NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL, INCLUDING DENTAL AND MENTAL HEALTH, INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
During the process of providing services to you, PENRAD IMAGING/Colorado Springs Radiologists, PC (“Agency”) will obtain, record, and use mental health and medical information about you that is protected health information (“PHI”). Ordinarily that information is confidential and will not be used or disclosed, except as described below.
I. USES AND DISCLOSURES OF PROTECTED INFORMATION
A. General Uses and Disclosures Not Requiring the Individual’s Consent. Agency will use and disclose PHI in following ways.
-
-
- Treatment. Treatment refers to the provision, coordination, or management of health care, including mental health care, and related services by one or more health care providers. For example, Agency will use your information to plan your course of treatment. As to other examples, Agency may consult with professional colleagues or ask professional colleagues to cover calls or the practice for Agency and will provide the information necessary to complete those tasks.
- Payment. Payment refers to the activities undertaken by Agency to obtain or provide reimbursement for the provision of health care. Agency will use your information to develop accounts receivable information, bill you, provide information to your insurance company or other third-party payer for services provided. The information provided to insurers and other third-party payers may include information that identifies you, as well as your diagnosis, type of service, date of service, provider name/identifier, and other information about your condition and treatment. If you are covered by Medicaid, information will be provided to the State of Colorado’s Medicaid program, including but not limited to your treatment, condition, diagnosis, and services received.
- Health Care Operations. Health Care Operations refers to activities undertaken by Agency that are regular functions of management and administrative activities of the practice. For example, Agency may use or disclose your PHI in the monitoring of service quality, staff evaluation, and obtaining legal services.
- Contacting the Individual. Agency may contact you to remind you of appointments and to tell you about treatments or other services that might be of benefit to you.
- Required by Law. Subject to the requirements discussed at Section G, Agency will disclose PHI when required by law or necessary for health care oversight. This includes, but is not limited to when (a) reporting child abuse or neglect; (b) a court-ordered release of information; (c) there is a legal duty to warn or take action regarding imminent danger to others; (d) the Individual is a danger to self or others or gravely disabled; (e) a coroner is investigating the Individual’s death; or (f) to health oversight agencies for oversight activities authorized by law and necessary for the oversight of the health care system, government health care benefit programs, or regulatory compliance.
- Crimes on the Premises or Observed by the Provider. Crimes that are observed by Agency or Agency’s staff, crimes that are directed toward Agency or Agency’s staff, or crimes that occur on the premises will be reported to law enforcement.
- Business Associates. Some of the functions of Agency may be provided by contracts with Business Associates. For example, some of the billing, legal, auditing, and practice management services may be provided by contracting with outside entities to perform those services. In those situations, PHI will be provided to those contractors as is needed to perform their contracted tasks. Business Associates are required to enter into an agreement maintaining the PHI privacy of the PHI released to them.
- Research. Agency may use or disclose PHI for research purposes if the relevant limitations of the HIPAA Privacy Rule are followed. 45 C.F.R. § 164.512(i).
- Involuntary Treatment. PHI regarding Individuals who are being treated involuntarily, pursuant to law, will be shared with other treatment providers, legal entities, third-party payers and others, as necessary to provide the care and management coordination needed.
- Family Members. Except for certain minors, incompetent Individuals, or involuntarily treated Individuals, PHI cannot be provided to family members without the Individual’s consent. In situations where family members are present during a discussion with the Individual, and it can be reasonably inferred from the circumstances that the Individual does not object, information may be disclosed in the course of that discussion. However, if the Individual objects, PHI will not be disclosed.
- Emergencies. In life threatening emergencies, Agency will disclose PHI necessary to avoid serious harm or death.
-
B. Statements That Certain Uses and Disclosures Require Authorization. Agency must obtain your Authorization in order to use or disclose your PHI for marketing purposes and most uses and disclosures of your psychotherapy notes.
C. Individual Authorization or Release of Information. Agency may not use or disclose PHI in any other way than set forth in this Notice without a signed Authorization. When you sign an Authorization, it may later be revoked, provided that the revocation is in writing. The revocation will apply, except to the extent Agency has already taken action in reliance thereon.
D. Health Information Exchanges (HIEs). The Agency participates in health information exchanges, which compile your PHI from various participating medical providers and healthcare facilities that provide you care. These medical records can be queried by participating providers involved in your care and are essential in order to provide you with the best possible care. This medical record is known as your Patient Summary Record. You have the right to prevent your medical provider(s) from querying your Patient Summary Record. This right is referred to as “Opt- Out”. If you choose to Opt-Out, you understand the following: (1) that your medical provider(s) will NOT be able to view your medical record within the Patient Summary Record, even in the case of an emergency, AND (2) that your medical provider(s) WILL be able to use the HIEs to electronically receive and send your PHI.
E. Judicial and Administrative Proceedings. Subject to the requirements discussed at Section G, Agency may, and is sometimes required by law, disclose your PHI in the course of any administrative or judicial proceeding to the extent expressly authorized by a court or administrative order. Subject to any state law restrictions, Agency may also disclose PHI in response to a subpoena, discovery request or other legal process if reasonable efforts have been made to notify you of the request and you have not objected, or if your objections have been resolved by a court or administrative order.
F. Law Enforcement. Subject to the requirements discussed at Section G, Agency may, and is sometimes required by law to, disclose PHI to a law enforcement official for purposes such as identifying or locating a suspect, fugitive, material witness or missing person, complying with a court order, warrant, grand jury subpoena and other law enforcement purposes.
II. YOUR RIGHTS AS AN INDIVIDUAL
A. Access to PHI. You have the right to inspect and obtain a copy of the PHI the provider has regarding you, in the designated record set. If records are used or maintained as electronic health records, you have a right to receive a copy of the PHI maintained in the electronic health record in an electronic format. However, you do not have the right to inspect or obtain a copy of psychotherapy notes. There are other limitations to this right, which will be provided to you at the time of your request, if any such limitation applies. To make a request, ask Agency.
B. Amendment of Your Record. You have the right to request that Agency amend your PHI. Agency is not required to amend the record if it is determined that the record is accurate and complete. There are other exceptions, which will be provided to you at the time of your request, if relevant, along with the appeal process available to you. To make a request, ask Agency.
C. Accounting of Disclosures. You have the right to receive an Accounting of certain disclosures Agency has made regarding your PHI. However, that Accounting does not include disclosures that were made for the purpose of Treatment, Payment, or Health Care Operations. In addition, the Accounting does not include disclosures made to you, disclosures made pursuant to a signed Authorization, or disclosures made prior to April 14, 2003. There are other exceptions that will be provided to you, should you request an Accounting. To make a request, ask Agency.
D. Additional Restrictions. You have the right to request additional restrictions on the use or disclosure of your PHI. Unless you pay for your services out of pocket, Agency does not have to agree to that request, and there are certain limits to any restriction, which will be provided to you at the time of your request. If you pay for a service out of pocket, you are permitted to demand that information regarding the service not be disclosed to your health plan or insurance. To make a request, ask Agency.
E. Alternative Means of Receiving Confidential Communications. You have the right to request that you receive communications of PHI from Agency by alternative means or at alternative locations. For example, if you do not want Agency to mail bills or other materials to your home, you can request that this information be sent to another address. There are limitations to the granting of such requests, which will be provided to you at the time of the request process. To make a request, ask Agency.
F. Fundraising Opt Out. Agency may use your PHI to communicate with you to raise funds for its operations, unless you notify the Privacy Officer in writing and request that we do not contact you for this purpose.
G. Marketing. Agency engages in marketing and will obtain your Authorization before we use your PHI to contact you with marketing communications.
H. Breach Notification. In the event of any breach of your unsecured PHI, Agency will notify you of such breach within sixty (60) days of the date Agency learns of the breach.
I. Copy of this Notice. You have a right to obtain another copy of this Notice upon request.
J. State Law. When federal and state privacy laws are different and conflict, and the state law is more protective of your PHI or provides you with greater access to your information, the Agency will follow state law. Further, certain other types of health information may have additional protection under state law. For example, health information about mental health, HIV/AIDS, and genetic testing results is treated differently than other types of health information under certain state laws. To the extent applicable, Agency will obtain your written permission before disclosing these categories of information to others in many circumstances.
III. Confidentiality of Substance Use Disorder Patient Records
Agency may receive information related to substance use disorder treatment (“Records”). The confidentiality of such Records is protected by special federal law and regulations, in addition to HIPAA.
A. Permitted Disclosures for Treatment, Payment, or Health Care Operations. Unless otherwise permitted by the Part 2 regulations, Agency may only disclose Records for treatment, payment, and health care operations with your written consent. Upon receipt of your written consent, Agency may use and disclose your Records in the same manner we are permitted to use and disclose your PHI under for treatment, payment, or health care operations.
B. Disclosures without your Written Consent. Agency may disclose your Records without your consent to medical personnel in a medical emergency, to public health authorities if the Record has been de-identified, or to qualified personnel for research, audit, or program evaluation purposes.
C. Legal Proceedings. Agency will not use or disclose Records or testimony containing information from your Records in civil, criminal, administrative, or legislative proceedings against you unless (1) you have consented to such use or disclosure in writing; or (2) a court order has been issued and you have been provided notice and an opportunity to be heard. A court order authorizing use or disclosure of your Records must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested Record can be used or disclosed.
IV. ADDITIONAL INFORMATION
A. Redisclosure. PHI disclosed pursuant to the HIPAA Privacy Rule may be subject to redisclosure by the recipient and may no longer be protected by the HIPAA Privacy Rule.
B. Privacy Laws. Agency is required by State and Federal law to maintain the privacy of PHI. In addition, Agency is required by law to provide Individuals with notice of Agency’s legal duties and privacy practices with respect to PHI. That is the purpose of this Notice.
C. Terms of the Notice and Changes to the Notice. Agency is required to abide by the terms of this Notice, or any amended Notice that may follow. Agency reserves the right to change the terms of its Notice and to make the new Notice provisions effective for all PHI that it maintains. When the Notice is revised, we will mail a revised notice to the address that you have given us, the revised Notice will be posted on our website, and will be available upon request.
D. Complaints Regarding Privacy Rights. If you believe Agency has violated your privacy rights, you have the right to complain to Agency. You also have the right to complain to the United States Secretary of Health and Human Services by sending your complaint to
Regional Manager, Office for Civil Rights
U.S. Department of Health & Human Services
999 18th Street, Suite 417
Denver, Colorado 80294
Phone: (800) 368-1019
TDD: (800) 537-7697
Fax: (303) 844-2025It is the policy of Agency that there will be no retaliation for your filing of such complaints.
E. Contact Information. If you have questions about this Notice or desire additional information about your privacy rights, please contact our Privacy Officer:
Andrew Buffenbarger, Director of Human Resources at:
Colorado Springs Radiologists, P.C. / PENRAD Imaging
1390 Kelly Johnson Blvd.
Colorado Springs, CO
719-426-2411Revised and Effective: 28 July, 2026
Effective 14 April 2003; Revised 23 September 2013, Revised 29 May 2015; Revised 07 December 2025; Revised 16 February 2026;-
