Spring Creek Dental HIPAA Notice of Privacy Policy
Our Commitment to Your Privacy
The privacy of your health information is important to us. We are required by the Health Insurance Portability and
Accountability Act of 1996 (HIPAA), 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records), and
applicable Colorado state law to maintain the privacy of your protected health information (PHI). We are also required
to provide you with this Notice about our privacy practices, our legal duties, and your rights concerning your health
information. This Notice takes effect on the date listed above and will remain in effect until replaced.
Before we make a significant change in our privacy practices, we will update this Notice and make the revised version
available upon request, posted prominently in our office, and on our website if applicable.
Uses and Disclosures of Health Information
Treatment
We may use or disclose your health information to a physician or other healthcare provider providing treatment to
you. For example, we may share information with a specialist to whom you are referred for further care.
Payment
We may use and disclose your health information to obtain payment for services we provide to you. This includes
sharing information with your insurance company for claims processing, billing, and collections.
Healthcare Operations
We may use and disclose your health information for healthcare operations, including quality assessment and
improvement activities, reviewing the competence or qualifications of healthcare professionals, evaluating practitioner
performance, conducting training programs, accreditation, certification, licensing, or credentialing activities.
To Your Family and Friends
We may disclose your health information to a family member, friend, or other person to the extent necessary to help
with your healthcare or with payment for your healthcare, unless you object.
Persons Involved in Care
We may use or disclose health information to notify, or assist in the notification of, a family member, your personal
representative, or another person responsible for your care, of your location, general condition, or death. In the event
of your incapacity or emergency circumstances, we will disclose health information based on our professional
judgment, disclosing only information that is directly relevant to the person's involvement in your healthcare.
Appointment Reminders
We may use or disclose your health information to provide you with appointment reminders (such as voicemail
messages, postcards, text messages, or letters).
Marketing Health-Related Services
We will not use your health information for marketing without your prior written authorization.
Required by Law
We may use or disclose your health information when required to do so by federal, state, or local law.
Abuse or Neglect
We may disclose your health information to appropriate authorities if we reasonably believe that you are a possible
victim of abuse, neglect, or domestic violence or the possible victim of other crimes. We may disclose your health
information to the extent necessary to avert a serious threat to your health or safety or the health or safety of others.
Other Permitted Uses and Disclosures
We may also use or disclose your health information for public health activities, health oversight activities, judicial and
administrative proceedings (in response to a court order or subpoena), law enforcement purposes, to coroners,
medical examiners, and funeral directors, for research purposes (with appropriate safeguards), to avert a serious
threat to health or safety, for specialized government functions, and for workers' compensation purposes. Any other
use or disclosure of your health information not described in this Notice will be made only with your written
authorization, which you may revoke at any time.
Substance Use Disorder (SUD) Treatment Records
Federal law (42 CFR Part 2) provides special privacy protections for substance use disorder (SUD) treatment records.
Even though our practice does not specialize in SUD treatment, we may receive SUD records as part of
your health history or through coordination of care with other providers. The following describes how SUD records
may be used and disclosed and your rights regarding those records.
Uses and Disclosures of SUD Records
If you provide a single written consent, we may use and disclose your SUD treatment records for treatment, payment,
and healthcare operations purposes. You may revoke this consent in writing at any time. Any revocation will not affect
uses or disclosures made in reliance on your consent before it was revoked.
Restrictions on SUD Records
Your SUD treatment records may not be used or disclosed in any civil, criminal, administrative, or legislative
proceedings conducted by any federal, state, or local authority without your specific written consent or a court order
that meets the requirements of 42 CFR Part 2. A general authorization for the release of medical or other information
is not sufficient for this purpose.
Redisclosure Notice
Important: If your SUD records are disclosed pursuant to your written consent under HIPAA, those records may
potentially be redisclosed by the recipient and may no longer be protected by federal confidentiality rules. However,
records disclosed under Part 2 include a prohibition on redisclosure statement that restricts further sharing.
Fundraising
If we use your SUD treatment information in connection with fundraising for the benefit of our practice, you have the
right to opt out of receiving fundraising communications. You may opt out at any time by contacting our office.
Your Part 2 Rights
In addition to the rights listed below under "Patient Rights," you have the following rights with respect to your SUD
treatment records: the right to request restrictions on certain uses and disclosures; the right to revoke consent for use
and disclosure at any time in writing; and the right to receive a copy of this notice. If you believe your Part 2 rights
have been violated, you may file a complaint with the U.S. Department of Health and Human Services Office for Civil
Rights.
Patient Rights
Right to Access Your Records
You have the right to inspect and obtain copies of your health information, with limited exceptions. We may charge a
reasonable, cost-based fee for expenses such as copies and staff time, consistent with federal and Colorado law.
Right to Amend
You have the right to request that we amend your health information. We may deny your request under certain
circumstances. If we deny your request, you have the right to submit a statement of disagreement that will be
included in your record.
Right to an Accounting of Disclosures
You have the right to request a list of certain disclosures we have made of your health information, other than
disclosures for treatment, payment, healthcare operations, and certain other purposes.
Right to Request Restrictions
You have the right to request restrictions on certain uses and disclosures of your health information. While we are not
required to agree to your request in most cases, we must agree to restrict disclosures to a health plan for services
you paid for entirely out of pocket.
Right to Request Confidential Communications
You have the right to request that we communicate with you about health matters in a certain way or at a certain
location (for example, by mail rather than phone). We will accommodate reasonable requests.
Right to a Paper Copy of This Notice
You have the right to obtain a paper copy of this Notice at any time, even if you agreed to receive it electronically. You
may request a copy by contacting our office.
Right to File a Complaint
We support your right to the privacy of your health information. If you believe your privacy rights have been violated,
you may file a complaint with our office or with the U.S. Department of Health and Human Services Office for Civil
Rights. You will not be retaliated against for filing a complaint.
Colorado State Privacy Protections
In addition to your federal rights under HIPAA, Colorado law provides the following protections for your health
information:
Record Access and Copy Fees (CRS § 25-1-801/802)
Under Colorado law, you have the right to inspect your health records at reasonable times and upon reasonable
notice at no charge. Copies of records will be provided upon request and payment of a reasonable fee. For third-party
record requests, Colorado law limits fees to: up to $18.53 for the first ten pages; $0.85 per page for the next thirty
pages; and $0.57 per page for each additional page. If certification is requested, a fee of $10.00 applies, plus actual
postage and electronic media costs. Electronic copies must be provided upon request when the original records are
stored and readily producible in electronic format.
Record Retention
Under the Colorado Dental Board rules, patient records for adults are retained for a minimum of seven (7) years after
the last date of treatment or examination. Records for minors are retained for a minimum of seven (7) years after the
patient reaches the age of majority (18).
Breach Notification (CRS § 6-1-716)
Colorado law requires that we notify you within 30 days if we become aware that a security breach involving your
personal information (including medical information and health insurance identification numbers) has occurred. If a
breach affects 500 or more Colorado residents, we must also notify the Colorado Attorney General.
Colorado Privacy Act (CPA)
While data governed by HIPAA is exempt from the Colorado Privacy Act, any personal data we collect that falls
outside HIPAA protections may be subject to the CPA. You may have additional rights under the CPA regarding such
data, including the right to access, correct, delete, and opt out of the sale of your personal data. As of January 1,
2025, the Colorado Attorney General may take direct enforcement action for CPA violations without a cure period.
Violations may result in civil penalties of up to $20,000 per violation.
Biometric Data (HB 24-1130)
Effective July 1, 2025, Colorado law imposes additional requirements on the collection and use of biometric identifiers
and biometric data. If our practice collects any biometric data, we will obtain your consent and comply with all
applicable disclosure and retention requirements under this law.
Our Duties
We are required by law to maintain the privacy and security of your protected health information, to provide you with
this Notice of our legal duties and privacy practices with respect to your health information, and to follow the terms of
our current Notice. We reserve the right to change the terms of this Notice and to make the new provisions effective
for all protected health information we maintain. A revised Notice will be posted in our office and made available upon
request.
Contact Information
If you have questions about this Notice, wish to exercise any of your rights, or wish to file a complaint, please contact:
Spring Creek Dental, PLLC
Dr. Joel Kaines
Dr. Lindsey Cosper
You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by
visiting www.hhs.gov/ocr/privacy/hipaa/complaints, calling 1-877-696-6775, or writing to: 200 Independence Avenue
S.W., Washington, D.C. 20201.
