The affiliated medical corporations may share PHI with one another
The two professional corporations are legally separate but share common ownership and control. Because they have designated themselves a single Affiliated Covered Entity, the Notice says they hold themselves out to the public as one covered entity and may use and disclose PHI with one another for the joint treatment, payment and health care operations of that entity.
Supporting quotations
may use and disclose PHI for the joint health care operations of the Affiliated Covered Entity
legally separate entities that share common ownership and control
the members may use and disclose PHI with one another for the joint treatment, payment, and health care operations of the Affiliated Covered Entity
Qualifications & exceptions
Sharing between the corporations is stated for joint treatment, payment and health care operations of the Affiliated Covered Entity; the first paragraph mentions only joint health care operations and the next paragraph lists all three purposes, so read the two together.
Not stated here
The Notice does not say which corporation holds which patient's records or which clinicians belong to which corporation.
Sharing & Disclosure · Permission or license
PHI may be shared with WHOOP, Inc. and service providers acting for the medical group
The medical corporations provide healthcare using technology, administrative and support services made available by WHOOP, Inc. and certain affiliated service providers. The Notice says WHOOP, Inc. is not a healthcare provider and does not practice medicine. The WHOOP Covered Entity may share PHI with WHOOP, Inc. and with service providers acting on the Covered Entity's behalf to support healthcare delivery and operations, including technology hosting, patient support, scheduling, payment processing, communications, security, analytics, quality improvement and other functions permitted by law. The Notice says these service providers are required by law and contract to appropriately safeguard your PHI.
Supporting quotations
using technology, administrative, and support services made available by WHOOP, Inc. and certain affiliated service providers
WHOOP, Inc. is not a healthcare provider and does not practice medicine
may share PHI with WHOOP, Inc. and service providers acting on behalf of the WHOOP Covered Entity to support healthcare delivery and operations
technology hosting, patient support, scheduling, payment processing, communications, security, analytics, quality improvement, and other functions permitted by law
These service providers are required by law and contract to appropriately safeguard your PHI.
Qualifications & exceptions
Sharing is described as being with parties acting on behalf of the WHOOP Covered Entity to support healthcare delivery and operations.
The listed functions follow the word 'including' and end with 'other functions permitted by law', so the list is not exhaustive.
Not stated here
The Notice does not name the service providers or say what contract terms bind them.
The Notice does not describe what WHOOP, Inc. may do with PHI beyond acting for the Covered Entity, or how WHOOP, Inc.'s own privacy policy applies; that policy is not part of this source.
Sharing & Disclosure · User right or choice
Right to ask for limits on use or disclosure, and the out-of-pocket exception
You may ask the medical group not to use or disclose certain PHI for treatment, payment or healthcare operations. The group is not required to agree to every request; if it agrees, it will comply unless disclosure is necessary to provide emergency treatment or is otherwise required by law. If you pay for a healthcare item or service in full out-of-pocket, you may ask that related PHI not be disclosed to your health plan for payment or healthcare operations, and the group says it will honor such a request when required by law.
Supporting quotations
You may ask us not to use or disclose certain PHI for treatment, payment, or healthcare operations.
We are not required to agree to every request.
we will comply unless disclosure is necessary to provide emergency treatment or is otherwise required by law
If you pay for a healthcare item or service in full out-of-pocket, you may request that we not disclose related PHI to your health plan for payment or healthcare operations purposes.
We will honor such requests when required by law.
Qualifications & exceptions
The group need not agree to a general restriction request.
An agreed restriction does not apply where disclosure is necessary for emergency treatment or otherwise required by law.
The out-of-pocket request concerns disclosure to your health plan for payment or healthcare operations, and is honored 'when required by law'.
Not stated here
The Notice does not say how to make a restriction request.
The Notice does not say what applies to an out-of-pocket request in situations where the law does not require honoring it.
Cross-references
qualifies (model-proposed): PHI may be used and disclosed for healthcare operations — qualifies: The right to ask for limits on use or disclosure for treatment, payment or healthcare operations qualifies the general permission to use PHI for healthcare operations; the group need not agree to a request.
Sharing & Disclosure · User right or choice
Right to a list of certain disclosures from the past six years
You may request a list of certain disclosures of your PHI made during the six years before your request. The list will not include disclosures made for treatment, payment, healthcare operations or certain other disclosures permitted by law.
Supporting quotations
You may request a list of certain disclosures of your PHI made during the six years before your request.
The accounting will not include disclosures made for treatment, payment, healthcare operations, or certain other disclosures permitted by law.
Qualifications & exceptions
Covers 'certain disclosures' within six years before the request.
Disclosures for treatment, payment, healthcare operations and certain other permitted disclosures are left out.
Not stated here
The Notice does not list the 'certain other disclosures' that are excluded or say how to request the list.
Sharing & Disclosure · User right or choice
You can tell the group your preferences on some sharing
For certain types of information you may tell the medical group your preferences about disclosure, including whether to share information with family members, friends or others involved in your care or payment for your care, and whether to share information in disaster relief situations. If you cannot communicate your preference, the group may share information if it determines this is in your best interests or necessary to prevent a serious threat to health or safety.
Supporting quotations
For certain types of information, you may tell us your preferences regarding disclosure.
You may instruct us whether to:
Share information with family members, friends, or others involved in your care or payment for your care.
Share information in disaster relief situations.
If you cannot communicate your preference, we may share information if we determine it is in your best interests or necessary to prevent a serious threat to health or safety.
Qualifications & exceptions
The choice applies to 'certain types of information' only.
If you cannot communicate a preference, the group may share if it determines it is in your best interests or necessary to prevent a serious threat to health or safety.
Not stated here
The Notice does not say which types of information the choices cover or how to state a preference.
Sharing & Disclosure · Company commitment
Written authorization needed for psychotherapy notes, most marketing and sale of PHI
Except as otherwise permitted by law, the medical group will obtain your written authorization before using or disclosing psychotherapy notes, using or disclosing PHI for most marketing purposes, or selling PHI. You may revoke an authorization at any time in writing, except to the extent the group has already relied on it.
Supporting quotations
Except as otherwise permitted by law, we will obtain your written authorization before:
Using or disclosing psychotherapy notes.
Using or disclosing PHI for most marketing purposes.
Selling PHI.
You may revoke an authorization at any time in writing, except to the extent we have already relied upon it.
Qualifications & exceptions
Applies 'except as otherwise permitted by law'.
Marketing is covered only for 'most' marketing purposes.
Revocation must be in writing and does not undo action already taken in reliance on the authorization.
Not stated here
The Notice does not say which marketing purposes need no authorization or what the legal exceptions are.
Sharing & Disclosure · Permission or license
Public health disclosures
The medical group may disclose PHI for public health purposes, including preventing or controlling disease, reporting adverse events, product recalls, reporting suspected abuse, neglect or domestic violence, and preventing serious threats to health or safety.
Supporting quotations
We may disclose PHI for public health purposes, including:
Preventing or controlling disease
Reporting adverse events
Product recalls
Reporting suspected abuse, neglect, or domestic violence
Preventing serious threats to health or safety
Qualifications & exceptions
The purposes are introduced with 'including' and are not a closed list.
Not stated here
The Notice does not name the recipients.
Sharing & Disclosure · Permission or license
Health oversight and research disclosures
The medical group may disclose PHI to government agencies authorized to oversee healthcare systems, providers and compliance activities. It may also use or disclose PHI for research purposes when permitted by law and subject to applicable privacy protections.
Supporting quotations
We may disclose PHI to government agencies authorized to oversee healthcare systems, providers, and compliance activities.
We may use or disclose PHI for research purposes when permitted by law and subject to applicable privacy protections.
Qualifications & exceptions
Oversight disclosures go to government agencies authorized to oversee healthcare.
Research use or disclosure is stated as 'when permitted by law and subject to applicable privacy protections'.
Not stated here
The Notice does not say whether research uses need your authorization or what protections apply.
Sharing & Disclosure · Permission or license
Disclosures required by law and in legal proceedings
The medical group may disclose PHI when required by federal, state or local law. It may also disclose PHI in response to court orders, subpoenas, legal processes, law enforcement requests or other governmental requests when permitted or required by law.
Supporting quotations
We may disclose PHI when required by federal, state, or local law.
We may disclose PHI in response to court orders, subpoenas, legal processes, law enforcement requests, or other governmental requests when permitted or required by law.
Qualifications & exceptions
Disclosure under legal process or law enforcement requests is stated 'when permitted or required by law'.
Not stated here
The Notice does not say whether you are told before PHI is disclosed in response to these requests.
Sharing & Disclosure · Permission or license
Workers' compensation, organ donation and death-related disclosures
The medical group may disclose PHI as necessary to comply with workers' compensation laws and similar programs, to organizations involved in organ, eye or tissue procurement and transplantation, and to coroners, medical examiners or funeral directors as authorized by law.
Supporting quotations
We may disclose PHI as necessary to comply with workers' compensation laws and similar programs.
We may disclose PHI to organizations involved in organ, eye, or tissue procurement and transplantation.
We may disclose PHI to coroners, medical examiners, or funeral directors as authorized by law.
Qualifications & exceptions
Workers' compensation disclosures are limited to what is necessary to comply with those laws and similar programs.
Disclosures to coroners, medical examiners and funeral directors are stated 'as authorized by law'.
Sharing & Disclosure · Permission or license
Military, national security and other specialized government functions
The medical group may disclose PHI for military, national security, protective services and other specialized government functions as authorized by law.
Supporting quotations
We may disclose PHI for military, national security, protective services, and other specialized government functions as authorized by law.
Qualifications & exceptions
Stated 'as authorized by law'.
Not stated here
The Notice does not say which agencies may receive the PHI.