Data Privacy
Introduction
ARC CNY PT NYC (“we,” “our,” or “us”) is committed to protecting the privacy and security of your personal health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, or interact with our healthcare facility.
As a healthcare provider, we are required to comply with the Health Insurance Portability and Accountability Act (HIPAA) and other applicable federal and state privacy laws. This policy serves as our Notice of Privacy Practices as required by HIPAA.
Information We Collect
Personal Health Information (PHI)
We collect and maintain various types of personal health information, including:
- Identification Information: Name, address, phone number, email address, date of birth, Social Security number, emergency contact information
- Medical History: Past and current medical conditions, medications, allergies, surgical history, family medical history
- Treatment Information: Physical therapy assessments, treatment plans, progress notes, therapy session records, exercise prescriptions
- Insurance Information: Insurance carrier details, policy numbers, coverage information, billing records
- Communication Records: Appointment scheduling information, patient correspondence, referral communications
Website Information
When you visit our website, we may collect:
- Technical Information: IP address, browser type, operating system, device information, pages visited, time spent on pages
- Contact Form Data: Information voluntarily submitted through our appointment request forms or contact forms
- Cookies and Tracking: We use cookies to improve website functionality and user experience
How We Use Your Information
We use your personal health information for the following purposes:
Treatment
- Providing physical therapy services and related healthcare
- Coordinating care with other healthcare providers
- Developing and implementing treatment plans
- Monitoring your progress and adjusting treatments accordingly
- Emergency situations where your health or safety may be at risk
Payment
- Processing insurance claims and billing
- Collecting payment for services rendered
- Verifying insurance coverage and benefits
- Conducting utilization review and quality assurance activities
Healthcare Operations
- Quality improvement and patient safety initiatives
- Staff training and education programs
- Business planning and development
- Compliance monitoring and auditing
- Appointment scheduling and reminder communications
- Patient satisfaction surveys and feedback collection
Legal Requirements
- Complying with federal and state laws and regulations
- Responding to court orders, subpoenas, or legal proceedings
- Reporting to public health authorities when required
- Cooperating with law enforcement when legally mandated
Information Sharing and Disclosure
Authorized Disclosures
We may share your information in the following circumstances:
Healthcare Providers: With other healthcare professionals involved in your care, including referring physicians, specialists, and home health agencies.
Insurance Companies: With your health insurance provider for payment and coverage determination purposes.
Family and Friends: With individuals you have authorized to receive information about your care, or in emergency situations.
Business Associates: With contracted service providers who assist us in providing healthcare services or conducting business operations, subject to written agreements protecting your information.
Required Disclosures
We are required to disclose your information:
- To you upon your request for access to your own health information
- To the Department of Health and Human Services for compliance investigations
- When authorized by and to the extent permitted by law
Special Circumstances
Without your authorization, we may use or disclose your information for:
- Public health activities and disease reporting
- Health oversight activities and inspections
- Judicial and administrative proceedings
- Law enforcement purposes when legally required
- Coroner or medical examiner functions
- Organ donation organizations
- Research purposes (with appropriate safeguards)
- Workers’ compensation claims
- Preventing serious threats to health or safety
Your Privacy Rights
Under HIPAA and applicable state laws, you have the following rights:
Right to Access
You have the right to inspect and obtain copies of your health information maintained in our records. Requests must be made in writing, and we will respond within 30 days.
Right to Amendment
You may request corrections to your health information if you believe it is inaccurate or incomplete. We will review your request and either make the correction or provide you with a written explanation of our denial.
Right to Restriction
You may request restrictions on how we use or disclose your health information for treatment, payment, or healthcare operations. While we are not required to agree to all restrictions, we will consider your request.
Right to Confidential Communications
You may request that we communicate with you about your health information in a specific manner or at a specific location to protect your privacy.
Right to an Accounting
You have the right to receive an accounting of certain disclosures of your health information made by us for purposes other than treatment, payment, or healthcare operations.
Right to Notification of Breach
You have the right to be notified in the event of a breach of your unsecured health information.
Right to Withdraw Authorization
If you have provided written authorization for specific uses or disclosures of your information, you may revoke that authorization at any time in writing.
Data Security Measures
We implement comprehensive security measures to protect your personal health information:
Physical Safeguards
- Secure facility access controls and locked storage areas
- Workstation and device security protocols
- Proper disposal of paper records and electronic media
- Clean desk and clear screen policies
Administrative Safeguards
- HIPAA compliance training for all staff members
- Regular security risk assessments and audits
- Incident response procedures for potential breaches
- Business associate agreements with third-party vendors
- Access controls and user authentication systems
Technical Safeguards
- Encryption of electronic health records and communications
- Secure network configurations and firewalls
- Regular software updates and security patches
- Automatic logoff and session timeout controls
- Audit logs and monitoring systems
Website Privacy and Cookies
Website Data Collection
Our website may collect information through:
- Contact Forms: Information voluntarily provided when requesting appointments or information
- Analytics: Aggregate data about website usage and performance
- Cookies: Small files that help improve website functionality
Cookie Usage
We use cookies to:
- Remember your preferences and settings
- Analyze website traffic and usage patterns
- Improve website performance and user experience
- Provide relevant content and features
You can control cookie settings through your browser preferences. Disabling cookies may affect website functionality.
Third-Party Services
We may work with trusted third-party service providers who assist us in:
- Electronic health record management
- Insurance verification and billing services
- Appointment scheduling systems
- Website hosting and maintenance
- Communication and patient portal services
All third-party providers are required to maintain appropriate safeguards for your personal health information and are bound by business associate agreements.
Data Retention
We retain your health information as required by federal and state laws and professional standards:
- Active Patient Records: Maintained during active treatment and for a minimum period thereafter
- Adult Records: Typically retained for 7-10 years after the last treatment date
- Minor Records: Retained until the patient reaches age of majority plus additional years as required by law
- Billing Records: Maintained for periods required by tax and healthcare regulations
Information may be retained longer if required for legal proceedings or ongoing treatment needs.
International Data Transfers
Your health information is primarily processed and stored within the United States. If information is transferred internationally, we ensure appropriate safeguards are in place to protect your privacy rights.
Children’s Privacy
We are committed to protecting the privacy of minor patients. Parents or legal guardians may exercise privacy rights on behalf of minor children. We comply with all applicable laws regarding the treatment of minors’ health information.
Changes to This Policy
We reserve the right to modify this Privacy Policy at any time. Changes will be effective immediately upon posting to our website. We will provide notice of material changes as required by law. The current version will always be available on our website with the effective date clearly marked.
Contact Information
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or need to file a complaint, please contact:
ElderCare Physical Therapy
Privacy Officer
1245 Senior
Wellness Drive
Healthcare Plaza,
Suite 200
Springfield, IL 62701
Phone: (555) 123-4567
Email: privacy@eldercarerehab.com
Fax: (555) 123-4568
Filing Complaints
You have the right to file a complaint if you believe your privacy rights have been violated. You may file complaints with:
- Our Privacy Officer at the contact information above
- U.S. Department of Health and Human Services
Office for Civil Rights 200 Independence Avenue, S.W.
Washington, D.C. 20201
Phone: 1-877-696-6775
Website: www.hhs.gov/ocr/privacy/
We will not retaliate against you for filing a complaint.
Acknowledgment
By using our services or website, you acknowledge that you have read and understand this Privacy Policy. If you do not agree with this policy, please do not use our services or website.
For patients receiving treatment, a separate acknowledgment form will be provided during your first visit as required by HIPAA regulations.
This Privacy Policy complies with HIPAA, state privacy laws, and other applicable regulations. It is designed to inform you of our privacy practices and your rights regarding your personal health information.