Notice of Privacy Practices
HIPAA NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.
This Notice of Privacy Practices ("Notice") is provided in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HIPAA Privacy Rule (45 C.F.R. Parts 160 and 164), and applicable Oregon privacy laws, including ORS 192.553 through ORS 192.581.
Effective Date: February 17, 2026
1. OUR LEGAL DUTIES
We are required by law to maintain the privacy and security of your protected health information ("PHI"). We must provide you with this Notice of our legal duties and privacy practices with respect to your PHI, and we must follow the terms of this Notice currently in effect.
We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
2. HOW WE MAY USE AND DISCLOSE YOUR PHI
The following categories describe different ways we may use and disclose your PHI without your written authorization. Not every use or disclosure in a category will be listed; however, all permitted uses and disclosures will fall within one of the categories.
A. Treatment
We may use and disclose your PHI to provide, coordinate, or manage your dental care and related services. For example, we may disclose information to other dentists, specialists, physicians, laboratories, pharmacies, or other healthcare providers involved in your care.
B. Payment
We may use and disclose your PHI so that the treatment and services you receive may be billed to and payment may be collected from you, your insurance company, or a third party. For example, we may provide information to your dental plan to obtain prior authorization or to determine whether your plan will cover treatment.
C. Healthcare Operations
We may use and disclose your PHI for our healthcare operations. These uses and disclosures are necessary to run our practice and ensure quality care. Examples include quality assessment and improvement activities, training programs, credentialing, licensing, business planning, and administrative activities.
D. Business Associates
We may disclose your PHI to third parties that perform services for us ("business associates"), such as billing services, practice management, IT support, shredding services, or accounting. Business associates are required by law and contract to safeguard your PHI.
E. Appointment Reminders and Communications
We may use and disclose your PHI to contact you for appointment reminders, treatment follow-up, and other health-related communications. We may contact you by phone, voicemail, text message, email, or mail unless you tell us not to use a specific method.
F. Persons Involved in Your Care
Unless you object, we may disclose your PHI to a family member, friend, or other person you identify who is involved in your care or payment for your care. We may also disclose information to notify such persons of your location, general condition, or death.
G. Required by Law; Public Health; Oversight; Law Enforcement
We may disclose your PHI when required to do so by federal, Oregon state, or local law; for public health activities; to report suspected abuse, neglect, or domestic violence; to health oversight agencies for audits, investigations, inspections, and licensure; and for certain law enforcement purposes as permitted by law.
H. Judicial and Administrative Proceedings
If you are involved in a lawsuit or dispute, we may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process as permitted by law.
I. Workers’ Compensation
We may disclose your PHI for workers’ compensation or similar programs that provide benefits for work-related injuries or illness.
3. USES AND DISCLOSURES REQUIRING AUTHORIZATION
Other uses and disclosures of your PHI not described in this Notice or permitted by applicable law will be made only with your written authorization. You may revoke an authorization at any time by submitting a written revocation to our Privacy Officer, except to the extent we have already acted in reliance on your authorization.
4. SPECIAL HIPAA PROTECTIONS
We will not sell your PHI, use or disclose your PHI for most marketing purposes, or disclose psychotherapy notes without your written authorization. If you have paid for a service or item out-of-pocket in full, you may request that we not disclose information about that service or item to your health plan for purposes of payment or healthcare operations, as required by HIPAA.
5. SUBSTANCE USE DISORDER (SUD) RECORDS – 42 C.F.R. PART 2
Federal law provides special protections for certain records related to substance use disorder (SUD) diagnosis, treatment, or referral for treatment. The U.S. Department of Health and Human Services (HHS) issued a final rule modifying the Confidentiality of Substance Use Disorder Patient Records regulations (42 C.F.R. Part 2). This rule imposes additional requirements on HIPAA-covered entities and their Notices of Privacy Practices (NPPs).
If we create, maintain, or receive SUD records that are subject to 42 C.F.R.
Part 2:
• We will use and disclose such records only as permitted by 42 C.F.R. Part 2 and other applicable law.
• A single patient consent may authorize use and disclosure for treatment, payment, and healthcare operations, as permitted by the updated rule.
• Redisclosure of Part 2 information is restricted and may be prohibited without additional consent or legal authority.
• You have the right to receive an accounting of disclosures of your SUD records, as required by law.
• Discrimination based on information contained in SUD treatment records is prohibited by federal law.
6. OREGON-SPECIFIC PRIVACY LAW (CROSS-REFERENCES)
In addition to HIPAA, Oregon law provides protections related to the confidentiality and disclosure of health information. Our practice complies with applicable Oregon privacy laws, including (but not limited to:)
• ORS 192.553 through ORS 192.581 (Oregon health information privacy provisions).
• ORS 192.558 (permitted uses and disclosures of protected health information).
• ORS 192.563 (patient right to inspect and obtain a copy of protected health information).
• Other Oregon laws that may provide heightened protections for certain sensitive information.
If there is a conflict between HIPAA and Oregon law, we will follow the law that provides greater privacy protection to you.
7. YOUR RIGHTS
You have the following rights regarding your PHI. To exercise these rights, contact our Privacy Officer using the information in Section 10.
Right to Inspect and Copy
You may ask to inspect or obtain an electronic or paper copy of your medical and billing records and other health information we maintain about you. We will provide a copy or a summary, usually within 30 days of your request. We may charge a reasonable, cost-based fee.
Right to Request an Amendment
You may ask us to correct health information about you that you believe is incorrect or incomplete. We may deny your request, but we will provide a written explanation within the time required by law.
Right to an Accounting of Disclosures
You may ask for a list (accounting) of certain disclosures we have made of your health information for up to six (6) years prior to the date you ask, as permitted by law. This includes an accounting of disclosures of SUD records subject to 42 C.F.R. Part 2, where applicable.
Right to Request Restrictions
You may ask us not to use or disclose certain information for treatment, payment, or operations. We are not required to agree, and we may deny your request if it would affect your care.
Right to Request Confidential Communications
You may ask us to contact you in a specific way (for example, at a different phone number) or to send mail to a different address. We will accommodate reasonable requests.
Right to Receive a Paper Copy of This Notice
You may ask for a paper copy of this Notice at any time, even if you have agreed to receive it electronically.
Right to Choose Someone to Act for You
If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will verify authority before taking action.
8. CHANGES TO THIS NOTICE
We reserve the right to change the terms of this Notice at any time. The revised Notice will apply to all PHI we maintain. The current Notice will be available upon request, in our office, and on our website (if applicable).
9. COMPLAINTS
If you believe your privacy rights have been violated, you may file a complaint with us and/or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against for filing a complaint.
10. CONTACT INFORMATION
Lotus Dental Wellness
5 Centerpointe Drive, Suite 260, Lake Oswego, OR 97035
Phone: 503-684-4174
Email: om@lotusdentalwellness.com
Website: lotusdentalwellness.com
Privacy Officer / Office Manager: ______________________
If you would like to restrict communications (for example, no voicemail or text), please notify our office in writing.