Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED BY FOX REHABILITATION SERVICES, P.C. AND EACH OF ITS  WHOLLY OWNED SUBSIDIARIES (collectively, “FOX”) AND HOW YOU CAN GET  ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

We are required by law to maintain the privacy of your Protected Health Information (“PHI”). PHI is personal information about you, including demographic information that we collect from you, that may be used to identify you and relates to your past, present or future physical or mental health or condition, including treatment and payment for the provision of healthcare.

This Notice explains our legal duties and privacy practice with regard to your PHI. We are required by federal law to provide you with a copy of this Notice and to abide by the terms of this Notice. Accordingly, we will ask you to sign a statement acknowledging that we have provided you with a copy of the Notice. If you have elected to receive a copy electronically, you still have the right to obtain a paper copy upon request.

We reserve the right to change the terms of this Notice at any time. The change may be retroactive and cover PHI that we received or created prior to the revision. If we do change the Notice, a copy of the new Notice will be in Fox Corporate Headquarters and on our website, if any. We will provide you with a copy of the revised Notice upon your request. If you are a student, your educational records governed by the Family Educational Rights and Privacy Act (FERPA) are not covered by this Notice of Privacy Practices.

I. PATIENT RIGHTS

You have the following rights as a patient of Fox with respect to your PHI:

1. The right to consider and sign an authorization for a non-authorized use. The law only allows us to use or disclose your PHI in certain circumstances, as explained more fully below. If we need to make a use or disclosure that does not fall into one of those exceptions, including the use or disclosure of psychotherapy notes, the use or disclosure of PHI for marketing purposes, and certain disclosures that constitute of “sale of PHI” – we will ask you to sign an authorization. If we do not have a valid authorization on file specifically authorizing the proposed use or disclosure, then we will not make that use or disclosure. You may revoke an authorization at any time in writing, but the revocation will not apply to uses or disclosures we have already made in reliance on your original authorization.

2. The right to access your PHI. You have a right to access and receive a copy, summary or explanation of your PHI. If you want to exercise this right, please ask one of our employees for a Request to Access Medical Records form. You will need to complete this and submit it to us. This right does not extend to psychotherapy notes, information compiled in reasonable anticipation of legal action and confidential information relating to certain lab tests. We have the right to deny you access, but you will be notified of the reason for denial and be given the right to have the denial reviewed under certain circumstances. If your PHI is maintained in an electronic form (e.g., in an electronic medical record), you have the right to request an electronic copy of your record be given to you or transmitted to another individual or entity. We may charge you a reasonable, cost-based fee for the labor associated with transmitting the electronic medical record.

3. The right to request restrictions on certain uses and disclosures. You may request restrictions of uses or disclosures of your PHI when it is used to carry out your treatment, obtain payment for your treatment, or perform healthcare operations of our practice. You must request the restriction before we have used or disclosed the relevant information. We are not required to agree to the restriction, and we have the right to decide not to accept the restriction and not to treat you.

4. Out of Pocket Payments. If you pay out-of-pocket in full for an item or service, you have the right to ask that your PHI with respect to that item or service not be disclosed to a health plan for purposes of payment or health care operations, and we will honor that request.

5. The right to receive confidential communications. You may request that we make confidential communications to you by an alternative means or at an alternative location. The request must be in writing, but we will not ask for an explanation from you. We will accommodate reasonable requests, but we may condition the accommodation on information as to how payment, if any, will be handled and specification of an alternative address or other method of contact.

6. The right to amend PHI. You have the right to ask us to amend your PHI. If you want to exercise this right, please ask one of our employees for a Request for Amendment of Medical Records form. You will need to complete this form, provide a reason for the request and submit it to us. We have the right deny your request for amendment, if we determine that your record was not created by us, is not maintained by us, would not be available for access, or is accurate and complete. Your records will not be changed or deleted as a result of our granting your request, but the amendment will be attached to your record and its existence noted in your record as necessary. (Note: use of this procedure is not necessary for routine changes to your demographic information, such as address, phone number, etc.)

7. The right to receive an accounting. You have the right to receive an accounting of our uses and disclosures of your PHI. If you want to exercise this right, please ask one of our employees for a Request for Accounting form. You will need to complete this form and submit it to us. The accounting does not have to list disclosures made (i) to carry out treatment, payment and healthcare operations (unless such disclosures were made through an electronic medical record, in which case you have a right to request an accounting of those disclosure made during the 3 years before your request); (ii) to you; (iii) pursuant to an authorization; (iv) for national security or intelligence purposes; (v) to correctional institutions or law enforcement personnel or (vi) that occurred prior to April 14, 2003. (Note: compliance with this right is time-consuming, and so we reserve the right to charge you a fee if you request more than one accounting in a twelve-month period.)

8. Right to Notice of Security Breach. We are required to notify you by first class mail or by e-mail (if you have indicated a preference to receive notice by e-mail) of any breach of your unsecured PHI as soon as reasonably practicable but in any event within 60 days of discovering the breach.

II. USES AND DISCLOSURES

We intend to limit the disclosure of your PHI to that necessary for Treatment, Payment and Operations:

• Treatment refers to specific sharing and use of your PHI relating to your direct care by our employees, including consulting other professionals and the use of disease management programs. For example, we will disclose your PHI to another health care professional or a testing facility to whom you have been referred for care or for assistance with treatment.
• Payment refers to specific sharing and use of your PHI for purposes of obtaining payment for our treatment of you, including billing and collection activities, related data processing and disclosure to consumer reporting agencies. For example, your PHI will be disclosed on forms we submit to your insurance plan for us to receive payment.
• Operations refer to specific sharing and use of your PHI necessary for our administrative and technical operations, within the limitations imposed by professional ethics. Permissible activities would include, but are not limited to, quality assessment, employee review, student training and other business activities. For example, we might need to disclose your PHI to a medical student as part of the educational process.

We may use or disclose your PHI for the following purposes in limited circumstances:

• In an Incidental Disclosure. We may disclose your PHI as a byproduct of another use or disclosure. For example, if an employee of the practice is talking to you, another employee may inadvertently overhear the conversation.
• To Comply With the Law.
• For Public Health Activities such as reporting disease outbreaks and other public health reporting.
• For Reporting Victims of Abuse, Neglect or Domestic Violence to government authorities, including a social service or protective service agency.
• For Health Oversight Activities such as audits by government agencies that oversee the services provided by the practice.
• For Judicial or Administrative Proceedings such as in response to a court order, search warrant or subpoena.
• For Law Enforcement Purposes such as providing limited information to locate a missing person.
• For Research Purposes such as research related to the prevention of disease or disability, if the study meets all privacy law requirements.
• To Provide Information Regarding Decedents. We may disclose information to a coroner, medical examiner or funeral director as necessary to carry out their duties.
• For Organ Procurement Purposes. We may use or disclose information for procurement, banking or transplantation of organs, eyes or tissue.
• To Avoid a Serious Threat to Health or Safety by, for example, disclosing your PHI to a police officer if we reasonably believe it is necessary to prevent a serious threat to your safety.
• For Specialized Government Functions such as military and veteran activities, national security and intelligence activities.
• For Workers Compensation including disclosures required by state workers compensation laws of job-related injuries.
• To Disaster Relief Agencies. We may disclose your PHI to disaster relief agencies, such as the Red Cross.

III. ORGANIZATIONAL POLICIES

To facilitate the smooth and efficient operation of our practice, we engage in certain practices and policies that you should understand. You can avoid any of the following practices by discussing your concerns with us and working out an alternative:

• We contact our patients by telephone (including leaving a message on an answering machine or voice mail) or mail to provide appointment reminders or routine test results.
• Our staff will conduct routine discussions with patients.
• We may contact our patients by telephone or mail to provide information about treatment alternatives or other health-elated benefits and services that may be of interest.
• We may use your name and address to send you a newsletter about our practice and the services we offer.
• We may disclose your PHI to a member of your family or a close friend that relates directly to that person’s involvement in your healthcare.

You should also be aware of the following policies regarding our uses and disclosures of your PHI. You cannot avoid these uses and disclosures, but you should discuss any questions or concerns you might have with us:

• We share PHI with third-party “business associates” that perform various functions for us (for example, billing and transcription), but we have written contracts with those entities containing terms that require the protection of your PHI.
• We will disclose your PHI to your personal representative(s), if any, unless we determine in the exercise of our professional judgment that such disclosure should not be made.
• Maryland patients: Effective January 1, 2024, FOX will participate in CRISP, the designated Health Information Exchange (HIE). For more information or to opt-out visit https://www.crisphealth.org/for-patients/#your-rights.

IV. QUESTIONS AND COMPLAINTS

If you have any questions about this Notice, the matters discussed herein or anything else related to our privacy policy, please feel free to ask for an appointment with our Privacy and Security Officer.

You may complain to the United States Secretary of Health and Human Services or us if you believe your privacy rights have been violated. To complain to the Secretary, your complaint must be in writing, name us, describe the acts or omissions believed to be in violation of your privacy rights and be filed within 180 days of when you knew or should have known that the act or omission occurred.

You can file a complaint with us by asking for a Complaint Reporting Form. We will not retaliate against you for filing a complaint. If you want further information about the complaint process, please talk to our Privacy and Security Officer. You may contact our Privacy and Security Officer at 856.705.1264. 7 Carnegie Plaza Cherry Hill, NJ 08003.