Privacy Policy and HIPAA Policy

Last Updated May 2024

Welcome to the website (the “Site”) of Columbia Basin Oral & Maxillofacial Surgeons (“Company,” “we,” “us,” or “our”). We have prepared this Privacy Policy to explain what personal information we collect through the Site and in connection with the provision of our [oral surgery services] (the “Service”), how we use and share that information, and your choices concerning our information practices.

Before using the Service or submitting any personal information to Company, please review this Privacy Policy carefully and contact us if you have any questions.

1. PERSONAL INFORMATION WE COLLECT

We collect personal information as follows:

Personal Information You Provide: We collect the following categories of personal information from you when you reach out to us via a “Contact Us” page of the site or pay a bill online:

• Identification Information: We collect your name, email address, phone number, mailing/billing addresses, and government identification documents.
• Health and Medical Information: We collect such information in connection with conducting research, and tracking adverse event reports.
• Communication Information: We may collect information when you contact us with questions or concerns and when you voluntarily respond to questionnaires, surveys or requests for market research seeking your opinion and feedback. Providing communication information is optional to you.
• Social Media Information: We have pages on social media sites (“Social Media Pages”). When you interact with our Social Media Pages, we will collect personal information that you elect to provide to us, such as your contact details. In addition, the companies that host our Social Media Pages may provide us with aggregate information and analytics regarding the use of our Social Media Pages.
• Other Data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Internet Activity Information: When you visit, use, and interact with the Service, we may receive certain information about your visit, use, or interactions. For example, we may monitor the number of people that visit the Service, peak hours of visits, which page(s) are visited, the domains our visitors come from and which browsers people use to access the Service, geographical information, and navigation pattern. In particular, the following information is created and automatically logged in our systems:

• Log Information: Information that your browser automatically sends whenever you visit the Site. Log Information includes your Internet Protocol address, browser type and settings, the date and time of your request, and how you interacted with the Site.
• Cookies Information: Please see the “Cookies” section below to learn more about how we use cookies.
• Device Information: Includes name of the device, operating system, and browser you are using. Information collected may depend on the type of device you use and its settings.
• Usage Information: We collect information about how you use our Service, such as the types of content that you view or engage with, the features you use, the actions you take, and the time, frequency, and duration of your activities.

Protected Health Information: Some of the personal information processed by Company in connection with providing the Service to you may be subject to laws and regulations, such as rules issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH), that govern providers’ use and disclosure of certain individually identifiable health-related personal information (“Protected Health Information”). When Company receives Protected Health Information, it does so as a “covered entity” or “business associate” of certain health care providers under an agreement that, among other things, prohibits us from using or disclosing the Protected Health Information in ways that are not permissible by the health care provider itself, and requires us to implement certain measures to safeguard the confidentiality, integrity, and availability of the Protected Health Information. When we act as a business associate, we may be subject to certain laws and regulations, including certain HIPAA rules, that govern our use and disclosure of Protected Health Information and that may be more restrictive than otherwise provided in this Privacy Policy. Please see our HIPAA Notice of Privacy Practices for further detail concerning our policies and practices related to Protected Health Information.

Cookies: We use cookies to operate and administer our Site, gather usage data on our Site, and improve your experience on it. A “cookie” is a piece of information sent to your browser by a website you visit. Cookies can be stored on your computer for different periods of time. Some cookies expire after a certain amount of time, or upon logging out (session cookies), others survive after your browser is closed until a defined expiration date set in the cookie (as determined by the third party placing it), and help recognize your computer when you open your browser and browse the Internet again (persistent cookies).

On most web browsers, you will find a “help” section on the toolbar. Please refer to this section for information on how to receive a notification when you are receiving a new cookie and how to turn cookies off. However, please note that if you limit the ability of websites to set cookies, you may be unable to access certain parts of the Site and you may not be able to benefit from the full functionality of the Site.

If you access the Site on your mobile device, you may not be able to control tracking technologies through the settings.

Analytics: We use Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses cookies to help us analyze how users use the Site and enhance your experience when you use the Site. For more information on how Google uses this information, click here.

Do Not Track Signals: [Our Site currently does not respond to “Do Not Track” (“DNT”) signals and operates as described in this Privacy Policy whether or not a DNT signal is received. If we do respond to DNT signals in the future, we will update this Privacy Policy to describe how we do so.] 

2. HOW WE USE PERSONAL INFORMATION

We may use personal information for the following purposes:

• To provide the Service;
• To respond to your inquiries, comments, feedback, or questions;
• To send administrative information to you, for example, information regarding the Service and changes to our terms, conditions, and policies;
• To analyze how you interact with our Service;
• To maintain and improve the Service;
• To develop new products and services;
• To prevent fraud, criminal activity, or misuses of our Service, and to ensure the security of our IT systems, architecture, and networks; and
• To comply with legal obligations and legal process and to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or other third parties.

Aggregated Information. We may aggregate personal information and use the aggregated information to analyze the effectiveness of our Service, to improve and add features to our Service, and for other similar purposes. In addition, from time to time, we may analyze the general behavior and characteristics of users of our Service and share aggregated information like general user statistics with prospective business partners. We may collect aggregated information through the Service, through cookies, and through other means described in this Privacy Policy.

Marketing. We may use your personal information to contact you to tell you about services we believe may be of interest to you. For instance, if you elect to provide your email we may use that information to send you communications about our practice and what we offer. You may opt out of receiving emails by following the instructions contained in each promotional email we send you. . In addition, if at any time you do not wish to receive future marketing communications, you may contact us. If you unsubscribe from our marketing lists, you will no longer receive marketing communications but we will continue to contact you regarding administrative matters and to respond to your requests.

3. SHARING AND DISCLOSURE OF PERSONAL INFORMATION

Company does not sell your personal information. In certain circumstances we may share the categories of personal information described above without further notice to you, unless required by the law, with the following categories of third parties:

• Vendors and Service Providers: To assist us in meeting business operations needs and to perform certain services and functions, we may share personal information with vendors and service providers, including providers of hosting services, cloud services, and other information technology services providers, email communication software and email newsletter services, advertising and marketing services, payment processors, customer relationship management and customer support services, and analytics services. Pursuant to our instructions, these parties will access, process, or store personal information in the course of performing their duties to us.
• Business Transfers: If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, dissolution, sale of all or a portion of our assets, or transition of service to another provider (collectively a “Transaction”), your personal information may be shared in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of or following that Transaction along with other assets.
• Legal Requirements: If required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, including to meet national security or law enforcement requirements, (ii) protect and defend our rights or property, (iii) prevent fraud, (iv) act in urgent circumstances to protect the personal safety of users of the Service, or the public, or (v) protect against legal liability.
• Affiliates: We may share personal information with our current and future affiliates, meaning an entity that controls, is controlled by, or is under common control with Company. Our affiliates may use the personal information we share in a manner consistent with this Privacy Policy.

4. CHILDREN

Our Service is not directed to children who are under the age of 16. Company does not knowingly collect personal information from children under the age of 16. If you have reason to believe that a child under the age of 16 has provided personal information to Company through the Service please contact us and we will try to delete that information from our databases.

5. LINKS TO OTHER WEBSITES

The Service may contain links to other websites not operated or controlled by Company, including social media services (“Third Party Sites”). The information that you share with Third Party Sites will be governed by the specific privacy policies and terms of service of the Third Party Sites and not by this Privacy Policy. By providing these links we do not imply that we endorse or have reviewed these sites. Please contact the Third-Party Sites directly for information on their privacy practices and policies.

6. SECURITY

You use the Service at your own risk. We implement commercially reasonable technical, administrative, and organizational measures to protect personal information both online and offline from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no Internet or e-mail transmission is ever fully secure or error free. In particular, e-mail sent to or from us may not be secure. Therefore, you should take special care in deciding what information you send to us via the Service or e-mail. Please keep this in mind when disclosing personal information to Company via the Internet. In addition, we are not responsible for circumvention of any privacy settings or security measures contained on the Service, or third-party websites.

7. PERSONAL INFORMATION PROCESSING IN THE U.S.

The Service is not intended for use outside the United States. By using our Service, you understand and acknowledge that your personal information will be transferred from your location to our facilities and servers in the United States, where data protection laws may differ from those in your jurisdiction.

8. YOUR CHOICES

In certain circumstances providing personal information is optional. However, if you choose not to provide personal information that is needed to use some features of our Service, you may be unable to use those features. You can also contact us to request updates or corrections to your personal information.

9. CHANGES TO THE PRIVACY POLICY

The Service and our business may change from time to time. As a result, we may change this Privacy Policy at any time. When we do, we will post an updated version on this page, unless another type of notice is required by the applicable law. By continuing to use our Service or providing us with personal information after we have posted an updated Privacy Policy, or notified you by other means if applicable, you consent to the revised Privacy Policy and practices described in it.

10. CONTACT US

If you have any questions about our Privacy Policy or information practices, please feel free to contact us at our designated request address: 512 N Young St, Kennewick, WA 99336

HIPAA Notice of Privacy Practices (“Notice”)

This HIPAA Notice of Privacy Practices (“Notice”) describes how medical information about you may be used and disclosed by Columbia Basin Oral & Maxillofacial Surgeons (“Company”) and how you can get access to this information. Please review it carefully. This notice is effective as of 04/01/2024.

Last updated: April 2024

Your Rights

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

Get an electronic or paper copy of your medical record

• You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. Ask us how to do this.
• We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable, cost‐based fee.

Ask us to correct your medical record

• You can ask us to correct health information about you that you think is incorrect or incomplete. Ask us how to do this.
• We may say “no” to your request, but we’ll tell you why in writing within 60 days.

Request confidential communications

• You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address.
• We will say “yes” to all reasonable requests.

Ask us to limit what we use or share

• You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request, and we may say “no” if it would affect your care.
• If you pay for a service or health care item out‐of‐pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information.

Get a list of those with whom we’ve shared information

• You can ask for a list (accounting) of the times we’ve shared your health information for six years prior to the date you ask, who we shared it with, and why.
• We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We’ll provide one accounting a year for free but will charge a reasonable, cost‐based fee if you ask for another one within 12 months.

Get a copy of this privacy notice

You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.

Choose someone to act for you

• If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.
• We will make sure the person has this authority and can act for you before we take any action.

File a complaint if you feel your rights are violated

• You can complain if you feel we have violated your rights by contacting us:

Address: 512 N Young St Kennewick, WA 99336 

Phone: (509) 783-7600

Email: info@cboms.com

• You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1‐877‐696‐6775, or visiting hhs.gov/ocr/privacy/hipaa/complaints/.
• We will not retaliate against you for filing a complaint.

Your Choices

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions.

In these cases, you have both the right and choice to tell us to:

• Share information with your family, close friends, or others involved in your care
• Share information in a disaster relief situation
• Include your information in a hospital directory

If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

In these cases, we never share your information unless you give us written permission:

• Marketing purposes
• Sale of your information
• Psychotherapy notes, unless otherwise required by law

In the case of fundraising:

• We may contact you for fundraising efforts, but you can “opt out” or “unsubscribe” and we will not contact you again with this type of communication.

Our Uses and Disclosures

How do we typically use or share your health information?

We typically use or share your health information in the following ways.

Treat you

We can use your health information and share it with other professionals who are treating you. Example: A doctor treating you for a health condition asks us about your behavioral health conditions that may affect treatment.

Run our organization

We can use and share your health information to run our practice, improve your care, and contact you when necessary. Example: We use health information about you to manage your treatment and services.

Bill for your services

We can use and share your health information to bill and get payment from health plans or other entities.

Example: We give information about you to your health insurance plan so it will pay for your services.

How else can we use or share your health information?

We are allowed or required to share your information in other ways – usually in ways that contribute to the public good, such as public health and research. We must meet many conditions in the law before we can share your information for these purposes. For more information see: https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html.

Help with public health and safety issues

We can share health information about you for certain situations such as:

• Preventing disease
• Helping with product recalls
• Reporting adverse reactions to medications
• Reporting suspected child abuse or neglect, and under certain circumstances, abuse, neglect or domestic violence involving adults
• Preventing or reducing a serious threat to anyone’s health or safety

Do research

We can use your information for health research, in aggregate (your personal information will not be separately identifiable).

Comply with the law

We will share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.

Work with a medical examiner or funeral director

We can share health information with a coroner, medical examiner, or funeral director when an individual dies.

Address workers’ compensation, law enforcement, and other government requests We can use or share health information about you:

• For workers’ compensation claims
• For law enforcement purposes or with a law enforcement official
• With health oversight agencies for activities authorized by law
• For special government functions such as military, national security, and presidential protective services

Respond to lawsuits and legal actions

We can share health information about you in response to a court or administrative order, or in response to a subpoena.

Our Responsibilities

• We are required by law to maintain the privacy and security of your protected health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this Notice and give you a copy of it.
• We will not use or share your protected health information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

For more information see: https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html.

Changes to the Terms of this Notice

We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request, in our office, and within this Application.

Other Instructions for Notice

• The effective date of this Notice is 04/11/2024
• For questions about this Notice, please contact:

Attn: Privacy & Compliance

Address: 512 N Young St Kennewick, WA 99336

Phone: (509) 783-7600

Email: info@cboms.com