Notice of Privacy Practices

Effective Date: May 1, 2025

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION, HOW YOU CAN GET ACCESS TO YOUR HEALTH INFORMATION, AND HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION. YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH [ENTER NAME OR TITLE] AT [PHONE AND EMAIL] IF YOU HAVE ANY QUESTIONS.

PLEASE REVIEW IT CAREFULLY

The Guthrie Clinic, including its affiliated entities, is required by law to maintain the privacy of Protected Health Information (PHI) and to provide each patient with The Guthrie Clinic “Notice of Privacy Practices” (“Notice”) detailing our legal duties and privacy practices with respect to PHI. A copy of the current Notice is posted in all our admissions and waiting areas. You will be provided with a copy of the Notice at the time of your initial visit to our facilities. You will also be able to obtain your own copy by accessing our website at www.Guthrie.org or Privacy Officer at 1-888-841-4644 or guthrie.ethicspoint.com

PHI is information that may identify you and that relates to your past, present, or future physical or mental health condition and related health care services. This Notice of Privacy Practices Guide outlines how we may use and disclose PHI to carry out treatment, payment or health care operations and for other specified purposes that are permitted or required by law. The Notice booklet details your rights with respect to your PHI. We are required to provide the Notice booklet to you by the Health Insurance Portability and Accountability Act (HIPAA).

The Guthrie Clinic is required to follow the terms contained in the “Notice of Privacy Practices”. We will not use or disclose your PHI without your written authorization, except as described or otherwise permitted in the Notice. We reserve the right to change our practices and the Notice and to make the new Notice effective for all PHI we maintain. Upon request, we will provide any revised Notice to you.

This Notice does not apply to health information that is not subject to HIPAA or similar state health information privacy laws, or information used or shared in a manner that cannot identify you. Additionally, this Notice only applies to those parts of The Guthrie Clinic’s websites and mobile device applications where you can access your PHI or interact with a clinician regarding your specific care, such as The Guthrie Clinic patient portal with respect to your PHI. However, these websites and applications may contain additional terms associated with your use. You should review those terms as well as the website terms contained on The Guthrie Clinic website that you visit.

You may have additional rights under other applicable state or federal law. Applicable state or federal laws that provide greater privacy protection or broader privacy rights will continue to apply and we will comply with such laws to the extent they are applicable.

Examples of How We Use and Disclose Protected Health Information about You

The following categories describe different ways that we use and disclose your protected health information; however, applicable laws governing sensitive information (including behavioral health information, drug and alcohol treatment information, reproductive health information, and information related to HIV/AIDS or other communicable diseases) may further limit these uses and disclosures. We have provided you with examples in certain categories; however, not every use or disclosure in a category is listed.

Treatment: We may use your health information to provide and coordinate the treatment, medications, and services you receive. We may disclose medical information to doctors, nurses, technicians, administrators, staff, and others who are taking care of you in our system. We may also disclose medical information with non-Guthrie providers, treatment team members, agencies, business associates or facilities in order to provide treatment, coordination or continuity of your care.
Example: A doctor treating you for an injury asks another doctor about your overall health condition.

Payment: We may use your health information for various payment-related functions, and we may disclose medical information so that the treatment and services you receive may be billed and payment collected. We will bill you or a third-party payer for the cost of treatment, equipment, and supplies provided to you.
Example: We give information about you to your health insurance plan so it will pay for your services.

Health Care Operation: We may use your health information for certain operational, administrative, and quality assurance activities. We may use information in your health record to monitor the quality and performance and to comply with laws and regulations. This information will be used in an effort to continually improve the quality and effectiveness of the health care and services we provide.
Example: To reduce the infection rate after a surgery, it would be necessary to look at medical records to determine the rate of infections that occurred.

Appointment Reminders: We may contact you to remind you that you have an appointment at The Guthrie Clinic or provide information about treatment alternatives or other health-related benefits and services that may be of interest to you.

Business Associates: We may disclose your PHI to our business associates who provide us with services necessary to operate and function as a medical practice. We will only provide the minimum information necessary for the associate(s) to perform their functions as it relates to our business operations. For example, we may use a separate company to process our billing or transcription services that require access to a limited amount of your PHI. Please know and understand that all of our business associates are obligated to comply with the same HIPAA privacy and security rules in which we are obligated. Additionally, all of our business associates are under contract with us and committed to protecting the privacy and security of your PHI. We may also share your PHI with a Business Associate who will remove information that identifies you so that the remaining information can be used or disclosed for purposes outside of this Notice.

Breach Notification Purposes: If for any reason there is an unsecured breach of your PHI, we will utilize the contact information you have provided us with to notify you of the breach, as required by law. In addition, your PHI may be disclosed as a part of the breach notification and reporting process.

We are also permitted to use or disclose your PHI for the following purposes.

Public Health: As required or permitted by law, we may disclose your PHI to public health or legal authorities charged with preventing or controlling disease, injury, or disability and for conducting public health monitoring, investigations, or activities.

Report Abuse: As permitted or required by law or as otherwise agreed to by you, we may disclose your PHI when the information relates to a victim of abuse, neglect, or domestic violence.

Law Enforcement: We will disclose your PHI for law enforcement purposes when all applicable legal requirements have been met. This includes, but is not limited to, law enforcement due to identifying or locating a suspect, fugitive, material witness or missing person; complying with a court order or warrant, and grand jury subpoena; reporting information about a victim of a crime, reporting a death we believe resulted from criminal conduct, reporting criminal conduct occurring on our premises, or reporting crime in an emergency, such as the location of the crime or victims or the identity, description or location of the person who committed the crime..

Lawsuits and Other Legal Actions: In connection with lawsuits or other legal proceedings we may use or disclose information in response to a court or administrative order or other lawful process. If required, we will first make sure that you have been made aware of the request or that efforts were made to secure a qualified protective order.

As Required by Law: We will disclose your PHI when required to do so by federal, state, or local law. For example, we may share your PHI as required to report a suspicious death or suspected child abuse or neglect.

Research: We may disclose your PHI to researchers when their research has been approved by an institutional review board or privacy board that has reviewed the research proposal and established protocols to ensure the privacy of your information. We may also use and share your PHI with a researcher if certain parts of your PHI that would identify you are removed before we share it with the researcher. This will only be done if the researcher agrees in writing not to share the information, will not try to contact you, and will obey other requirements that the law provides.

Respond to Organ and Tissue Donation Requests: We can share health information about you with to organizations that handle organ procurement or organ, eye or tissue transplantation, or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

Work with Coroners, Medical Examiner or Funeral Director: We can share health information with a coroner, medical examiner, or funeral director as permitted by law to carry out their duties, when an individual dies.

Workers’ Compensation: We may release medical information about you to programs that provide benefits for work-related injury or illness.

To Avert a Serious and Imminent Threat to Health or Safety: We may use your health information or share it with others when necessary to prevent a serious and imminent threat to your health or safety, or the health or safety of another person or the public.

Health Oversight Activities: We may disclose your medical information to health oversight organizations authorized to conduct audits, investigations, and inspections of our facilities.

Specialized Government Functions: We will disclose your PHI regarding government functions such as military, national security and intelligence activities. We will use or disclose PHI to the Department of Veterans Affairs to determine whether you are eligible for certain benefits.

Inmates: If you are an inmate of a correctional facility, we may disclose to the institution or agents of the institution health information necessary for your health and the health and safety of other individuals.

Minors: PHI of minors will be disclosed to their parents or legal guardians acting as personal representatives, unless prohibited by law or in circumstances where the law permits us to withhold PHI, such as to prevent harm to the minor or another person or in cases of suspected child abuse or neglect.

Ownership Change: If our medical practice is sold, acquired, or merged with another entity, your PHI may become the property of the new owner. However, you will still have the right to request copies of your records and have copies transferred to another provider.

Uses And Disclosures Where You Have The Right To Object And Opt Out

To Communicate with Individuals Involved in Your Care or Payment for Your Care: Unless you object, we may disclose to a family member, other relative, close personal friend or any other person you identify that PHI which is directly relevant to that person's involvement in your care or payment related to your care. We may share your PHI with these persons if you are present or available before we share your PHI with them and you do not object to our sharing your PHI with them, or we reasonably believe that you would not object to this. If you are not present and certain circumstances indicate to us that it would be in your best interests to do so, we will share information with a friend or family member or someone else identified by you, to the extent necessary. This could include sharing information with your family or friends so that they could pick up a prescription or a medical supply.

Disaster Notification: We may use or disclose your PHI In the event of a disaster, to disaster relief organizations to coordinate your care and/or to notify or assist in notifying a family member, personal representative, or another person responsible for your care or payment for your care, regarding your location, general condition, and in the unfortunate event of your death. Whenever possible, we will provide you with an opportunity to agree or object.

Patient Information Directory: While you are a hospital patient, your name, location, general condition (e.g., satisfactory) and your religious affiliation will be included in a patient information directory. Directory information, except for your religious affiliation, may be released to people who ask for you by name. Your religious affiliation may also be provided to members of the clergy of your congregation, even if they don’t ask for you by name. We will give you the opportunity to object to being included in the directory, unless an emergency situation prevents us from asking you.

Fundraising: We may use information about you to contact you to raise money for one or more of our facilities. We may use or disclose demographic and contact information (such as your name, address, phone, gender), the date and department of service and your treating physician. We will provide you an opportunity to opt out of these types of communications.

Health Information Networks and Exchanges. We may participate in certain health information networks or exchanges ("HIEs") that permit health care providers or other health care entities, such as your health plan or health insurer, to share your PHI for treatment, payment and other purposes permitted by law, including those described in this Notice. You are automatically opted in to such HIEs. If you wish to opt out, please submit a written request to us, which we will comply with unless disclosure is required by law. If you opt out of participating in these HIEs, your PHI will no longer be provided to other health care entities through the HIE. However, your decision does not affect the PHI that was exchanged prior to the time you opted out of participation.

Use And Disclosure of Reproductive Health Records

Federal law recognizes and protects the confidentiality of comprehensive reproductive health care services, including abortion care, and places additional restrictions on the use or disclosure of PHI related to reproductive health care. Reproductive health care means health care that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes. This includes, but is not limited to, contraception, including emergency contraception; preconception screening and counseling; management of pregnancy and pregnancy-related conditions, including pregnancy screening, prenatal care, miscarriage management, treatment for preeclampsia, hypertension during pregnancy, gestational diabetes, molar or ectopic pregnancy, and pregnancy termination; fertility and infertility diagnosis and treatment, including assisted reproductive technology and its components (e.g., in vitro fertilization (IVF)); diagnosis and treatment of conditions that affect the reproductive system (e.g., perimenopause, menopause, endometriosis, adenomyosis); and other types of care, services, and supplies used for the diagnosis and treatment of conditions related to the reproductive system (e.g., mammography, pregnancy-related nutrition services, postpartum care products). The Guthrie Clinic is prohibited from using or disclosing any PHI potentially related to reproductive health care for the following activities: (i) to conduct criminal, civil or administrative investigation into a person for the mere act of seeking, obtaining, providing or facilitating reproductive health care, (ii) to impose criminal, civil or administrative penalties for the mere act of seeking, obtaining, providing or facilitating reproductive health care, or (iii) to identify a person for either of these purposes. Seeking, obtaining, providing, or facilitating reproductive health care includes, but is not limited to, any of the following: expressing interest in, using, performing, furnishing, paying for, disseminating information about, arranging, insuring, administering, authorizing, providing coverage for, approving, counseling about, assisting, or otherwise taking action to engage in reproductive health care; or attempting any of the same. Outside of these activities, The Guthrie Clinic may continue to use and disclose PHI related to reproductive health care for all other purposes described in this Notice.

The prohibition on use and disclosure of reproductive health care only applies where the relevant activity is in connection with a person seeking, obtaining, providing, or facilitating reproductive health care, and The Guthrie Clinic has reasonably determined either that:

Reproductive health care is lawful under the law of the state in which such health care is provided under the circumstances in which it is provided. For example, if a resident of one state traveled to another state to receive reproductive health care, such as an abortion, that is lawful in the state where such health care was provided.
The reproductive health care is protected, required, or authorized by Federal law, including the United States Constitution, under the circumstances in which such health care is provided, regardless of the state in which it is provided. For example, if use of reproductive health care, such as contraception, is protected by the Constitution.

Where reproductive health care is provided by someone other than The Guthrie Clinic, The Guthrie Clinic may presume it is lawful unless either of the following is true:

The Guthrie Clinic has actual knowledge that reproductive health care was not lawful under the circumstances in which it was provided. For example, an individual discloses to their doctor that they obtained reproductive health care from an unlicensed person and the doctor knows that the specific reproductive health care must be provided by a licensed health care provider.
The requestor provides information that demonstrates a substantial factual basis that the reproductive health care was not lawful under the specific circumstances in which it was provided. For example, a law enforcement official provides a health plan with evidence that the information being requested is reproductive health care that was provided by an unlicensed person where the law requires that such health care be provided by a licensed health care provider.

When The Guthrie Clinic receives request for PHI potentially related to reproductive health care for purposes of health oversight activities, judicial and administrative proceedings, law enforcement coroner and medical examiner purposes, as described above, The Guthrie Clinic will obtain a valid, signed attestation from the requestor that the use or disclosure is not for a prohibited purpose, as provided in this section. For example, if The Guthrie Clinic receives a subpoena for medical records related a civil lawsuit to which the patient is a party from an attorney, it would obtain such an attestation from the attorney before providing the records. The Guthrie Clinic is only permitted to disclose reproductive health information for law enforcement purposes where the disclosure is not subject to the prohibition above, the disclosure is required by law, and the disclosure meets all applicable conditions of HIPAA’s permission to use or disclose PHI as required by law.

Use And Disclosure Of Substance Use Disorder Records Under Part 2

Federal law protects the confidentiality of substance use disorder patient records and places additional restrictions on the use or disclosure of such health information. A substance use disorder is a cluster of cognitive, behavioral, and physiological symptoms indicating that the individual continues using the substance (such as drugs or alcohol but not including tobacco or caffeine) despite significant substance-related problems such as impaired control, social impairment, risky use, and pharmacological tolerance and withdrawal. If you receive services from The Guthrie Clinic covered by such laws, The Guthrie Clinic complies with the federal Confidentiality of Substance Use Disorder Patient Records laws and regulations that protect information regarding substance use disorder diagnosis, treatment and referral for treatment. See 42 U.S.C 290dd-3 and 42 U.S.C. 290ee-3 for Federal laws and 42 CFR Part 2 for Federal regulations (collectively, "Part 2"). Additionally, if The Guthrie Clinic receives records containing information regarding substance use disorders, these records may also be protected by Part 2. Where Part 2 is applicable, The Guthrie Clinic will not disclose your substance use disorder records, that you are enrolled in a Part 2 program, or any other information that would identify you as having or having had a substance use disorder (collectively, "Part 2 Records") except in compliance with this Section.

We will obtain your written consent to use and disclose your Part 2 Records unless we are permitted to use and disclose Part 2 Records without your written consent consistent with Part 2. The following categories describe the ways that we may use and disclose your Part 2 Records without your written consent under Part 2.

Medical Emergencies. We may disclose your Part 2 Records to medical personnel to the extent necessary to meet a bona fide medical emergency in which the your prior written consent cannot be obtained or in which we are closed and unable to provide services or obtain your prior written consent during a temporary state of emergency declared by a state or federal authority as the result of a natural or major disaster, until such time as we resume operations. The Guthrie Clinic will obtain your authorization prior to disclosing your information for non-emergency treatment. The Guthrie Clinic may also disclose your Part 2 Records to medical personnel of the Food and Drug Administration (FDA) who assert a reason to believe that your health may be threatened by an error in the manufacturer, labeling, or sale of a product under the FDA jurisdiction, and that your Part 2 Records will be used for the exclusive purpose of notifying you or your physicians of potential danger.

Research. Under certain circumstances, The Guthrie Clinic may use and disclose your Part 2 Records without your consent for research purposes. Generally, we would first obtain your written consent; however, in certain circumstances, we may be permitted to use or disclose your Part 2 Records for research purposes without your consent to the extent permitted by HIPAA, FDA and HHS regulations related to human subject research where a waiver of consent has been granted.

Management and Financial Audits and Program Evaluation. Under certain circumstances we may use or disclose your Part 2 Records for purposes of the performance of certain program financial and management audits and evaluations. For example, we may disclose your identifying information to any federal, state, or local government agency that provides financial assistance to the Part 2 program or is authorized by law to regulate the activities of Part 2 program. We may also use or disclose your identifying information to qualified personnel who are performing audit or evaluation functions on behalf of any person that provides financial assistance to the Part 2 program, which is a third-party payer or health plan covering you in your treatment, or which is a quality improvement organization (QIO), performing QIO review, the contractors, subcontractors, or legal representatives of such person or QIO, or an entity with direct administrative control over our program.

Fundraising. Consistent with provisions elsewhere in this Notice, we may also use or disclose your Part 2 Records for fundraising purposes.

Public Health. We may use or disclose to the public health authority your Part 2 Records for public health purposes. However, the contents of the information from the Part 2 Records disclosed will be de-identified in accordance with the requirements of the HIPAA regulations, such that there will be no reasonable basis to believe that the information can be used to identify you.

The Guthrie Clinic may use and disclose your Part 2 Records when you give you written consent satisfying the requirements of Part 2.

Designated person or entities. We may use and disclose your Part 2 Records in accordance with the consent to any person or category of person identified or generally designated in the consent. For example, if you provide written consent naming your spouse or a healthcare provider, we will share your health information with them as outlined in your consent.

Single Consent for Treatment, Payment or Healthcare Operations. We may also use and disclose your Part 2 Records when the consent provided is a single consent for all future uses and disclosures for treatment, payment, and healthcare operations, as permitted by the HIPAA regulations, until such time you revoke such consent in writing.

Central Registry or Withdrawal Management Program. We may disclose your Part 2 Records to a central registry or to any withdrawal management or treatment program for the purposes of preventing multiple enrollments, with your written consent. For instance, if you consent to participating in in a drug treatment program, we can disclose your information to the related program to coordinate care and avoid duplicate enrollment.

Criminal Justice System. We may disclose information from your Part 2 Records to those people within the criminal justice system who have made your participation in the Part 2 program a condition of the disposition of any criminal proceeding against you. The written consent must state that it is revocable upon the passage of a specified amount of time or the occurrence of a specified, ascertainable event. The time or occurrence upon which consent becomes revocable may be no later than the final disposition of the conditional release or other action in connection with which consent was given. For example, if you consent, we can inform a court-appointed officer about your treatment status as part of legal agreement or sentencing conditions.

PDMPs. We may report any medication prescribed or dispensed by us to the applicable state prescription drug monitoring program if required by applicable state law. We will first obtain your consent to the disclosure of Part 2 Records to a prescription drug monitoring program prior to reporting of such information.

Any Part 2 Record, or testimony relaying the content of such Part 2 Records, shall not be used or disclosed in a civil, administrative, criminal, or legislative proceeding against you unless you provide specific written consent (separate from any other consent) or a court issues an appropriate order. Your Part 2 Records will only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to you, the The Guthrie Clinic or other holders of the Part 2 Record in accordance with Part 2. A court order authorizing use or disclosure of Part 2 Records must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the Part 2 Records may be used or disclosed.

Part 2 does not protect health information about a crime committed on The Guthrie Clinic's premises or against any The Guthrie Clinic personnel or about any threat to commit such crime. Part 2 also does not prohibit the disclosure of health information by The Guthrie Clinic from reporting suspected child abuse or neglect under state law to appropriate state or local authorities. The restrictions on use and disclosure in Part 2 do not apply to communications of Part 2 Records between or among personnel having a need for them in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment of patients with substance use disorders if the communications are within the program (or with an entity that has direct administrative control over the program the communications between a part 2 program) and to communications of Part 2 Records to a qualified service organization if needed by the qualified service organization to provide services to or on behalf of The Guthrie Clinic (similar to provisions herein regarding business associates). To the extent applicable state law is even more stringent than Part 2 on how we may use or disclose your health information, we will comply with the more stringent state law.

Please note that if Part 2 Records are disclosed to us or our business associates pursuant to your written consent for treatment, payment, and healthcare operations, we or our business associates may further use and disclose such health information without your written consent to the extent that the HIPAA regulations permit such uses and disclosures, consistent with the other provisions in this Notice regarding PHI.

Uses And Disclosures That Require Your Written Authorization/Consent

We will not disclose or use your PHI in the situations listed below without first obtaining written authorization to do so. In addition to the uses and disclosures listed below, other uses and disclosures of your PHI or Part 2 Records not covered in this Notice will be made only with your written authorization/consent. If you provide us with an authorization/consent, you may revoke it at any time by submitting a request in writing. Revocation does not apply to PHI or Part 2 Records that have already been used or disclosed with your permission. You can obtain an authorization/consent form from us upon request.

Disclosure of Psychotherapy Notes: Unless we obtain your written authorization, in most circumstances we will not disclose your psychotherapy notes. Some circumstances in which we will disclose your psychotherapy notes include the following: for your continued treatment; training of medical students and staff; to defend ourselves during litigation; if the law requires; health oversight activities regarding your psychotherapist; to avert a serious or imminent threat to yourself or others; and to the coroner or medical examiner upon your death.

Marketing: Disclosures for marketing purposes which result in our receiving financial payment from a third party whose product or services is being marketed will require your written authorization. This does not include compensation that merely covers our cost of reminding you to take and refill your medication or otherwise communicate about a drug or biologic that is currently prescribed to you. However, we may use or disclose your PHI without your authorization to send you information about alternative medical treatments, our own programs or about health-related products and services that may be of interest to you, provided that we do not receive financial remuneration for making such communications. For example, if you suffer from a chronic illness or condition, we may use your PHI to assess your eligibility and propose newly available treatments. When we see you face-to-face, we may also use your PHI without your authorization to encourage you to maintain a healthy lifestyle and get recommended tests, suggest that you participate in a disease management program, provide you with promotional gifts of nominal value, or tell you about government sponsored health programs.

Sale of PHI: Any activity constituting a sale of your PHI will require your prior written authorization.

Your Health Information Rights

The following are statements of your rights, subject to certain limitations, with respect to your Protected Health Information and apply equally with respect to Part 2 Records:

Obtain a paper copy of the Notice upon request: You may request a copy of our current “Notice of Privacy Practices” at any time. You may obtain a copy of the paper throughout The Guthrie Clinic or on our website at www.Guthrie.org.

Request a restriction on certain uses and disclosures of PHI: You have the right to request additional restrictions on our use or disclosure of your PHI by sending a written request to the Privacy Officer. We may not be required to agree to those restrictions. We cannot agree to restrictions on uses or disclosures that are legally required, or which are necessary to administer our business. We will agree to restrictions to withhold information from a health plan where you, the individual, pay out-of-pocket in full for the services ahead of time. If we do agree to any request, we still may provide PHI, as necessary, to give you emergency treatment.

Inspect and obtain a copy of PHI: In most cases, you have the right to access and copy the PHI in a Designated Record Set that we maintain about you. Under federal law, you may not inspect or copy the following types of records: psychotherapy notes, information compiled as it relates to civil, criminal, or administrative action or proceeding; information restricted by law; information related to medical research in which you have agreed to participate; information obtained under a promise of confidentiality; and information whose disclosure may result in harm or injury to yourself or others. To inspect or copy such PHI, you must send a written request to the Health Information Department . We may charge you a reasonable, cost-based fee for the costs of copying, mailing and supplies that are necessary to fulfill your request. We may deny your request to inspect and copy in certain limited circumstances. If we deny you access to your PHI for certain reasons, we will provide you with an opportunity to request that the denial be reviewed. A licensed health care professional chosen by us will perform such a review. This person will not be the same person who refused your request.

You have a right to a summary or explanation of your PHI. You have the right to request only a summary of your PHI if you do not desire to obtain a copy of your entire record. You also have the option to request an explanation of the PHI to which you were provided access when you request your entire record.

You have the right to obtain an electronic copy of medical records. You have the right to request an electronic copy of your medical record for yourself or to be sent to another individual or organization when your Protected Health Information is maintained in an electronic format. We will make every attempt to provide the records in the format you request; however, in the case that the information is not readily accessible or producible in the format you request, we will provide the record in a standard electronic format or a legible hard copy form. We provide The Guthrie Clinic patient portal as one option for patients to electronically access their PHI. You may set up access to the patient portal by [requesting a form from your health care provider]. There is no fee for you to access information through the patient portal.

Request an amendment of PHI: If you feel the PHI we maintain in a Designated Record Set about you is incomplete or incorrect, you may request that we amend it. To request an amendment, you must send a written request to the Privacy Officer. You must include a reason that supports your request. In certain cases, we may deny your request for amendment, but we will inform you of our decision within 60 days. If we deny your request for an amendment, you may file a written statement of disagreement, which we may rebut in writing. The denial, statement of disagreement, and rebuttal will be included in any future disclosures of the relevant PHI.

Receive an accounting of disclosures of PHI: You have the right to receive an accounting of the disclosures we have made of your PHI after April 14, 2003 for most purposes other than treatment, payment, or health care operations. The right to receive an accounting is subject to certain exceptions, restrictions, and limitations. To request an accounting, you must submit a request in writing to the Privacy Officer. Your request must specify the time period. The time period may not be longer than six years and may not include dates before April 14, 2003. We’ll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred. If you are requesting an accounting of disclosures of Part 2 Records made pursuant to your written consent 3 years prior to the date of the request (or a shorter time period chosen by you), we will provide such accounting consistent with these HIPAA requirements and Part 2. When regulations are effective requiring such accounting pursuant to HIPAA and Part 2, we will provide a patient with an accounting of disclosures of records for treatment, payment, and health care operations only where such disclosures are made through an electronic health record and during only the 3 years prior to the date on which the accounting is requested.

Request communications of PHI by alternative means or at alternative locations: For instance, you may request that we contact you at a different residence or post office box. To request confidential communication of your PHI, you must submit a request in writing to the Privacy Officer. Your request must tell us how or where you would like to be contacted. We will accommodate all reasonable requests.

Notification of Breach: Affected individuals will be notified of breaches of their unsecured PHI pursuant to state and federal laws.

You have the right to appoint a personal representative, such as a medical power of attorney or if you have legal guardian. Your personal representative may be authorized to exercise your rights and make choices about your PHI. We will confirm the person has this authority and can act for you before we take any action based on their request

Electronic Medical Information Sharing Through APIs

You have the right to request or authorize that your electronic PHI in your designated record set be transmitted to you or another person or organization through an application programming interface (API). APIs are computer coding mechanisms that permit two or more electronic computer applications or software programs to communicate with each other and share information. The Guthrie Clinic is required by law to comply with requests regarding API transmissions, subject to certain exceptions. You understand that PHI transmitted through an API at your request will no longer be under The Guthrie Clinic’s protection and control, will no longer be subject to the protections and rights outlined in this Notice, and may no longer be subject to the same laws, regulations, policies or procedures regarding its confidentiality, security, privacy, use, or disclosure. You understand and agree that you make any request to The Guthrie Clinic to transmit your PHI through an API at your own risk and you assume all liability for the consequences of such action taken by The Guthrie Clinic at your direction. The Guthrie Clinic cautions you to confirm any confidentiality, security or privacy protections with respect to your transmitted PHI with the recipient of the PHI prior to submitting a request to The Guthrie Clinic to transmit your PHI through an API.

Notice Of Redisclosure

PHI that is disclosed pursuant to this Notice may be subject to redisclosure by the recipient and no longer protected by HIPAA. Law applicable to the recipient may limit their ability to use and disclose the PHI received, such as if they are another covered entity subject to HIPAA or a program or entity subject to Part 2.

For More Information or To Report a Problem

If you have questions or would like additional information about The Guthrie Clinic privacy practices, you may contact our Privacy Officer at The Guthrie Clinic. If you believe your privacy rights have been violated, you can file a complaint with the Privacy Officer at 1-888-841-4644 or www.Guthrie.ethicspoint.com or with the Secretary of Health and Human Services (HHS) at www.hhs.gov/ocr/privacy/hipaa/complaints/. Violation of Part 2 is a crime. You may report suspected violations of Part 2 to the Secretary of the United States Department of Health and Human Services in the same manner as HIPAA violations are reported. We will not retaliate against you for filing a complaint.

The Guthrie Clinic reserves the right to change our privacy practices and the “Notice of Privacy Practices” at any time. We will make available the current Notice at all The Guthrie Clinic facilities and on our website at www.Guthrie.org. For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.

This Notice of Privacy Practices Applies to All of The Guthrie Clinic Entities.
This initial Document was approved in 2003.The most recent prior update was January 2025.