Health privacy notice.

A HIPAA-covered treating practice must issue a notice identifying the covered entity, how protected health information is used and disclosed, its duties, patient rights, complaint contact, and effective date. SAMSON’s covered-entity status and treating practice details have not been verified. This draft does not establish HIPAA compliance.

The final notice must reflect actual operations, applicable federal requirements, and stronger state privacy protections, including special rules for sensitive records where applicable. It must identify how to obtain a copy and whom to contact with privacy questions.

Where HIPAA applies, a provider may generally use or disclose information for treatment, payment, and healthcare operations, subject to legal limits. Other permitted or required disclosures can include public health, legally required reporting, oversight, and certain legal proceedings; additional restrictions may apply.

Uses not permitted by law or the notice require a valid authorization. Marketing, sale of protected health information, and most uses of psychotherapy notes generally require specific authorization, subject to exceptions. An authorization can generally be revoked in writing for future uses; revocation does not undo actions already taken in reliance on it. Website intake consent is not a blanket HIPAA authorization.

Subject to applicable conditions and exceptions, you may request access to or a copy of your records, ask for corrections, request confidential communications, ask for restrictions on uses or disclosures, receive an accounting of certain disclosures, and obtain a paper copy of the provider’s notice.

A provider generally need not accept every requested restriction, but must honor certain requests not to disclose information to a health plan about services paid in full out of pocket, unless disclosure is otherwise required by law. Ask the practice how to submit requests, what deadlines apply, and whether permitted fees apply.

A covered provider must protect the privacy of protected health information, provide its notice, follow the notice currently in effect, and notify affected individuals following a breach of unsecured protected health information as required by law. No online system can promise absolute security.

Changes to a final notice must follow applicable law and explain how an updated notice is made available. The practice’s actual safeguards, retention requirements, and notice revision process must be verified rather than assumed.

The final notice must name or identify the practice’s privacy contact and provide a usable address or phone number. Those details are pending; do not send medical records through the general contact form.

Where HIPAA applies, you may complain to the provider or to the U.S. Department of Health and Human Services Office for Civil Rights without retaliation. Complaints are generally due within 180 days of learning of the act or omission, with extensions possible for good cause.

HHS: HIPAA complaints ↗

Confirm the covered practice’s legal name and address, any joint-notice participants, privacy contact and phone number, notice effective date, actual uses and disclosures, patient-request procedures, and all current federal and state required language. Obtain counsel’s review and make the finalized notice available to patients.

Do not ask patients to acknowledge receipt of an effective HIPAA notice using this draft. Website Privacy Policy acknowledgment is separate from provider notice acknowledgment and from optional authorizations.

HHS: Notice of Privacy Practices ↗