Blue Ridge Family Physicians, PLLC
NOTICE OF PRIVACY PRACTICES
Effective Date: April 14, 2003
Questions, Concerns, and Complaints are to be directed to:
Joanna Herath, Privacy Officer
Blue Ridge Family Physicians, PLLC
2605 Blue Ridge Road, Suite 300
Raleigh, NC 27607
TABLE OF CONTENTS
Your Medical Record and the Purpose of this Notice 3
Your Rights Regarding Information about You 4
1. Right to Inspect and Copy 4
2. Right to Amend 4
3. Right to an Accounting of Disclosures 5
4. Right to Request Restrictions on Use and Disclosures of Protected Health 5
Information About You
5. Right to Request Confidential Communications From This Office 6
6. Right to a Paper Copy of This Notice 6
How Blue Ridge Family Physicians May Use and Disclose Information About You 6
1. Consent for Disclosure Is Not Needed/Required 6
Health Care Operations 7
Appointment Reminders 7
Treatment Alternatives 7
Health Related Products and Services 7
Additional Disclosures 7
2. Consent for Disclosure Is Needed/Required 9
HIV, STD, Abnormal Test Results, Substance Abuse 10
Communications with Family and Friends 10
Release of Test Results and Medications to Third Party 10
Minor Children 10
Power of Attorney 11
Patient Cannot Be Reached or Is Incapacitated 11
3. Withdrawal of Consent 11
Additional Protections of Protected Health Information That Are Provided Under North 11
Carolina Law or Other Law
Communicable Diseases 12
Mental Health, Developmental Disability, Substance Abuse 12
Change of this Notice 12
Where to File Complaints 13
Notice of Privacy Practices Receipt 14
YOUR MEDICAL RECORDS AND THE PURPOSE OF THIS NOTICE
Each time you visit Blue Ridge Family Physicians, a record of your visit is made. Typically, this
record contains your symptoms, examination and test results, diagnoses, treatment, and a plan for
future care or treatment. This information often referred to as your medical record, serves as a:
Basis for planning your care and treatment,
Means of communication among the many health professionals who contribute to your
Legal document describing the care you received,
Means by which you or a third-party payer can verify that services billed were actually
A tool in educating health professionals,
A source of data for medical research,
A source of information for public health officials charged with improving the health of
this state and the nation,
A source of data for our planning and marketing,
A tool with which we can assess and continually work to improve the care we render and
the outcomes we achieve.
Understanding what is in your record and how your health information is used helps you to
ensure its accuracy, better understand who, what, when, where and why others may access your
health information, and make more informed decisions when authorizing disclosures to others.
Although your medical record is the physical property of Blue Ridge Family Physicians, PLLC,
the information belongs to you. You have the right to know about the uses and disclosures of
your protected health information that may be made. Blue Ridge Family Physicians is committed
to responsibly treating and using your protected health information (PHI). This notice describes
information about privacy practices followed by our employees, staff, and other personnel. The
practices described in this notice will also be followed by healthcare providers you consult with
by telephone (when your regular healthcare provider from our office is not available) who
provide “call coverage” for your health care provider.
This notice applies to the information and records we have about your health, health status, and
the healthcare and services you receive at this office. We are required by federal law to maintain
the privacy of protected health information and to provide individuals with the notice of our legal
duties and privacy practice with respect to your information. We will also follow North Carolina
laws that give you more protection of your PHI than the federal law. For example, North
Carolina law gives you more protection of some kinds of PHI including information about
communicable diseases, mental health, developmental disability, and substance abuse. It will tell
you about the ways in which we may use and disclose health information about you. Also, it
describes your rights and our obligations regarding the use and disclosure of that information.
PLEASE REVIEW IT CAREFULLY. You will be asked to sign a form that you received this
Notice. Even if you do not sign this form, we will still provide you treatment. If you have any
questions about this notice, please contact our designated privacy official at 919-787-3448 or by
mail at 2605 Blue Ridge Road, Suite 300 Raleigh, NC 27607. This notice is effective April 14,
2003 and applies to all protected health information as defined by federal and state regulations.
YOUR RIGHTS REGARDING HEALTH INFORMATION ABOUT YOU
You have the following rights regarding information we maintain about you:
1. Right to Inspect and Copy
You have the right to inspect and copy your health information, such as medical and billing
records, that we use to make decisions about you. You must submit your request in writing.
Please complete a Request to Inspect and Copy Information Form and submit it to our
designated privacy official. A convenient appointment time will be scheduled to give you the
opportunity to review your records. A Blue Ridge employee will be present during your
appointment to assist you. If you request a copy of the information, we may charge a reasonable
fee for the costs of copying, mailing or other associated supplies.
We may deny your request to inspect and/or copy in certain limited circumstances. Under these
circumstances, we will respond to you in writing, stating why we will not grant your request and
describing any rights you have to request review of the denial. If you are denied access to your
health information, you may ask that the denial be reviewed. If such a review is required by law,
we will select a licensed healthcare professional to review your request and our denial. The
person conducting the review will not be the person who denied your request, and we will
comply with the outcome of the review.
2. Right to Amend
If you believe information we have about you is incorrect or incomplete, you may ask us to
amend the information. You have the right to request an amendment as long as the information
is kept by this office. Your request must be in writing. You must also give us a reason for your
request. To request an amendment, complete and submit a Medical Record
Amendment/Correction Form to our designated privacy official. If we accept your request to
amend the information we will make reasonable efforts to inform others of the amendment,
including persons you name who have received PHI and who need the amendment.
We may deny your request for an amendment if it is not in writing or does not include a reason
to support the request. In addition, we may deny your request if you ask us to amend information
a) We did not create, unless the person or entity that created the information is no longer
available to make the amendment.
b) Is not part of the health information that we keep
c) You would not be permitted to inspect and copy
d) We believe is accurate and complete.
Under these circumstances, we will respond to you in writing, stating why we will not grant your
request and describing any rights you have to request review of the denial.
3. Right to an Accounting of Disclosures
You have the right to request an “accounting of disclosures.” This is a list of the disclosures we
made of medical information about you for purposes other than treatment, payment, and
healthcare operations. The list contains the following elements:
Date of Request
Purpose of Disclosure (Why information was requested)
Rule Permission for Disclosure (Is additional patient consent needed?)
Date of Disclosure
Information Disclosed (Specific Information Disclosed)
Recipient (Who Requested Information?)
Was PHI Requested? Yes or No
To obtain this list, you must submit and complete the Accounting of Disclosures Form and
submit it to our designated privacy official. It must state a time period, which may be no longer
than six (6) years and may not include dates before April 14, 2003. Your request should indicate
in what form you want the list (for example, on paper or electronically). We may charge you for
the costs of providing the list. We will notify you of the cost involved and you may choose to
withdraw or modify your request at that time before any costs are incurred.
We are not required to include disclosures:
For your treatment
For billing and collection of payment for your treatment
For our health care operation
Requested by you that you authorized, or which we made to individuals involved in your
Allowed by law when the use and/or disclosure related to certain specialized government
functions or related to correctional institutions and in other law enforcement custodial
As part of a limited set of information which does not contain information that would
4. Right to Request Restrictions on Use and Disclosures of Protected Health Information
(PHI) About You
You have the right to request a restriction or limitation on the health information we use or
disclose about you for treatment, payment or healthcare operations. You have the right to
request a limit on the health information we disclose about you to someone who is involved in
your care or the payment for it, like a family member or friend. For example, you could ask that
we not disclose information about a surgery you had. Your request must be in writing. To request
restrictions, you may complete and submit the Restriction on Use and Disclosure of
Information Form to our designated privacy officer.
We are not required to agree to your request. If we do agree, we will comply with your request
unless the information is needed to provide you emergency treatment or disclosure described in
pages 7 through 8 of this notice. Under these circumstances, we will respond to you in writing,
stating why we will not grant your request and describing any rights you have to request review
of the denial.
5. Right to Request Confidential Communications From This Office
You have the right to request how and where we contact you. For example, you can ask that we
only contact you at work or by mail.
Your request must be in writing. To request confidential communications, you may complete and
submit the Communication Preference Form to our designated privacy official. We will not
ask you the reason for your request. We will accommodate all reasonable requests. Your
request must specify how or where you wish to be contacted.
6. Right to a Paper Copy of This Notice
You have the right to a paper copy of this notice. You may ask us to give you a copy of this
notice at any time. Paper copies are available at the front desk. Electronic files are also available
on our website at www.blueridgefamilyphysicians.com. Even if you have agreed to receive it
electronically, you are still entitled to a paper copy.
HOW BLUE RIDGE FAMILY PHYSICIANS MAY USE AND DISCLOSE HEALTH
INFORMATION ABOUT YOU
1. Consent for Disclosure Is Not Needed/Required
Treatment We may use health information about you to provide you with medical
treatment or services. We may disclose health information about you to doctors, nurses,
technicians, office staff or other personnel who are involved in taking care of you and
For example, your doctor may be treating you for a heart condition and may need to
know if you have other health problems that could complicate your treatment. The
doctor may use your medical history to decide what treatment is best for you. The doctor
may also tell another doctor about your condition so that doctor can help determine the
most appropriate care for you.
Different personnel in our office may share information about you and disclose
information to people who do not work in our office in order to coordinate your care,
such as phoning in prescriptions to your pharmacy, scheduling lab work and ordering x-
rays. Family members and other healthcare providers may be part of your medical care
outside this office and may require information about you that we have.
Payment We may use and disclose health information about you so that the treatment
and services you receive at this office may be billed to and payment may be collected
from you, an insurance company or a third party. For example, we may need to give your
health plan information about a service you received here so your health plan will pay us
or reimburse you for the service. We may also tell your health plan about a treatment you
are going to receive to obtain prior approval, or to determine whether your plan will
cover the treatment.
Healthcare Operations We may use and disclose health information about you in order
to run the office and make sure that you and our other patients receive quality care. For
example, we may use your health information to evaluate the performance of our staff in
caring for you. We may also use health information about all or many of our patients to
help us decide what additional services we should offer, how we can become more
efficient, or whether certain new treatments are effective. We may also disclose PHI for
the healthcare operations of any organized health care arrangement in which we
participate. An example of an organized health care arrangement is the joint care
provided by a hospital and the physicians who see patients at the hospital.
Appointment Reminders We may contact you as a reminder that you have an
appointment for treatment or medical care at the office. If you do not wish to receive
appointment reminders, you can request not to receive this service. We will need this
notice in writing.
Treatment Alternatives We may tell you about or recommend possible treatment
options or alternative that may be of interest to you.
Health Related Products and Services We may tell you about health-related products or
services that may be of interest to you.
Additional Disclosures We may use or disclose health information about you without
your permission for the following purposes, subject to all applicable legal requirements
To Avert a Serious Threat to Health or Safety We may disclose health information
about you in limited circumstances to prevent a serious threat to your health and
safety or the health and safety of the public or another person. This disclosure can
only be made to a person who is able to help prevent the threat.
Required by Law We may use and disclose PHI as required by federal, state, or local
law to the extent that the use or disclosure complies with the law and is limited to the
requirements of the law.
Abuse, Neglect, or Domestic Violence We may disclose PHI in certain cases to
proper government authorities if we reasonably believe that a patient has been a
victim of domestic violence, abuse, or neglect.
Research We may use and disclose health information about you for research project
that are subject to a special approval process. We will ask you for your permission if
the researcher will have access to your name, address, or other information that
reveals who you are, or will be involved in your care at the office.
Organ and Tissue Donation If you are an organ donor, we may release health
information to organizations that handle organ procurement or organ, eye or tissue
transplantation or to an organ donation bank, as necessary to facilitate such donation
Specialized Government Functions Under certain conditions, we may disclose PHI:
o For certain military and veteran activities, including determination of
eligibility for veterans benefits and where deemed necessary by military
o For national security and intelligence activities;
o To help provide protective services for the President of the United States and
o For the health or safety of inmates and others at correctional institutions or
other law enforcement custodial situations or for general safety and health
related to correctional facilities.
Workers’ Compensation We may release health information about you for workers’
compensation or similar programs as authorized by workers’ compensation laws or
other similar programs that provide benefits for work-related injuries or illness.
Public Health Activities We may use or disclose PHI to public health authorities or
other authorized persons to carry out certain activities related to public health,
including the following activities:
o To prevent or control disease, injury, or disability;
o To report disease, injury, birth or death;
o To report child abuse or neglect;
o To report reactions to medications or problems with products or devices
regulated by the federal Food and Drug Administration (FDA) or other
activities related to qualify, safety, or effectiveness of FDA-regulated
products or activities;
o To locate and notify persons of recalls of products they may be using;
o To notify a person who may have been exposed to a communicable disease in
order to control who may be at risk of contracting or spreading the disease;
o To report to your employer, under limited circumstance, information related
primarily to workplace injuries or illnesses, or workplace medical
Health Oversight Activities We may disclose health information about you to a
health oversight agency for audits, investigations, inspections, or licensing purposes.
These disclosures may be necessary for certain state and federal agencies to monitor
the healthcare system, government programs, and compliance with civil rights laws.
Lawsuits, Disputes, and other Legal Proceedings We may use or disclose PHI
when required by a court or administrative tribunal order. We may also disclose PHI
in response to subpoenas, discovery request, or other required legal process when
efforts have been made to advise you of the request or to obtain an order protecting
the information requested.
Law Enforcement Under certain conditions, we may disclose PHI to law
enforcement officials for the following purposes where the disclosure is:
o About a suspected crime victim if, under certain limited circumstances we
are unable to obtain a person’s agreement because of incapacity or
o To alert law enforcement of a death that we suspect was the result of
o Required by law;
o In response to a court order, warrant, subpoena, summons, administrative
agency request, or other authorized process;
o To identify or locate a suspect, fugitive, material witness, or missing person;
o About a crime or suspected crime committed at our office; or
o In response to a medical emergency not occurring at the office, if necessary
to report a crime, including the nature of the crime, the location of the crime
or the victim, and the identity of the person who committed the crime.
Coroners, Medical Examiners and Funeral Directors We may release health
information to a coroner or medical examiner, as authorized by law, so that they may
carry out their jobs. This may be necessary, for example, to identify a deceased
person or to determine cause of death.
Disclosures Required by HIPAA Privacy Rule We are required to disclose PHI to
the Secretary of the United States Department of Health and Human Services when
requested by the Secretary to review our compliance with the HIPAA Privacy Rule.
We are also required in certain cases to disclose PHI to you upon your request to
access PHI or for an accounting of certain disclosures of PHI about you.
Incidental Disclosures We may use of disclose PHI incident to a use or disclosure
permitted by the HIPAA Privacy Rule so long as we have reasonable safeguarded
against such incidental uses and disclosures and have limited them to the minimum
Limited Data Set Disclosures We may use or disclose a limited data set (PHI that
has certain identifying information removed) for the purposes of research, public
health, or health care operations. This information may only be disclosed for
research, public health, and health care operations purposes. The person receiving the
information must sign and agreement to protect the information.
2. Consent for Disclosure Is Needed /Required
We will not use or disclose your health information for any purpose other than those identified in
the previous sections without your specific, written authorization. There are two forms that can
be completed and submitted: Authorization to Use and Disclose Health Information Form and
the Patient Proxy/Representative Authorization Form. We will not use or disclose your
information in these situations:
HIV, STD, Substance Abuse Information Some test results can only be discussed in
face-to-face situations – HIV tests, sexually transmitted diseases, abnormal results etc.
These results will not be discussed with a patient or any other third party over the phone.
If we have HIV or substance abuse information about you, we cannot release that
information to a third party without a special signed, written authorization (different than
the Authorization and Consent mentioned above) from you. In order to disclose these
types of records for purposes of treatment, payment, or healthcare operations, we will
have to have both your signed Consent and a special written Authorization that complies
with the law governing HIV or substance abuse records.
Communications to Family and Friends We may disclose health information about you
to your family members or friends if we obtain your written agreement (Patient Proxy
Representative Authorization Form) to do so or if we give you an opportunity to object
to such a disclosure and you do not raise objection. We may also disclose health
information to your family or friends if we can infer from the circumstances, based on
our professional judgment that you would not object. For example, we may assume you
agree to our disclosure of your personal health information to your spouse when you
bring your spouse with you into the exam room during treatment or while treatment is
Release of Test Results and Medications to Third Party For the protection of your
private health information, this office requires written permission to release test results,
copies of medical records, and billing history to your spouse or other family members. To
authorize the release of this information to a third party, you may complete and submit
the Patient Proxy/Representative Authorization Form to our designated privacy officer.
Documentation of your consent will be made in your record. Your consent can be
revoked at any time. Most will not be discussed over the phone with anyone other than
yourself without written permission. Again, HIV, STD, and Substance Abuse information
will not be discussed over the telephone at all. We may use our professional judgment
and experience with common practice to make reasonable decision about when it is in
your best interest to allow another person to act on your behalf.
Minor Children Minors must have written permission from parents for treatment.
Verbal consent will suffice in an emergency, however, the parent’s/guardian’s permission
must be documented in the patient’s chart. Custodial parents of minors may authorize
another adult to consent to treatment for their children. The North Carolina General
Statute contains a non-exclusive form that may be used for this purpose, at §32A-34. A
form of this kind is typically used by: Parents whose children are routinely kept by
another adult (such as a grandparent or babysitter), parents who are planning to be out-of-
town or otherwise unavailable for a defined period. The standard form may be altered to
limit the agent’s authority to a certain period or to exclude certain procedures or
situations from the agent’s authority. In an emergency situation, treatment will not be
delayed because of lack of this authorization. Some practices typically see minor patients
who are old enough to come to the office alone. Minors will occasionally be dropped off
at a practice for treatment while the parent is otherwise occupied. If either of these
situations is anticipated, the parent or guardian may sign a form in advance of the
appointment authorizing the physicians or practice to treat the minor in the parent’s
absence. In an emergency situation, treatment should not be delayed because of a lack of
this authorization. Parents of minors have access to charts until child turns 18.
Communications with Patient 18 yrs old and over are only directed to the patient unless
directed otherwise. Minors can consent to treatment in certain situations. North Carolina
statute (N.C.G.S. §90-21.5) identifies four areas in which patients under 18 may give
consent for treatment for themselves: prevention, diagnosis, and treatment of venereal
disease, prevention, diagnosis, and treatment of pregnancy (not including termination of
pregnancy), prevention, diagnosis, and treatment of substance abuse, prevention,
diagnosis, and treatment of emotional disturbance (not including admission to an in-
patient facility). According to North Carolina General Statute §7A-721, an emancipated
minor is a person under eighteen years of age who: is married or has been emancipated
by judicial action. An emancipated minor can consent to any medical or dental treatment
for himself or herself independent of a parent or guardian. Note that a minor does not
become emancipated by moving out of his or her parents’ house or by having a baby.
Power of Attorney If family member has power of attorney we must have a copy on file
in order to comply with the patient representative’s requests.
Patient is Unreachable or Incapacitated In situations where you are not capable of
giving consent (because you are not present, we are unable to reach you, or you are
incapacitated by a medical emergency), we may, using our professional judgment,
determine that a disclosure to your family member or friend is in your best interest. In
that situation, we will disclose only health information relevant to the person’s
involvement in your care or payment related to your care.
3. Withdrawal of Consent
If you give us Authorization to use or disclose health information about you, you may revoke
that Authorization, in writing, at any time. Please complete the Withdrawal of Consent Form
and submit it to our designated privacy officer. If you revoke your Authorization, we will no
longer use or disclose information about you for the reasons covered by your written
Authorization, but we cannot take back any uses or disclosures already made with your
Your revocation will be effective when we receive it, but it will not apply to any uses and
disclosures that occurred before that time. If you do revoke your Consent to the extent we would
not be permitted to use or disclose information for purposes of treatment, payment or healthcare
operations, we may choose to discontinue providing you with healthcare treatment and services.
ADDITIONAL PROTECTIONS OF PROTECTED HEALTH INFORAMTION THAT
ARE PROVIDED UNDER NORTH CAROLINA LAW OR OTHER LAW
Up to this place in this Notice, we have been describing the uses and disclosure of PHI that we
may make under the HIPAA Privacy Rule. However, HIPAA does not change some North
Carolina laws or other laws that are more protective of patient privacy. This section describes
these other laws that give you more protection in certain circumstances or with respect to certain
kinds of PHI. Aside from these laws, we believe that HIPAA generally is consistent with North
Carolina and other privacy laws and requirements. As government agencies offer more guidance
on HIPAA, state, and other laws, we will make appropriate changes to our privacy practices and
1. Communicable Diseases
State law limits when communicable disease information may be disclosed. In certain situations,
state law permits disclosure of communicable disease information that relates to you without
your authorization. “Communicable diseases” are generally illnesses that can be transmitted
from one person to another, such as HIV/AIDS, tuberculosis, hepatitis, and syphilis. North
Carolina law allows disclosures of communicable disease information in the following
to health care personnel for the purpose of providing you treatment;
to the appropriate government agency responsible for the control of communicable
diseases and conditions;
if a court orders the disclosure;
if we receive a subpoena that requires a disclosure;
to the health inspector during an inspection of our offices; and
if the disclosure is for statistical purposes and there is no way that you can be identified.
We must disclose your HIV status to the physician treating a health care worker who was
exposed to your blood or body fluids. We must notify the local health director if we have reason
to believe that you are HIV positive and are not following any of the control measures that have
been given to you by the local health director.
2. Mental Health, Developmental Disability, and Substance Abuse
Under North Carolina law, there are limitations on the disclosure of information about you that
relates to your being served by a facility that provides services for the care, treatment,
habilitation, or rehabilitation of the mentally ill, the developmentally disabled, or substance
abusers without your authorization. We may disclose this kind of information only as permitted
or required by North Carolina law.
Federal law and regulations do not protect any information about a crime committed by a patient
either at the program or against any person who works for the program or about any threat to
commit such a crime. Federal laws and regulations do not protect any information about
suspected child abuse or neglect from being reported under State law to appropriate State or local
CHANGES TO THIS NOTICE
We reserve the right to change this notice, and to make the revised or change notice effective for
medical information we already have about you as well as any information we receive in the
future. We must change our policies and procedures as necessary and appropriate to comply
with changes in law. We will post a summary or the current notice in the office with its effective
date in the top right hand corner. An updated copy will also be located at our website
www.blueridgefamilyphysicians.com . You are entitled to a copy of the notice currently in
If you believe your privacy rights have been violated, you may file a complaint with our office or
with the Secretary of the Department of Health and Human Services. To file a complaint with
our office, please complete and submit a Complaint Form to our privacy official. Our Privacy
Official may be contacted by phone (919-787-3448) or by mail at:
Blue Ridge Family Physicians
2605 Blue Ridge Road, Suite 300
Raleigh, NC 27607
You may also choose to file your complaint with the Office for Civil Rights, U.S. Department of
Health and Human Services. The address for the OCR is listed below:
Office for Civil Rights
U.S. Department of Health and Human Services
209 Independence Avenue, S.W.
Room 509F, HHH Building
Washington, D.C. 20201
There will be no retaliation for filing a complaint with either the Privacy Official or the Office of
Civil Rights (OCR).
Blue Ridge Family Physicians, PLLC
Notice of Privacy Practices Receipt
Please read and sign this form acknowledging you
received the Notice of Privacy Practices.
I acknowledge that I was provided with the Notice of Privacy Practice of Blue Ridge
Name of Patient: ______________________________________________
Signature of Patient: ___________________________________________
Patient’s Date of Birth: _________________________________________
Patient #: ____________________________________________________
For Personal Representative of the Patient (if applicable)
Name of Personal Representative: ____________________________________________
Describe Personal Representative Relationship:
Signature of Personal Representative: _________________________________________
For Practice Use Only:
Signature of Practice Employee Date