SUMMARY OF OUR NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION

ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU

CAN GET ACCESS TO THIS INFORMATION

Please review the full Notice of Privacy Practices (NPP) which is attached. If you have any

questions about this notice, please contact Renee Clark, Manager at (317) 274-4624.

This notice describes our privacy practices. We are affiliated with and in some circumstances

may operate under the policies and practices of:

All these entities, sites, and locations follow the terms of this notice. In addition, these entities,

sites, and locations may share health information with each other for treatment, payment, or

health care operations purposes described in this notice.

We understand that health information about you and your health care is personal. We are

committed to protecting health information about you. We create a record of the care and

services you receive from us. We need this record to provide you with quality care and to

comply with certain legal requirements. This notice applies to all of the records of your care

generated by this health care practice, whether made by your personal doctor or others working

in this office. This notice will tell you about the ways in which we may use and disclose health

information about you. We also describe your rights to the health information we keep about

you, and describe certain obligations we have regarding the use and disclosure of your health

information.

We are required by law to:

information about you; and

© 2001-2002 On File - p. 1

The following categories describe different ways that we use and disclose health information. By

coming for care, you give us the right to use your information for treatment, to get reimbursed

for your care, and to operate our organization.

There are also various other ways in which we may use or disclose your information:

The full details for all these uses are contained in the full NPP.

You have the following rights regarding health information we maintain about you:

Information on how to exercise these rights can be seen in the NPP or can be obtained from

Renee Clark, Manager at (317) 274-4624.

We reserve the right to change this notice. We reserve the right to make the revised or changed

notice effective for health information we already have about you as well as any information we

receive in the future. We will post a copy of the current notice in our facility. The notice will

contain on the first page, in the top right-hand corner, the effective date. In addition, each time

you register for treatment or health care services, we will offer you a copy of the current notice

in effect.

If you believe your privacy rights have been violated, you may file a complaint with us or with the

Secretary of the Department of Health and Human Services. To file a complaint with us, contact

Other uses and disclosures of health information not covered by this notice or the laws that

apply to us will be made only with your written permission. If you provide us permission to use

or disclose health information about you, you may revoke that permission, in writing, at any

time. If you revoke your permission, we will no longer use or disclose health information about

you for the reasons covered by your written authorization. You understand that we are unable to

© 2001-2002 On File - p. 2

take back any disclosures we have already made with your permission, and that we are

required to retain our records of the care that we provided to you.

© 2001-2002 On File - p. 3

HIPAA NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION

ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU

CAN GET ACCESS TO THIS INFORMATION

PLEASE REVIEW IT CAREFULLY

If you have any questions about this notice, please contact Renee Clark, Manager at (317)

274-4624.

This notice describes our privacy practices. We are affiliated with and in some circumstances

may operate under the policies and practices of:

All these entities, sites, and locations follow the terms of this notice. In addition, these entities,

sites, and locations may share health information with each other for treatment, payment, or

health care operations purposes described in this notice.

We understand that health information about you and your health care is personal. We are

committed to protecting health information about you. We create a record of the care and

services you receive from us. We need this record to provide you with quality care and to

comply with certain legal requirements. This notice applies to all of the records of your care

generated by this health care practice, whether made by your personal doctor or others working

in this office. This notice will tell you about the ways in which we may use and disclose health

information about you. We also describe your rights to the health information we keep about

you, and describe certain obligations we have regarding the use and disclosure of your health

information.

We are required by law to:

© 2001-2002 On File - p. 4

information about you; and

The following categories describe different ways that we use and disclose health information.

For each category of uses or disclosures we will explain what we mean and try to give some

examples. Not every use or disclosure in a category will be listed. However, all of the ways we

are permitted to use and disclose information will fall within one of the categories.

For Treatment. We may use health information about you to provide you with health care

treatment or services. We may disclose health information about you to doctors, nurses,

technicians, health students, or other personnel who are involved in taking care of you. They

may work at our offices, at the hospital if you are hospitalized under our supervision, or at

another doctor's office, lab, pharmacy, or other health care provider to whom we may refer you

for consultation, to take x-rays, to perform lab tests, to have prescriptions filled, or for other

treatment purposes. For example, a doctor treating you for a broken leg may need to know if

you have diabetes because diabetes may slow the healing process. In addition, the doctor may

need to tell the dietitian at the hospital if you have diabetes so that we can arrange for

appropriate meals. We may also disclose health information about you to an entity assisting in a

disaster relief effort so that your family can be notified about your condition, status and location.

For Payment: We may use and disclose health information about you so that the treatment and

services you receive from us may be billed to and payment collected from you, an insurance

company, or a third party. For example, we may need to give your health plan information about

your office visit so your health plan will pay us or reimburse you for the visit. We may also tell

your health plan about a treatment you are going to receive to obtain prior approval or to

determine whether your plan will cover the treatment.

For Health Care Operations: We may use and disclose health information about you for

operations of our health care practice. These uses and disclosures are necessary to run our

practice and make sure that all of our patients receive quality care. For example, we may use

health information to review our treatment and services and to evaluate the performance of our

staff in caring for you. We may also combine health information about many patients to decide

what additional services we should offer, what services are not needed, whether certain new

treatments are effective, or to compare how we are doing with others and to see where we can

make improvements. We may remove information that identifies you from this set of health

information so others may use it to study health care delivery without learning who our specific

patients are.

Appointment Reminders: We may use and disclose health information to contact you as a

reminder that you have an appointment. Please let us know if you do not wish to have us

contact you concerning your appointment, or if you wish to have us use a different telephone

number or address to contact you for this purpose.

As Required By Law. We will disclose health information about you when required to do so by

federal, state, or local law.

To Avert a Serious Threat to Health or Safety. We may use and disclose health information

about you when necessary to prevent a serious threat to your health and safety or the health

and safety of the public or another person. Any disclosure, however, would only be to someone

able to help prevent the threat.

© 2001-2002 On File - p. 5

Military and Veterans. If you are a member of the armed forces or separated/discharged from

military services, we may release health information about you as required by military command

authorities or the Department of Veterans Affairs as may be applicable. We may also release

health information about foreign military personnel to the appropriate foreign military authorities.

Workers' Compensation. We may release health information about you for workers'

compensation or similar programs. These programs provide benefits for work-related injuries or

illness.

Public Health Risks. We may disclose health information about you for public health activities.

These activities generally include the following:

products;

contracting or spreading a disease or condition;

victim of abuse, neglect, or domestic violence. We will only make this disclosure if

you agree or when required or authorized by law.

Health Oversight Activities. We may disclose health information to a health oversight agency

for activities authorized by law. These oversight activities include, for example, audits,

investigations, inspections, and licensure. These activities are necessary for the government to

monitor the health care system, government programs, and compliance with civil rights laws.

Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose health

information about you in response to a court or administrative order. We may also disclose

health information about you in response to a subpoena, discovery request, or other lawful

process by someone else involved in the dispute, but only if efforts have been made to tell you

about the request or to obtain an order protecting the information requested.

Law Enforcement. We may release health information if asked to do so by a law enforcement

official:

perpetrators of crime;

- Name and address

- Date of birth or place of birth;

- Social security number;

- Blood type or rh factor;

© 2001-2002 On File - p. 6

- Type of injury;

- Date and time of treatment and/or death, if applicable; and

- A description of distinguishing physical characteristics.

circumstances, we are unable to obtain the person's agreement;

the identity, description, or location of the person who committed the crime.

Coroners, Health Examiners and Funeral Directors. We may release health information to a

coroner or health examiner. This may be necessary, for example, to identify a deceased person

or determine the cause of death. We may also release health information about patients to

funeral directors as necessary to carry out their duties.

National Security and Intelligence Activities. We may release health information about you to

authorized federal officials for intelligence, counterintelligence, and other national security

activities authorized by law.

Protective Services for the President and Others. We may disclose health information about

you to authorized federal officials so they may provide protection to the President, other

authorized persons or foreign heads of state or conduct special investigations.

Inmates. If you are an inmate of a correctional institution or under the custody of a law

enforcement official, we may release health information about you to the correctional institution

or law enforcement official. This release would be necessary (1) for the institution to provide you

with health care; (2) to protect your health and safety or the health and safety of others; or (3)

for the safety and security of the correctional institution.

You have the following rights regarding health information we maintain about you:

Right to Inspect and Copy: You have the right to inspect and copy health information that may

be used to make decisions about your care. Usually, this includes health and billing records.

To inspect and copy health information that may be used to make decisions about you, you

must submit your request in writing to Renee Clark, Manager. If you request a copy of the

information, we may charge a fee for the costs of copying, mailing or other supplies and

services associated with your request.

We may deny your request to inspect and copy in certain very limited circumstances. If you are

denied access to health information, you may request that the denial be reviewed. Another

licensed health care professional chosen by our practice will review your request and the denial.

The person conducting the review will not be the person who denied your request. We will

comply with the outcome of the review.

Right to Amend. If you feel that health information we have about you is incorrect or

incomplete, you may ask us to amend the information. You have the right to request an

amendment for as long as we keep the information. To request an amendment, your request

must be made in writing, submitted to Renee Clark, Manager, and must be contained on one

page of paper legibly handwritten or typed in at least 10 point font size. In addition, you must

provide a reason that supports your request for an amendment.

© 2001-2002 On File - p. 7

We may deny your request for an amendment if it is not in writing or does not include a reason

to support the request. In addition, we may deny your request if you ask us to amend

information that:

longer available to make the amendment;

Any amendment we make to your health information will be disclosed to those with whom we

disclose information as previously specified.

Right to an Accounting of Disclosures. You have the right to request a list accounting for any

disclosures of your health information we have made, except for uses and disclosures for

treatment, payment, and health care operations, as previously described.

To request this list of disclosures, you must submit your request in writing to Renee Clark,

Manager. Your request must state a time period which may not be longer than six years and

may not include dates before April 13, 2003. The first list you request within a 12 month period

will be free. For additional lists, we may charge you for the costs of providing the list. We will

notify you of the cost involved and you may choose to withdraw or modify your request at that

time before any costs are incurred. We will mail you a list of disclosures in paper form within 30

days of your request, or notify you if we are unable to supply the list within that time period and

by what date we can supply the list; but this date will not exceed a total of 60 days from the date

you made the request.

Right to Request Restrictions. You have the right to request a restriction or limitation on the

health information we use or disclose about you for treatment, payment, or health care

operations. You also have the right to request a limit on the health information we disclose

about you to someone who is involved in your care or the payment for your care, such as a

family member or friend. For example, you could ask that we restrict a specified nurse from use

of your information, or that we not disclose information to your spouse about a surgery you had.

ensure our compliance or believe it will negatively impact the care we may provide you. If

we do agree, we will comply with your request unless the information is needed to provide you

emergency treatment. To request a restriction, you must make your request in writing to Renee

Clark, Manager. In your request, you must tell us what information you want to limit and to

whom you want the limits to apply; for example, use of any information by a specified nurse, or

disclosure of specified surgery to your spouse.

Right to Request Confidential Communications. You have the right to request that we

communicate with you about health matters in a certain way or at a certain location. For

example, you can ask that we only contact you at work or by mail to a post office box.

To request confidential communications, you must make your request in writing to Renee Clark,

Manager. We will not ask you the reason for your request. We will accommodate all reasonable

requests. Your request must specify how or where you wish to be contacted.

Right to a Paper Copy of This Notice. You have the right to obtain a paper copy of this notice

at any time. However, at the time of first service rendered after April 14, 2003, it is required that

© 2001-2002 On File - p. 8

you receive a paper copy. To obtain a copy, please request it from Renee Clark, Manager.

We reserve the right to change this notice. We reserve the right to make the revised or changed

notice effective for health information we already have about you as well as any information we

receive in the future. We will post a copy of the current notice in our facility. The notice will

contain on the first page, in the top right-hand corner, the effective date. In addition, each time

you register for treatment or health care services, we will offer you a copy of the current notice

in effect.

If you believe your privacy rights have been violated, you may file a complaint with us or with the

Secretary of the Department of Health and Human Services. To file a complaint with us, contact

Other uses and disclosures of health information not covered by this notice or the laws that

apply to us will be made only with your written permission. If you provide us permission to use

or disclose health information about you, you may revoke that permission, in writing, at any

time. If you revoke your permission, we will no longer use or disclose health information about

you for the reasons covered by your written authorization. You understand that we are unable to

take back any disclosures we have already made with your permission, and that we are

required to retain our records of the care that we provided to you.

We will request that you sign a separate form or notice acknowledging you have received a

copy of this notice. If you choose, or are not able to sign, a staff member will sign their name,

date. This acknowledgement will be filed with your records.

© 2001-2002 On File - p. 9

I, _______________________________________, have received the Notice of Privacy

Practices from Pediatric Surgical Associates, PC.

In lieu of patient signature, I, _______________________________________, a staff member

of Pediatric Surgical Associates, PC, state that

_______________________________________ has been given our current Notice of Privacy

Practices.

© 2001-2002 On File - p. 10

State Law Information for Notice of Privacy Practices

State: IN

Your state's laws regarding Protected Health Information must be considered along with

the HIPAA Privacy Regulation when updating your organization's policies and

procedures. We are providing the information below as a guide to what those other

considerations may be. Consult your state's laws to make sure you are meeting all of

the requirements.

Indiana statutes have a great impact on the Notice of Privacy Practices. Though there

are no provisions on the actual format of the NPP, there are many restrictions on

non-consensual disclosures. Carefully read each state provision and our "Expected

Impact" and then incorporate appropriate language into your policy. Seek outside

counsel if anything is unclear.

According to the HIPAA Privacy Regulation, you are required to give a copy of a Notice

of Privacy Practices to each patient at the first encounter after April 14, 2003. The state

law may have additional provisions on content, presentation requirements, and may

note some exceptions to the federal requirements.

We have not discovered any relevant state statutes for this section.

Use and Disclosure of Protected Health Information

The following sections describe different portions of the Notice of Privacy Practices. The

state law may or may not allow the same categories for access or they may add

additional restrictions in disclosing information for the categories. For each category you

need to take a careful look at the state statutes and change the category accordingly.

This may require you to remove some categories, add more categories, or revise the

explanation in the category.

According to the HIPAA Privacy Regulation, a healthcare provider may release PHI

without patient authorization for the purpose of treatment. State law may limit what

information can be disclosed, if this information can be released without authorization,

and under what circumstances the information can be released without authorization.

© 2001-2002 On File - p. 11

The federal regulation broadly allows uses and disclosures for treatment

of the patient or any other individual. State law does not allow disclosures

for treatment of another patient. Permitted state law disclosures for

treatment appears to be more restrictive than disclosures allowed under

the federal regulation.

NOTE: Some non-consensual disclosures for treatment are permitted

under both state law and the federal regulation. However the state law

does not allow disclosures for treatment of another patient. Follow the

familiar state law standard for treatment disclosures.

Indiana Code 16-39-5-1

State law does not prohibit a healthcare provider from obtaining a patient's

health records from another provider without the patient's consent, if the

health records are needed to provide healthcare services to the patient.

According to the regulation, a healthcare provider may release PHI without patient

authorization for the purpose of payment. State law may limit what information can be

disclosed, if this information can be released without authorization, and under what

circumstances the information can be released without authorization.

The federal regulation allows disclosures for payment without

authorization. The definition of payment in the federal regulation is

expansive, but it may be comparable to the "legitimate business purposes"

allowed under state law. Disclosures for payment are permitted without

patient authorization under both the federal regulation and state law.

NOTE: Non-consensual disclosures for submission of claims to third party

payors are permitted under both state law and the federal regulation. For

other payment-related disclosures, state law may be more restrictive than

the federal regulation. Other authorities may have more definitive advice.

Indiana Code 16-39-5-3(c), (c)(1), (c)(2)

Health records may be used (and presumably disclosed) by the provider

without authorization, for legitimate business purposes including submission

of claims for payment from third parties and collection of accounts.

According to the regulation, a healthcare provider may release PHI without patient

authorization for the purpose of healthcare operations. State law may limit what

information can be disclosed, if this information can be released without authorization,

and under what circumstances the information can be released without authorization.

© 2001-2002 On File - p. 12

The federal regulation allows disclosures without patient authorization for

healthcare operations, an expansively broad category of activities. The

state law authorization of non-consensual disclosures for legitimate

business purposes may be comparable. Both the federal regulation and

state law appears to allow disclosures for a broad range of business

activities/healthcare operations.

NOTE: Some non-consensual disclosures for business

activities/healthcare operations are permitted under both state law and the

federal regulation. Most disclosures that were permissible for business

purposes under state law before HIPAA are likely to qualify under the

federal regulation. Check with other authorities if there are any doubts.

Indiana Code 16-39-5-3(c)

Indiana Code 16-39-5-3(d)

Health records may be used (and presumably disclosed) by the provider

without authorization for legitimate business purposes, litigation defense,

quality assurance, and peer review. The identity of the patient can be

disclosed, but only when disclosure is essential to the provider's business use

or to quality assurance and peer review.

According to the regulation, a healthcare provider may disclose health information to tell

the patient about health-related services or to recommend possible treatment options,

as long as the patient has the right to accept or reject such a disclosure. State law may

have a different provision for handling this situation.

The federal regulation allows some disclosures for marketing without

patient authorization. It is not clear if the marketing disclosures allowed

without patient authorization would qualify as a legitimate business

purpose under state law. If state law would not allow the disclosures, then

state law would be applicable.

NOTE: Some marketing disclosures are permitted without patient approval

under federal regulation. We can't really tell if these disclosures qualify as

legitimate business purpose under state law. Follow state law if the

disclosures are not allowed. The safer course is to avoid marketing

disclosures altogether, or unless a definitive authority says otherwise.

Indiana Code 16-39-5-3(c)

© 2001-2002 On File - p. 13

Health records may be used (and presumably disclosed) by the provider

without authorization for legitimate business purposes.

According to the regulation, a healthcare provider may disclose health information to

contact patients in an effort to raise money for not-for-profit operations as long as the

patient has the right to accept or reject such a disclosure. State law may have a

different provision for handling this situation.

The federal regulation allows some disclosures for fundraising without

patient authorization. It is not clear if the fundraising disclosures allowed

without patient authorization would qualify as a legitimate business

purpose under state law. If state law would not allow the disclosures, then

state law would be applicable.

NOTE: Some disclosures for fundraising are permitted without patient

approval under federal regulation. We can't really tell if these disclosures

qualify as legitimate business purpose under state law. Follow state law if

the disclosures are not allowed. The safer course is to avoid fundraising

disclosures altogether, or unless a definitive authority says otherwise.

Indiana Code 16-39-5-3(c)

Health records may be used (and presumably disclosed) by the provider

without authorization for legitimate business purposes.

According to the regulation, under certain circumstances a healthcare provider may

release PHI without patient consent for the purpose of research. State law may limit

what information can be disclosed, if this information can be released without

authorization, and under what circumstances the information can be released without

authorization.

The federal regulation allows research disclosures without patient

authorization generally with the approval of an institutional review board or

privacy board. State law restricts research disclosures to nonprofit medical

research organizations or to providers. The federal regulation appears to

be applicable with respect to disclosures for research. The state law

requirement that the recipient protects the confidentiality of the record and

may not disclose the patient's identity appears to be effective. The state

law restriction on disclosures to nonprofit medical research organizations

appears to be effective.

NOTE: Follow the state law restrictions limiting research disclosures to

providers or nonprofit medical research organizations. Federal procedures

© 2001-2002 On File - p. 14

regulating research disclosures are applicable. The state law provision

defining the responsibilities of recipients also applies.

Indiana Code 16-39-5-3(c)(6)

Indiana Code 16-39-5-3(c), (e)

A provider can disclose a health record to another provider or to a nonprofit

medical research organization to be used in connection with a joint scientific,

statistical, or educational project. Each person to whom a disclosure is made,

should protect the confidentiality of the record and not disclose the patient's

identity, unless authorized by law.

According to the regulation, a healthcare provider may release PHI without patient

consent for the purpose of organ and tissue donation. State law may limit what

information can be disclosed, if this information can be released without authorization,

and under what circumstances the information can be released without authorization.

The main state health record privacy statute does not address this

category of disclosures. The disclosures allowed by the federal regulation

may qualify as legitimate business purposes or be otherwise authorized by

state law.

NOTE: We can't tell for sure if these disclosures qualify under the state

law's legitimate business purpose. If a disclosure was consistent with state

law before HIPAA, then the disclosure is probably still permissible. Other

authorities may have more definitive advice.

Indiana Code 16-39-5-3(c)

Health records may be used (and presumably disclosed) by the provider

without authorization for legitimate business purposes.

The regulation allows you to disclose PHI when required by federal, state, or local law.

State law may have additional provisions when releasing information for such a

purpose.

The main state health record privacy statute does not address this

category of disclosures. The disclosures allowed by the federal regulation

may qualify as legitimate business purposes or be otherwise authorized by

state law.

NOTE: We can't tell for sure if these disclosures qualify under the state

law's legitimate business purpose. If a disclosure was consistent with state

© 2001-2002 On File - p. 15

law before HIPAA, then the disclosure is probably still permissible. Other

authorities may have more definitive advice.

Indiana Code 16-39-5-3(c)

Health records may be used (and presumably disclosed) by the provider

without authorization for legitimate business purposes.

The regulation allows you to disclose PHI without patient consent for the purpose of

health and safety. State law may have a different provision for handling this situation or

may not allow such a disclosure to occur without patient consent.

The main state health record privacy statute does not address this

category of disclosures. The disclosures allowed by the federal regulation

may qualify as legitimate business purposes or be otherwise authorized by

state law.

NOTE: We can't tell for sure if these disclosures qualify under the state

law's legitimate business purpose. If a disclosure was consistent with state

law before HIPAA, then the disclosure is probably still permissible. Other

authorities may have more definitive advice.

Indiana Code 16-39-5-3(c)

Health records may be used (and presumably disclosed) by the provider

without authorization for legitimate business purposes.

The regulation allows you to disclose PHI without patient consent as required by military

command authorities of the Department of Veterans Affairs. State law may have a

different provision for handling this situation or may not allow such a disclosure to occur

without patient consent.

The main state health record privacy statute does not address this

category of disclosures. The disclosures allowed by the federal regulation

may qualify as legitimate business purposes or be otherwise authorized by

state law.

NOTE: We can't tell for sure if these disclosures qualify under the state

law's legitimate business purpose. If a disclosure was consistent with state

law before HIPAA, then the disclosure is probably still permissible. Other

authorities may have more definitive advice.

© 2001-2002 On File - p. 16

Indiana Code 16-39-5-3(c)

Health records may be used (and presumably disclosed) by the provider

without authorization for legitimate business purposes.

The regulation allows you to disclose PHI without patient consent for Worker's

Compensation programs. State law may have a different provision for handling this

situation or may not allow such a disclosure to occur without patient consent.

We have not discovered any relevant state statutes for this section.

The regulation allows you to disclose PHI without patient consent for public health

activities which are listed in this category. State law may have a different provision for

handling this situation or may not allow such a disclosure to occur without patient

consent.

The main state health record privacy statute does not address this

category of disclosures. The disclosures allowed by the federal regulation

may qualify as legitimate business purposes or be otherwise authorized by

state law.

NOTE: We can't tell for sure if these disclosures qualify under the state

law's legitimate business purpose. If a disclosure was consistent with state

law before HIPAA, then the disclosure is probably still permissible. Other

authorities may have more definitive advice.

Indiana Code 16-39-5-3(c)

Health records may be used (and presumably disclosed) by the provider

without authorization for legitimate business purposes.

The regulation allows you to disclose PHI without patient consent for certain health

oversight activities. State law may have a different provision for handling this situation or

may not allow such a disclosure to occur without patient consent.

The main state health record privacy statute does not address this

category of disclosures. The disclosures allowed by the federal regulation

may qualify as legitimate business purposes or be otherwise authorized by

state law.

NOTE: We can't tell for sure if these disclosures qualify under the state

© 2001-2002 On File - p. 17

law's legitimate business purpose. If a disclosure was consistent with state

law before HIPAA, then the disclosure is probably still permissible. Other

authorities may have more definitive advice.

Indiana Code 16-39-5-3(c)

Health records may be used (and presumably disclosed) by the provider

without authorization for legitimate business purposes.

The regulation allows you to disclose PHI without patient consent for lawsuits and

disputes. State law may have a different provision for handling this situation or may not

allow such a disclosure to occur without patient consent.

The federal regulation allows disclosures for a wide range of judicial and

administrative purposes, but notice to the patient and an opportunity to

object is generally required. The patient notice procedures under the

federal regulation appear to be applicable. It is not certain whether state

law is more restrictive than the federal regulation with respect to

disclosures for all judicial or administrative proceedings.

NOTE: Both the federal regulation and state law allow disclosures for

judicial and administrative proceedings, but it is uncertain if the state law is

more restrictive than the federal regulation. Follow the federal regulation's

notice procedures when asked to disclose records in connection with

judicial and administrative proceedings. Other authorities may have more

definitive advice.

Indiana Code 16-39-5-3(c)(3)

Health records are the property of the provider and may be used by the

provider without authorization for the legitimate business purposes of litigation

defense.

The regulation allows you to disclose PHI without patient consent for certain law

enforcement issues. State law may have a different provision for handling this situation

or may not allow such a disclosure to occur without patient consent.

The main state health record privacy statute does not address this

category of disclosures. The disclosures allowed by the federal regulation

may qualify as legitimate business purposes or be otherwise authorized by

state law.

© 2001-2002 On File - p. 18

NOTE: We can't tell for sure if these disclosures qualify under the state

law's legitimate business purpose. If a disclosure was consistent with state

law before HIPAA, then the disclosure is probably still permissible. Other

authorities may have more definitive advice.

Indiana Code 16-39-5-3(c)

Health records may be used (and presumably disclosed) by the provider

without authorization for legitimate business purposes.

The regulation allows you to disclose PHI without patient consent to coroners, health

examiners and funeral directors. State law may have a different provision for handling

this situation or may not allow such a disclosure to occur without patient consent.

The main state health record privacy statute does not address this

category of disclosures. The disclosures allowed by the federal regulation

may qualify as legitimate business purposes or be otherwise authorized by

state law.

NOTE: We can't tell for sure if these disclosures qualify under the state

law's legitimate business purpose. If a disclosure was consistent with state

law before HIPAA, then the disclosure is probably still permissible. Other

authorities may have more definitive advice.

Indiana Code 16-39-5-3(c)

Health records may be used (and presumably disclosed) by the provider

without authorization for legitimate business purposes.

The regulation allows you to disclose PHI without patient consent for national security

and intelligence activities. State law may have a different provision for handling this

situation or may not allow such a disclosure to occur without patient consent.

The main state health record privacy statute does not address this

category of disclosures. The disclosures allowed by the federal regulation

may qualify as legitimate business purposes or be otherwise authorized by

state law.

NOTE: We can't tell for sure if these disclosures qualify under the state

law's legitimate business purpose. If a disclosure was consistent with state

law before HIPAA, then the disclosure is probably still permissible. Other

authorities may have more definitive advice.

© 2001-2002 On File - p. 19

Indiana Code 16-39-5-3(c)

Health records may be used (and presumably disclosed) by the provider

without authorization for legitimate business purposes.

The regulation allows you to disclose PHI without patient consent for protective services

for the President and others. State law may have a different provision for handling this

situation or may not allow such a disclosure to occur without patient consent.

The main state health record privacy statute does not address this

category of disclosures. The disclosures allowed by the federal regulation

may qualify as legitimate business purposes or be otherwise authorized by

state law.

NOTE: We can't tell for sure if these disclosures qualify under the state

law's legitimate business purpose. If a disclosure was consistent with state

law before HIPAA, then the disclosure is probably still permissible. Other

authorities may have more definitive advice.

Indiana Code 16-39-5-3(c)

Health records may be used (and presumably disclosed) by the provider

without authorization for legitimate business purposes.

The regulation allows you to disclose PHI without patient consent for inmates. State law

may have a different provision for handling this situation or may not allow such a

disclosure to occur without patient consent.

The main state health record privacy statute does not address this

category of disclosures. The disclosures allowed by the federal regulation

may qualify as legitimate business purposes or be otherwise authorized by

state law.

NOTE: We can't tell for sure if these disclosures qualify under the state

law's legitimate business purpose. If a disclosure was consistent with state

law before HIPAA, then the disclosure is probably still permissible. Other

authorities may have more definitive advice.

Indiana Code 16-39-5-3(c)

Health records may be used (and presumably disclosed) by the provider

© 2001-2002 On File - p. 20

without authorization for legitimate business purposes.

Patient Rights

The regulation allows patients to view their PHI except for psychotherapy notes. The

state law may have special provisions for patients to access their records and may have

specific impact on the management of psychotherapy notes.

The federal regulation exempts all psychotherapy notes from patient

access. State law allows withholding of mental health records only for

good medical cause, where the physician determines that inspection or

copying is detrimental to the physical or mental health of the patient, or

likely to cause the patient to harm self or others.

NOTE: Follow the narrower state law and withhold psychotherapy notes

only if the standard for harm is met.

Indiana Code 16-39-2-4

A patient can inspect and copy mental health records. However, if the

provider determines to the best of professional judgment, that the information

requested is detrimental to the physical or mental health of the patient, or

likely to cause the patient to harm self or another person, the provider may

withhold the information from the patient.

The federal regulation allows providers to ask for a written request for

access or for a copy. State law provides that a written request is required

to trigger the provision for providing a copy. The federal regulation grants

a right of access as well as a right to a copy. State law does not expressly

require a provider to provide access, except to x-rays. A written request is

consistent with both the federal regulation and state law.

NOTE: You can ask patients who want to inspect or have a copy of

medical records to make a written request. Follow the federal regulation

that allows a patient to inspect and to ask for a copy of the medical

records.

Indiana Code 16-39-1-1(c), (d)

Indiana Code 16-39-1-2

© 2001-2002 On File - p. 21

Upon written request and reasonable notice, a provider should furnish a copy

of the patient's health records used in assessing the patient's and/or the

pertinent part of the record relating to a specific condition, as requested by

the patient. Upon written request and reasonable notice, a provider should

also provide the patient access to or a copy of the patient's x-ray film, at no

cost to the patient.

The regulation allows patients to amend their PHI. There are however, certain

exceptions. The state law may have special provisions for patients to amend their

records and may or may not have the same exceptions.

We have not discovered any relevant state statutes for this section.

The regulation allows patients to request an accounting of disclosures of their PHI. The

state law may have special provisions for patients to access this.

We have not discovered any relevant state statutes for this section.

The regulation allows patients to request restrictions on their PHI. The state law may

have special provisions for this issue.

We have not discovered any relevant state statutes for this section.

The regulation allows patients to request confidential communications of their PHI. The

state law may have special provisions for this issue.

We have not discovered any relevant state statutes for this section.

Other Uses of Health Information

According to the regulation, any other disclosures of PHI not covered by this notice

require patient authorization. Also, a patient may revoke an authorization at any time.

The state law may have special provisions for when patients may revoke an

authorization.

The federal regulation has a comparable requirement.

NOTE: There is no conflict between state law and the federal regulation

regarding revocation.

© 2001-2002 On File - p. 22

Indiana Code 16-39-1-4(8)

A written consent by a patient for release of a health record must include a

statement that the consent is subject to revocation at any time, except to the

extent that action has been taken in reliance on the consent.

© 2001-2002 On File - p. 23