Under the Health Insurance Portability and Accountability Act (HIPAA) of 1996, Protected Health Information (or “PHI”) means (among other things) any information, whether oral or recorded in any form or medium, that is created or received by a health care provider, and relates to your physical or mental health or condition, to the provision of health care to you, or to the payment for the provision of health care to you.


As your health care provider, effective April 14, 2003, we are required by law to maintain the privacy of your PHI, to provide you with a Notice stating our legal duties and privacy practices with respect to PHI, and to abide by the terms of that Notice so long as it is in effect.




Treatment.  We may use or disclose your PHI to provide, coordinate, or manage your health care and any related services, including coordination or management of your health care with a third party who may or may not have already obtained your permission to have access to your PHI.  For example, we will disclose your PHI, as we deem appropriate, to another physician, health care provider, hospital, surgical care facility, emergency room, skilled nursing facility, long term care facility, residential facility, adult day care facility, ambulatory care center, laboratory, pharmacy, durable medical equipment provider, or home health agency that provides care to you or that may care for you at our request.  We will obtain an authorization from you to use or disclose psychotherapy notes from your record. 


Payment.  We may use or disclose your PHI, as needed, to obtain payment for health care services that we provide to you.  This may include disclosure to a health, life, or disability insurance company, an employer group health insurance plan, a preferred provider organization, a managed care company, a health insurance clearing house, or any business associates who perform billing services for us (such as a collection agency).  For example, your health insurance plan may require us to disclose your PHI before the plan approves or pays for health care services we recommend for you, as when the plan determines eligibility or coverage for benefits, conducts a utilization review before authorizing hospitalization or surgery, or evaluates the medical necessity of services provided to you.  We will agree to a “restriction on disclosure of your PHI to a health plan” made by you when the disclosure is for payment or health care operations and you pay in full for the item or services to which the PHI relates.  The exception to this is if the disclosure is required by law, or if you fail to pay the bill.  Prepayment will be required if precertification is required. 


Healthcare Operations.  We may use or disclose your PHI, as needed, in order to conduct our business activities.  These activities include, but are not limited to:  describing or recommending treatment alternatives, providing information about health-related benefits and services that may be of interest to you or your family; training employees or medical students; conducting quality assessment or employee review activities; licensing; marketing or fundraising activities or the solicitation of funds to benefit our business; creating de-identified health information; and conducting or arranging for other business activities, or for the sale, transfer, merger or consolidation with another covered or non-covered entity.  For example, we may disclose your PHI to medical school students who see patients in our office or at a hospital where we hold privileges.  With regard to the use or disclosure of your PHI for fundraising, marketing or the sale of PHI, a separate authorization will be obtained from you and you will have the right to opt-out of any of these disclosures. 




  • We may disclose your PHI to an individual (such as a relative or close family friend) involved with your care, to the extent that the PHI is relevant to the individual’s involvement.  We may also disclose your PHI to an involved individual in order to notify (or assist in notifying) that individual of your location, general condition or death.  We may also disclose your PHI to an entity that is authorized to assist in disaster relief, when the disclosure is for coordination either of the purposes set forth above.  In each of these three cases, you will ordinarily be given an opportunity to object to the disclosure.  However, if you cannot be present, if you are incapacitated, or if there is an emergency situation, we may make the decision to disclose your PHI in one of these ways.  Such a disclosure will be based on our professional judgment, and will be made only if we determine that the disclosure is in your best interests.
  • We may use or disclose your PHI to the extent required by federal or state law.  The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law.
  • We may disclose your PHI to law enforcement officials:  in response to a court order or other legal process; in response to their limited requests for identification and location; in response to a request for information about the victim of a crime; if we suspect that your death has occurred as a result of criminal conduct; if the disclosure is evidence of a crime on our premises; in response to an emergency, if we determine that the disclosure is necessary to report a crime.
  • We may disclose your PHI if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, or is necessary for law enforcement officials to identify or apprehend an individual. If required by law, you will be notified of any such uses or disclosures.
  • If you are in the custody of a law enforcement official or are an inmate of a correctional institution, we may disclose your PHI to the official or institution when the disclosure is necessary for:  your health and safety; the health and safety of other individuals who are at the institution or who are responsible for transporting you; or administering and maintaining the safety, security, and good order of the institution.
  • We may disclose your PHI to a public health authority that is permitted by law to collect or receive the information for the purpose of:  controlling disease, injury, or disability.  For example, we may report:  child abuse or neglect, diseases, injuries, or vital statistics such as birth and death, and we may provide PHI to assist in the conduct of public health investigations, surveillance, and intervention.  If directed to do so by public health authority, we may disclose your PHI to a foreign government agency that is collaborating with the public health authority. 
  • If we believe that you have been the victim of abuse, neglect, or domestic violence, we may disclose your PHI to the governmental entity or agency authorized to receive such information.  The disclosure will be made in accordance with applicable state and federal laws.
  • We may use or disclose your PHI for research purposes, provided that:  the use or disclosure has been authorized by an institutional Review Board or a privacy board and the PHI is necessary for the research.
  • We may disclose your PHI to health oversight agencies for activities authorized by law, such as:  audits; investigations; inspections; civil, criminal, or administrative proceedings or actions; or other activities necessary for appropriate oversight of government programs relating to health care, benefits, and civil rights.
  • We may disclose your PHI to the FDA (Food and Drug Administration) for purposes related to the quality, safety, or effectiveness of products and services under the FDA’s jurisdiction.  For example, we may report adverse events, product defects or problems, or biologic product deviations; similarly, we may provide data to help the FDA track products, conduct product recalls, make repairs or replacements, or conduct surveillance.
  • We may disclose your PHI in the course of a judicial or administrative proceeding:  in response to the order of a court or administrative tribunal, but only to the extent such disclosure is expressly authorized by the court; or in response to a subpoena, discovery request, or other lawful process, but only if there are satisfactory assurances that reasonable efforts were made to notify you of the disclosure in advance and to obtain a qualified protective order. 
  • We may disclose your PHI to comply with workers’ compensation laws and other similar programs.
  • If you are in the Armed Forces (or foreign military service), we may disclose your PHI for activities deemed necessary by appropriate military command authorities (or foreign military authorities), provided that such authorities have published the notice required by law. 
  • We may disclose your PHI to authorized federal officials for conducting lawful intelligence, counter-intelligence and other national security activities authorized by the National Security Act and implementing authority.  We may also disclose your PHI to authorized federal officials for the provision of protective services to the President of the United States, or other persons, or heads of state as legally authorized. 
  • We may disclose your PHI to a coroner, medical examiner, or funeral director for identification purposes, for determining cause of death, or for other duties authorized by law.  We may disclose your PHI to the appropriate organizations for purposes of cadaveric organ, eye, or tissue donation.
  • We may disclose your PHI, when required by the Secretary of the Department of Health and Human Services, to investigate or determine our compliance with the privacy regulations (45 CFR 164.500 et seq.) promulgated under the Health Insurance Portability and Accountability Act of 1996.


Uses and disclosures of your PHI that are not described in this Notice will be made only with your written authorization.  You may revoke such an authorization at any time, in writing, except to the extent that we have already used or disclosed the PHI in reliance on the authorization.  If a breach of your PHI occurs by Central Nebraska Medical Clinic, you will be notified as set forth in the HITECH Privacy, Security, Enforcement, Breach and GINA Final Rule. 




Inspection and copying.  You have the right to inspect your PHI that is contained in our “designated record set”.  Our designated record set includes medical and billing records that we generate and use for making decisions about you.  For a reasonable fee, you have the right to obtain a copy of all or part of your designated record set in the format you request.  Your request will be completed within 30 days of our receipt of your request.  Under federal law, however, you may not inspect or copy:  psychotherapy notes; information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding; or PHI that is subject to the law prohibiting access to the PHI.  Under some laws, portions of a minor’s PHI may not be accessible to parents or legal guardians without the authorization by the minor.


Restriction of PHI.  You have the right to request restrictions on the use or disclosure of your PHI for treatment, payment, or health care operations.  You should understand that this restriction may hamper treatment by another provider, or payment by your insurer.  You should make this request, in writing, that any part of your PHI not be disclosed to family members or friends who may be involved in your care or for notification purposes as described in this Notice of Privacy Practices.  We have the right not to agree to the restrictions that you request.  You may make a similar request on behalf of your minor child; again, we have the right not to agree to the restrictions you request. 


Request of confidential communications.  You have the right to request that we communicate your PHI, or your minor child’s PHI, to you confidentially, by alternative means, or at an alternative location.  To the best of our ability, we will accommodate reasonable requests, for a reasonable fee.


Amendment of PHI.  You have the right to request that we amend the PHI in your designated record set, for as long as we maintain this information.  Your request must be made in writing, to the Privacy Contact listed below.  We have the right to deny the request.  You will be advised of such a denial, to which you can disagree, in writing, to the Privacy Contact.  Your physician has the right of rebuttal, of which you will be advised in writing.  The disagreement and rebuttal will be maintained in the designated record set.


Accounting of disclosures.  You have the right to receive an accounting of certain disclosures we have made of your PHI after April 14, 2003.  The accounting excludes disclosures for treatment, payment or health care operations.  The accounting also excludes any disclosures we have made:  to you; to family members or friends involved in your care, as described in this Notice; incident to a permitted use or disclosure, as described in this Notice; pursuant to an authorization; for a facility director or for notification purposes; for national security or intelligence purposes, as described in this Notice; or to correctional institutions, as described in this Notice.


Notice of Privacy Practice.  You have a right to obtain a paper copy of this Notice from us, upon request, even if you have agreed to accept this Notice electronically.  We reserve the right to change this Notice from time to time.  The effective date of this Notice is reflected at the bottom of the last page of this Notice.  Notices of Privacy Practice will be provided upon your presentation to our facility for services.  Changes may affect PHI created or received prior to the effective date of this Notice of Privacy Practices or its revisions and you will be provided a copy in the same manner as the original. 


Complaints.  If you believe we have violated your privacy rights, you have the right to complain to the Secretary of Health and Human Services.  You may also file a complaint with us by notifying our privacy contact of your complaint.  We will not retaliate against you for filing a complaint.


We have not listed here all of the activities included within HIPAA’s Privacy Rule;  so please refer to the HIPAA Privacy Rule for a complete list.  More information about HIPAA and the Privacy Rule may be found at 


You may contact our Privacy Officer, Sharon Zach, by telephone at 308-872-2486, by mail at PO Box 690, Broken Bow, NE 68822 or by e-mail at



145 Memorial Drive                404 W Main

Broken Bow, NE 68822                      Sargent, NE 68874                               Effective: September 23, 2013