About This Notice
Driftless Health LLC ("Driftless Health") is committed to protecting the privacy of your health information. This Notice explains how we may use and disclose your protected health information, the rights you have concerning that information, and the duties we must follow. This Notice applies to Driftless Health, its health care providers, workforce members, and others who help provide or support care on its behalf.
When Wisconsin law or another applicable law gives your health information greater protection than federal law, Driftless Health will follow the more protective law.
Questions or requests: Contact the Privacy Officer at 608-638-8500 or write to Driftless Health LLC, 124½ S. Main Street, Suite 103, Viroqua, Wisconsin 54665.
1. Your Rights
You have the following rights concerning health information we maintain about you.
Get an electronic or paper copy of your health information
You may ask to inspect or receive an electronic or paper copy of health information in your designated record set, including medical and billing records, except for limited information the law does not require us to provide. You may submit a request through the patient portal or contact the Privacy Officer.
We generally will provide access within 30 days after receiving your request. If we need more time, we will give you a written explanation and the expected completion date. If we deny access, we will explain why in writing and tell you whether you may have the decision reviewed.
We may charge a reasonable, cost-based fee permitted by applicable law for copying, supplies, postage, or preparation of an agreed-upon summary. We will notify you in advance of the approximate fee.
Ask us to correct your record
If you believe health information in your record is incorrect or incomplete, you may ask us in writing to amend it and explain the reason for the request. We will generally respond within 60 days. We may deny the request in some circumstances, such as when the information is accurate and complete or was not created by us and the person who created it is available to act on the request. If we deny the request, we will explain why in writing and tell you how to submit a statement of disagreement.
Request confidential communications
You may ask us to contact you in a specific way, such as only through the patient portal or at a particular telephone number, or to send mail to a different address. We will accommodate reasonable requests and will not require you to explain the reason.
Ask us to limit what we use or disclose
You may ask us not to use or disclose certain health information for treatment, payment, or health care operations, or not to share it with a person involved in your care or payment for your care. We are generally not required to agree, and we may decline if the requested restriction would affect your care or if the disclosure is otherwise required or permitted by law.
If you pay in full out of pocket for a health care item or service and ask us not to disclose information about that item or service to a health plan for payment or health care operations, we will agree unless the disclosure is required by law.
Get a list of certain disclosures
You may ask for an accounting of certain disclosures of your health information made during the six years before your request. The accounting will not include every disclosure, including most disclosures made for treatment, payment, or health care operations, disclosures you authorized, and certain other disclosures excluded by law. We will provide one accounting in any 12-month period at no charge and may charge a reasonable, cost-based fee for additional accountings during that period after notifying you in advance.
Get a paper copy of this Notice
You may ask for a paper copy of this Notice at any time, even if you agreed to receive it electronically. The current Notice is also available at driftlesshealth.co and from our office.
Choose someone to act for you
If you have given someone medical power of attorney, or if someone is your legal guardian or otherwise legally authorized to act for you, that person may exercise your rights and make choices about your health information. We may ask for documentation and will verify the person's authority before acting.
Privacy rights of minors
A parent or legal guardian ordinarily acts as a minor patient's personal representative. Exceptions may apply when a minor may consent to care under law, when another person has legal authority, or when law limits a parent's access. We evaluate access and disclosure requests based on the type of care, applicable law, and the requesting person's authority.
File a complaint
If you believe your privacy rights have been violated, you may contact the Driftless Health Privacy Officer at 608-638-8500 or write to 124½ S. Main Street, Suite 103, Viroqua, Wisconsin 54665. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, through its online complaint portal at ocrportal.hhs.gov or by using the contact information at hhs.gov/ocr. We will not retaliate against you for filing a complaint.
2. Your Choices
For certain uses and disclosures, you may tell us what you prefer. Tell us your preference in writing or by contacting the Privacy Officer. If you cannot communicate your preference, we may share information if we believe it is in your best interest and the disclosure is permitted by law.
Family, friends, caregivers, and disaster relief
You may tell us whether we may share relevant health information with family members, close friends, or others involved in your care or payment for your care. We may also share limited information with an entity assisting in disaster relief so your family can be notified about your condition, status, and location. Whenever practical, we will ask for your permission or give you an opportunity to object.
Marketing, sale of information, and psychotherapy notes
We will obtain your written authorization before using or disclosing your protected health information for marketing, before selling protected health information, or for most uses and disclosures of psychotherapy notes. Driftless Health does not sell protected health information.
Fundraising
Driftless Health does not currently use protected health information for fundraising. If that changes and we contact you for fundraising, we will tell you how to opt out of future communications.
3. How We May Use and Disclose Health Information
We may use and disclose your protected health information without your written authorization for the purposes described below, subject to applicable law. We limit uses and disclosures to the information reasonably necessary for the purpose when the minimum-necessary rule applies.
Treatment
We may use and disclose your health information to provide, coordinate, or manage your care. For example, we may share information with a laboratory, pharmacy, imaging center, consultant, or another health care provider involved in your treatment or referral.
Health care operations
We may use and disclose information to operate our practice and improve care. Examples include quality assessment, patient-safety activities, staff training, credentialing, compliance, auditing, legal and accounting services, business planning, and technology support.
Payment
We may use and disclose information to bill for or collect payment for services and to determine who is responsible for payment. Driftless Health is a direct-pay practice and does not routinely submit claims to commercial insurance, Medicare, Medicaid, or the Department of Veterans Affairs. Payment-related disclosures may still occur when requested or authorized by you, required by law, or necessary for workers' compensation or another responsible payer.
Business associates
We may share information with contractors that perform services for us, such as our electronic health record and patient-portal vendor, billing or payment vendors, laboratories, consultants, attorneys, accountants, and secure data-storage providers. These business associates must appropriately safeguard the information they receive when required by law and contract.
Public health and safety activities
We may disclose health information for public-health activities authorized by law, including reporting disease, injury, birth, death, adverse events, product problems, and information needed for recalls. We may also disclose information to prevent or control disease or to an employer in limited workplace-surveillance circumstances permitted by law.
Abuse, neglect, or domestic violence
We may disclose information to an appropriate government authority when we reasonably believe a person may be a victim of abuse, neglect, or domestic violence and the disclosure is required or permitted by law. When applicable, we will inform the person about the disclosure unless doing so would create a serious risk of harm or another legal exception applies.
Health oversight
We may disclose information to health-oversight agencies for activities authorized by law, such as audits, investigations, inspections, licensing, disciplinary proceedings, and monitoring of health care programs.
Compliance with law and government review
We may disclose information when required by federal, state, or local law. We also must disclose information to the U.S. Department of Health and Human Services when it requests information to determine our compliance with federal privacy requirements.
Judicial and administrative proceedings
We may disclose health information in response to a court or administrative order. We may also respond to a subpoena, discovery request, or other lawful process when legal safeguards and any additional protections for specially protected records have been satisfied.
Law enforcement
We may disclose limited health information to law enforcement when permitted or required by law, such as in response to certain court orders or legal processes, to identify or locate certain persons, to report certain crimes, or to address a death or emergency that may involve criminal conduct.
Workers' compensation and similar programs
We may disclose health information as authorized by and necessary to comply with workers' compensation laws or similar programs that provide benefits for work-related injuries or illness.
Research
We may use or disclose health information for research when the research has been approved through a process that reviews privacy protections, when the information has been prepared so that it does not identify you, or when another legal basis permits the use or disclosure. We will obtain your written authorization when required.
Organ and tissue donation
We may disclose health information to organizations that facilitate organ, eye, or tissue donation and transplantation when applicable and permitted by law.
Coroners, medical examiners, and funeral directors
We may disclose health information to a coroner or medical examiner for duties authorized by law and to a funeral director as necessary to carry out the director's duties.
A serious threat to health or safety
We may use or disclose health information when we believe in good faith that doing so is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, consistent with applicable law and ethical standards.
Special government functions
We may disclose information for certain military and veterans activities, national-security and intelligence activities, protective services, correctional-institution needs, and other special government functions when authorized by law.
4. Specially Protected Information
Some kinds of health information receive additional protection under Wisconsin or federal law. When a more protective rule applies, we will obtain consent or authorization, or meet another legal condition, before using or disclosing the information.
Mental health, developmental disability, and substance-use information
Wisconsin law provides heightened confidentiality protections for certain treatment records relating to mental health, developmental disabilities, alcoholism, and drug dependence. We will disclose such records only with consent or as otherwise specifically permitted or required by applicable law.
HIV test results
Wisconsin law provides additional confidentiality protection for HIV test results and related information. We will disclose that information only as permitted or required by law.
Records protected by 42 C.F.R. Part 2
To the extent Driftless Health receives or maintains substance-use-disorder treatment records protected by 42 C.F.R. Part 2, those records, or testimony describing their contents, will not be used or disclosed in a civil, criminal, administrative, or legislative proceeding against you unless based on your specific written consent or a qualifying court order entered after notice and an opportunity to be heard. A court order authorizing the disclosure must be accompanied by a subpoena or other legal mandate compelling disclosure.
5. Uses and Disclosures Requiring Written Authorization
Uses and disclosures not described in this Notice generally require your written authorization. You may revoke an authorization in writing at any time, except to the extent we already acted in reliance on it or another legal exception applies. Revocation will not affect actions already taken.
6. Electronic Communications and the Patient Portal
We use an electronic health record and patient portal to support scheduling, forms, secure messages, records, and other aspects of care. The portal is the preferred method for non-urgent clinical communication. We take reasonable safeguards to protect electronic information, but ordinary email and text messages may present privacy and security risks. If you ask us to communicate through email, text, or another method, we will consider the request and explain material limits when appropriate.
Electronic messages are not monitored continuously and should not be used for emergencies or urgent medical needs. Call 911 or go to the nearest emergency department for an emergency.
7. Our Responsibilities
- We are required by law to maintain the privacy and security of protected health information.
- We will give you this Notice and follow the duties and privacy practices described in the Notice currently in effect.
- We will notify affected individuals following a breach of unsecured protected health information when notification is required by law.
- We will not use or disclose your information in a way that is not described in this Notice unless you give us written authorization or the law otherwise permits or requires it.
- We will not retaliate against you for exercising your privacy rights or filing a complaint.
8. Changes to This Notice
We may change this Notice and make the revised Notice effective for all protected health information we maintain, including information created or received before the change. The revised Notice will include a new effective date. We will make the current Notice available at our office and on driftlesshealth.co and will provide a paper or electronic copy upon request.
9. Contact Information
For questions, requests, or complaints about this Notice or our privacy practices, contact:
Privacy Officer
Driftless Health LLC | 124½ S. Main Street, Suite 103
Viroqua, WI 54665 | 608-638-8500 | driftlesshealth.co