Patient Privacy Policy
Highland Family Practice, P.A.
1248 Ft. Bragg Road
Fayetteville, NC 28305
Effective: 09/22/2006


If you have any questions abut this notice, please contact the business manager: or 910-323-0334.


This notice describes our practice and that of:

  • Any health care professional authorized to enter information into your medical record.
  • All sections of the practice.
  • Any member of the practice we allow to help you while you are in our practice.
  • All employees, staff and other practice personnel.


We are aware and understand the medical information regarding you and your health is personal. We are committed to protecting all medical information about you. We create a record of the medical care and services you receive at our practice. We need this record to provide you with quality care and to comply with legal requirements. This notice applies to all records about your care generated by the practice, whether made by our personnel or your primary care doctor. Your primary care doctor may have different policies or notices regarding the doctor's use and disclosure of your medical information created in the provider's office.

This notice will tell you about the way in which we may use and disclose medical information about you. We also describe to you your rights and certain obligations we have regarding the use and disclosure of medical information.

We are required by law to:
  • Make sure that medical information that identifies you is keep private at all times
  • Give you this notice of our legal duties and privacy policies with regards to medical information about you and
  • Follow the terms of the notice that is currently in effect.

We reserve the right to make changes to the notice and to make such changes effective for all Protected Health Information (PHI) we may already have about you. If and when this notice is changed, we will post a copy in our office in a prominent location. We will also provide you with a copy of the revised notice upon your request made to our Privacy Officer.


The following categories describe the different ways that we use and disclose medical information. For each category of uses or disclosures, we will explain to you what we mean. Every use or disclosure in a category will not be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

For Treatment. We may use medical information about you to provide you with medical treatment or services. We may disclose medical information about you with doctors, nurses, technicians, medical students, or hospital personnel who are involved in taking care of you, should you require care at Cape Fear Valley Medical Center, Highsmith-Rainey Memorial Hospital, The Fayetteville Ambulatory Surgery Center or other health facility such nursing homes, etc. We may also disclose your PHI to family members who assist in your care such as spouse, children, or parents ,if we feel it is necessary for your treatment. We may contact you at home, work or other phone number at which you have agreed in writing to be notified; by regular mail, or by e-mail if you have signed an e-mail communication agreement in connection with treatment.

For Payment. We may use and disclose medical information about you so that the treatment and services you receive by one of our providers may be billed to and payment may be collected from you, an insurance carrier or a third party. We may also need to tell your insurance carrier about a treatment in order to obtain prior-authorization or determine if your plan covers the procedure or treatment. We may disclose limited PHI to collection agency relating to collection of payment owed to us. We may disclose PHI to other companies in which you have requested coverage and we may disclose to allow a health insurance company to review PHI for the insurance company to determine the insurance benefits to be paid for your care.

Health Care Operations. We may use and disclose your PHI to operate our business. For example, we may use your PHI to evaluate the quality of care we provided to you, for peer review, or for cost-management and business planning activities related to the practice.

USES AND DISCLOSURES NOT REQURING SEPARATE AUTHORIZATION. Please notify us if you do not wish to be contacted for appointment reminders, treatment alternatives or health-related products and services. If you advise us in writing at the address at the top of this notice, or on the patient Consent for Use and Disclosure of Protected Health Information, that you do not wish to receive such communications, we will not use or disclose your information for thee purposes.

Appointment reminders. We may use and disclose PHI in contacting you by phone, mail, e-mail at any hone number or address we have on file to remind you of an appointment.

Treatment options. We may use and disclose PHI to inform you of potential treatment options or alternatives.

Health-related products and services. We may use and disclose to PHI to inform you of health-related products or services that may be of interest to you.

Release of Information to family and friends. We may use and disclose your PHI to a friend or family member if we obtain your verbal or written agreement, or if you do not object to such a disclosure when given the opportunity. We may disclose health information to family or friend is we conclude in our professional judgment under the circumstances that you would not object. For instance, we may assume you agree to our disclosure of PHI if you bring your spouse or friend into the exam room with you when treatment is provided or discussed. As another example, a parent or guardian may ask that a babysitter take their child to the doctor's office for treatment of a cold. In this example, the babysitter may have access to this child's medical information.

If you cannot give consent due to a medical emergency, physical or mental incapacity in your absence, we may determine in our professional judgment that disclosure to your family member or friend is in your best interest. In that case, we will disclose only heath information relevant to the person's involvement in your care. For example, if a person brought you to the emergency room we may inform them you had a heart attack and give them updates on your status. Ir if you are physically unable to pick up a prescription or medical supply, we may disclose information to a person who can then obtain the needed item for you.


The following categories describe unique scenarios in which we may use or disclose your identifiable health information:

DISCLOSURES REQUIRED BY LAW. We may use and disclose you PHI when we are required do do by federal, state or local law. As required by law, the practice discloses PHI to public health officials. This includes reporting of communicable diseases and other conditions, sexually transmitted infections, lead poison, Reyes Syndrome and mandated reports of injury, medical conditions or procedures, or food-borne illness. This may also include, but is not limited to adverse reactions to immunizations, cancer, adverse pregnancy outcomes, death and birth. As required by law, the practice disclosed PHI to the proper authorities regarding victims of abuse, neglect or domestic violence about any minor, disabled adult, nursing home resident or person over 60 years of age who the practice reasonably believes to be a victim of abuse or neglect, this includes child abuse of a disabled adult. If not required by law, this information is disclosed only if the individual agrees to the disclosure. The practice informs the individual of such reporting unless: (a) the practice, in its professional judgment believes informing the individual would place him or her at risk of serious harm; (b) the practice would be informing the individual's personal representative who is believed by the practice to be responsible of abuse, neglect or other injury and the practice believes in its professional judgment that informing this personal representative would not be in the patient's best interests.

Health oversight activities. We may disclose your PHI to a health oversight agency for activities authorized by law. This information may be use and release for audits, investigations, licensed issues and other health oversight activities which may include, but are not limited to hospital peer review, managed care peer review or Medicaid or Medicare peer review, other civil, administrative and criminal procedures or actions and other activities necessary for the government to monitor government programs, compliance with civil rights laws and the heath care system in general.

Judicial and Administrative proceedings: We may use and disclose your PHI for judicial and administrative proceedings in response to a court order or administrative order. Disclosure will be limited to PHI expressly authorized by the order. We also may disclose your PHI in response to a discovery request, subpoena, or other lawful process not accompanied by a court or administrative order, but only if we are satisfied that a reasonable effort has been made by the requester either (a.) to inform you of the request and allow you to raise objections or (b) to obtain a qualified protective order from a court or administrative tribunal.

Law enforcement. We may disclose your PHI for law enforcement purposes to law enforcement officials. The information sought must be relevant and material, the request must be specific and limited to amount reasonably necessary and it is not possible to use de-indentified information.

  • The practice releases limited PHI to identify or locate a suspect, fugitive, material witness or missing person only as approved by a person authorized to act on behalf of the individual.
  • The practice discloses limited PHI about a suspect victim of a crime if the individual agrees to disclosure.
  • The practice discloses PHI about a deceased individual if the practice suspects that death resulted from criminal conduct and such disclosure is approved by persons authorized to act on behalf of the deceased individual.
  • The practice discloses PHI that the practice judges to constitute evidence of criminal conduct that occurred on covered entity's premises.
  • The practice discloses PHI relating to emergency health care as required or permitted by law, such as test results of those involved in automobile accidents.
  • The practice may disclose PHI when the practice has reasonable cause to believe the patient's ability to safely drive may be impaired.

  • Serious threats to health or safety. Our practice may use and disclose your PHI to public health and other authorities as required by law when necessary to avert a serious threat to the health and safety of yourself, another individual or the general public.

    Special government functions. Our practice may use and disclose your PHI as required by law for military and veterans activities, national security and intelligence activities, and other activities.

    Inmates. Our practice may disclose your PHI to correctional institutions or law enforcement officials if you are an inmate or under the custody of a law enforcement official. Disclosure for these purposes would be necessary: (a) for the institution to provide health care services to you (b) for the safety and security of the institution and or, (c) to protect your health and safety or the health and safety of other individuals.

    Compensation. Our practice may release your PHI for worker's compensation and similar programs. Worker's compensation is concerned under HIPPA, but a signed authorized usually is not required for release of PHI in worker’s compensation cases, because such release PHI is required by law.

    Deceased patients. Our practice may release PHI to a medical examiner, coroner or funeral directed as required by law. The attending physician is required to sign the death certificate and provide the coroner with a copy of the decedent’s PHI.

    Organ and tissue donation. Our practice may use and disclose your PHI to facilitate organ,eye or tissue donations.

    Research. Our practice may use and disclose your PHI for research purposes in certain limited circumstance. We will obtain your written authorization to use your PHI for research purposes except when an Institutional Review Board or Privacy Board determines that a waiver of your authorizations satisfies the following:

  • an adequate plan to protect the identifiers from improper use and disclosures
  • an adequate plan to destroy the identifiers at the earliest opportunity consistent with the research (unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law;
  • adequate written assurances that the PHI will not be re-uses or disclosed to any other person or entity
  • (except as required by law) for authorized oversight of the research study or for other research for which the use or disclosure would otherwise be permitted;
  • the research could not practicably be conducted without the waiver and
  • the research could not practicably be conducted without access to and use PHI.

  • Other use and disclosures of health information.

    Our practice will obtain your written authorization for use and discloses that are not re identified by this notice or permitted by applicable law. We will provide the patient upon request with a copy of the authorization requested by the practice and signed by the patient. If you give us written authorization to use or disclose health information about you, you may revoke that authorization in writing at any time. If you do revoke an authorization, we will no longer use or disclose information about you for the reasons covered by the authorization, but we cannot take back any authorized uses or disclosures already made.

    Our practice does not use or disclose PHI to an employer or health plan sponsor for underwriting or related purposes, for faculty directories, to brokers and agents, or for fundraising. In addition, automobile insurance, homeowner's insurance, and similar policies that provide coverage for health care expenditures are not covered under HIPPA, in most circumstances. A signed authorization is required prior to releasing PHI to such entities. If an individual want the practice to release information for any of these purposes, a written authorization must be submitted to the practice.

    Your individual right regarding you PHI. You have the following individual rights regarding the PHI that we maintain about you.

  • Right to confidential communications. You have the right to request that our practice communicate with you about your health related issues in a particular manner or at a certain location. For instance, you may ask that we contact you at home rather than at work. In order to request a type of confidential communications you must make a written request to the Business manager, Highland family Practice, PA 1248 Ft. Bragg Rd., Fayetteville, NC 28305, specifying the requested method of contact or the location where you wish to be contacted. You do not need to give a reason for your request. Our practice will accommodate reasonable requests with reasonableness determined solely based on the administrative difficulty of complying with the request. The practice will not refuse a request if the requester indicated that the communication will cause endangerment or based on any perception of merit of the requester request.
  • Right to request restrictions. You have the right to request a restriction in our use or disclosure of your PHI for treatment, payment or health care operations. Additionally, you have the right to request that we restrict our disclosure of your PHI to only certain individuals involve in your care or the payment for your care, such as family members and friends. We are not required to agree to your request, However, if we do agree, we are bound by our agreement except with otherwise required by law, in emergencies or when the information is necessary to treat you. In order to request a restriction in our use or disclosure of your PHI, you must make your request in writing to Business Manager, Highland Family Practice, 1248 Ft. Bragg Road, Fayetteville, NC 28305. Your request must describe in a clear and concise fashion; (a) the information you wish restricted; (b) whether you are requesting to limit our practice's use, disclosure or both (c) to who you want the limits to apply.
  • Right to inspection and copies. You have the right to inspect and obtain a copy of the PHI in the presence of a practice employee. This include information that may be used to make decisions such a hospital records, laboratory or x-ray reports, and records from previous physicians, may be inspected and copied in the same manner as records generated by the practice. All requests to inspect record will be documented, and the practice will respond to request in a timely fashion. Our practice may deny your request to inspect and or copy in certain limited circumstances however; you may request a review of our denial. Another licensed health care professional chosen by will conduct review. To request inspection and copying of records, you must submit a request in writing to Business Manager, Highland Family Practice. 1248 Ft. Bragg Road, Fayetteville, NC 28305. Our practice will charge a reasonable fee, not more than the legal NC limit, for the costs of copying, mailing, labor and supplies associated with your request. NC law prohibits charges that exceed the following: $20.00 handling fee plus 75 cents per each page 1-25, 50 cents each for pages 26-50 pages and 26 cents for pages 51-100 with a cap of $25.20 and 15 cents per page over 100 pages, plus actual expenses related to the copying of x-rays, CAT scans and similar documents.
  • Right to amendment. You may ask us to amend your health information or billing record if you believe it is incorrect or incomplete, and you may request an amendment for as long as the information is kept by or for our practice. The practice documents all requests for amendment, responds to requests in a timely fashion, and informs individuals of their appeal rights when a request is denied in whole or in part. If we deny your request, we will provide a written denial in a timely fashion. You may submit a written statement of one page or less in length if you disagree with a denial. Your statement must include the reason for you disagreement.
  • To request an amendment, your request must be made in writing and submitted to Office Manager, Highland Family Practice, PA 1248 Ft. Bragg Road, Fayetteville, NC 28305. You must provide us with a reason that supports your request for amendment. Our practice will deny your request if you fail to submit your request (and the reason supporting your request) in writing. Also, we may deny your request if you ask us to amend information that is in our opinion: (a) accurate and complete; (b) not part of the PHI kept by or for the practice; (c)not part of the PHI which you would permitted to inspect and copy; or (d) not created by our practice, unless the individual or entity that created the information is not available to amend the information.
  • Right to Accounting of Disclosures. Our practice tracks all disclosures of a patient's PHI that are a) not for the purposes of treatment, payment and health care operations; b) not made to the patient or a person involved in his care; c) not made as a result of a patient authorization, and d) not made for national security or intelligence purposes or to correctional institutions or law enforcement officials. Documentation of uses of your PHI as part of the routine patient care in our practice in not required. Examples of routine use are the doctor sharing information with the nurse, or the billing department using your information to file your insurance claim. All patients have the right to request an “accounting of disclosures”.
  • All requests for an “accounting of disclosures” must specify a time period, which may be up to, but not longer than, six (6) years form the date of disclosure. The request may not include dates before April 14, 2003. The practice will respond within 60 days to a request for accounting of disclosures. If the practice intends to provide the accounting for disclosures but cannot do so within 60 days, the requester will be informed of the reason for the delay and the date the practice expects to fulfill the request. Only one 30-day extension is permitted. The first list you request within a 12-month period is free of charge, but our practice will charge $15 for additional lists within the same 12-month period. You may withdraw your request before you incur any cost.
  • To obtain an accounting of disclosures, you must submit your request in writing to Office Manager, Highland Family Practice, PA, 1248 Ft. Bragg Road, Fayetteville, NC 28305.
  • Right to File a Complaint. If you believe your privacy rights have been violated, you may file a complaint with our practice at Office Manager, Highland Family Practice, PA, 1248 Ft. Bragg Road, Fayetteville, NC 28305. All complaints must be submitted in writing, must describe the acts or omissions that are the subject to the complaint, and must be filed within 180 days of the time the patient became aware, or should have become aware, of the violation. The practice investigates each complaint and may, at its discretion, reply to the patient of the patient's agent. You may also submit a complaint to the Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W. Room 509F HHH Building, Washington, DC 20201. Any complaint filed with the Department of Health and Human Services must be in writing, must name the practice, describe the acts or omissions that are the subject of the complaint, and must be filed within 180 days of the time the patient became aware or should have become aware of the violation. Highland Family Practice will not take any adverse action against a patient for filing a complaint, either directly or through an agent, against the practice.
  • Right to a Paper Copy of This Notice. You are entitled to receive a paper copy of our Notice or Privacy Practices. You may ask us to give you a paper copy of this notice at any time. To obtain a paper copy of this notice, contact Business manager, Highland Family Practice, PA, 1248 Ft. Bragg Road, Fayetteville, NC 28305. You may also obtain a copy from the practice website.