We have the right to use and disclose your PHI for all activities that are included within the definitions of "treatment," "payment" and "health care operations" as set out in the HIPAA Privacy Rule (45 CFR parts 160 and 164).

We may contract with individuals and entities (Business Associates) to perform various functions on our behalf or to provide certain types of services. To perform these functions or to provide the services, our Business Associates may receive, create, maintain, use, or disclose PHI, but only after we require the Business Associates to agree in writing to contract terms designed to appropriately safeguard your information. For example, we may disclose your PHI to a Business Associate to administer claims or to provide service support, utilization management, subrogation, or pharmacy benefit management.

In the event a Business Associate is a "health care component" as designated by our governing body, no written agreement regarding the safeguarding of your information is required by law, and we will not enter into such an agreement with those health care components.

We may use or disclose your PHI to assist health care providers in connection with their treatment or payment activities, or to assist other covered entities in connection with payment activities and certain health care operations. For example, we may disclose your PHI to a health care provider when needed by the provider to render treatment to you, and we may disclose PHI to another covered entity to conduct health care operations in the areas of quality assurance and improvement activities, or accreditation, certification, licensing or credentialing. This also means that we may disclose or share your PHI with other insurance carriers or governmental programs providing or paying for health care in order to coordinate benefits if you or your family members have coverage through such other carrier or governmental program.

We may disclose your PHI to the County for purposes of plan administration or pursuant to an authorization request signed by you.

We may use or disclose your protected health information to the extent that the use or disclosure is required by law. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. If required by law, you will be notified of any such uses or disclosures.

We may disclose your protected health information for public health activities and purposes to a public health authority that is permitted by law to collect or receive the information. The disclosure will be made for the purpose of controlling disease, injury or disability. We may also disclose your protected health information, if directed by the public health authority, to a foreign government agency that is collaborating with the public health authority.

We may disclose your PHI to a health oversight agency for activities authorized by law, such as: audits; investigations; inspections; licensure or disciplinary actions; or civil, administrative, or criminal proceedings or actions. Oversight agencies seeking this information include government agencies that oversee: (1) the health care system; (2) government benefit programs; (3) other government regulatory programs; and (4) compliance with civil rights laws.

We may disclose your protected health information to a public health authority or other government authority that is authorized by law to receive reports of child abuse or neglect. In addition, if we believe that you have been a victim of abuse, neglect or domestic violence we may disclose your protected health information to the governmental entity or agency authorized to receive such information. In this case, the disclosure will be made consistent with the requirements of applicable federal and state laws.

We may disclose your PHI: (1) in the course of any judicial or administrative proceeding; (2) in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized); and (3) in response to a subpoena, a discovery request, or other lawful process, once we have met all administrative requirements of the HIPAA Privacy Rule. For example, we may disclose your PHI in response to a subpoena for such information, but only after we first meet certain conditions required by the HIPAA Privacy Rule.

Under certain conditions, we also may disclose your PHI to law enforcement officials. For example, some of the reasons for such a disclosure may include, but not be limited to: (1) it is required by law or some other legal process; (2) it is necessary to locate or identify a suspect, fugitive, material witness, or missing person; and (3) it is necessary to provide evidence of a crime that occurred on our premises.

We may disclose PHI to a coroner or medical examiner for purposes of identifying a deceased person, determining a cause of death, or for the coroner or medical examiner to perform other duties authorized by law. We also may disclose, as authorized by law, information to funeral directors so that they may carry out their duties. Further, we may disclose PHI to organizations that handle organ, eye, or tissue donation and transplantation.

We may disclose your PHI to researchers when an institutional review board or privacy board has: (1) reviewed the research proposal and established protocols to ensure the privacy of the information; and (2) approved the research.

Consistent with applicable federal and state laws, we may disclose your PHI if we believe that the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We also may disclose PHI if it is necessary for law enforcement authorities to identify or apprehend an individual.

Under certain conditions, we may disclose your PHI if you are, or were, Armed Forces personnel for activities deemed necessary by appropriate military command authorities. If you are a member of foreign military service, we may disclose, in certain circumstances, your information to the foreign military authority. We also may disclose your PHI to authorized federal officials for conducting national security and intelligence activities, and for the protection of the President, other authorized persons, or heads of state.

If you are an inmate of a correctional institution, we may disclose your PHI to the correctional institution or to a law enforcement official for: (1) the institution to provide health care to you; (2) your health and safety and the health and safety of others; or (3) the safety and security of the correctional institution.

We may disclose your PHI to comply with Workers' Compensation laws and other similar programs that provide benefits for work-related injuries or illnesses.

Using our best judgment, we may make your PHI known to a family member, other relative, close personal friend or other personal representative that you identify. Such a use will be based on how involved the person is in your care, or payment that relates to your care. We may release information to parents or guardians, if allowed by law.

We also may disclose your information to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status, and location.

If you are not present or able to agree to these disclosures of your PHI, then, using our professional judgment, we may determine whether the disclosure is in your best interest.

We are required to disclose your PHI to the Secretary of the U.S. Department of Health and Human Services when the Secretary is investigating or determining our compliance with the HIPAA Privacy Rule.

We are required to disclose to you most of your PHI in a "designated record set" when you request access to this information. Generally, a "designated record set" contains medical and billing records, as well as other records that are used to make decisions about your health care benefits. We also are required to provide, upon your request, an accounting of most disclosures of your PHI that are for reasons other than treatment, payment, and health care operations and are not disclosed through a signed authorization.

We will disclose your PHI to an individual who has been designated by you as your personal representative and who has qualified for such designation in accordance with relevant Texas law. However, before we will disclose PHI to such a person, you must submit a written notice of his/her designation, along with the documentation that supports his/her qualification (such as a power of attorney).

Even if you designate a personal representative, the HIPAA Privacy Rule permits us to elect not to treat the person as your personal representative if we have a reasonable belief that: (1) you have been, or may be, subjected to domestic violence, abuse, or neglect by such person; (2) treating such person as your personal representative could endanger you; or (3) we determine, in the exercise of our professional judgment, that it is not in your best interest to treat the person as your personal representative.

We are not required to agree to a restriction that you may request. If we believe it is in your best interest to permit use and disclosure of your protected health information, your protected health information will not be restricted. If we agree to the requested restriction, we may not use or disclose your protected health information in violation of that restriction unless it is needed to provide emergency treatment. With this in mind, please discuss any restriction you wish to request with your health care provider. You may request a restriction by completing a "Restriction of use and Disclosures Request Form," which you may obtain from our Contact Person designated in this Notice.

Under federal law, however, you may not inspect or copy the following records: psychotherapy notes; information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding; and protected health information that is subject to any law that prohibits access to protected health information. Depending on the circumstances, a decision to deny access may be reviewable. Please contact our Contact Person designated in this Notice if you have questions about access to your medical record.