HIPAA Notice of Privacy Practices

This notice applies to Guardian Sports Medicine & Family Health and our workforce when providing care and handling information on the practice’s behalf. Protected health information is information that identifies you and relates to your health, care, or payment for care. It includes paper and electronic records, conversations, portal messages, clinical photographs, and ultrasound and other diagnostic images.

For information about browsing this public website, see our Privacy Policy. For questions about this notice or help exercising any of the rights below, contact our Privacy Officer.

Call or write to our Privacy Officer, or ask our front desk, to start a request. We will explain the process, help with any needed form, and verify your identity and any representative’s authority. You do not need to use the patient portal to exercise your rights.

See or obtain a copy of your records

You may inspect or request an electronic or paper copy of the medical, billing, and other records used to make decisions about you. Ask for the format you need; we will provide it if readily producible or agree on another usable format with you. We act on access requests within 30 days. If an extension is permitted and needed, we will explain the reason and completion date in writing; only one extension of up to 30 days is allowed. We may charge only a reasonable, legally permitted, cost-based copying fee. An unpaid care balance is not a reason to withhold access. If a legal exception limits access, we will explain the reason and any review rights in writing.

Ask for a correction

You may ask us to amend information you believe is incorrect or incomplete. Tell us what needs correction and why. We respond within 60 days, with one extension of up to 30 days if we notify you in writing of the reason and expected date. Accepted amendments are linked to the original record, and we make reasonable efforts to notify people who need the correction. If we deny a request, we explain why in writing and how to submit a statement of disagreement to be included with the disputed information.

Request private communications

You may ask us to contact you at a different address or telephone number, or by a specific method. We accommodate reasonable requests. Tell us how to reach you safely; you do not need to explain why you are making this request.

Ask us to limit use or disclosure

You may request restrictions on information used or shared for treatment, payment, or healthcare operations. We consider each request but generally do not have to agree. If we agree, we follow the restriction except as permitted by law, including when the information is needed for emergency treatment. You may also tell us not to share information with a particular family member or other person involved in your care; we record and honor those choices.

If you pay for an item or service in full out of pocket and ask us not to disclose information about it to your health plan for payment or healthcare operations, we must agree unless disclosure is required by law. Let us know before we submit a claim so we can arrange this restriction.

Receive a list of certain disclosures

You may request an accounting of disclosures for a period of up to six years before your request, including who received the information, when, and why. The accounting excludes disclosures for treatment, payment, and healthcare operations, disclosures to you or made with your authorization, and other legal exceptions. We respond within 60 days, with one 30-day extension if we provide written notice explaining the delay and expected date. The first accounting in a 12-month period is free. We tell you in advance about any permitted fee for an additional request and let you change or withdraw it.

Have an authorized representative act for you

A person legally authorized to act for you, such as a healthcare agent or guardian, may exercise rights within that authority. We verify the authority first. Special rules may apply to minors and when abuse, neglect, or endangerment is a concern.

Obtain this notice and raise concerns

You may request a paper copy of this notice at any time, even if you previously agreed to an electronic copy. You may also file a complaint with us or with the U.S. Department of Health and Human Services without retaliation. See contact and complaint options below.

Tell us who you want involved in your care and what we may share. With your agreement, an opportunity for you to object, or circumstances that reasonably show you do not object, we may share information directly relevant to a family member’s, friend’s, or caregiver’s involvement in your care or payment. Being present at a visit does not automatically authorize access to your records.

If you are unavailable or unable to make a choice, we may use professional judgment to share relevant information in your best interest. We may also share limited information for disaster relief and notification of people responsible for your care as permitted by law. Tell us about any limits you want us to honor.

Use our patient portal for secure medical messages, or call to arrange another approved method. If you request unencrypted email or text, we discuss the risks and document your choice before using it where permitted. Do not use portal messages or email for emergencies; call 911.

HIPAA generally permits the following uses and disclosures without written authorization. Additional protections described in Records with additional protections may limit them. We apply those protections whenever required.

• Treatment. We use and share information to provide and coordinate your care. For example, we may send an imaging report to a specialist treating your injury, or send a prescription to your pharmacy.
• Payment. We use and share information to obtain payment for services. For example, we may send your insurer the diagnosis and services needed to process a claim, subject to any applicable paid-in-full restriction.
• Healthcare operations. We use and share information to operate our practice and improve care. For example, we may review records to evaluate care quality or coordinate services. We may contact you about appointments, treatment alternatives, or health-related services.
• Service providers. Vendors helping with functions such as billing, records systems, and secure patient communications receive information needed for their work under business associate agreements when required.

Other disclosures allowed or required by law

We may use or disclose information for the purposes below only when the applicable legal conditions are met. A request alone does not give someone a right to your records.

• Public health and safety: reporting disease, adverse medication reactions, or product problems; assisting with recalls; reporting suspected abuse, neglect, or domestic violence; and preventing or lessening a serious and imminent threat to health or safety.
• Health oversight and legal requirements: audits, inspections, licensing activities, and disclosures required by law, including to HHS to assess our compliance.
• Legal proceedings and law enforcement: responding to qualifying court or administrative orders, subpoenas, or law enforcement requests after the applicable legal requirements are satisfied. Part 2 records have additional limits described below.
• Workers’ compensation and government functions: disclosures authorized by workers’ compensation law, or for legally authorized military, national security, protective services, or correctional health and safety purposes.
• Research: when an approved waiver or another applicable legal basis permits research without individual authorization; otherwise, we obtain the required authorization.
• Organ donation and deceased individuals: information needed by organ procurement organizations, coroners, medical examiners, or funeral directors to perform authorized duties.

Uses and disclosures not described in this notice require your written authorization. Authorization is also required for marketing that requires permission under HIPAA, sale of protected health information, and most uses or disclosures of separately maintained psychotherapy notes.

Under our practice policy, disclosures to employers, schools, teams, coaches, and athletic trainers require specific written authorization unless disclosure is required by law or necessary under a legally permitted emergency exception. An athletic trainer’s placement at a school is not your authorization. We do not confirm an athlete’s patient status or provide injury updates to the media without authorization.

We obtain consent before clinical photography. Use of patient photographs, recordings, or diagnostic images for education, publication, marketing, or social media requires a separate, specific written authorization. Declining photography does not affect your care.

You may revoke an authorization at any time by writing to our Privacy Officer. Revocation applies going forward; it cannot undo actions already taken in reliance on your authorization. We do not condition treatment on authorization except in the limited cases the law allows. Information lawfully disclosed to a recipient may be shared again and may no longer be protected by HIPAA, although other laws, including Part 2 where applicable, may still protect it.

Substance use disorder records

Some records from federally assisted substance use disorder programs are protected by 42 CFR Part 2. If we receive or maintain these records, we follow Part 2’s additional consent and disclosure requirements. Where Part 2 permits your consent to cover future treatment, payment, and healthcare operations, we may use and redisclose records received under that consent as HIPAA permits, subject to Part 2’s continuing restrictions. Other uses require the applicable consent or a specific legal exception.

Part 2 records, and testimony describing their contents, cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your specific written consent or a qualifying court order. Before such an order is issued, you or the record holder must receive notice and an opportunity to be heard as Part 2 requires. The order must also be accompanied by a subpoena or another legal mandate compelling disclosure. A general consent for treatment, payment, or operations does not authorize these uses. For example, we cannot release Part 2 treatment records for a prosecution against you based only on an ordinary records request or subpoena.

If we use Part 2 records for fundraising, we will first provide a clear opportunity to choose not to receive those communications. You may opt out of any fundraising communications without affecting your treatment or payment for care.

Minors and other sensitive information

Parents or guardians ordinarily act for a minor, but applicable law may protect information about care a minor can consent to independently or receives under a confidential arrangement. We verify who may receive the information and apply those limits to records and portal access. We explain confidentiality limits, including mandatory reporting and information that may appear on an insurance statement.

Mental health, reproductive and sexual health, HIV and other infection-related information, genetic information, and records concerning abuse or confidential adolescent services may have additional protections under applicable federal or Utah law. When a law requires more protection than HIPAA, we follow it and obtain any additional permission it requires before disclosure. Separately maintained psychotherapy notes generally require a separate authorization, subject to limited legal exceptions.

We are legally required to protect the privacy of your protected health information, provide this notice of our duties and practices, and follow the notice currently in effect. We maintain administrative, physical, and technical safeguards and limit workforce access to job-related needs. Where the minimum-necessary rule applies, we limit uses, requests, and disclosures to the information needed for their purpose.

We must notify you following a breach of your unsecured protected health information as required by law. Required individual notice is provided without unreasonable delay and no later than 60 days after discovery, except for delays the law permits.

To ask a question, exercise a right, or file a complaint, call or write to our Privacy Officer using the details below. Tell us what happened and how we can contact you safely. We can help you submit the details securely. You do not have to complain to us before contacting HHS.

You may also complain to the Secretary of the U.S. Department of Health and Human Services through its Office for Civil Rights. Visit HHS privacy complaint instructions to file online or obtain a complaint form, call 1-877-696-6775, or write to: Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, DC 20201.

We will not retaliate against you for filing a complaint or exercising your privacy rights. Your care will not be affected.

We provide this notice no later than your first service and ask you to acknowledge receipt. Acknowledgment is not consent to a disclosure, and declining to sign does not prevent treatment. Anyone may request a copy at any time. Ask our office for a paper copy, help understanding the notice, or language assistance.

We may change this notice and apply the revised terms to all protected health information we maintain, including information received before the revision. We will post the updated notice with its effective date in our office and on this page, make copies available on request, and provide a materially revised notice at your next visit.