NOTICE OF PRIVACY PRACTICES FOR PROTECTED HEALTH INFORMATION THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW THIS NOTICE CAREFULLY.
A. Introduction
Indian Health Center of Santa Clara Valley (“IHCSCV”) is dedicated to maintaining the privacy of your protected health information (PHI). “PHI” includes all individually identifiable information created, received, or maintained by IHCSCV, or on IHCSCV’s behalf, relating to your past, present or future physical or mental health condition, treatment for that condition, or payment for that treatment. In conducting our business, we will create records regarding you and the services we provide to you. We are required by law to maintain the confidentiality of health information that identifies you. We are also
required by law to provide you with this Notice of our legal duties and privacy practices concerning your PHI. By law, we must follow the terms of this notice of privacy practices that we have in effect at the time.
To summarize, this Notice provides you with the following important information:

    • How we may use and disclose your protected health information
    • Your privacy rights in your protected health information
    • Our obligations concerning the use and disclosure of your protected health
      information

IHCSCV will use and disclose your PHI without first obtaining your written authorization only as described in this Notice. If IHCSCV obtains your written authorization for a use or disclosure not described in this Notice, you may revoke or modify that authorization at any time by submitting the appropriate form to IHCSCV Privacy Officer at the IHCSCV Business Offices. IHCSCV Privacy Officer will provide you with a copy of the form upon request.
The terms of this Notice apply to all records containing your PHI that are created or retained by, or on behalf of, IHCSCV. We reserve the right to amend this Notice. Any revision or amendment to this Notice will be effective for all of your records that IHCSCV has created or received in the past, and for any of your records we may create or receive in the future. We will post a copy of our current notice on our web site Indian Health Center of Santa Clara Valley Notice of Privacy Practices for Protected Health Information https://www.indianhealthcenter.org/, and you may request a copy of our most current
notice.

B. How We Will Use and Disclose Your PHI Without Your Authorization

1. Uses And Disclosures For Treatment. IHCSCV will use and disclose your PHI for “treatment”. “Treatment” includes the provision, coordination or management of health care and related services by one or more health care providers. For example, IHCSCV might use your PHI to coordinate your care with your internist.
2. Uses And Disclosures For Payment. IHCSCV will use and disclose your PHI for “payment”. “Payment” includes, but is not limited to, billing, obtaining payment under a contract of insurance, and related health care data processing. For example, IHCSCV may use your PHI to prepare a bill to obtain reimbursement for its services from you or from your insurance company, Medicare, or Medicaid.
3. Uses And Disclosures For Health Care Operations. IHCSCV will use and disclose your PHI for “health care operations.” “Health care operations” include, but is not limited to, quality assessment and improvement activities, case management and care coordination, evaluating the performance of health care practitioners, health care training, health care compliance programs, investigating and resolving complaints of privacy violations, business planning and development, and business management and general administrative activities. IHCSCV may also disclose PHI as part of an investigation into a fraudulent claim. For example, IHCSCV might use your PHI to evaluate the performance of one of its employees.

4. Disclosures To Business Associates.

IHCSCV has contracted with one or more third parties (referred to as a business associate) to use and disclose your PHI to perform services for IHCSCV. IHCSCV will obtain
the business associate’s written agreement to safeguard the privacy of your PHI.
5. IHCSCV is part of an organized health care arrangement including participants in OCHIN. A current list of OCHIN participants is available at www.ochin.org as a business associate of Adapt Oregon OCHIN supplies information technology and related services to IHCSCV and other OCHIN participants. OCHIN also engages in quality assessment and improvement activities on behalf of its participants. For example, OCHIN coordinates clinical review activities on behalf of participating organizations to establish best practice standards and assess clinical benefits that may be Indian Health Center of Santa Clara Valley derived from the use of electronic health record systems. OCHIN also helps participants work collaboratively to improve the management of internal and external patient referrals. Your personal health information may be shared by IHCSCV with other OCHIN participants or a health information exchange only when necessary for medical treatment or for the health care operations purposes of the organized health care arrangement. Health care operation can include, among other things, geocoding your residence location to improve the clinical benefits you receive. The personal health information may include past, present and future medical information as well as information outlined in the Privacy
Rules. The information, to the extent disclosed, will be disclosed consistent with the Privacy Rules or any other applicable law as amended from time to time. You have the right to change your mind and withdraw
this consent, however, the information may have already been provided as allowed by you. This consent will remain in effect until revoked by you in writing. If requested, you will be provided a list of entities to which your information has been disclosed.

C. How We May Use Or Disclose Your PHI Without Your Authorization Federal law generally permits

IHCSCV to make certain uses or disclosures of PHI without your permission. Federal law also requires IHCSCV to list in the Notice each of these categories of disclosures. The listing is below.
1. Uses Or Disclosures Required By Law. IHCSCV may use or disclose your PHI as required by any statute, regulation, court order or other mandate enforceable in a court of law.
2. Disclosures For Workers’ Compensation. IHCSCV may disclose your PHI as required or permitted by state or federal workers’ compensation laws.
3. Disclosures To Family Members Or Close Friends. IHCSCV may disclose your PHI to a family member or close friend who is involved in your care or payment for your care if (a) you are present and agree to the disclosure, or (b) you are not present or you are not capable of agreeing, and IHCSCV determines that it is in your best interest to disclose the information.
4. Disclosures For Judicial And Administrative Proceedings. IHCSCV may disclose your PHI in an administrative or judicial proceeding in response to a subpoena or a request to produce documents. IHCSCV will disclose your PHI in these circumstances only if the requesting party first provides written documentation that the privacy of your PHI will be protected.
5. Disclosures For Law Enforcement Purposes. IHCSCV may disclose your PHI for law enforcement purposes to a law enforcement official, such as in response to a grand jury subpoena.
6. Incidental Disclosures. IHCSCV may use or disclose your PHI in a manner which is incidental to the uses and disclosures described in this Notice.
7. Disclosures For Public Health Activities. IHCSCV may disclose your PHI to a government agency responsible for preventing or controlling disease, injury, disability, or child abuse or neglect. IHCSCV may disclose your PHI to a person or entity regulated by the Food and Drug Administration (“FDA”) if the disclosure relates to the quality or safety of an FDAregulated product, such as a medical device. 8. Disclosures For Health Oversight Activities. IHCSCV may disclose your PHI to a government agency responsible for overseeing the health care system or health-related government benefit programs.
9. Disclosures About Victims Of Abuse, Neglect, Or Domestic Violence. IHCSCV may disclose your PHI to the responsible government agency if (a) IHCSCV’s Privacy Officer reasonably believes that you are a victim of abuse, neglect, or domestic violence, and (b) IHCSCV is required or permitted by law to make the disclosure. IHCSCV will promptly inform you that such a disclosure has been made unless IHCSCV determines that informing you would not be in your best interests.
10. Disclosures To Avert A Serious Threat To Health or Safety. IHCSCV may use or disclose your PHI to reduce a risk of serious and imminent harm to you, another person, or the public.
11. Disclosures To HHS. IHCSCV may disclose your PHI to the United States Department of Health and Human Services (“HHS”), the government agency responsible for overseeing IHCSCV’s compliance with federal privacy law and regulations regulating the privacy of PHI.
12. Uses And Disclosures For Research. IHCSCV may use or disclose your PHI for research, subject to conditions. “Research” means systemic investigation designed to contribute to generalized knowledge.
13. Disclosures In Connection With Your Death Or Organ Donation. IHCSCV may disclose your PHI to a coroner for identification purposes, to a funeral director for funeral purposes, or to an organ procurement organization to facilitate transplantation of one of your organs.
14. Uses And Disclosures For Specialized Government Functions. IHCSCV may disclose your PHI to the appropriate federal officials for intelligence and national security activities authorized by law or to protect the President or other national or foreign leaders. If you are a member of the U.S. Armed Forces or of a foreign armed forces, IHCSCV may use or disclose your PHI for activities deemed necessary by the appropriate military commander. If you were to become an inmate in a correctional facility, IHCSCV may disclose your PHI to the correctional facility in certain circumstances. If applicable state law does not permit the disclosure described above, IHCSCV will comply with the stricter State law. D. Our Disclosures of Your PHI With Your Prior Authorization IHCSCV is required to obtain your written authorization in the following circumstances:
(a) to use or disclose psychotherapy notes (except when needed for payment purposes or to defend against litigation filed by you); (b) to use your PHI for marketing purposes;
(c) to sell your PHI; and (d) to use or disclose your PHI for any purpose not previously described in this Notice. IHCSCV also will obtain your authorization before using or disclosing your PHI when required to do so by (a) state law, such as laws restricting the use or disclosure of genetic information or information concerning HIV status; or (b) other federal law, such as federal law protecting the confidentiality of substance abuse records. IHCSCV also will obtain your written authorization prior to a referral to an Advanced Augmentative Communications (“AAC”) Advocate. Material will be sent to our AAC advocate as required to facilitate alternate funding sources or appeal a denial of funding decision. IHCSCV will obtain written authorization from you before disclosing your PHI for this purpose.

E. Your Privacy Rights You may exercise the rights described below.

The forms referenced below can be obtained from IHCSCV’s Privacy Officer.
1. Right To Access Your PHI. You may make an oral request to the Privacy Officer to review your PHI on file with IHCSCV, or to receive copies of it in paper or electric form, by submitting the appropriate form to the Privacy Officer. The Privacy Officer will provide access, or will deliver copies to you, within 30 days of your request unless the PHI is not available on-site, in which case the review will occur within 60 days of your request. IHCSCV may extend the deadline by up to an additional 30 days. IHCSCV will provide you with a written explanation of any denial of your request for access or copies.
IHCSCV may charge you a reasonable, cost-based fee for photocopies or for mailing. If there will be a charge, the Privacy Officer will first contact you to determine whether you wish to modify or withdraw your request.
2. Right To Amend PHI. You may amend your PHI on file with IHCSCV by submitting the appropriate request form to the Privacy Officer. IHCSCV will respond to your request within 60 days. IHCSCV may extend the deadline by up to an additional 30 days. If IHCSCV denies your request to amend, IHCSCV will provide a written explanation of the denial. You would then have 30 days to submit a written statement explaining your disagreement with the denial. Your statement of disagreement would be included with any future disclosure of the disputed PHI.
3. Right To An Accounting Of Disclosures Of Your PHI. You may request an accounting of IHCSCV’s disclosures of your PHI by submitting the appropriate form to the Privacy Officer. IHCSCV will provide the accounting within 60 days of your request. IHCSCV may extend the deadline by up to an additional 30 days. The accounting will exclude the following disclosures: (a) disclosures for “treatment,” “payment” or “health care operations”, (b) disclosures to you or pursuant to your authorization, (c) disclosures to family members or close friends involved in your care or in payment for your care; (d) disclosures as part of a data use agreement; and (e) incidental disclosures. IHCSCV will provide the first accounting during any 12-month period without charge. IHCSCV may charge a reasonable, cost-based fee for each additional accounting during the same 12-month period. If there will be a charge, the Privacy Officer will first contact you to determine whether you wish to modify or withdraw your request.
4. Right To Request Additional Restrictions On The Use Or Disclosure Of Your PHI. You may request that IHCSCV place restrictions on the use and disclosure or your PHI for “treatment,” “payment” or for “health care operations” in addition to the restrictions required by federal law by submitting the appropriate request form to the Privacy Officer. IHCSCV will notify you in writing within 30 days of your request whether it will agree to the requested restriction. IHCSCV is not required to agree to your request unless (a) you request that IHCSCV not disclose your PHI to a health insurance company, Medicare or Medicaid for payment or health care operations purposes; (b) you, or someone on your behalf, has paid IHCSCV in full for the health care item or service to which the PHI pertains; and (c) IHCSCV is not required by law to disclose to the insurer, Medicare, or Medicaid the PHI that is the subject of your request.                           5. Right To Request Communications By Alternative Means Or To An Alternative Location. IHCSCV will honor your reasonable request to receive PHI by alternative means, or at an alternative location, if you
submit the appropriate request form to the Privacy Officer. We will accommodate a request if you tell us that not doing so would endanger you.
6. Right To Receive Notice Of A Breach Of Your Unsecured PHI: If we discover a breach of your unsecured PHI, the Plans will notify you of the breach and provide the information required by law.
7. Right To A Paper Copy Of This Notice. You may request at any time that the Privacy Officer provide you with a paper copy of this Notice.

F. Personal Representatives

Any person with the legal authority to act as your personal representative will have all rights that you have regarding your protected health information. There are several ways a person may acquire legal authority to act as your personal representative, including, but not limited to: (a) if you sign a written document giving the person formal authority to make health care decisions on your behalf. This document may be a general power of attorney or any specific power of attorney authorizing the person to act on your behalf for health care purposes; and (b) if a court issues an order appointing the person to act as your conservator or guardian. Any person claiming to have legal authority to act as your personal representative must provide satisfactory proof of authority, such as the documents referenced above.

G. Your Right To File A Complaint

If you believe that your privacy rights have been violated because the IHCSCV has used or disclosed your PHI in a manner inconsistent with this Notice, because the IHCSCV has not honored your rights as described in this Notice, or for any other reason, you may file
a complaint in one, or both, of the following ways:
1. Internal Complaint: Within 180 days of the date you learned of the conduct, you can submit a complaint using the appropriate complaint form to the Privacy Officer at the IHCSCV Business Offices, designated below. You can obtain a complaint form from by calling (408) 445-3400 and asking for the Privacy Officer.
2. Complaint To HHS: Within 180 days of the date you learned of the conduct, you may submit a complaint by mail to the Secretary of the U.S. Department of Health and Human Services, Hubert H. Humphrey Building, 200 Independence Ave., S.W., Washington, D.C. 20201.
H. IHCSCV’s Anti-Retaliation Policy
IHCSCV will not retaliate against you for submitting an internal complaint, a complaint to HHS, or for exercising your other rights as described in this Notice or under applicable law.
I. Whom To Contact For More Information About IHCSCV’s Privacy Policies And Procedures If you have any questions about this Notice, or about how to exercise any of the rights described in this Notice, you should contact IHCSCV’s Privacy Officer by mail c/o 1333 Meridian Ave, San Jose, CA. 95125, or call (408) 445-3400 and ask for the Privacy Officer.

J. Revisions To The Privacy Policy And To The Notice IHCSCV has the right to change this Notice or IHCSCV’s privacy policies and procedures at any time.

If the change to IHCSCV’s privacy policies and procedures would have a material impact on your rights, IHCSCV will notify you of the change by promptly mailing (either electronically or by U.S. Postal Service) a revised Notice to you, in accordance with applicable regulations, which reflects the change. Any change to IHCSCV’s privacy policies and procedures, or to the Notice, will apply to your PHI created or received before the revision.

Effective Date Of This Notice: December 31, 2021