Organizational Privacy Policy


This Notice describes the information privacy practices followed by our employees, staff, and office personnel at Equitas Health and Equitas Health Pharmacy. The purpose of this Notice is to tell you how we share your information and how you can find out more about our sharing practices, including your rights and our obligations regarding the use and disclosure of your information. This Notice does not apply to non-health care functions such as those related to lifestyle, education, employer, and outreach events.


This Notice is available on our website and may be shared with you before your first visit. On our registration form, you will consent to having received this Notice at your first visit. Please review carefully and if you have any questions, please contact the Privacy Officer:

Privacy Officer

A: 4400 N. High Street, Suite 300, Columbus OH 43209

P: (614) 340-6781



We are required by law to maintain the privacy of your protected health information. This notice applies to the information and records we have about who you are; where you live; your past, present, and future medical conditions; your health, health status, mental health care, mental health status, alcohol, and other drug treatment status; the prescriptions you have received; and services you receive from our employees (referred to as your “protected health information” or “PHI”). We are required by law to maintain the privacy of your protected health information and to provide you with notice of our legal duties. For instance, we are required to notify you in the unlikely event there is a breach of your protected health information and we are required to follow this Notice. A copy of this Notice can be obtained from the front desk staff or the Privacy Officer.  And we reserve the right to change the terms of this Notice as necessary and to make the new notice effective for all protected health information maintained by us.


We typically use and share your PHI in the following ways:

  • Your Authorization. Except as outlined below, we will not use or disclose your health information for any purpose without your specific written authorization. If you sign a HIPAA Authorization for Release of Information for us to use or disclose your health information, you may revoke that Release, in writing, at any time. You may orally revoke the Release if we take actions in reliance on your request.  If you revoke your Release, we will no longer use or disclose information about you for the reasons covered by your written Release, but we cannot take back any uses or disclosures already made with your permission.
  • To Treat You. We may use your PHI to provide, coordinate, and manage your treatments, prescriptions, and services. We may also provide subsequent healthcare providers with copies of various records, reports, or summaries that assists them in treating you. We may release or receive your health information to other healthcare facilities not affiliated with our organization that also provides care to you. For instance, if your dentist requests certain records coordinate care, we will provide them with the records requested. We will require you sign authorization Release before disclosing your psychotherapy notes, unless permitted or required by law.
  • To Bill For Your Services. We may use and disclose PHI about you so that the treatment and services you receive may be billed to and payment may be collected from you, an insurance company, Equitas Health, or another third party.
  • To Run Our Organization. We may use and disclose health information about you for our healthcare operations and make sure that you and our other patients receive quality care, as well as compliance activities, credentialing and licensure review, case management, medical review, legal and auditing services, and business management and general administrative activities.
  • Research. We may use and disclose your health information for research purposes. For instance, a research organization may wish to compare outcome of all patients that received a particular drug and will need to review your medical record. Your confidentiality will be protected by strict confidentiality requirements promulgated by the Institutional Review Board or the privacy board overseeing the particular research. When necessary for research purposes and so long as the PHI does not leave our organization, we may disclose your health information to researchers preparing to conduct a research project. We also may disclose your PHI to researchers after your death. Those receiving your information must abide by Ohio law.
  • Marketing. We will require written consent for marketing communications unless the communication is made directly to you in person, is simply a promotional gift of nominal value, is a prescription refill reminder or appointment reminder, is what we consider general health or wellness information, or a communication about health-related products or services that we offer or that are directly related to your treatment.
  • Appointment Reminders & Services. We may contact you to provide reminders to pick up your prescriptions or regarding an upcoming appointment. We may also share certain test results with you. We will only do so if you indicate on your registration form or to your provider that you wish to receive such reminders and results.
  • Business Associates. Certain services are performed by outside persons or organizations with whom we contract, such as legal services, auditors, health record vendors, etc. At times it may be necessary for us to provide your protected health information to one or more of these outside persons or organizations who assist us. In all cases, we require these business associates to appropriately safeguard the privacy of your information, and enter into an agreement with the business associate memorializing such commitment.


  • Family and Friends. We may disclose health information about you to your family members and friends if we obtain your verbal agreement to do so or if we give you an opportunity to object to such a disclosure and you do not raise an objection. We may assume you agree to our disclosure of your personal health information to an individual when you bring that individual with you into the exam room during treatment or while treatment is discussed. In situations where you are not capable of giving consent (because you are not present or due to your incapacity or medical emergency), we may, using our professional judgment, determine that a disclosure to your family member or friend is in your best interest. In that situation, we will disclose only health information relevant to the person’s involvement in your care.
  • Communications. We may communicate to you via newsletters, mailings, and other means regarding treatment options: information on health-related benefits or services, disease-management programs, wellness programs, to assess your satisfaction with our services, as part of fundraising efforts, for population-based activities relating to training programs or reviewing competence of health care professionals, or other community based initiatives or activities which we are participating. If you are not interested in receiving these communications, please contact the Privacy Officer.
  • Ohio Protections. Ohio law requires that we obtain a consent from you in many instances before disclosing the performance or results of an HIV test or diagnoses of AIDS or an AIDS-related condition; before disclosing information about drug or alcohol treatment you have received in a drug or alcohol treatment program; and before disclosing information about mental health services you may have received.
  • Fundraising. We may contact you to donate to a fundraising effort for or on our behalf. You have the right to “opt-out” of receiving fundraising materials/communications, contact the Privacy Officer by telephone at 614-340-6781 or at


We may use or disclose health information about you without your permission for the following purposes:

  • For any purpose required by law;
  • For public health activities, such as required reporting of disease, injury, and birth and death, and for required public health investigations;
  • As required by law if we suspect child abuse or neglect; we may also release your PHI  as required by law if we believe you to be a victim of abuse, neglect, or domestic violence;
  • To the Food and Drug Administration if necessary to report adverse events, product defects, or to participate in product recalls;
  • To your employer when we have provided health care to you at the request of your employer to determine workplace-related illness or injury (in most cases you will receive notice that information is disclosed to your employer);
  • If required by law to a government oversight agency conducting audits, investigations, or civil or criminal proceedings;
  • If required to do so by subpoena or discovery request (in some cases you will have notice of such release);
  • To law enforcement officials as required by law to report wounds and injuries and crimes;
  • To coroners and/or funeral directors consistent with law;
  • If necessary to arrange an organ or tissue donation from you or a transplant for you;
  • In limited instances if we suspect a serious threat to health or safety;
  • If you are a member of the military as required by armed forces services; we may also release your PHI if necessary for national security or intelligence activities; and
  • To workers’ compensation agencies if necessary for your workers’ compensation benefit determination.
  • When necessary to prevent a serious threat to the health and safety of you, another person, or the public.
  • When information about you in a way that does not personally identify you or reveal who you are.
  • When certain services are performed through contracts with outside companies and organizations. In performing these contracts, we may need to provide the companies with your health information. We will always enter into a Business Associate Agreement with these companies to ensure that they are also safeguarding your information.


You have the following rights regarding health information:

  • Right to Access and Receive a Copy of Your Medical Record. You have the right to inspect and receive a copy of your records.  We ask that you submit these requests in writing to our Medical Records Manager. We may charge a reasonable fee to cover the costs of your request, but we will let you know in advance.  We may deny your request in some circumstances, in which case, you may request that the denial be reviewed.  You have the right to obtain an electronic copy of your health information that exists in an electronic format and you may direct that the copy be transmitted directly to an entity or person designated by you, provided that any such designation is clear, conspicuous, and specific with complete name and mailing address or other identifying information.
  • Right to Amend Your Medical Record. If you feel that medical information we have about you is incorrect or incomplete, you may ask us to amend the information by submitting a request in writing to our Medical Records Manager. You have the right to request an amendment for as long as we keep the information. We may deny your request for an amendment and if this occurs, you will be notified of the reason for the denial. If an amendment or correction you request is made by us, we may also notify others who work with us and have copies of the uncorrected record if we believe that such notification is necessary.
  • Right to an Accounting of Disclosures. You have the right to request a list of certain disclosures that we have made of your health information. To request this list of disclosures, you must submit your request in writing to the Medical Records Manager. Your request must state a time period, which may not be longer than six years. We may charge you for the costs of providing the list, but we will let you know in advance. When you request an accounting of disclosures of your electronic health record, the accounting will be for three years prior to the date of the request for the accounting and will include, in addition to all types of disclosures listed in the general policy, disclosures for treatment, payment and health care operations
  • Right to Request Restrictions. You have the right to request a restriction or limitation on the PHI we use or disclose about your treatment, payment or health care operations. You also have the right to request a limit on the PHI we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend.  We ask that you submit these requests in writing to our Medical Records Manager.  We are not required to agree to your request, but we will accommodate your request if reasonable. If we do agree to your request, we will comply except in certain emergency situations or as required by law.
  • Right to Request Confidential Communications. You have the right to request that we communicate with you about health matters in a certain way or at a certain location. If you do not wish to participate or wish for us to only contact you by certain means, you may notify us in writing, by telephone, or in person. We will not ask you the reason for your request. We will accommodate all reasonable requests.
  • Right to a Paper Copy of This Notice. You have the right to a paper copy of this notice.


Your protected health information may be disclosed to an approved Health Information Exchange to facilitate the provision of health care to you. Health Information Exchange allows health care professionals and patients to appropriately access and securely share medical information electronically. The approved Health Information Exchange is required to maintain appropriate administrative, physical, and technical safeguards to protect the privacy and security of protected health information. Only authorized individuals may access and use protected health information from the approved health information exchange.

Equitas Health is part of an organized health care arrangement including participants in OCHIN.  A current list of OCHIN participants is available at as a business associate of Equitas Health OCHIN supplies information technology and related services Equitas Health and other OCHIN participants.  OCHIN also engages in quality assessment and improvement activities on behalf of its participants.  For example, OCHIN coordinates clinical review activities on behalf of participating organizations to establish best practice standards and assess clinical benefits that may be derived from the use of electronic health record systems.  OCHIN also helps participants work collaboratively to improve the management of internal and external patient referrals.  Your health information may be shared by Equitas Health with other OCHIN participants when necessary for health care operations purposes of the organized health care arrangement.


We reserve the right to change this notice, and to make the revised or changed notice effective for medical information we already have about you as well as any information we receive in the future. We will post a summary of the current notice in the office with its effective date in the top right hand corner. You are entitled to a copy of the notice currently in effect, and it is also available at


If you believe your privacy rights have been violated, you may file a complaint with our office or with the Secretary of the Department of Health and Human Services. To file a complaint with our office, contact the Privacy Officer, at Equitas Health. You will not be penalized for filing a complaint. In the unlikely event that there is a breach of your protected health information, you will receive notice and information on steps you may take to protect yourself from harm.


You will be asked to sign an acknowledgment form that you received this Notice of Practice Practices.

Effective Date: 9/2012
Reviewed and Updated: 4/2014; 4/2015; 4/2016; 12/2018