Notice of Privacy Practices

Who Will Follow This Notice

This Notice applies to the California Institute of Cosmetic and Reconstructive Surgery (CICRS) and its affiliates, including:

• Authorized health care professionals, departments, units, and outsourced operations.
• Volunteers, employees, staff, and personnel.

All entities may share your medical information for treatment, payment, or health care operations as described herein.

Our Pledge Regarding Your Medical Information

We are committed to protecting your personal health information (PHI). We create records of your care to provide quality services and comply with legal requirements, including the Health Insurance Portability and Accountability Act (HIPAA). This Notice applies to all records generated by CICRS. We must keep your PHI private, provide this Notice, and follow its terms. We may update this Notice and make changes effective for existing and future PHI.

How We May Use and Disclose Your Medical Information

We may use or disclose your PHI without your authorization for the following purposes (examples are illustrative, not exhaustive):

• For Treatment: To provide care, e.g., sharing with doctors, nurses, or family involved in your care.
• For Payment: For billing and collection, e.g., sharing with insurers or third-party billers.
• For Health Care Operations: To improve quality, e.g., audits, staff training, or combining data for studies (de-identified where possible).
• Appointment Reminders, Treatment Alternatives, and Health-Related Benefits: To contact you about appointments, options, or services.
• Individuals Involved in Your Care or Payment: To family or friends involved, or for disaster relief.
• Research: With approval, for studies; we usually require your authorization if identifiable.
• As Required by Law: For legal compliance.
• To Avert Serious Threat to Health or Safety: To prevent harm.
• Substance Use Disorder (SUD) Records: If we maintain SUD treatment records protected under 42 CFR Part 2, we align with HIPAA but require your written consent for most uses or disclosures (e.g., treatment, payment, operations). SUD records have heightened protections; one consent covers ongoing uses, but you may revoke it. We prohibit uses for legal proceedings against you without court order. Contact our Privacy Officer for details.

Special Situations

We may disclose PHI in these cases:

• Organ/Tissue Donation: To procurement organizations.
• Military/Veterans: As required by authorities.
• Workers' Compensation: For work-related claims.
• Public Health: For disease control, reporting abuse or neglect, product recalls, or exposure notifications (with your agreement where required).
• Health Oversight: For audits, investigations, or licensure.
• Lawsuits and Disputes: In response to court orders or subpoenas (with notice and efforts to protect).
• Law Enforcement: For court orders, identifying suspects, crime reporting, or emergencies.
• Coroners/Funeral Directors: For identification or cause of death.
• National Security: For authorized federal activities.
• Inmates: For correctional health and safety.

Other Uses and Disclosures

All other uses require your written authorization. You may revoke it anytime in writing, but prior disclosures remain valid. We retain records as required.

Your Rights Regarding Your Medical Information

You have these rights (submit written requests to our Privacy Officer; forms available):

• Right to Inspect and Copy: View or copy your records (excluding psychotherapy notes). We may charge fees. Allow 24–48 hours. We provide electronic copies if requested and feasible (e.g., via secure email). Denials are rare and reviewable.
• Right to Amend: Request corrections if information is inaccurate. We may deny if not created by us, not part of our records, or already accurate.
• Right to Accounting of Disclosures: List of disclosures (excludes treatment, payment, operations, those made to you, or directories). First request free annually; fees for others. Covers up to 6 years post-April 14, 2003.
• Right to Request Restrictions: Limit uses or disclosures for treatment, payment, or operations or to involved individuals. We are not required to agree but will comply if we do (except in emergencies).
• Right to Confidential Communications: Request alternative methods or locations (e.g., email).
• Right to Paper Copy of This Notice: Available anytime.

Changes to This Notice

We may revise this Notice, effective for all PHI. Updated versions will be posted in our office and offered at registration.

Complaints

If you believe your rights were violated, contact our Privacy Officer or the Secretary of the U.S. Department of Health and Human Services. There will be no retaliation for complaints. All complaints must be in writing.

Contact Our Privacy Officer