Original Date: 07/01/2005

Revised per HIPAA Omnibus Rule 06/21/2013

Revised Date Implementation: 9/23/2013


You are receiving health care at CRYSTAL LAKE CLINIC.

We are required by law to maintain the privacy of individually identifiable patient health information (this information is “protected health information” and is referred to herein as “PHI”). We are also required to provide patients with a Notice of Privacy Practices regarding PHI.    We will only use or disclose your PHI as permitted or required by applicable state law.  This Notice applies to your PHI in our possession including the medical records.

CRYSTAL LAKE CLINIC understands that your health information is highly personal, and we are committed to safeguarding your privacy. Please read this Notice of Privacy Practices thoroughly.  It describes how CRYSTAL LAKE CLINIC will use and disclose your PHI, and what your rights are under HIPAA.

A.     Permitted Use or Disclosure

1.  Treatment.

CRYSTAL LAKE CLINIC will use and disclose your PHI in the provision and coordination of health care to carry out treatment functions.

CRYSTAL LAKE CLINIC will disclose all or any minimally necessary portion of your patient medical record information to your attending physician, consulting physician(s), nurses, pharmacists, technicians, medical students, dieticians, and other health care providers who have a legitimate need for PHI in your care and continued treatment.

Different departments will share medical information about you in order to coordinate specific services, such as lab work, x-rays and prescriptions.

CRYSTAL LAKE CLINIC also will disclose PHI to people or entities outside CRYSTAL LAKE CLINIC who will be involved in your medical care after you leave CRYSTAL LAKE CLINIC such as other care providers and family who will provide services that are part of your care, to coordinate treatment.

CRYSTAL LAKE CLINIC will use and disclose your PHI to inform you of, or recommend possible treatment options or alternatives that will be of interest to you.

CRYSTAL LAKE CLINIC will use and disclose PHI to contact you as a reminder that you have an appointment for treatment or medical care at CRYSTAL LAKE CLINIC. With respect to a group health plan, CRYSTAL LAKE CLINIC may also disclose PHI to a health plan sponsor.

If you are an inmate of a correctional institution or under the custody of a law enforcement officer, CRYSTAL LAKE CLINIC will disclose your PHI to the correctional institution or law enforcement official.

2.  Payment.

CRYSTAL LAKE CLINIC will disclose PHI about you for the purposes of determining insurance coverage and eligibility, billing, claims management, medical data processing, stop loss/reinsurance and reimbursement.

The medical information will be disclosed to any insurance company, third party payer, third party administrator, health plan or other health care provider (or their duly authorized representatives) involved in the payment of your medical bill and will include copies or excerpts of your medical records which are necessary for payment of your account.  It will also include sharing the necessary information to obtain pre-approval for payment for treatment from your health plan.

The medical information may also be released to independent health care providers who were involved in your treatment (for example, Emergency Room physicians and Radiologists who are not employed by CRYSTAL LAKE CLINIC) or emergency delivery (via ambulance service) to CRYSTAL LAKE CLINIC so that they may seek payment for caring for you.

CRYSTAL LAKE CLINIC will disclose PHI to collection agencies and other subcontractors engaged in obtaining payment for care.

3.  Health Care Operations.

CRYSTAL LAKE CLINIC will use and disclose your PHI during routine health care operations including quality review, utilization review, medical review, internal auditing, accreditation, certification, licensing or credentialing activities of CRYSTAL LAKE CLINIC, and for educational purposes.

For instance, we will need to share your demographic information, diagnosis, treatment plan and health status for population based activities relating to improving health or reducing health care costs, protocol development, case management and care coordination.

4.  Medical Research.

Crystal Lake Clinic may disclose your PHI without your authorization to medical researchers who request it for approved medical research projects; however, with very limited exceptions such disclosures must be cleared through a special approval process before any PHI is disclosed to the researchers.  Researchers will be required to safeguard the PHI they receive.

5.  More Stringent State and Federal Laws.

The State law of Michigan is more stringent than HIPAA in several areas.  State law is more stringent when the individual is entitled to greater access to records than under HIPAA and when under state law the records are more protected from disclosure than under HIPAA.  Certain federal laws also are more stringent than HIPAA. CRYSTAL LAKE CLINIC continues to abide by these more stringent state and federal laws.

B.     Permitted Use or Disclosure with an Opportunity for You to Agree or Object

1.  Family/Friends.

CRYSTAL LAKE CLINIC may disclose PHI about you to a friend or family member who is involved in your medical care. We will also give information to someone who helps you pay for your care.  In addition, we will disclose PHI about you to an agency assisting in a disaster relief effort so that your family can be notified about your condition, status and location.  You have a right to request that your PHI not be shared with some or all of your family or friends.

2.  Promotional Communications.

CRYSTAL LAKE CLINIC will not share or sell your information to companies that sell health care products or services.

3.  Psychotherapy Notes.

CRYSTAL LAKE CLINIC must obtain your authorization for any use or disclosure of psychotherapy notes, except as permitted by policy or law.

4.  Other Uses.

Any uses or disclosures that are not for treatment, payment or operations and that are not required for public policy purposes or by law, and other uses and disclosures not described in this Notice will be made only with your written authorization.

5.  Revocation.

You have the right to revoke an authorization at any time, by putting your request in writing and submitting the request to Administration.

6.  Breach Notification.

CRYSTAL LAKE CLINIC will notify you if a breach of your unsecured protected health information occurs, if the information is shown to have been compromised.

C.     Use or Disclosure Permitted by Public Policy or Law without your Authorization

1.  Law Enforcement Purposes.

CRYSTAL LAKE CLINIC will disclose your PHI for law enforcement purposes as required by law, such as responding to a court order or subpoena, and may disclose information for purposes of identifying a criminal suspect or a missing person, or providing information about a crime victim or possible criminal conduct as part of a criminal investigation.

2.  Required by Law.

CRYSTAL LAKE CLINIC will disclose PHI about you when required by federal, state or local law to make reports or other disclosures.  CRYSTAL LAKE CLINIC also will make disclosures for judicial and administrative proceedings such as lawsuits or other disputes in response to a court order or subpoena.  CRYSTAL LAKE CLINIC will disclose your medical information to government agencies when required by law, such as reporting a dog bite to public health.  CRYSTAL LAKE CLINIC will report drug diversion and information related to fraudulent prescription activity to law enforcement and regulatory agencies.  Specialized government functions will warrant the use and disclosure of your health information.  These government functions will include military and veteran’s activities, national security and intelligence activities, and protective services for the President and others.  CRYSTAL LAKE CLINIC will make certain disclosures that are required in order to comply with workers’ compensation or similar programs.

3.  Coroners, Medical Examiners, Funeral Directors.

CRYSTAL LAKE CLINIC will disclose your information to a coroner or medical examiner.  For example, this will be necessary to identify a deceased person or to determine a cause of death.  We will also disclose your medical information to funeral directors as necessary to carry out their duties.

4.  Organ Procurement.

CRYSTAL LAKE CLINIC will disclose your information to an organ procurement organization or entity for organ, eye or tissue donation purposes when donation has been authorized or to verify that appropriate organ procurement procedures were followed.

5.  Health or Safety.

CRYSTAL LAKE CLINIC will use and disclose your information to avert a serious threat to health and safety of a person or the public.  CRYSTAL LAKE CLINIC will use and disclose PHI to Public Health Agencies for immunizations, communicable diseases, etc. CRYSTAL LAKE CLINIC will use and disclose PHI for activities related to the quality, safety or effectiveness of FDA-regulated products or activities, including collecting and reporting adverse events, tracking and facilitating product recalls, etc. and post marketing surveillance.  You may opt out of the opportunity to receive information about a medical device subject to FDA tracking requirements; i.e. you may decline to disclose, or refuse permission to disclose, your name, address, telephone number and social security number, or other identifying information for the purpose of tracking the FDA device.

D.     Your Health Information Rights

Although CRYSTAL LAKE CLINIC maintains all paper and electronic records concerning your   treatment, you have the following rights concerning your PHI:

1.  Right to Inspect and Copy.

You have the right to access your PHI and to inspect and have a paper or electronic copy made of your PHI as long as we maintain it, except for:  psychotherapy notes (those notes kept in a personal file by a therapist or physician and not part of the formal medical record), information that may be used in anticipation of, or that will be used in a civil, criminal or administrative action or proceeding and where prohibited or protected by law. CRYSTAL LAKE CLINIC will deny your request for access to your PHI without giving you an opportunity to review that decision if:

You don’t have the right to inspect the information; or it is otherwise prohibited or protected by law.

You are an inmate at a correctional institution and obtaining a copy of the information would risk the health, safety, security, custody or rehabilitation of you or other inmates.

The disclosure of the information would threaten the safety of any officer, employee or other person at the correctional institution or who is responsible for transporting you.

CRYSTAL LAKE CLINIC obtained the information that you seek access to from someone other than the health care provider under a promise of confidentiality and your access request is likely to reveal the source of the information.

Under other limited circumstances. In these instances, however, CRYSTAL LAKE CLINIC will allow the review of its decision by a health care professional that CRYSTAL LAKE CLINIC has chosen. This person will not have been involved in the original decision to deny your request.

CRYSTAL LAKE CLINIC may charge a reasonable copying charge.  You must make your requests to access and copy your PHI in writing to CRYSTAL LAKE CLINIC. CRYSTAL LAKE CLINIC will respond to your request within 30 days of its receipt.  If we cannot, we will notify you in writing to explain the delay and the date by which we will act on your request.  In any event, we will act on your request within 60 days of its receipt.

2.  Right to Amend.

You have the right to amend your PHI for as long as CRYSTAL LAKE CLINIC maintains it.  However, we will deny your request for amendment if:

CRYSTAL LAKE CLINIC did not create the information;

The information is not part of the designated record set;

The information would not be available for your inspection (due to its condition or nature); or

The information is accurate and complete.

If CRYSTAL LAKE CLINIC denies your request for changes in your PHI, we will notify you in writing with the reason for the denial.  We will also inform you of your right to submit a written statement disagreeing with the denial.  You may ask that we include your request for amendment and the denial any time that CRYSTAL LAKE CLINIC discloses the information that you wanted changed.  CRYSTAL LAKE CLINIC may prepare a rebuttal to your statement of disagreement and will provide you with a copy of that rebuttal.

You must make your request for amendment of your PHI in writing to CRYSTAL LAKE CLINIC, including your reason to support the requested amendment.  CRYSTAL LAKE CLINIC will respond to your request within 60 days of its receipt.  If we cannot, we will notify you in writing to explain the delay and the date by which we will act on your request.  In any event, we will act on your request within 90 days of its receipt.

3.  Right to an Accounting.

You have a right to receive an accounting of the disclosures of your PHI that CRYSTAL LAKE CLINIC made, except for the following disclosures:

To carry out treatment, payment or health care operations.

To you.

For national security or intelligence purposes.

To correctional institutions or law enforcement officials in custodial situations.

That occurred prior to April 14, 2003.

For each disclosure, you will receive: the date of the disclosure, the name of the receiving organization and address if known, a brief description of the PHI disclosed and a brief statement of the purpose of the disclosure or a copy of the written request for the information, if there was one.

You must make your request for an accounting of disclosures of your PHI in writing to CRYSTAL LAKE CLINIC Administration. You must include the time period of the accounting, which may not be longer than 6 years. We will respond to your request within 60 days from its receipt.  If we cannot, we will notify you in writing to explain the delay and the date by which we will act on your request.  In any event, we will act on your request within 90 days of its receipt.


4.  Right to Request Restrictions.

You have the right to request restrictions on certain uses and disclosures of your PHI:

To a health plan with respect to healthcare for which you have paid out of pocket in full, prior to service being initiated. The request must be in writing.

5.  Right to Confidential Communications.

You have the right to receive confidential communications of your PHI by alternative means or at alternative locations.  For example, you may request that we only contact you at work or by mail.

6.  Right to Receive a Copy of this Notice.

You have the right to receive a paper copy of this Notice of Privacy Practices, upon request.

E.     Complaints

If you believe your privacy rights have been violated, you may file a complaint with CRYSTAL LAKE CLINIC and /or with the Secretary of the Department of Health and Human Services, Office of Civil Rights. For more information, or to voice a privacy complaint for an incident at CRYSTAL LAKE CLINIC, please contact CRYSTAL LAKE CLINIC’s Privacy Officer Deborah Gatrell, at:

6227 Frankfort Hwy. (M-115)

Benzonia, MI  49616

(231) 882-9661 or (231) 882-1036

CRYSTAL LAKE CLINIC assures you that there will be no retaliation for filing a complaint.

Review of the Notice of Privacy Practices

The NPP was reviewed and updated in 2013, and is reviewed every 2 years. The most current version of the NPP is posted on CRYSTAL LAKE CLINIC’s internet site.