Notice of Privacy Practices

This is a model Notice of Privacy Practices for healthcare practices that deliver care using the OmniEHR platform. Your healthcare provider (the practice) is the covered entity responsible for the privacy of your health information and adopts this notice for its patients. NorCemic Inc. provides the OmniEHR platform as a Business Associate to those practices.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our duties

Your healthcare provider is required by law to maintain the privacy of your protected health information (PHI), to give you this notice of its legal duties and privacy practices, and to follow the terms of the notice currently in effect. Your provider is required to notify you following a breach of unsecured PHI.

How your information may be used and disclosed

• Treatment. Your information is used and shared to provide and coordinate your care, including with other clinicians involved in your treatment.
• Payment. Your information is used and shared to bill and obtain payment from you, an insurer, or another third party.
• Health care operations. Your information supports activities such as quality assessment, training, and administration.
• As required by law. Information is disclosed when required by federal, state, or local law.
• Public health and safety. Information may be shared to prevent a serious threat to health or safety, for public health activities, or to report abuse or neglect as the law allows.

Certain categories of information receive additional protection under federal and state law, including substance use disorder records (42 CFR Part 2) and, where applicable, mental health, reproductive health, and HIV-related information. These are disclosed only with your authorization or as specifically permitted by law.

Uses and disclosures that require your authorization

Most uses and disclosures of psychotherapy notes, uses for marketing, and any sale of your information require your written authorization. You may revoke an authorization in writing at any time, except to the extent your provider has already acted on it.

Your rights

• Access and copies. You may inspect and obtain a copy of your record, including an electronic copy of information held electronically.
• Amendment. You may ask your provider to correct information you believe is incorrect or incomplete.
• Accounting of disclosures. You may request a list of certain disclosures made of your information.
• Restrictions. You may ask your provider to limit how your information is used or shared. You have the right to restrict disclosure to a health plan for services you paid for in full out of pocket.
• Confidential communications. You may ask to be contacted a certain way or at a certain location.
• Paper copy. You may request a paper copy of this notice at any time.
• Choose someone to act for you. A parent, guardian, or person with legal authority may exercise these rights on your behalf, subject to applicable law and any limits on access to a minor's confidential information.

Changes to this notice

This notice may change, and a changed notice may apply to information already held. The current notice is posted and available on request, with its effective date shown above.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with your healthcare provider or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against for filing a complaint.

Contact

For questions about how the OmniEHR platform handles information as a Business Associate, contact the NorCemic Inc. Privacy Officer:

Ambima Buzhyason, Privacy Officer
NorCemic Inc., Phoenix, AZ 85023
admin@norcemic.com · 480-675-7832

To exercise a right over your own record, contact your healthcare provider directly, as the practice holds and controls your record.