Your health record contains personal information about you and your health, referred to as Protected Health Information (PHI). This Notice describes how Vitality Urgent Care may use and disclose your PHI in accordance with HIPAA (45 CFR Parts 160 and 164), Illinois law, and the Illinois Personal Information Protection Act (PIPA 815 ILCS 530). We are required by law to maintain the privacy of PHI, to provide you with this Notice, and to abide by its terms.

Note that certain categories of information, including HIV/AIDS information, genetic information, mental health records, substance use treatment records, and state Medicaid recipient information, may be subject to more stringent confidentiality protections under applicable state or federal law. We will abide by all such special protections.

We may use or disclose your PHI to provide, coordinate, or manage your healthcare and related services, including sharing information with other providers involved in your care such as pharmacists, specialist physicians, or other facilities. No authorization is required for treatment-related disclosures.

We may use or disclose your PHI to obtain payment for services provided, including billing your insurance company, verifying coverage, processing claims, reviewing medical necessity, and collection activities if necessary. Only the minimum necessary PHI will be used for billing purposes. Payment-related disclosures do not require your prior written authorization under HIPAA.

We may use or disclose your PHI for quality reviews, staff training, licensing, compliance activities, strategic planning, claims reporting, and business operations. PHI shared with third-party business associates is governed by written HIPAA-compliant agreements. We will ensure that the minimum necessary PHI is used in all healthcare operations.

We may use and disclose your PHI to contact you as a reminder that you have an appointment for treatment or medical care.

We will disclose your PHI when required to do so by federal, state, or local law, including to the U.S. Department of Health & Human Services (HHS) for compliance purposes.

HIPAA permits the following disclosures without your prior authorization:

• Child Abuse / Neglect. Reporting to state or local agencies authorized by law, including notification to appropriate government authorities if we believe a patient has been a victim of abuse, neglect, or domestic violence.
• Court Orders and Legal Proceedings. In response to a subpoena, court order, or administrative order, provided efforts have been made to notify you or obtain a protective order.
• Deceased Patients. To a coroner, medical examiner, or funeral director as required by law, or to next-of-kin involved in prior care.
• Medical Emergencies. To medical personnel or entities assisting in disaster relief to prevent serious harm and to notify family of your condition, status, and location.
• Family Members and Caregivers. To a friend or family member involved in your care or payment for your care, with your verbal permission.
• Health Oversight Agencies. For audits, investigations, inspections, and licensure activities authorized by law.
• Law Enforcement. As required by law for legal proceedings, crime investigations, to identify suspects or missing persons, or in emergency circumstances to report a crime.
• Public Health Activities. To prevent or control disease, report births and deaths, report reactions to medications, notify exposed individuals, and related public health functions.
• Public Safety Threats. When necessary to prevent a serious threat to your health and safety or that of the public, disclosed only to someone able to help prevent the threat.
• Immunization Records. To schools required by law, upon your or a guardian’s request.
• Workers' Compensation. As authorized by applicable law to comply with workers' compensation programs and laws related to similar programs providing benefits for work-related injuries or illness.
• Research. Under certain circumstances, with appropriate oversight and safeguards. You will not be the subject of research without your prior written and informed consent, and your identity and health information will remain private during and after the research.
• Organ and Tissue Donation. To organizations that handle organ procurement, transplantation, or donation banks, as necessary to facilitate organ or tissue donation and transplantation.
• Military and Veterans. If you are a member of the armed forces, we may release your PHI as required by military command authorities or to the appropriate foreign military authority.
• National Security and Intelligence. To authorized federal officials for intelligence, counterintelligence, protective services for the President, and other national security activities authorized by law.
• Inmates. If you are an inmate of a correctional institution, to the institution or law enforcement as necessary to provide you health care or maintain safety and security.
• Business Associates (Third Parties). To third parties contracted to perform services on our behalf, such as billing or health care management companies, governed by written HIPAA-compliant Business Associate Agreements.

The following uses and disclosures require your signed authorization, which you may revoke at any time in writing. Revocation will not affect disclosures already made.

• Psychotherapy notes.
• Mental health records or drug and alcohol treatment records.
• PHI used for marketing purposes, including subsidized treatment communications.
• Disclosures that constitute a sale of PHI.
• Any other use or disclosure not described in this Notice.

We will not use or disclose your PHI for marketing or sale without your written authorization. To authorize or revoke a release, contact our Privacy Officer.

• We are required by law to maintain the privacy of your PHI.
• We must provide you with this Notice and follow its terms.
• We will notify you promptly in writing if a breach of your unsecured PHI occurs.
• We will not retaliate or take any negative action against you for exercising any right described here, including filing a complaint or seeking a review.
• We reserve the right to change this Notice. Updated versions will be posted on our website and available at our locations upon request. We will notify you of any significant changes.

To exercise any right below, submit a written request to:
admin@vitalityurgentcare.com
or
rlevin@vitalityurgentcare.com.
All requests will be reviewed within the timeframes required under HIPAA. Under certain circumstances we may deny your request; you have the right to have the denial reviewed.

We will NEVER retaliate against you for filing a complaint.

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the U.S. Department of Health and Human Services Office for Civil Rights.