Notice of Privacy Practices

Our commitment to your privacy

The Institute for Infant Feeding and Early Development ("the Institute," "we," "us," or "our") is required by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") to maintain the privacy of your child's protected health information ("PHI"), to give you this notice of our legal duties and privacy practices, and to notify affected individuals following a breach of unsecured PHI. This notice applies to PHI the Institute creates or receives, including information we receive from your child's other providers.

This notice is separate from our website Privacy Policy, but the two work together. This notice explains how we handle PHI that HIPAA covers. The Privacy Policy explains what information this website collects and how its forms and technology work. Some information may be covered by both, depending on what it is and how we receive it. Information is not outside HIPAA simply because an appointment has not yet been scheduled or a first visit has not happened.

We are required to follow the terms of this notice while it is in effect. This notice is effective as of the date above and remains in effect until we replace it.

Who acts for your child

In most cases, a child's parent or legal guardian acts as the child's "personal representative" under HIPAA. This means you can generally exercise the rights described in this notice for your child and receive your child's PHI. There are exceptions under federal and Texas law, for example when a court order limits a parent's authority, when a minor lawfully consents to their own care, or when we reasonably believe that treating someone as a personal representative could endanger a child. Where an exception applies, we follow the law. When we say "you" in this notice, we mean you as your child's parent, guardian, or other personal representative.

How we may use and disclose health information

The following categories describe the ways we are permitted to use and disclose PHI without your written authorization. Not every use or disclosure in a category is listed. If other law, including Texas law, is more protective than HIPAA, we follow the more protective law.

Treatment

We may use and disclose your child's PHI to provide, coordinate, or manage care and any related services. This includes coordinating care with other healthcare providers, such as your child's pediatrician, neonatologist, lactation consultant, dietitian, or other treating providers.

Payment

We may use and disclose PHI so that treatment and services can be billed and payment collected, whether from you, an insurance company, or a third party. This may include verifying coverage, obtaining prior authorization, and billing-related activities.

Healthcare operations

We may use and disclose PHI for operations necessary to run our practice and ensure patients receive quality care, for example, quality assessment and improvement activities, training, licensing, and business planning.

Family, friends, and caregivers involved in care

As described above, we generally share your child's PHI with the child's parents and legal guardians. We may also share relevant PHI with another family member, caregiver, or person you identify who is involved in your child's care or payment for care, if you agree or do not object when given the chance. If you are not available or able to agree, we may share limited information when we believe, using our professional judgment, that it is in your child's best interest.

As required by law

We will disclose PHI when required to do so by federal, state, or local law, including in response to a court order.

Public health and safety

We may disclose PHI for public health activities, such as reporting to public health authorities, and to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

Health oversight, legal, and law enforcement purposes

We may disclose PHI to health oversight agencies for activities authorized by law, such as audits and licensing inspections. We may disclose PHI in response to a court order, or in response to a subpoena or similar legal request when HIPAA's conditions for doing so are met. We may disclose limited PHI to law enforcement officials under the circumstances HIPAA allows.

Mandatory reporting

We may be required by law to report suspected child abuse or neglect to the appropriate state agency, even if you object.

Other permitted disclosures

HIPAA also permits certain other disclosures, including to coroners, medical examiners, and funeral directors; for approved research under the privacy safeguards the law requires; for certain government functions; and to the U.S. Department of Health and Human Services when it is checking our compliance with HIPAA.

Business associates

We may disclose PHI to contractors, agents, and other "business associates" who perform functions on our behalf or provide us services, provided they agree in writing to appropriately safeguard the information consistent with HIPAA.

Uses and disclosures requiring your written authorization

We will get your written authorization before we:

• use or disclose PHI for marketing purposes (other than a face-to-face conversation with you or a promotional gift of nominal value);
• sell PHI; or
• use or disclose psychotherapy notes, if applicable, except in the limited ways HIPAA allows.

Other uses and disclosures not described in this notice will also be made only with your written authorization. You may revoke an authorization at any time, in writing, except to the extent we have already relied on it.

Additional protections for substance use disorder records (42 CFR Part 2)

The Institute is not a substance use disorder treatment program. However, we may receive records from a program covered by a federal law known as 42 CFR Part 2. Federal law gives these records extra confidentiality protections that are stricter than HIPAA in some situations. If we have records subject to Part 2:

• We will use and disclose them only as HIPAA and Part 2 both allow. Where the two differ, we follow the stricter rule.
• We will not use or disclose them, or testimony about their contents, in a civil, criminal, administrative, or legislative proceeding against the person the records are about unless that person gives written consent, or a court issues an order after notice and an opportunity to be heard. A court order must be accompanied by a subpoena or other legal requirement compelling disclosure before we release the record.
• The person the records are about keeps the rights described in this notice, including the right to an accounting of disclosures, and may revoke a Part 2 consent in writing, except to the extent action has already been taken in reliance on it.
• We will not use or disclose these records for fundraising unless the person has first been given a clear and conspicuous opportunity to elect not to receive fundraising communications.

A possible violation of Part 2 may be reported to the U.S. Department of Health and Human Services, as described under "Complaints" below.

Fundraising

We may contact you to raise funds for the Institute. If we do, you have the right to opt out of receiving those communications, and every fundraising message will tell you how. Opting out will not affect your child's care.

Your rights regarding your child's health information

You have the following rights with respect to your child's PHI:

• Right to inspect and copy. You may ask to inspect and get a copy of your child's health and billing records, with limited exceptions. If we keep the records electronically, you may ask for an electronic copy in the form and format you request, if we can readily produce it that way (or in another form we agree on), and you may ask us to send the copy directly to a person or service you name in writing. We will respond within 30 days. If we need more time, we may extend that once by up to 30 days and will tell you why. Texas law may require a faster response for electronic health record requests. We may charge a reasonable, cost-based fee, and we may deny access in limited cases. If we do, we will explain why in writing and tell you about any review rights.
• Right to request amendment. You may ask us to correct health information you believe is incorrect or incomplete. We will respond in writing within 60 days (with one possible 30-day extension). We may deny the request in certain circumstances. If we do, we will explain why in writing, and you may submit a statement of disagreement that we will include with the record.
• Right to an accounting of disclosures. You may ask for a list of certain disclosures we have made of your child's PHI during the six years before your request. The list does not include disclosures for treatment, payment, and healthcare operations, disclosures you authorized, and certain other exceptions. We will respond within 60 days (with one possible 30-day extension). You may receive one list per 12 months at no charge; we may charge a reasonable, cost-based fee for additional requests.
• Right to request restrictions. You may ask us to limit how we use or disclose PHI for treatment, payment, or healthcare operations, or with family members or others involved in care. We are not required to agree, and we may say no if it would affect your child's care. If we agree, we will follow the restriction except in an emergency.
• Right to restrict disclosures to a health plan for services you pay for in full. If you pay for a service or item out of pocket and in full, and you ask us not to share information about that service with your health plan for payment or healthcare operations, we must agree, unless the law requires us to disclose it. This applies only to the specific service you paid for yourself, and the payment must actually be made.
• Right to request confidential communications. You may ask that we communicate with you about health matters in a particular way or at a particular location (for example, by contacting you only at a specific phone number or address). We will accommodate reasonable requests.
• Right to a paper copy of this notice. You may request a paper copy of this notice at any time, even if you have agreed to receive it electronically.
• Right to choose someone to act for you. If someone is your legal guardian or holds a health care power of attorney for you, they can exercise your rights and make choices about your information. We will confirm that person has this authority before we act.
• Right to be notified of a breach. You have the right to be notified if a breach of unsecured PHI involving your child's information occurs.

To exercise any of these rights, contact us using the information below. Some requests may require a signed, written form. We may ask you to confirm your identity and your authority to act for your child.

Our responsibilities

• We are required by law to maintain the privacy and security of your child's protected health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your child's information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your child's information other than as described here unless you tell us, in writing, that we can. If you tell us we can, you may change your mind at any time by letting us know in writing.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. This includes concerns about records protected by 42 CFR Part 2. To file a complaint with us, use the contact information below. You will not be penalized, and your child's care will not be affected, in any way for filing a complaint.

You may file a complaint with the Office for Civil Rights electronically through the OCR Complaint Portal at ocrportal.hhs.gov/ocr/portal/lobby.jsf, or by mail at U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Washington, D.C. 20201.

Changes to this notice

We reserve the right to change this notice and to make the revised notice effective for health information we already have as well as any information we receive in the future. We will post a copy of the current notice in our office and on this website, with the effective date noted at the top.

Contact us / Privacy Officer

Questions, requests, or complaints regarding this notice or your child's health information can be directed to our Privacy Officer at:
The Institute for Infant Feeding and Early Development
4800 Hedgcoxe Rd, Suite 200, Plano, Texas 75024
(972) 836-7080
info@infantexperts.com