Privacy practices for clinical information.

Which information this covers

This page concerns health information created or received in connection with provider review, diagnosis, treatment, payment, and healthcare operations. The public website and pre-registration assessment are also covered by the separate WeightMed Privacy notice.

Treatment, payment, and healthcare operations

A participating healthcare entity may use and disclose health information to evaluate and treat you, coordinate with other clinicians and pharmacies, obtain or process payment, maintain records, improve quality, train staff, investigate complaints, and operate its clinical services.

Other uses permitted or required by law

Health information may be disclosed for public-health activities, health oversight, reporting abuse or neglect, responding to lawful court or law-enforcement requests, workers' compensation, preventing a serious threat to health or safety, and other purposes required by law. Only the information reasonably needed for the purpose should be disclosed.

Family, caregivers, and personal representatives

Information relevant to care or payment may be shared with a person you identify when you agree, do not object after being given a chance, or when professional judgment and law allow it in an emergency. A legally authorized personal representative may exercise rights on your behalf.

Uses requiring authorization

Uses or disclosures not otherwise permitted by law generally require written authorization. You may revoke an authorization in writing, except to the extent action has already been taken in reliance on it or another legal exception applies.

Your health-information rights

• Request access to or a copy of eligible health records.
• Ask for inaccurate or incomplete records to be amended.
• Request confidential communication by a reasonable method.
• Ask for limits on certain uses or disclosures.
• Request an accounting of certain disclosures.
• Receive a paper or electronic copy of the controlling notice.

Some requests may be limited or denied when law permits. The healthcare entity must explain the applicable response process.

Breaches and complaints

The responsible healthcare entity must provide notice when required after a breach of unsecured protected health information. You may submit a privacy complaint through the secure patient support channel or to the U.S. Department of Health and Human Services. Retaliation for making a good-faith privacy complaint is prohibited.

Which notice controls

Before clinical services begin, the patient account must identify the professional entity or provider responsible for care and present its current Notice of Privacy Practices, effective date, and privacy contact. That provider-specific notice controls if it differs from this summary.