HIPAA - Notice of Privacy Practices

Effective: 07/2023
Revised: 09/2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

We at Idaho Gastroenterology Associates are required by law to maintain the privacy of your protected health information (PHI). PHI is information that identifies you and that relates to your physical or mental health condition. We are also required to provide you with a copy of the Notice of Privacy Practices, which summarizes our responsibilities to your legal rights concerning PHI. We are required to abide by the terms of our Notice that is currently in effect. This notice applies to the PHI that is created or maintained about you as a patient of Idaho Gastroenterology Associates. It applies to any information received by IGA, including information received from other health care providers. Please note that if our physicians provide services to you while you are a patient at one of the hospitals, the use and disclosure of your PHI and your rights regarding your PHI related to the care you received while in the hospital are governed by the Notice provided to you by the hospital.

USES AND DISCLOSURES OF INFORMATION THAT DO NOT REQUIRE YOUR PERMISSION OR WRITTEN AUTHORIZATION.
We may use or disclose your PHI as may be allowed by law, including for any of the following purposes without your permission or written authorization. The examples provided are not meant to be all-inclusive.

I. Treatment. We may use or disclose your PHI so that we, or other health care providers, may provide you with treatment. For example, we may use any information in your medical records to provide treatment to you (such as determining the need for, and performing, colonoscopy or upper endoscopy). Likewise, we may disclose PHI about you to other physicians, hospitals, and health care providers so that they may provide treatment to you.

II. Payment. We may use or disclose PHI about you so that we, and other health care providers, may obtain payment for treatment provided to you. For example, we may disclose PHI about you to your health insurance plan, to obtain preauthorization for treatment, or to submit a claim for payment for treatment we provide. In addition, we may share PHI about you with other health care providers to the extent necessary to assist them to obtain payment for services they provided to you, just as we may obtain information from other healthcare providers that we may properly obtain payment for services we provided to you. PHI may also be disclosed to others such as collection agencies, to help us obtain payment for services we provide. However, we will not disclose protected health information to the patient’s health plan, if the patient informs IGA to not disclose the patient’s protected health information to the patient’s health plan and either the patient or someone else has paid IGA in full for the service provided to the patient.

III. Health Care Operations. We may use or disclose PHI to operate our business as healthcare providers. For example, we may use your PHI for assessing the quality of care we provide, training our employees, and operating our business.

IV. Appointment Reminders and Information about Available Services. We may use or disclose your PHI to contact you to make appointments or provide you with reminders of appointments. We may also use your PHI to inform you about treatment alternatives and other health-related benefits and services that we may offer or that we believe may be of interest to you.

V. Research. In certain circumstances, we may use PHI for research purposes. For example, we may use and disclose your PHI to compare the outcome of treatment provided to you with the outcome of different treatment provided to others with similar conditions by reviewing your PHI. Before we may use or disclose PHI for research purposes without your authorization, we will make a reasonable effort to ensure the appropriateness of the research and that your privacy is reasonably protected.

VI. To Family or Others Involved in Care or Payment. Practice personnel may disclose protected health information to family members, close friends, or others involved in the care of the patient or the payment for such health care if: (1) the patient is present and does not object to the disclosure, and the practitioner believes disclosure is in the patient’s best interests; or (2) the patient is not present, but the disclosure is in the patient’s best interest and is consistent with the patient’s prior expressed wishes. Practice personnel should only disclose information relevant to the person’s involvement in the patient’s health care. (See 45 CFR § 164.510). This disclosure may occur after the patient’s death.

VII. Public Health Activities. We may use or disclose your PHI when permitted or required to for certain public health activities. These activities include, for example, providing reports to appropriate governmental authorities to prevent or control disease, injury, or disability; to report information concerning the quality, safety, or effectiveness of FDA related products or activities, including collecting, and reporting adverse events, tracking and assisting with FDA governed product recalls and post-marketing surveillance. If you receive a medical device subject to the FDA oversight, the FDA may ask us that we disclose certain identifying information about you such as your name, address, telephone number, and social security number for the purpose of tracking the device.

VIII. Communicable Diseases. We may disclose PHI about you concerning communicable diseases to certain governmental agencies. For example, we may disclose disease information to agencies like the Centers for Disease Control; we may also disclose to appropriate agencies that you have been diagnosed with a sexually transmitted disease. We may also disclose PHI to public health agencies for purposes of tracking immunizations.

IX. Abuse and Neglect. We may disclose PHI to appropriate governmental agencies if we suspect abuse, neglect, domestic violence, or that you are the victim of a crime. We may report PHI to prevent a serious threat to your health and safety or the health and safety of another, or the public.

X. Health Oversight Activities. We may use or disclose PHI to health oversight agencies and entities, including licensing and regulatory agencies that oversee physicians, the clinic, the ambulatory surgery center, other practitioners, or the health care systems generally. We also may use or disclose information to comply with regulatory programs and standards, including to the Department of Health and Human Services, which oversees and enforces your rights as outlined in the Notice.

XI. Judicial, Administrative and Other Legal Procedures. We may use or disclose your protected health information in response to the court order or other governmental authority order. We may also use or disclose your PHI in response to a subpoena, discovery request, or other lawful process if efforts have been made to inform you of the request or obtain a protective order.

XII. Law Enforcement. We may use or disclose your PHI for law enforcement purposes as may be required by law. For example, we may provide PHI to law enforcement to help identify, locate, or apprehend a suspect, fugitive, material witness, or missing person, to provide information about the victim of a crime, or to report that a crime has occurred on our premises. We will also report drug diversion and information related to fraudulent prescription activity to law enforcement and regulatory agencies.

XIII. National Security. We may disclose PHI to federal officials for national security and intelligence activities, for protective services for the President and other governmental officials and foreign dignitaries.

XIV. Military. If you are in the military, we may use or disclose your PHI as requested of us by the military command authorities.

XV. Inmates or Persons in Police Custody. If you are an inmate, or in the custody of law enforcement, we may use or disclose PHI to law enforcement or correctional authorities.

XVI. Workers Compensation. We may use or disclose PHI to comply with workers compensation laws and other similar programs, including reporting information about certain work-related injuries and illnesses.

XVII. Coroners and Funeral Directors. We may disclose PHI to a coroner or medical examiner to identify a deceased person, determine the cause of death, or permit the coroner or medical examiner to perform their duties. We may disclose PHI to a funeral director so they may carry out their responsibilities.

XVIII. Organ Donation and Procurement. We may disclose your PHI to an organ procurement organization or other entities engaged in procuring, banking, or transplantation of organs, eyes, and other tissues, for donation purposes.

XIX. Business Associates. We may disclose PHI to persons and companies who are our business associates who use such PHI to provide services to us. For example, we may provide PHI to billing and transcription service companies, or to financial and legal counselors. Whenever we have an arrangement with a business associate that involves the use or disclosure of your PHI, we will require the business associate to give us adequate written assurance that it will appropriately safeguard and limit the use and disclosure of PHI provided to them.

XX. Proof of Vaccinations/School. We may disclose information relating to proof of immunization to a school if required by state law for enrollment and the patient or the patient’s personal representative (if the patient is a minor) consents to the disclosure. The consent may be oral but should be documented.

XXI. Fundraising Activity. We may contact IGA patients to provide information about IGA sponsored activities, including fundraising programs and educational events. If we have your substance use disorder patient records, subject to 42 CFR part 2, we will give you clear and obvious notice in advance and a choice about whether to receive fundraising communications that use your Part 2 information

XXII. Personal Representatives. In the case of minors, deceased patients, or other patients who lack capacity, we may disclose information to the parent, guardian, or other personal representative with authority to make health care decisions for the patient under Idaho law. Non-custodial parents are generally entitled to access information about their children. We may decline to disclose information to the personal representative if we believe it would not be in the patient’s best interest to disclose the information.

XXIII. Additional Protection for Substance Use Disorder Records. Some of your health information may be protected by special federal confidentiality rules for substance use disorder treatment records (42 CFR Part 2). If we have records protected by these rules, we generally will not share them for use in legal actions or investigations against you unless you give us written permission or a court issues the required order and subpoena.

DISCLOSURE OF INFORMATION THAT WE MAY MAKE IF WE OBTAIN YOUR WRITTEN AUTHORIZATION.
Unless one of the foregoing exceptions apply, IGA personnel must generally require or obtain written authorization from the patient or personal representative before using or disclosing protected health information. A written authorization is required for most uses or disclosures of psychotherapy notes. The authorization may not be combined with any other document. The written authorization must contain elements required by HIPAA to be valid. IGA personnel should normally use IGA’s approved HIPAA authorization form. IGA personnel must retain a copy of the authorization. If the authorization is requested by someone other than the patient or the patient’s representative, IGA must also give the patient or personal representative a copy of the authorization. IGA will not sell any patient’s protected health information without the patient’s written authorization, which will disclose if the sale will result in remuneration to IGA. Similarly, IGA will not use patient’s protected health information for marketing purposes (if IGA is to receive remuneration to make the communication) without the patient’s written authorization. If remuneration is involved, the written authorization signed by the patient will state that IGA will receive remuneration for the marketing communication.

1. Marketing. Idaho Gastroenterology Associates is not permitted to provide your PHI to any other company or person for marketing their products or services to you, other than our own products or services, unless you have signed an authorization.
2. Research. We will use or disclose your PHI as part of research that includes providing you treatment. For example, if you are part of a clinical research study that includes treatment, we may require that you sign an authorization to allow the researchers to use or disclose your PHI for purposes for this research. We may also require you to sign such an authorization as a condition to participate in research treatment.
3. Other Uses. Other uses and disclosures of your PHI will be made only with your written authorization unless we are otherwise required or allowed by law to use or disclose your PHI. By submitting a written revocation to our Privacy Officer, you may revoke your written authorization at any time, except to the extent we have already relied on your authorization in the use or disclosure of your PHI.
4. Notice of Redisclosure. If you authorize us to use and share your substance use disorder treatment records for treatment, payment, and health care operations, we may share them with other health care providers, health plans, and organizations involved in your care. Organizations that receive these records and are subject to HIPAA may further use and disclose them as permitted by HIPAA. However, these records cannot be used or disclosed in legal proceedings or investigations against you unless you give written permission or a court issues the required order and subpoena (or other lawful legal process).
   3.5.

YOUR RIGHTS CONCERNING PRIVATE HEALTH INFORMATION
Although we maintain our records concerning treatment we provide to you at Idaho Gastroenterology Associates, and we own such records, you have the following rights concerning your PHI:

1. Right to Request Additional Restrictions. Individuals may request restrictions on the use and disclosure of their protected health information. Requests for restriction do not have to be granted; however, if Idaho Gastroenterology Associates agrees to a restriction, any agreed-to restriction will not be effective to prevent uses and disclosures to the individual or as required by law.
2. Right to Receive Communication by Alternative Means. You have the right to receive confidential communications of your PHI by alternative means or at alternative locations. For example, you may request that we contact you only at work or by mail, or that we only call your cell phone. We will not ask you to explain your reason for your request. We will accommodate reasonable requests of alternative means of communication. We will condition the accommodation on you providing information to us as to how payment will be handled, or of a method by which you may be contacted.
3. Right to Inspect and copy Your Records. You have the right to inspect and obtain a copy of your PHI (including an electronic copy of that information) that we maintain in a designated record set, which includes your medical and billing records. You may inspect a copy your PHI by submitting a written request to the Privacy Officer. We may charge a reasonable cost-based fee for providing copies of the records to you. We generally have 30 days to respond to a request. We will produce an electronic copy of the protected health information if it is readily producible in the form or format requested by the patient. If an electronic copy of the PHI is not readily producible in the format requested by the patient, we will produce the information in a readable electronic format as agreed to by IGA and the patient. PHI you have requested you can either be picked up at any IGA location or will be mailed to the home address IGA has currently on file. In addition, upon the patient’s signed, written request IGA will transmit a copy of the PHI directly to another person designated and clearly identified by the patient. You do not have the right to copy or inspect certain PHI, including psychotherapy notes; information that will be used in a civil, criminal, or administrative action or proceeding; information that is protected by applicable law; information that is not included in your designated record set; information if you are an inmate at a correctional institution and we believe providing you with the requested information would risk the health, safety, security, custody or rehabilitation of you or others or endanger those involved in your custody; if you are receiving treatment as part of a clinical research project and that research project is still ongoing; and if we obtained the PHI that you seek from someone other than a health care provider under the promise of confidentiality and we believe your access request is likely to reveal the source of information. If we deny your request for access based upon any of the above reasons, or other lawful reasons, you do not have the right to have this decision reviewed.
   We also may deny access to information if we believe that providing it to you, or to your personal representative, would endanger the health or safety of you or someone else. In these instances, you may be allowed the right to have the decision reviewed by a health care provider of your choosing who was not involved in the original decision to deny access to the information.
4. Right to Request Amendment. You have the right to request that your PHI be amended. You may make a written request for amendment and submit it to the attention of our Privacy Officer. We may deny your request for amendment if we did not create the record; the PHI is not part of your designated record set; the information would not be available for your access were you to request it, or we believe the record set is accurate and complete. If we deny your request for amendment, you have a right to submit a statement of disagreement and to have the statement, as well as your request, attached to the record.
5. Right to An Accounting of Certain Disclosures of Your PHI. You have the right to request and receive an accounting of certain disclosures we have made of your PHI after April 14, 2003. This right does not exist as to disclosures to carry out treatment, payment, or health care operations for us or others, and disclosures made to you; disclosures made pursuant to a written authorization, disclosures to persons involved in your care, disclosures for national security or intelligence purposes; disclosures to correctional institutions or law enforcement officials; and other disclosures for which we are not required to make an accounting by law. You have the right to receive one accounting within a twelve- month period free of charge. We will charge a reasonable cost-based fee for subsequent accounting within that same twelve-month period. You may request an accounting by submitting a written request to the Privacy Officer.
6. You Have the Right to a Copy of This Notice. You have a right to obtain a paper copy of this Notice upon request.
7. Complaints. If you believe your rights regarding your PHI as outlined in this Notice have been violated, you may file a complaint with us by contacting the Privacy Officer. You may also make a complaint with the Secretary of the Department of Health and Human Services, Bureau of Facility Standards, PO Box 83720, Boise, ID 83720-0036, (208)334-6626. All complaints submitted to us must be in writing. We will not retaliate against you for filing a complaint.

IV. CARE QUALITY
This office has chosen to participate in the Care Quality Data Exchange. If you do not want to participate in Care Quality and you do not want to have your health care information shared with other medical providers involved in your care, you can opt out of participation. Opting out of sharing information to health data exchanges is available at the front desk during check-in, or by calling and requesting that we do not share health data. If you do not choose to opt out, we may share your protected health information with other healthcare providers involved in your care through Care Quality. This is a secure internet-based health information exchange, with the goal of improving the quality and coordination of our patients’ records to other medical facilities.

V. IDAHO HEALTH DATA EXCHANGE
This office has chosen to participate in the Idaho Health Data Exchange (IHDE). If you do not want to participate in the IHDE and you do not want to have your health care information shared with other medical providers involved in your care, you can opt out of participation. To do so, you must complete and sign the IHDE Request to Restrict Disclosure of Health Information form and mail or fax it to IHDE. This form is available at the front desk. If you do not complete this form, we may share your protected health information with other healthcare providers involved in your care through the IHDE. This is a secure statewide internet-based health information exchange, with the goal of improving the quality and coordination of health care in Idaho.

VI. NOTICE ABOUT THE USE OF TECHNOLOGY
We may use electronic software, services and equipment, including, but not limited to, email, video conferencing technology, cloud and server storage, Internet communication, cellular network, voicemail, facsimile, electronic health record, and related technology (" Technology ") to share PHI with you or with third parties subject to the rights and restrictions contained herein. In any case, certain unencrypted storage, forwarding, communications, and transfers may not be confidential. We will take measures to safeguard the transmitted data, as well as to guarantee its integrity against intentional or unintentional violation or corruption. However, in rare circumstances, security protocols can fail and cause a violation of privacy or PHI. Recording any portion of the telehealth visit is prohibited.
We use Large Language Model (LLM) assisted technology to enhance efficiency and improve patient experience. This includes answering phone calls, scheduling and patient communications. Any information gathered during these interactions is strictly confidential, for our office use only and HIPAA compliant. All data processed is encrypted both during transmission and while stored.

VII. CHANGES TO THIS NOTICE.
Idaho Gastroenterology Associates will abide by the terms of its Notice of Privacy Practices currently in effect. We reserve the right to change the terms of the Notice and to make the new Notice provisions effective for all PHI that we maintain. We will provide you with the revised Notice upon your first visit to our offices as a patient following the revision of the Notice.

To contact our Privacy Officer or obtain further information regarding issues covered in the Notice of Privacy please contact:

Idaho Gastroenterology Associates
Attn: Privacy Officer
425 W Bannock St
Boise, ID 83702
(208) 343-6458