HIPAA & Health Information Privacy

This notice describes how protected health information (PHI) about you may be used and disclosed in connection with Flexion Foundation's programs, and how you can access this information. Please review it carefully.

1. Who this notice applies to

This notice applies to Flexion Foundation (a 501(c)(3) nonprofit corporation) and to the licensed clinicians who deliver care under Foundation-funded programs. Direct clinical care is provided by licensed physical therapists, occupational therapists, and other healthcare professionals who maintain their own HIPAA compliance programs at the practice level. Foundation programs that involve clinical services adopt the same standards.

2. What we mean by PHI

Protected Health Information is individually identifiable health information, including information about your physical or mental health, the health care you receive, and the payment for that care, in any form (paper, electronic, oral).

3. How we may use and disclose PHI

For program operations, we may use PHI to coordinate care between Foundation-funded clinicians, evaluate program outcomes in de-identified aggregate form, and meet legal, audit, or accreditation obligations. We do not use PHI for marketing or fundraising without your written authorization. Specific permitted uses include:

• Treatment. Sharing relevant clinical information with the licensed clinician(s) providing your Foundation-funded care.
• Payment. Documenting that funded services were delivered, for program accounting and audit purposes. The Foundation does not bill insurance for patient-funded programs; payment documentation refers to internal program accounting only.
• Healthcare operations. Quality improvement, program evaluation, accreditation, training, and audit activities, with PHI minimized or de-identified wherever possible.
• As required by law. Including public health reporting, abuse or neglect reporting, judicial or administrative proceedings, and other situations where disclosure is mandated.
• With your written authorization. Any other use or disclosure not described above is made only with your written, revocable authorization.

4. Your rights regarding PHI

Under HIPAA you have the right to:

• Inspect and obtain a copy of your PHI in our designated record set (usually within 30 days; small fee may apply).
• Request that we amend PHI that you believe is inaccurate or incomplete.
• Receive an accounting of certain disclosures of your PHI that we have made in the prior 6 years.
• Request restrictions on certain uses and disclosures of your PHI.
• Request that we communicate with you in a particular way or at a particular location.
• Receive a paper copy of this notice on request, even if you previously received it electronically.
• File a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights without fear of retaliation.

5. Submitting PHI through this website

Do not submit PHI through forms on this website. The donate, contact, volunteer, partnership, and newsletter forms are not intended for the transmission of medical records, patient names, diagnoses, or other PHI. If you need to share clinical information for an intake or referral, the licensed clinician handling your case will provide a secure intake channel.

6. Our duties

Flexion Foundation is required by law to maintain the privacy of PHI we handle, provide you with notice of our legal duties and privacy practices, follow the terms of the notice currently in effect, and notify you in the event of a breach of unsecured PHI as required by HIPAA Breach Notification rules.

7. Privacy and Security Officer

Our designated Privacy Officer and Security Officer is Ali Koh, Privacy Officer. Direct any questions, requests, or complaints to:

donate@flexionfoundation.org

8. Changes to this notice

We may revise this notice and apply changes to PHI we already hold, in line with HIPAA. Updated notices will be posted on this page with a new effective date.