Our commitment to transparency and your rights
Effective Date: June 9, 2025
Updated: June 9, 2025
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Careway Health, Inc. in association with Careway Health Medical PA and Careway Health Medical West PC ("Careway Health", "us," "we," "our," or the "Company") and its employees are dedicated to maintaining the privacy of your personal health information ("PHI"), as required by applicable federal and state laws. These laws require us to provide you with this Notice of Privacy Practices, and to inform you of your rights and our obligations concerning Protected Health Information, or PHI, which is information that identifies you and that relates to your physical or mental health condition. We are required to follow the privacy practices described below while this Notice is in effect.
We may disclose your PHI for the following reasons.
We may disclose your PHI to a physician or other healthcare provider providing or coordinating treatment you receive. For example, we may disclose medical information about you to physicians, nurses, pharmacists, technicians or personnel who are involved with the administration of your care. We may also disclose your PHI with other third parties, such as hospitals, other pharmacies and other health care facilities and agencies to facilitate the provision of health care services, medications, equipment and supplies you may need. This helps to coordinate your care and make sure that everyone who is involved in your care has the information that they need about you to meet your health care needs.
We may disclose your PHI to bill and collect payment for the services we provide to you and for other payment activities related to the services that we provide. For example, we may contact your insurer, pharmacy benefit manager or other health care payor to determine whether it will pay for health care products and services you need and to determine the amount of your co-payment. We will bill you or a third-party payor for the cost of health care products and services we provide to you. The information on or accompanying the bill may include information that identifies you, as well as information about the services that were provided to you or the medications you are taking. We may also disclose your PHI to other health care providers or HIPAA covered entities who may need it for their payment activities.
We may disclose your PHI in connection with our healthcare operations. Healthcare operations include quality assessment activities, reviewing the competence or qualifications of healthcare professionals, evaluating provider performance, and other business operations. For example, we may use your PHI to evaluate the performance of the healthcare services you received. We may also provide your PHI to accountants, attorneys, consultants and others to make sure we comply with the laws that govern us. We may also disclose your PHI to other HIPAA covered entities that have provided services to you so that they can improve the quality and effectiveness of the health care services that they provide. We may use your PHI to create de-identified data, which is stripped of your identifiable data and no longer identifies you.
We may contract with third parties to perform certain services for us, such as billing services, copy services or consulting services. These third party service providers, referred to as Business Associates, may need to access your PHI to perform services for us. They are required by contract and law to protect your PHI and only use and disclose it as necessary to perform their services for us.
We may disclose your PHI if you require emergency treatment or are unable to communicate with us.
We may disclose your PHI to a family member, friend or any other person who you identify as being involved with your care or payment for care, unless you object. Additionally, we may disclose PHI to your "personal representative." If a person has the authority by law to make health care decisions for you, we will generally regard that person as your "personal representative" and treat him or her the same way we would treat you with respect to your PHI.
We may disclose your PHI for law enforcement purposes and as required by federal, state, or local law. For example, the law may require us to report instances of abuse, neglect or domestic violence; to report certain injuries such as gunshot wounds; or to disclose PHI to assist law enforcement in locating a suspect, fugitive, material witness or missing person. We will inform you or your representative if we disclose your PHI because we believe you are a victim of abuse, neglect or domestic violence, unless we determine that informing you or your representative would place you at risk. In addition, we must provide PHI to comply with an order in a legal or administrative proceeding. Finally, we may be required to provide PHI in response to a subpoena discovery request or other lawful process, but only if efforts have been made, by us or the requesting party, to contact you about the request or to obtain an order to protect the requested PHI.
We may disclose your PHI if we believe it is necessary to avoid a serious threat to the health and safety of you or the public.
We may disclose your PHI to public health or other authorities charged with preventing or controlling disease, injury or disability, or charged with collecting public health data, including the FDA. In certain circumstances, we may also report work-related illnesses and injuries to employers for workplace safety purposes.
We may disclose your PHI to a health oversight agency for activities authorized by law. These activities include audits; civil, administrative or criminal investigations or proceedings; inspections; licensure or disciplinary actions; or other activities necessary for oversight of the health care system, government programs and compliance with civil rights laws.
We may disclose your PHI for certain research purposes, but only if we have protections and protocols in place to ensure the privacy of your PHI.
We may release your PHI to coroners or medical examiners so that they can carry out their duties. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also disclose PHI to funeral directors consistent with applicable law to enable them to carry out their duties.
Consistent with applicable law, we may disclose your PHI to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs for the purpose of tissue donation and transplant.
We may use or disclose your PHI to notify or assist in notifying a family member, personal representative, or another person responsible for your care, regarding your location and general condition.
We may use and disclose your PHI to organizations for purposes of disaster relief efforts.
If you are or become an inmate of a correctional institution, we may disclose to the institution, or its agents, PHI necessary for your health and the health and safety of other individuals.
We may disclose your PHI to comply with laws relating to workers' compensation or other similar programs.
If you are active military or a veteran, we may disclose your PHI as required by military command authorities. We may also be required to disclose PHI to authorized federal officials for the conduct of intelligence or other national security activities.
Not Otherwise Permitted. In any other situation not described in Section A above, we may not disclose your PHI without your written authorization.
Marketing and Sale of PHI. We must receive your written authorization for any disclosure of PHI for marketing purposes or for any disclosure which is a sale of PHI.
You have the right to receive a paper copy of this Notice upon request.
You have the right to inspect and copy your PHI for as long as we maintain your medical record. You must make a written request for access to the Compliance Officer at the email address listed at the end of this Notice. We may charge you a reasonable fee for the processing of your request and the copying of your medical record pursuant to state law. In certain circumstances we may deny your request to access your PHI, and you may request that we reconsider our denial. Depending on the reason for the denial, another licensed health care professional chosen by us may review your request and the denial
You have the right to request a restriction on the use or disclosure of your PHI for the purpose of treatment, payment or health care operations, except for in the case of an emergency. You also have the right to request a restriction on the information we disclose to a family member or friend who is involved with your care or the payment of your care. However, we are not legally required to agree to such a restriction.
You have the right to restrict the disclosure of your PHI to a health plan if the PHI pertains to health care services for which you paid in full directly to us.
You have the right to request that we amend your PHI if you believe it is incorrect or incomplete, for as long as we maintain your medical record. We may deny your request to amend if (a) we did not create the PHI, (b) is not information that we maintain, (c) is not information that you are permitted to inspect or copy (such as psychotherapy notes), or (d) we determine that the PHI is accurate and complete.
You have the right to request an accounting of disclosures of PHI made by us (other than those made for treatment, payment or health care operations purposes) during the 6 years prior to the date of your request. You must make a written request for an accounting, specifying the time period for the accounting, to the Compliance Officer at the email address listed at the end of this Notice.
You have the right to request that we communicate with you about your PHI by certain means or at certain locations. For instance, you may request that we contact you at a different residence or post office box, or via e-mail or other electronic means. Please note if you choose to receive communications from us via e-mail or other electronic means, those may not be a secure means of communication and your PHI that may be contained in our e-mails to you will not be encrypted. This means that there is risk that your PHI in the e-mails may be intercepted and read by, or disclosed to, unauthorized third parties. You must make a written request, specifying how and where we may contact you, to the Compliance Officer at the email address listed at the end of this Notice.
You have a right to be notified following a breach of your unsecured PHI, and we will notify you in accordance with applicable law.
We reserve the right to change our practices and this notice and to make the new notice effective for all PHI we maintain. If we do so, the updated notice will be posted on our website. Upon request, we will provide any revised notice to you.
We will ask you to sign an acknowledgment that you received this Notice.
If you would like more information about our privacy practices or have questions or concerns, you may contact us via email help@careway.health or by calling us at (413) 438-2273. If you believe your privacy rights have been violated, you can file a complaint with us or with the Secretary of Health and Human Services. There will be no retaliation for filing a complaint.
This notice is effective as of June 9, 2025.