Who this notice covers
This notice describes the privacy practices of Dr. Muneer Ali, and the practice operated by Dr. Ali (referred to in this notice as "the practice," "we," "us," or "our"). We are required by law to maintain the privacy of your protected health information, to give you this notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect.
Protected health information, referred to in this notice as PHI, means information that identifies you and that relates to your past, present, or future physical or mental health, the health care you receive, or payment for that care.
How we may use and disclose your health information
Treatment
We may use your PHI to provide, coordinate, or manage your care. We may disclose it to other health care providers involved in your care, such as your primary care physician, pediatrician, therapist, or a specialist to whom we refer you. For example, with your knowledge we may send a summary of our findings and recommendations to your pediatrician, or contact a pharmacy to issue a prescription.
Payment
This is a private-pay practice and we do not bill insurance. We may use and disclose your PHI to obtain payment for services, including processing your payment method and, at your request, preparing a superbill that you may submit to your insurer for out-of-network reimbursement. If you ask us to prepare a superbill, the information on it will be disclosed to your insurer by you.
Health care operations
We may use and disclose your PHI for the operation of the practice, such as quality assessment, reviewing the competence of clinicians, business planning, and administrative activities.
Business associates
We use outside vendors to help operate the practice, including our electronic health record, secure messaging and email, telehealth platform, laboratory partners, and billing and payment services. These vendors may receive PHI in order to perform their functions. We require each of them to sign a business associate agreement obligating them to protect your information.
Appointment reminders and practice communications
We may contact you to remind you of appointments, to follow up on care, or to tell you about treatment alternatives or health-related services that may be of interest to you. You may ask us to limit how we contact you for these purposes.
Uses and disclosures that do not require your authorization
Federal and state law permit or require us to use or disclose your PHI without your authorization in certain circumstances, including:
- When required by law. When federal, state, or local law requires the use or disclosure.
- Public health activities. To public health authorities for purposes such as preventing or controlling disease, or reporting adverse events related to medications or products.
- Suspected abuse or neglect. To report suspected child abuse or neglect, elder abuse, or abuse of a vulnerable adult, as required by the law of the state in which you are located. As a child and adolescent psychiatrist, Dr. Ali is a mandated reporter in every state in which he practices.
- Health oversight activities. To agencies that oversee the health care system, such as licensing boards, for audits, investigations, and inspections.
- Judicial and administrative proceedings. In response to a court order, subpoena, or other lawful process, subject to the protections that apply to mental health records.
- Law enforcement. In limited circumstances defined by law, such as responding to a court order or identifying a suspect or missing person.
- To avert a serious threat to health or safety. When we believe in good faith that disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety or to the health or safety of another person, and the disclosure is to someone able to prevent or lessen the threat.
- Coroners, medical examiners, and funeral directors. As necessary for them to carry out their duties.
- Workers' compensation. As authorized by workers' compensation laws.
- Specialized government functions. Including military and veterans activities, national security, and protective services.
- Research. Where an institutional review board or privacy board has approved a waiver of authorization, or where the information has been de-identified.
Uses and disclosures that require your written authorization
Other uses and disclosures of your PHI will be made only with your written authorization. This includes, and is not limited to:
- Psychotherapy notes. Most uses and disclosures of psychotherapy notes require your written authorization.
- Marketing. Uses and disclosures of PHI for marketing purposes.
- Sale of information. Any disclosure that constitutes a sale of your PHI.
You may revoke an authorization in writing at any time. Revocation will not affect any use or disclosure we already made in reliance on it.
Your rights regarding your health information
Right to inspect and copy
You have the right to inspect and obtain a copy of your medical and billing records, with limited exceptions. You may request an electronic copy if we maintain the record electronically. We may charge a reasonable, cost-based fee. Requests should be made in writing to the Privacy Officer named below. We will respond within thirty days, and may extend that period once by thirty days with written notice to you.
Right to request an amendment
If you believe information in your record is incorrect or incomplete, you may ask us in writing to amend it. We may deny your request in certain circumstances, and if we do, we will explain why in writing and tell you how to submit a statement of disagreement to be included in your record.
Right to an accounting of disclosures
You have the right to request a list of certain disclosures we have made of your PHI, other than disclosures for treatment, payment, health care operations, and several other categories defined by law. The accounting may cover up to six years prior to the date of your request.
Right to request restrictions
You may ask us to restrict how we use or disclose your PHI for treatment, payment, or health care operations, or to a family member or friend involved in your care. We are not required to agree to every requested restriction, but if we agree we will honor it unless the information is needed to provide you emergency treatment.
Right to request confidential communications
You may ask us to communicate with you in a specific way or at a specific location, for example only by a particular phone number or email address. We will accommodate reasonable requests and will not ask you to explain the reason.
Right to a paper copy of this notice
You have the right to a paper copy of this notice at any time, even if you agreed to receive it electronically. Ask us and we will provide one.
Right to be notified of a breach
You have the right to be notified if we discover a breach of your unsecured PHI.
Right to choose someone to act for you
If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will verify that the person has this authority before we act.
Minors and parental access
When a patient is a minor, a parent or legal guardian generally has the right to access the minor's health information and to exercise the rights described in this notice on the minor's behalf. There are exceptions. State law in Georgia, Tennessee, and Florida gives minors the right to consent to certain kinds of care on their own, and where a minor lawfully consents to care, the minor may control the information about that care. We may also decline to disclose information to a parent where we reasonably believe that doing so would place the minor at risk of harm, or where a court has directed otherwise.
In addition, effective psychiatric care for adolescents depends on a degree of confidentiality. At the start of care we will discuss with families how information will be shared, what will be kept confidential, and the circumstances under which we will always inform a parent, including risk of harm to the patient or to others.
The rules on when a minor may consent to outpatient mental health care without a parent differ by state. In the states where we practice:
- Georgia has no general minor consent provision for outpatient mental health treatment. A parent or legal guardian must consent for any patient under 18. Narrow statutory exceptions exist, including for a minor who is emancipated, is married, is a parent, or is seeking treatment for substance abuse.
- Tennessee provides, under Tenn. Code Ann. § 33-8-202, that a child 16 years of age or older with a serious emotional disturbance or mental illness has the same rights as an adult with respect to outpatient mental health treatment, and that an outpatient professional may provide treatment without the consent of a parent, legal guardian, or legal custodian.
- Florida provides, under Fla. Stat. § 394.4784, that a minor 13 years of age or older may access outpatient crisis intervention and diagnostic services without parental consent, limited to two visits in any one-week period. That authority expressly excludes medication and other somatic treatments.
Where a minor lawfully consents to care under these provisions, the minor generally controls the health information about that care, and a parent's right of access may be limited accordingly.
Telehealth
Care in this practice is provided by telehealth. We use platforms that support encrypted video and messaging and that have signed business associate agreements with us. No electronic transmission is entirely without risk. We ask that you take part in visits from a private location where you will not be overheard, and we will do the same. If a connection fails during a visit, we will attempt to reach you by telephone.
Laboratory testing
If you complete biomarker testing through the practice, your specimen and identifying information are shared with the laboratory performing the analysis, and results are returned to the practice. Laboratories that receive your information are required to protect it under their own legal obligations and under our agreements with them.
Our obligations
We are required by law to maintain the privacy of your PHI, to give you notice of our legal duties and privacy practices, to follow the terms of the notice currently in effect, and to notify you if a breach occurs that may have compromised the privacy or security of your information.
We reserve the right to change this notice, and to make the revised notice effective for information we already hold as well as information we receive in the future. If we make a material change, we will post the revised notice on our website and make paper copies available on request.
How to raise a concern
If you believe your privacy rights have been violated, you may file a complaint with the practice using the contact information below, or with the Secretary of the U.S. Department of Health and Human Services. You will not be penalized, and your care will not be affected, for filing a complaint.
To file with the federal government, write to the Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, D.C. 20201, call 1-877-696-6775, or visit hhs.gov/ocr/privacy/hipaa/complaints.
Contact
To exercise any of the rights described in this notice, to ask a question, or to make a complaint, contact our Privacy Officer:
Requests to inspect, copy, amend, or restrict your information should be made in writing.