providers according to nationally recognized standards. You may restrict the HIE’s use and disclosure of your PHI by contacting the HIE for guidance on how to opt out of the HIE. You may also contact us to request a restriction on the use and disclosure of your PHI through the HIE. Certain disclosures through the HIE may require further authorization from you.
Marketing. MedExpress will not use and/or disclose your PHI to any outside marketing agencies without your written authorization. If the marketing is to result in direct or indirect payment to MedExpress by a third party, we will state this on the authorization form you sign. We will never sell your PHI, unless permitted by law or you have authorized us to do so.
Emergencies. If an emergent situation exists where it is not possible to obtain your consent for your PHI uses and/or disclosures, MedExpress will make every effort to obtain consent once the emergent situation is resolved.
Additional Restrictions on Use and Disclosure. Certain federal and state laws may require special privacy protections that restrict the use and disclosure of certain health information, including highly confidential information about you. “Highly confidential information” may include confidential information under Federal laws governing alcohol and drug abuse information as well as state laws that often protect the following types of information:
- HIV/AIDS;
- Mental health;
- Genetic tests;
- Alcohol and drug abuse;
- Sexually transmitted diseases and reproductive health information;
- Child or adult abuse or neglect, including sexual assault.
If a use or disclosure of health information described above in this notice is prohibited or materially limited by other laws that apply to us, it is our intent to meet the requirements of the more stringent law. Attached to this notice is a “Federal and State Amendments” document.
Except for uses and disclosures described and limited as set forth in this notice, we will use and disclose your health information only with a written authorization from you. This includes, except for limited circumstances allowed by federal privacy law, not using or disclosing psychotherapy notes about you, selling your health information to others, or using or disclosing your health information for certain promotional communications that are prohibited marketing communications under federal law, without your written authorization. Once you give us authorization to release your health information, we cannot guarantee that the recipient to whom the information is provided will not disclose the information. You may take back or “revoke” your written authorization at any time in writing, except if we have already acted based on your authorization. To find out how to revoke an authorization, use the contact information below under the section titled “Exercising Your Rights.”
Exercising Your Rights
Contacting your Provider. If you have any questions about this notice or want information about exercising any of your rights, please contact our Compliance and Privacy Officer at 1-304-985-3636.
Submitting a Written Request. Mail to us your written requests to exercise any of your rights, including modifying or cancelling a confidential communication, requesting copies of your records, or requesting amendments to your record, at the following address:
MedExpress Administrative Offices
Attn: Compliance Department
423 Fortress Blvd.
Morgantown, WV 26508
Filing a Complaint. If you believe your privacy rights have been violated, you may file a complaint with us at the following address:
MedExpress Administrative Offices
Attn: Compliance Department
423 Fortress Blvd.
Morgantown, WV 26508
You may also notify the Secretary of the U.S. Department of Health and Human Services of your complaint. We will not take any action against you for filing a complaint.
Federal and State Amendments
The first part of this Notice, which provides our privacy practices for Medical Information, describes how we may use and disclose your health information under federal privacy rules. There are other laws that may limit our rights to use and disclose your health information beyond what we are allowed to do under the federal privacy rules. The purpose of the charts below is to:
- show the categories of health information that are subject to these more restrictive laws; and
- give you a general summary of when we can or cannot use and disclose your health information without your consent.
If your written consent is required under the more restrictive laws, the consent must meet the particular rules of the applicable federal or state law.
SUMMARY OF FEDERAL LAWS
Alcohol & Drug Abuse Information
We are allowed to use and disclose alcohol and drug abuse information that is protected by federal law only (1) in certain limited circumstances, and/or disclose only (2) to specific recipients.
SUMMARY OF STATE LAWS
General Health Information
We are allowed to disclose general health information only (1) under certain limited circumstances, and/ or (2) to specific recipients in CA, FL, IN, MN, MT , NEW , NJ, PR, RI, TN, TX, WA.
You may be able to restrict certain electronic disclosures of health information in NC, NV.
We are not allowed to use or disclose health information for certain purposes in CA, FL, IA, MT, NH, TN.
We will not use and/or disclose information regarding certain public assistance programs except for certain purposes in AL, CA, MO, MT, NV, NJ, SD, TX.
We are allowed to disclose certain immunization records only (1) under certain limited circumstances, and/or disclose only (2) to specific recipients in FL, IL, NE, NV, SC.
We must restrict access to records of minors subject to a court protective order in IL.
We must comply with additional restrictions prior to using or disclose your health information for certain purposes in KS, VI.
We are allowed to disclose your health information only for limited research purposes in WA.
Prescriptions
We are allowed to disclose certain prescription-releated information only (1) under certain limited circumstances, and /or (2) to specific recipients in AL, CO, CT, FL, ID, IN, KY, MI, NE, NV, NH, NY, OH, RI, SC, TN, UT, VA, WV, WY.
We must limit the amount of certain of your health information that we can include on a prescription or other medical certification document in ME.
Communicable Diseases
We are allowed to disclose communicable disease information only (1) under certain limited circumstances, and /or (2) to specific recipients in AZ, IA, IN, KS, MI, MT, NE, NV, OK.
Sexually Transmitted Diseases & Reproductive Health
We are allowed to disclose sexually transmitted disease and/or reproductive health information only (1) under certain limited circumstances and/ or (2) to specific recipients in AZ, CA, FL,IL, IN, IA, KS, MA, MI, MT, NV, NJ, NM, OK, WA, WV, WY.
We are not allowed to identify certain abortion patients in legal proceedings in OK.
Alcohol & Drug Abuse
We are not allowed to disclose alcohol and drug abuse information without your written consent in WV.
We are allowed to use and disclose alcohol and drug abuse information (1) under certain limited circumstances, and/or disclose only (2) to specific recipients in AR, CA, CT, FL, GA, IL, IN, IA, LA, MD, MA, MI, MN, MS, NV, NC, OH, OK, PA, TN, VA, WA, WI.
Genetic Information
We are not allowed to disclose genetic information without your written consent in KS, NH, NY.
We are allowed to disclose genetic information only (1) under certain limited circumstances and/ or (2) to specific recipients in AK, AZ, FL, IL, LA, MA, ME, MO, NH, NV, NJ, NM, OR, RI, TX, VT, WA, WY.
Restrictions apply to (1) the use, and/or (2) the retention of genetic information in AK, DE, NM, WY.
HIV/AIDS
We are allowed to disclose HIV/AIDS-related information only (1) under certain limited circumstances and/or (2) to specific recipients in AZ, CA, CO, CT, DE, FL,GA, IA, IL, IN, KS, KY, ME, MD, MA, MI, MO, MT, NE, NV, NH, NM, NY, NC, OH, OK, OR, PA, PR, RI, TX, WA, WV, WI, WY.
Certain restrictions apply to oral disclosures of HIV/AIDS-related information in CT, FL.
Mental Health
We are not allowed to disclose mental health information without your written consent in PR, UT.
We are allowed to disclose mental health information only (1) under certain limited circumstances and/or (2) to specific recipients in AK, AZ, CA, CT, DC,IA, IL, IN, ME, MD, MI, MS, NV, NH, NJ, NM, NC, OK, PA, SC, SD, TN, TX, UT, WA, WI.
Certain restrictions apply to oral disclosures of mental health information in CT.
Child or Adult Abuse
We are allowed to use and disclose child and/ or adult abuse information only (1) under certain limited circumstances, and/or disclose only (2) to specific recipients in AR, IL, MD.
* Urgent Care MSO, LLC (“MSO”) is a management services provider for physician-owned and other urgent care, walk-in, and on-site centers operated in multiple states as “MedExpress” (hereinafter “Private Office Practice”). The Private Office Practice has complete authority with regards to all medical decision-making and patient care. MSO shall, in no way, determine or set the methods, standards, or conduct of the practice of medicine or healthcare provided at, or by, or through any Private Office Practice, or by any of its professionals. MSO provides consultation services and offers recommendations through its Chief Medical Officer for the Private Office Practice to consider, reject, revise, and/or adopt as it deems fit.
This Medical Information Notice of Privacy Practices applies to all urgent care, walk-in, and on-site centers for which MedExpress provides management services.