HIPAA Notice of Privacy Practices

Our Commitment to Your Privacy

Merrillville Injury Care / Merrillville Plaza Surgery Center (“we,” “us,” “our”) understands the importance of your health information and is committed to protecting the privacy of your Protected Health Information (PHI). PHI includes any individually identifiable information about your past, present, or future health condition, the provision of healthcare, and payment for healthcare services.

How We May Use and Disclose Your PHI

We may use and disclose your PHI for the following purposes without your written authorization:

• Treatment: We may use your PHI to provide, coordinate, or manage your healthcare and related services, including consultations between healthcare providers regarding your treatment and referrals to other providers.
• Payment: We may use and disclose your PHI to bill and collect payment for the services we provide, including billing your insurance company, workers’ compensation carrier, or attorney’s office under a medical lien arrangement.
• Healthcare Operations: We may use your PHI for internal operations, including quality assessment, employee training, compliance activities, and audits.
• As Required by Law: We will disclose your PHI when required by federal, state, or local law, including reporting to public health authorities, reporting abuse or neglect, and responding to court orders.
• Public Health Activities: We may disclose your PHI for public health purposes, such as preventing or controlling disease, injury, or disability.
• Workers’ Compensation: We may disclose your PHI as authorized by and necessary to comply with Indiana workers’ compensation laws (IC 22-3).
• Law Enforcement: We may disclose your PHI to law enforcement officials as required by law or in response to a valid court order, subpoena, or administrative request.
• Health Oversight Activities: We may disclose your PHI to health oversight agencies for audits, investigations, inspections, and licensure activities.

Uses and Disclosures Requiring Your Written Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes not described in this notice, including:

• Marketing purposes
• Sale of your PHI
• Most uses of psychotherapy notes (if applicable)
• Sharing your medical records with your attorney (requires written patient authorization)

You may revoke your authorization in writing at any time, except to the extent that we have already taken action in reliance on the authorization.

Your Rights Regarding Your PHI

Under HIPAA and Indiana law (IC 16-39), you have the following rights:

• Right to Access: You have the right to inspect and obtain a copy of your PHI maintained in our records. Under Indiana law IC 16-39-1-1, you may request copies of your medical records. We may charge a reasonable, cost-based fee for copies.
• Right to Amendment: You have the right to request that we amend your PHI if you believe it is inaccurate or incomplete. We may deny your request under certain circumstances and will provide a written explanation.
• Right to an Accounting of Disclosures: You have the right to receive a list of certain disclosures we have made of your PHI for purposes other than treatment, payment, healthcare operations, and certain other exceptions.
• Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures of your PHI. We are not required to agree to all requests, but we must agree to restrict disclosures to a health plan if you pay out-of-pocket in full.
• Right to Confidential Communications: You have the right to request that we communicate with you about your PHI in a certain way or at a certain location (e.g., only by mail to a specific address).
• Right to a Paper Copy: You have the right to obtain a paper copy of this Notice of Privacy Practices at any time upon request.
• Right to Be Notified of a Breach: You have the right to be notified if there is a breach of your unsecured PHI.

Our Responsibilities

• We are required by law to maintain the privacy and security of your PHI
• We are required to provide you with this Notice of our legal duties and privacy practices
• We are required to abide by the terms of this Notice currently in effect
• We will notify you if a breach occurs that may have compromised the privacy or security of your PHI
• We will not use or disclose your PHI without your authorization except as described in this Notice

Indiana Medical Records Law (IC 16-39)

Under Indiana Code IC 16-39, patients have specific rights regarding their medical records, including the right to examine and copy records, the right to have records released to third parties with written consent, and protections regarding the confidentiality of mental health records. Indiana law provides that healthcare providers must respond to a patient’s request for records within 30 days.

How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with: