Notice of Privacy Practices

HIPAA (Health Insurance Portability and Accountability Act)

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

4913 W. Reno, Oklahoma City, OK 73127 • Tel: (405) 948-4900 • Fax: (405) 948-4933

Any uses and disclosures not outlined in this notice will be made only with your written authorization, which you may later revoke in writing at any time by calling (405) 948-4900. (Such revocation would not apply where the health information already has been disclosed or used or in circumstances where OKCIC has taken action in reliance on your authorization or the authorization was obtained as a condition of obtaining insurance coverage and the insurer has a legal right to contest a claim under the policy or the policy itself.)

Contact Oklahoma City Indian Clinic’s Chief Operating Officer to exercise your rights under this Notice, to ask for more information, or to report a problem.

Understanding Your Health Record/Information

Each time you visit Oklahoma City Indian Clinic (OKCIC) for services, a record of your visit is made. If you are referred by OKCIC through the Purchased/Referred Care (PRC) program, OKCIC also keeps a record of your PRC visit. Typically, this record contains your symptoms, examination, test results, diagnoses, treatment, and a plan for future care. This information, often referred to as your health record, serves as a:

• Plan for your care and treatment.
• Communication source between health care professionals.
• Tool with which we can check results and continually work to improve the care we provide.
• Means by which Medicare, Medicaid or private insurance payers can verify the services billed.
• Tool for education of health care professionals.
• Source of information for public health authorities charged with improving the health of the people.
• Source of data for medical research, facility planning and marketing.
• Legal document that describes the care you receive.

Understanding what is in your health record and how the information is used helps you to:

• Ensure its accuracy. 
• Better understand why others may review your health information.
• Make an informed decision when authorizing disclosures.

How Oklahoma City Indian Clinic may use and disclose health information about you.

OKCIC may use and disclose Protected Health Information (PHI) without your authorization for the following purposes:

Treatment: We will use and/or disclose your health information to provide your treatment. For example: Your personal information will be recorded in your health record and used to determine the course of treatment for you. Your health care provider will document in your health record her/his instructions to members of your health care team. The actions taken and the observations made by the members of your health care team will be recorded in your health record so your health care provider will know how you are responding to treatment. If OKCIC refers you to another health care facility or provider for further care and treatment, OKCIC may disclose your health information to that health care provider for treatment decisions.

If you are transferred to another facility for further care and treatment, OKCIC may disclose information to that facility to enable them to know the extent of treatment you have received and other information about your condition.

Your health care provider(s) may give copies of your health information to others, including health care professionals or personal representatives to assist in your treatment.

Payment: We will use and/or disclose your health information for payment purposes. For example: If you have coverage through a health plan or program, a bill will be sent to the health plan/program for payment. The information on or accompanying the bill will include information that identifies you, as well as your diagnoses, procedures, supplies used for your treatment, and any other requested documentation to support the claim.

If OKCIC refers you to another health care provider under the PRC program, OKCIC may disclose your health information to that provider for health care payment purposes.

Health Care Operations: We will use and/or disclose your health information for health care operations. For example: We may use your health information to evaluate your care and treatment outcomes with our quality improvement team. This information will be used to continually improve the quality and effectiveness of the services we provide. This includes health care services provided under the PRC program.

In addition to Treatment, Payment, and Health Care Operations (TPO), HIPAA allow OKCIC to use and disclose PHI without patient authorization for specific situations, including the following:

• Health Information Exchange (HIE): OKCIC will make your information available electronically through an information exchange network to other providers who are involved in your care.
• Personal Health Record: The Personal Health Record (PHR) is a secure web based application that provides patients access to their health care information. The PHR is accessible to patients who receive care within the IHS health system and requests a PHR account. 
• DIRECT Messaging: OKCIC may share your health information between providers, you and/or your authorized representatives, using the DIRECT secure, web-based messaging service.
• Business Associates: OKCIC provides some health care services and related functions through the use of contracts with business associates. For example, OKCIC may have contracts for medical transcription. When these services are contracted, OKCIC may disclose your health information to business associates so that they can perform their jobs. OKCIC requires our business associates to protect and safeguard your health information in accordance with all applicable federal laws.
• Notification: OKCIC may use or disclose your health information to notify or assist in the notification of a family member, personal representative or other authorized person(s) responsible for your care, unless you notify us that you object.
• Communication with Family: OKCIC health providers may use or disclose your health information to others involved with/responsible for your care unless you object. For example, OKCIC may provide your family members, other relatives, close personal friends or any other person you identify with health information which is relevant to that person’s involvement with your care or payment for such care.
• Emancipated Minors and Incompetent Adults: OKCIC may disclose health information to an emancipated minor and to a personal representative of an individual who has been declared incompetent due to physical or mental incapacity by a court of competent jurisdiction.
• Interpreters: In order to provide you proper care and services, OKCIC may use the services of an interpreter. This may require the use or disclosure of your personal health information to the interpreter.
• Research: OKCIC may also use or disclose your health information for research purposes based on your written authorization.
• Uses and Disclosures about Decedents: OKCIC may use or disclose health information about decedents to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law. OKCIC also may disclose health information to funeral directors consistent with applicable law as necessary to carry out their duties. In addition, OKCIC may disclose protected health information about decedents where required under the Freedom of Information Act or as otherwise required by law.
• Treatment Alternatives and Other Health-Related Benefits and Services: OKCIC may contact you to provide information about treatment alternatives or other types of health related benefits and services that may be of interest to you. For example, we may contact you about the availability of new treatment or services for diabetes.
• Food and Drug Administration (FDA): OKCIC may use or disclose your health information to the FDA in connection with an FDA-regulated product or activity. For example, we may disclose to the FDA information concerning adverse events involving food, dietary supplements, product defects or problems, and information needed to track FDA-regulated products or to conduct product recalls, repairs, replacements, or look backs (including locating people who have received products that have been recalled or withdrawn), or post marketing surveillance.
• Appointment Reminders: We may use or disclose your contact information for the purpose of notifying you of a pending or missed appointment. You may be contacted by mail or telephone at any phone number associated with you,  including wireless numbers. Telephone calls may be made using pre-recorded or artificial voice messages and/or an automatic dialing device (an “autodialer”). Messages may be left on answering machines or voicemail. Text messages or emails using any email addresses you provide may also be used for this purpose. 
• Workers Compensation: OKCIC may use or disclose your health information for workers compensation purposes as authorized or required by law.
• Public Health: OKCIC may use or disclose your health information to public health or other appropriate government authorities (Federal, State, local or Tribal) as follows: (1) OKCIC may use or disclose your health information to government authorities that are authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, or conducting public health surveillance, investigations, and interventions; (2) OKCIC may disclose your health information to government authorities that are authorized by law to receive reports of child abuse or neglect, and (3) OKCIC may disclose your health information to government authorities that are authorized by law to receive reports of other abuse, neglect, or domestic violence as required by law, or as authorized by law if OKCIC believes it is necessary to prevent serious harm. Where authorized by law, OKCIC may disclose your health information to an individual who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition. In some situations (for example, if you are employed by OKCIC or another component of the Department of Health and Human Services, or if necessary to prevent or lessen a serious and imminent threat to the health and safety of an individual or the public), OKCIC may disclose to your employer health information concerning a work related illness or injury or a workplace-related medical surveillance.
• Correctional Institution: If you are an inmate of a correctional institution, OKCIC may use or disclose to the institution, health information necessary for your health and the health and safety of other individuals such as officers or employees or other inmates.
• Law Enforcement: OKCIC may disclose your health information for law enforcement activities as authorized by law or in response to a court of competent jurisdiction.
• Health Oversight Authorities: OKCIC may use or disclose your health information to health oversight agencies for activities authorized by law. These oversight activities include: investigations, audits, inspections and other actions. These are necessary for the government to monitor the health care system, government benefit programs, and entities subject to government regulatory programs and/or civil rights laws for which health information is necessary to determine compliance. OKCIC is required by law to disclose protected health information to the Secretary of HHS to investigate or determine compliance with the HIPAA privacy standards.
• Sexual Orientation/Gender Identity (SO/GI) Information: SO/GI information and preferred name are collected so we can address you the way you want to be addressed and acknowledge you in a way you are most comfortable. This data will ensure our LGBTQ/Two Spirit patients are being provided with services and treatments that fit their health care needs. Participation is voluntary and all data collected is confidential.
• Members of the Military: If you are a member of the military services including the Commissioned Corps of the United States Public Health Service, OKCIC may use or disclose your health information if necessary to the appropriate military command authorities as authorized by law.
• Compelling Circumstances: OKCIC may use or disclose your health information in certain other situations involving compelling circumstances affecting the health or safety of an individual. For example, in certain circumstances: (1) we may disclose limited protected health information where requested by a law enforcement official for the purpose of identifying or locating a suspect, fugitive, material witness or missing person; (2) if you are believed to be a victim of a crime, a law enforcement official requests information about you and we are unable to obtain your agreement because of incapacity or other emergency circumstances, we may disclose the requested information if we determine that such disclosure would be in your best interests; (3) we may use or disclose protected health information as we believe is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person; (4) we may use or disclose protected health information in the course of judiciary and administrative proceedings if required or authorized by law; (5) we may use or disclose protected health information to report a crime committed on the OKCIC premises or when OKCIC is providing services during an emergency; and (6) OKCIC may use or disclose health information during a disaster and for disaster relief purposes.
• Required by Law: OKCIC may use or disclose health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.

Non Violation of this Notice: OKCIC is not in violation of this Notice or the HIPAA Privacy Rule if any of its employees or its contractors (business associates) discloses protected health information under the following circumstances:

• Disclosures by Whistleblowers: If an OKCIC employee or contractor (business associate) in good faith believes that OKCIC has engaged in conduct that is unlawful or otherwise violates clinical and professional standards or that the care or services provided by OKCIC has the potential of endangering one or more patients or members of the workplace or the public and discloses such information to:
  • Public Health Authority or Health Oversight Authority authorized by law to investigate or otherwise oversee the relevant conduct or conditions, or the suspected violation, or an  appropriate health care accreditation organization for the purpose of reporting the allegation of failure to meet professional standards or misconduct by OKCIC; or
  • An attorney on behalf of the workforce member, or contractor (business associate) or hired by the workforce member or contractor (business associate) for the purpose of determining their legal options regarding the suspected violation. 
• Disclosures by Workforce Member Crime Victims: Under certain circumstances, an OKCIC workforce member (either an employee or contractor) who is a victim of a crime on or off the facilities premises may disclose information about the suspect to law enforcement official provided that:
  • The information disclosed is about the suspect who committed the criminal act.
  • The information disclosed is limited to identifying and locating the suspect.

Certain uses and disclosures of PHI require your written authorization before the clinic can share the information. These include, but are not limited to:

• Psychotherapy Notes: Uses or disclosure of psychotherapy notes generally requires patient authorization, except in limited cases such as legal defense by the provider or certain treatment-related uses.
• Marketing Purposes: OKCIC must obtain authorization before using or disclosing PHI for marketing purposes, unless the communication is face-to-face or involves  a promotional gift of nominal value.
• Sale of PHI: Any disclosure that involves the sale of PHI requires explicit patient authorization, with limited exceptions such as public health purposes or research where only reasonable cost-based fees are charged.
• Certain Disclosures of Substance Use Disorder Treatment Records: Information related to treatment for substance use disorders, governed by 42 CFR Part 2,  often requires patient authorization before being shared, except in specific circumstances such as medical emergencies or court orders.
• Other Uses Not Covered by HIPAA Regulations: Any other use or disclosure of PHI not explicitly permitted under HIPAA regulations requires your written authorization.

Your Health Information Rights

Although your health record is the physical property of OKCIC, the information belongs to you.

You have the right to:

• Receive an electronic or paper copy of your health record within 30 days (with possible extension).
• Request records obtained from doctors, hospitals, and other healthcare providers that were provided to OKCIC to make decisions about your care.
• Request a restriction on certain uses and disclosures of your health information. For example, you may ask that we not disclose your health information and or treatment to a family member. OKCIC is not required to agree to your request, and may say “no” if it would affect your care. You may also request that your PHI not be disclosed to your health plan for payment if you have already paid OKCIC in full for the services rendered.
• Request a correction/amendment to your health record. If you believe the health information we have about you is incorrect or incomplete, we may amend your record or include your statement of disagreement.
• Request confidential communications about your health information. You may ask that we communicate with you in a specific way. For example, you may ask that we call you at home or work, or that we send mail to a location other than your home. Reasonable requests will be honored.
• Receive a listing of certain disclosures OKCIC has made of your health information. You can ask for a list of the times we have shared your health information during the six (6) years prior to the date you ask, who we shared it with and why. We will include all disclosures except for those about treatment, payment, health care operations and certain other disclosures (such as any you asked us to make).
• Revoke your written authorization to use or disclose health information. This does not apply to health information already disclosed or used or in circumstances where we have taken action on your authorization or the authorization was obtained as a condition of obtaining insurance coverage and the insurer has a legal right to contest a claim under the policy or the policy itself.
• Choose someone to act for you. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. OKCIC will make sure the person has this authority and can act for you before taking any action.
• Obtain a paper copy of Oklahoma City Indian Clinic Notice of Privacy Practices upon request.
• Obtain a paper copy of System IHS Notice # 09-17-0001 upon request. Notice # 09-17-0001 is in the Federal Register and includes details about information that is collected and why.
• File a written complaint, if you believe your HIPAA rights have been violated to:
  • Oklahoma City Indian Clinic, Privacy Office, 4913 Reno Ave, Oklahoma CIty, OK 73127. 
  • U.S. Department of Health and Human Services at  200 Independence Avenue, S.W. Room 509F HHH Bldg., Washington, D.C. 20201 or OCRcomplaint@hhs.gov

Your Privacy Rights Regarding Reproductive Health

• Compliance with State and Federal Laws:
  • We comply with the Health Insurance Portability and Accountability Act (HIPAA) and all applicable state laws. Where state laws impose restrictions on certain reproductive services, we will disclose information only when legally mandated. We will make reasonable efforts to inform you of such disclosures unless prohibited by law or if circumstances prevent timely notification.

• Protection of Reproductive Health Information:
  • We are committed to safeguarding your reproductive health information. “Protected Health Information” (PHI) includes any information that identifies you and relates to your reproductive health services. We will not disclose your reproductive health PHI without your written authorization, except as required or permitted by law.
• Disclosures to Law Enforcement and Legal Requests:
  • We will not disclose your reproductive health information to law enforcement or third parties without a valid court order, subpoena, or other legally binding request, unless:
    • Disclosure is required by law, such as to prevent serious harm or to protect your safety or the safety of others.
    • Disclosure is necessary to comply with mandatory public health reporting requirements (e.g., reporting communicable diseases).
    • Disclosure is necessary in an emergency situation to provide essential medical treatment, limited to the information required to address the emergency.

No Retaliation

OKCIC will not retaliate against you for filing a complaint. If OKCIC determines  that your privacy rights have been violated, you will be notified by the OKCIC Privacy Officer or designee.

Contact Information

You may contact the OKCIC Privacy Officer for further information about the complaint process or for further explanation of this document. The OKCIC Privacy Officer (or designee) may be contacted at:

Oklahoma City Indian Clinic
Privacy Officer
4913 W. Reno Ave.
Oklahoma City, Oklahoma 73127
(405) 948-4900

Oklahoma City Indian Clinic’s Responsibilities

Oklahoma City Indian Clinic is required by law to:

• Maintain the privacy and security of your protected health information.
• Inform you about our privacy practices regarding health information we collect and maintain about you.
• Notify you if we are unable to agree to a requested restriction.
• Promptly notify you if a breach occurs that may have compromised the privacy or security of your protected health information (PHI).
• Honor the terms of this Notice or any subsequent revisions of this Notice.

Oklahoma City Indian Clinic will not share your information without your written authorization in the following circumstances:

• Marketing purposes
• Sale of your information
• Most sharing of psychotherapy notes (except when required by law)

OKCIC may contact you for fundraising efforts, but you can tell us not to contact you again.

OKCIC reserves the right to change its privacy practices and to make the new provisions effective for all PHI it maintains. The revised Notice will be available upon request, posted in public places at OKCIC, and included on our web site at www.okcic.com.

OKCIC understands that health information about you is personal and is committed to protecting your health information. OKCIC will not use or disclose your health information without your permission, except as described in this Notice and as permitted by the Privacy Act and Oklahoma City Indian Clinic Health and Medical Records; System IHS Notice 09-17-0001.

Effective Date: April 14, 2003
Revised Date: March 5, 2025