1.1 Responsible Parties

Charleston Oral and Facial Surgery is committed to protecting all confidential health information. This Notice of Privacy Practices (“Notice”) describes how Charleston Oral and Facial Surgery may use and disclose protected health information (PHI), patient rights, and Charleston Oral and Facial Surgery responsibilities regarding PHI under the Health Insurance Portability and Accountability Act (HIPAA). Any team member employed by either Charleston Oral and Facial Surgery or its parent company Forge Specialty Partners, who is authorized to create, access, modify, or transfer PHI for the purposes of Treatment, Payment, or Healthcare Operations is required to abide by this Notice. Those team members may be:

● Any team member involved in direct patient care

● Any team member involved in the billing and claims process following patient care

● Any team member involved in scheduling or facilitating planned patient care

● Any temporary team member, e.g. intern, student, or trainee, with access to PHI

● Any entity providing fractional or support services, e.g. Information Technology support, or medical equipment or supply management

​

1.1.1 Responsibilities of Charleston Oral and Facial Surgery

According to federal law, Charleston Oral and Facial Surgery is required to:

● Maintain the privacy and security of PHI

● Provide this Notice of legal duties and privacy practices

● Follow the terms of this Notice currently in effect

● Provide prompt notification if a breach occurs that may have compromised the privacy or security of PHI

​

1.1.2 Responsibilities Creation of PHI

Charleston Oral and Facial Surgery will create, manage, and protect the records of cases and services for all patients. This record is necessary to provide quality care and comply with legal requirements. PHI may be created, managed, and stored digitally or on paper, or a combination of the two. When created, managed, and stored digitally, Charleston Oral and Facial Surgery will comply with all federal regulations regarding the proper use, storage and disposal of digitally accessible PHI. Charleston Oral and Facial Surgery will also comply with all cybersecurity standards, best practices, and recommendations to safeguard digitally accessible PHI.

​

1.1.3 Data Considered Protected Health Information 

Data collected as part of healthcare services and protected under the Health Insurance Portability and Accountability Act (HIPAA), are as listed below.

● Patient Names or Aliases

● Residential Address and Related Components

● Birthdates or other Date Identifiers such as Date of Services, Date of Death, or Exact Age of Patients older than 89

● Social Security Numbers

● Medical Record Identifiers

● Healthcare Insurance Member Identification Numbers

● Financial Account Numbers

● Telephone or Fax Numbers

● Email Addresses

● Vehicle Identifying Descriptions or License Plate Number

● Certificate/license numbers

● Medical Device Attributes or Serial Numbers

● Online Identifiers, such as Social Media Handles

● IP Addresses

● Biometric Identifiers, such as Fingerprints, Retinal Scans, or Voice Files

● Full-face Photographic Images

​

2.1 Use and Disclosure of PHI

Disclosure of PHI may occur in the following ways during the course of patient care. Not all possible use cases or reasons for disclosure can be anticipated and provided here; however, all of the ways Charleston Oral and Facial Surgery is legally permitted to use or disclose PHI will fall into one of the listed categories even if the scenario is not provided here explicitly.

​

2.1.1 For Treatment

Charleston Oral and Facial Surgery may use PHI to provide medical treatment or services. During the course of care or to properly coordinate or administer care, PHI may be disclosed to team members employed by, or associated with, Charleston Oral and Facial Surgery. Coordination of treatment may extend outside of the control of Charleston Oral and Facial Surgery, for example, requesting surgical clearance from another healthcare provider, sending prescriptions to the pharmacy, submitting lab or imaging orders to another healthcare entity, referring for additional treatment with another healthcare provider, etc.

​​

2.1.2 For Payment

Charleston Oral and Facial Surgery will disclose PHI during the claims and billing processes for patients with applicable insurance coverage. Claim submission and other billing processes, including the use of collections agencies, may route through a third-party partner. In cases when a third-party partner is used to manage collection of payment for services rendered, Charleston Oral and Facial Surgery will have entered into a Business Associate Agreement (BAA) as required by the HIPAA Privacy and Security Rules. Only the minimum-required information to collect payment will be provided to an insurance carrier or third-party partner.

​

2.1.3 Healthcare Operations

Charleston Oral and Facial Surgery may use or disclose PHI if necessary to manage the practice operations in its mission to render quality patient care. Some examples of operational use or disclosure are provided below for clarity; however, these examples are not comprehensive and are subject to change as the operations of the practice and its patient care evolve, or as federal guidelines change.

2.1.3.2 Treatment Alternatives or Supplemental Care Recommendations

PHI may be shared in part, or in total, with other healthcare providers or facilities if related to the total management of a patient’s treatment or well-being. Charleston Oral and Facial Surgery is required to notify the patient of its intent to refer care to another healthcare provider or facility prior to transmitting PHI, unless the disclosure falls under the Healthcare Emergencies disclosure circumstance. Patients have the right to decline a referral for treatment alternatives or supplemental care recommendations prior to the disclosure of PHI.

2.1.3.3 Communication Barriers (Interpreter Services)

To comply with federal law, Charleston Oral and Facial Surgery is required to provide language services for patients for whom English is not their preferred language. Charleston Oral and Facial Surgery is obligated to ensure that all patients are informed of healthcare rights, treatment recommendations, risks of treatment, and financial obligations. If a patient requests, or if Charleston Oral and Facial Surgery is not confident that a patient is competent in all areas of consent, a third party interpreting service may be used. In the event of an interpreter not associated with the patient, PHI will be disclosed; however, all third-party interpreting services will be bound by a BAA to protect confidential health information. It is not legally permissible to use Google Translate, or other comparable no-cost translating services, for the purposes of communicating healthcare education to a patient whose consent is required for treatment.

2.1.3.4 Internal Operations Performance Assessments

PHI may be used by team members or third-party partners (covered by a BAA) not involved in direct patient care for the purposes of assessing the quality, performance, or structure of internal operations of the practice. All reporting containing PHI used in assessing or augmenting practice operations is still protected by the same requirements set forth in the HIPAA Privacy and Security Rules. Patients will not be notified of disclosures of this type unless the assessment results in a security breach. 2.1.3.5 Legally-required Audits

Charleston Oral and Facial Surgery may undergo audits of operational or financial records as part of the usual course of business and/or when audited by a regulatory agency. In the event of an audit, all measures to protect as much PHI from disclosure as possible will be taken to ensure disclosure is limited to only those data that are strictly relevant to the outcome of the audit. Patients will not be notified of disclosures of this type unless the audit process results in a security breach.

​

2.2 Other Uses and Disclosures

It may also be necessary for, or compelled of, Charleston Oral and Facial Surgery to disclose PHI under the following uncommon circumstances.

​

2.2.1 To Comply with the Law

Any request compelled by a federal, state, or local law enforcement official may require partial or complete disclosure of PHI. Charleston Oral and Facial Surgery is required to abide by federal, state, and local laws and will willingly comply with any request made by an official acting in an official capacity pursuing appropriate legal action.

​

2.2.2 Public Health and Safety

Permissible disclosures of PHI for the purposes of protecting public health and safety may include:

● Control or prevention of communicable or contagious disease

● Report of child abuse or neglect

● Report of adult abuse, neglect, or domestic violence

● Report adverse reactions to medications, products, or equipment

● Notification of recalled supplies or materials

​

2.2.3 Healthcare Emergencies

In a life-threatening medical emergency situation, it will be necessary for Charleston Oral and Facial Surgery to disclose PHI to the emergency responders called to transport a patient from the outpatient facility to a hospital setting. In these circumstances, it is often not possible to collect verbal or written approval from the patient to disclose PHI that may be necessary to successfully transfer care to the emergency responders. As soon as the emergency situation has resolved, the patient will be advised of the disclosure.

​

2.2.4 Healthcare Emergencies

If subpoenaed or a court or administrative order compels Charleston Oral and Facial Surgery to disclose PHI, the practice will comply only after notifying the patient of the request to disclose made by the court or officer of the court.

​

2.2.5 Law Enforcement

2.2.5.1 Possible Law Enforcement Circumstances for Disclosure

● Response to Court Order, Subpoena, Warrant, Summons, etc.

● Identification of a Suspect, Fugitive, Material Witness, or Missing Person(s)

● Report of a Crime

● Report of a Death Resulting from Criminal Conduct

● Report of Criminal Misconduct of a Provider or Team Member

​

2.2.5.2 Aversion of Serious Threat to Health of Safety of Self or Others

Disclosure of PHI without prior consent of the patient may be permissible if Charleston Oral and Facial Surgery is acting in the public or personal interest to prevent foreseeable harm in a violent, escalating, or immediately hazardous situation.

​

2.2.5.2 Inmates

Disclosure of PHI to the correctional facility or to the law enforcement official responsible for the custody of the patient is permissible to ensure appropriate transfer or continuation of healthcare services for the patient after leaving the outpatient facility of Charleston Oral and Facial Surgery. This release of information may also be necessary if disclosed in the interest of protecting the patient or the health and safety of those in proximity to the inmate patient.

​

2.2.6 Military and National Security

2.2.6.1 Active-Duty Military Members

If commanded by military authorities, Charleston Oral and Facial Surgery will comply with the release of requested PHI without the prior authorization of the patient serving active-duty orders.

​

2.2.6.2 Veterans Affairs

If under the care of Veterans Affairs, having been referred to Charleston Oral and Facial Surgery by a VA provider, Charleston Oral and Facial Surgery may be obligated to disclose PHI for the purposes of collecting payment from the VA system for services rendered in a Community Partner facility.

​

2.2.6.3 National Security and Intelligence Activity

If compelled by a federal official for the purposes of national security, intelligence, or counterintelligence, Charleston Oral and Facial Surgery will comply with the release of all PHI without the prior authorization of the patient. Charleston Oral and Facial Surgery may be restricted by federal officials in notifying the patient of the disclosure.

​

2.2.6.4 Protection of Heads of State

If compelled by a federal official for the purposes of protecting the President of the United States or other foreign heads of state, Charleston Oral and Facial Surgery will comply with the release of all PHI without the prior authorization of the patient. Charleston Oral and Facial Surgery may be restricted by federal officials in notifying the patient of the disclosure.

​

2.2.7 Coroners, Medical Examiners, and Funeral Directors 

PHI may be released to a coroner, medical examiner, or funeral director if it is required to identify a deceased person, or if the medical information is relevant to determining cause of death or carrying out funeral services.

​

2.2.8 Organ and Tissue Donation

PHI may be released to organ and tissue donation agencies if required to facilitate donation or transplantation.

​

2.2.9 Workers’ Compensation

PHI required to complete worker’s compensation investigations and case management will be provided upon request. In worker’s compensation, or other similar program, cases, it is typical for the patient to provide documentation from that agency to Charleston Oral and Facial Surgery that includes a clause relevant to the necessary release of PHI.

​

2.2.10 Observation of Directive to Provide PHI Access to Approved Individuals

Charleston Oral and Facial Surgery will disclose PHI to any individual named by the patient as an Authorized Party. Authorized Party designations typically are in force for twelve (12) months from the date of execution; however, the patient may amend Authorized Party(ies) at any time during that period with written notice to Charleston Oral and Facial Surgery.

​

2.3 Uses and Disclosures Requiring Authorization

Other uses and disclosures of PHI not detailed in this Notice will be made only with written authorization. If authorization is provided by the patient to disclose PHI, that authorization may be revoked at any time, in writing. If authorization is revoked, Charleston Oral and Facial Surgery is no longer permitted to disclose PHI outside of those uses or disclosures that would obligate Charleston Oral and Facial Surgery to violate other legal obligations requiring disclosure - refer to Section 2.2 Other Uses and Disclosures. If authorization is revoked, it is not possible to affect any disclosures that had been previously authorized.

 

Apart from disclosures deemed necessary to require written authorization, additional circumstances requiring express written authorization to use or disclose PHI may include:

● Use of identifying information for marketing purposes

● Sale of PHI to another entity not managed or covered by the privacy practices of Charleston Oral and Facial Surgery

● Disclosure of psychotherapy records

● Inclusion in healthcare research studies

​

3.1 Patient Rights

Patient rights regarding access and disclosure of PHI are as follows. To exercise patient rights as detailed below, contact the Privacy Officer via the contact information provided on Page 1 of this Notice.

​

3.1.1 Right to Access, Inspect and Copy

Patients have a right to access, inspect and copy (or request copies of) PHI used to make decisions about care, or review previously rendered care and services. Though there may be some exceptions to the records that are released by Charleston Oral and Facial Surgery, nothing considered PHI under the Health Insurance Portability and Accountability Act (HIPAA) would be unavailable for patient review. A nominal and reasonable charge may be associated with records requests to cover the administrative costs of providing a large volume of records. Any associated cost would be indicated in advance of preparing the request, allowing for the opportunity to withdraw or modify the request. There are protections in place to prevent burdensome or unreasonable expenses incurred for requesting access to healthcare records.

 

Requests for records will require completing a request form indicating the content, method of delivery, and terminal recipient with a dated signature of the patient or patient’s power of attorney authorizing the disclosure and release of PHI. Practices have the right to determine the process by which records requests are managed so long as the process is not prohibitive to access, inspection, or copying of PHI. Requests for healthcare records may be denied. If access is denied, the denial may be reviewed upon patient request. Another licensed healthcare provider will be chosen by Charleston Oral and Facial Surgery to review the denial on behalf of the patient. Charleston Oral and Facial Surgery would comply with the access or disclosure or release of the requested records if the independent provider overturns the denial.

​

3.1.2 Right to Request an Amendment

Patients have a right to request an amendment of any healthcare record believed to be false, incorrect, or incomplete. Requests for records amendments can be received and considered so long as Charleston Oral and Facial Surgery is in possession of the record(s). Requirements for medical records storage vary by state. Charleston Oral and Facial Surgery will comply with state or federal regulations dictating the storage of medical records, including the time for which records must be kept and made accessible to patients.

 

Amendment requests may be denied under the following circumstances:

● Patient has not submitted an amendment request in writing

● Patient has not submitted a supporting reason for the amendment in writing

● Charleston Oral and Facial Surgery did not create the original record in question

● Charleston Oral and Facial Surgery is no longer in possession of the record in question due to legal destruction of records beyond the legal requirement to maintain those records

● The amendment request does not pertain to PHI protected by the patient’s right to access or inspect

● The amendment request is found to be irrelevant because the record in question is determined to be accurate and/or complete

​

3.1.3 Right to an Accounting of Disclosures

Patients have a right to request an “Accounting of Disclosures” which details all disclosures Charleston Oral and Facial Surgery has made of PHI. The request must indicate a specific time period for the list of disclosures, which may not be greater than six years or include dates prior to April 14, 2003. The request should indicate if the list provided should be delivered on paper or digitally. Patients have a right to one Accounting of Disclosures per twelve (12) month period at no cost; however, additional lists may incur a nominal and reasonable charge to cover the administrative costs of supplying additional lists. Any associated cost would be indicated in advance of preparing the request, allowing for the opportunity to withdraw or modify the request.

​

3.1.4 Right to Request Restrictions

Patients have the right to request a restriction or limitation on the PHI disclosed regarding payments or treatment with associated costs. The restriction or limitation may be set on the type of information that may be shared with an individual or entity otherwise involved in care or payment for care. Requests for restriction or limitation must include explicit instruction on the type of information limited and to whom the limits apply. Charleston Oral and Facial Surgery is not required to accept these requests if the request for restriction or limitation positions the practice in such a way that it may violate other legal obligations requiring disclosure - refer to Section 2.2 Other Uses and Disclosures. If the request is accepted, Charleston Oral and Facial Surgery is not required to notify other healthcare providers (or named individuals or entities in the request) of the restrictions or limitations on the disclosure of PHI. The right to restrict or limit PHI disclosure extends to information about a service or treatment that was paid out-of-pocket, if the cost has been paid in full. Charleston Oral and Facial Surgery will not accept requests associated with outstanding balances, specific to individual services or treatments.

​

3.1.5 Right to Receive Notice of a Breach

Charleston Oral and Facial Surgery is legally obligated to notify patients of a security breach by first-class mail or by email, depending on a pre-determined patient preference. The notification must be provided to affected patients ‘as soon as possible’ but no later than sixty (60) days following the discovery of a breach. Notifications must be made if “Unsecured Protected Health Information” is accessed. Unsecured Protected Health Information is defined as information not secured through the use of a technology or methodology identified by the Secretary of the U.S. Department of Health and Human Services to render PHI unusable, unreadable, and undecipherable to all unauthorized users.

 

Notice of a breach must include the following information:

● A brief description of the breach

● The date of the breach

● The date of discovery of the breach

● A description of the type of PHI involved in the breach

● Any steps recommended to protect against potential harm resulting from the breach

● Any action taken by Charleston Oral and Facial Surgery to investigate the breach, mitigate the losses or impact of the breach, and to protect against future breaches

● The contact information necessary to allow any patient to ask questions or obtain additional information about the breach

​

For breaches involving ten (10) or more patients whose contact information cannot be confirmed as current, or is known as out-of date, Charleston Oral and Facial Surgery will post notice of the breach on the home page of the practice website and/or in a major print publication or other broadcast media. For breaches involving more than five hundred (500) patients in a single state and/or jurisdiction, Charleston Oral and Facial Surgery will submit notices to prominent local media outlets. Additionally, breaches affecting more than five hundred (500) patients will necessitate notification to the Secretary of the U.S. Department of Health and Human Services. Any breach less than that total of affected patients will necessitate an annual report for any breaches in that year with a written log maintaining the record of breaches involving fewer than five hundred (500) patients.

​

3.1.6 Right to Request Confidential Communications

Patients have a right to request that communications from Charleston Oral and Facial Surgery be restricted or limited by delivery method or location. No reason for the request is required. Charleston Oral and Facial Surgery will comply with all reasonable requests specifying how or where communication about PHI should be handled. Some examples of reasonable restrictions or limitations on practice to patient communications include:

● Requests to receive calls only to a personal mobile device, rather than a work or home number

● Requests to only receive appointment details on paper, rather than via text or email

● Requests to discuss treatment or payment information at a specific office location rather than via telephone

● Requests to send physical mail regarding treatment or payment to a Post Office Box, rather than a residential address

​

3.1.7 Right to a Copy of This Notice

Patients have a right to request a paper copy of this Notice, even if this Notice has been provided electronically. This Notice must be supplied by Charleston Oral and Facial Surgery any time it is requested. An electronic copy of this Notice is always available on the practice website, titled “Notice of Privacy Practices”.

​

4.1 Changes to this Notice

Charleston Oral and Facial Surgery reserves the right to change this Notice and make the new provisions effective for all PHI currently maintained by the practice, and all future PHI created by the practice. A copy of the most current Notice is available at all individual practice locations, and on the practice website. The Notice will include an effective date in the top right-hand corner of the document. Prompts to review the current Notice will be made for all patients - new or returning - with each new admission for services or treatment; or, if a change to the Notice has been made since the latest appointment for an existing chief complaint.

                                                                                                          -End-