About Protected Health Information (PHI). In this Notice, "we," "our," or "us" means Shift Therapy & Wellness and our workforce of employees, contractors, and volunteers; "you" and "your" refer to each of our patients who are entitled to a copy of this Notice. We are required by federal and state law to protect the privacy of your health information. Certain types of health information may specifically identify you; because we must protect this information, we refer to it as Protected Health Information, also known as "PHI."
In this Notice, we tell you about: how we use your PHI; when we may disclose your PHI to others; your privacy rights and how to use them; our privacy duties; and whom to contact for more information or a complaint.
We will use your PHI to provide you with care and treatment, to obtain payment for your care and related services, and for certain activities we refer to as "healthcare operations." We will also use or disclose your PHI as required or permitted by law. The examples below help explain each of these; space does not allow for a comprehensive list of every use or disclosure. If you have any questions, please contact us.
1. Treatment
We use and disclose your PHI in the course of your treatment. For instance, once we have completed your evaluation, re-evaluation, or Plan of Care, we will send a copy or summary of our report to your referring/attending physician. We also maintain records detailing the care and services you receive at our facility, so that we can accurately and consistently provide the care you need, and to meet specific legal requirements. These records may be used and/or disclosed by members of our workforce to ensure that proper and optimal care is rendered.
2. Payment Involving a Third-Party Payer
After we treat you, we will typically bill a third party for the services you receive. We will collect the treatment information, enter the data into our computer system, and process the claim either on paper or electronically. The claim form will detail your health problem, the treatments you received, your insurance policy number, and other identifying details. If your Social Security number is required, the first five digits will be redacted. The third-party payer may also request a review of your medical records to ensure the services are medically necessary.
3. Payment Exclusive of a Third-Party Payer (fully self-pay)
If you choose to pay for your services in full without involving a third party (such as an insurer or employer), you may request that we not disclose any information regarding those services for payment purposes. You will be provided with a Good Faith Estimate (GFE) for all self-paid visits or treatments, regardless of the reason. Exception: you will not receive a GFE if you are enrolled in Medicare Part A, B, or C, Medicaid, TRICARE, Veterans Affairs, or Indian Health Services.
4. Health Care Operations
We also use and disclose your PHI in our healthcare operations. For example, our therapists meet periodically to study clinical records and monitor the quality of care at our facility. Your records and PHI could be used in these quality assessments. Sometimes we participate in student internship programs and use the PHI of actual patients to assess their skills and knowledge. Other operational tasks may include business planning, compliance monitoring, and investigating and resolving complaints.
5. Special Uses
We also use or disclose your PHI for purposes that involve your relationship with us as a patient, including to update your workers' compensation case worker or employer (you may not opt out of disclosure if you are a WC patient and your state does not require your authorization).
You may opt out of any of the following, verbally or in writing:
- Remind you of appointments.
- Follow up on home programs that you have been taught.
- Advise you of new or updated services or home supplies, including via telecommunication or newsletter.
- Release equipment and/or supplies to your designee.
- Conduct follow-ups on your home programs or discharge planning.
- Conduct research that does not directly identify you.
- Communicate via electronic means at your request or with your authorization. We will only use secure transmission due to the risk of unauthorized access, and we highly recommend securing communications involving sensitive information.
- Conduct marketing functions, including providing nominal promotional gifts.
- Contact you regarding fundraising projects we are engaged in.
If we receive direct or indirect financial remuneration from a third party for marketing a product or item, or for any fundraising we are engaged in, we will advise you in advance and offer you the opportunity to opt out. We will obtain written authorization before using PHI for marketing purposes when required by law.
6. Uses & Disclosures Required or Permitted by Law
Permitted without authorization: if you do not object verbally, we may share some of your PHI with a family member or friend who participates in your care. We may use your PHI in an emergency if you are unable to communicate. If we receive certain assurances that protect your privacy, we may use or disclose your PHI for research purposes (this facility will always obtain your authorization even though it is permitted without it). If you are a workers' compensation patient, we may update your case worker or employer unless state law requires your authorization.
Required without authorization: when required by law, such as a court order; for public health activities, such as reporting a communicable disease or an adverse reaction to the FDA; to report neglect, abuse, or domestic violence; when government regulators need to determine our compliance; for judicial or administrative proceedings, such as responding to a valid subpoena; when properly requested by law enforcement or other legal requirements, such as reporting gunshot wounds; to avert a health hazard or threat to public safety; when deemed necessary by military command authorities if you are in the Armed Forces; and in connection with certain organ donor programs.
Required use and disclosure exception: substance use disorder records require your authorization for release according to 42 CFR Part 2, unless required by federal law. Part 2 permits disclosure without your authorization only in limited circumstances: medical emergencies, scientific research under strict safeguards, audits or program evaluations, court orders meeting specific legal requirements, reporting suspected child abuse or neglect as required by law, and crimes committed on program premises or against program staff.
7. Your Authorization May Be Required
In the circumstances noted in Section 6 above, we have the right to use and disclose your PHI; however, if you change your mind at a later date, you may revoke your authorization or opt out of the disclosure, if permitted by law.
8. Your Privacy Rights and How to Exercise Them
This facility will provide patients with a written notice regarding the risks of transmitting protected health information via unsecured email or messaging platforms. Patient authorization will be obtained before initiating or responding to any such electronic communication. You have the following rights under our federally required privacy program:
Right to Request Limited Use or Disclosure
You have the right to request that we do not use or disclose your PHI in a particular way. We are not obligated to comply, but if we agree, we must abide by the agreement. We require this request in writing.
Right to Confidential Communication
You have the right to receive confidential communications from us at a location or phone number you specify. We may request that this be in writing, including the alternative address or phone number, and confirmation that it will not interfere with your payment method.
Right to Inspect and Copy Your PHI
You have the right to inspect and copy your PHI, in the format we maintain (paper or electronic). Should we decline, we must provide a resource person to help you review our decision. We must respond within 30 days, as required by state law, and may charge reasonable fees for copying and labor time.
Right to Revoke Your Authorization
If you have authorized us to use or disclose your PHI, you may revoke that authorization at any time in writing. We relied on the validity of your permission before the revocation and used or disclosed your PHI within its scope up to that point.
Right to Amend Your PHI
You have the right to request an amendment of your record, in writing. We may deny the request if the record is accurate and/or if this facility did not create it. If we accept the amendment, we will notify you and make an effort to inform others who have the original record.
Right to Know Who Else Sees Your PHI
You have the right to request an accounting of certain disclosures made over the past six years. We do not have to account for all disclosures, including those made directly to you, or those involving treatment, payment, healthcare operations, family or friends involved in your care, or national security. We may charge for accounting requests that occur more than once per year, after notifying you of the charge.
Right to Be Informed of a Breach
We are required to notify you by first-class mail or email (if you've indicated a preference for email) of any breach of unsecured Protected Health Information as soon as possible, and no later than 30 days following discovery. The notice will describe the breach, the type of information involved, steps you should take to protect yourself, and our corrective action.
Right to Complain
You have the right to complain if you feel your privacy rights have been violated. You may complain directly to us by contacting our HIPAA Officer (see Contact Information below), or to the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201, by calling 1-877-696-6775, or by visiting www.hhs.gov/ocr/privacy/hipaa/complaints (opens in a new tab). We will not retaliate against you for filing a complaint.
Right to Receive a Copy of the Privacy Notice
We are obligated to provide our patients with a copy of this Notice and to post it in a conspicuous place and on our website. We reserve the right to modify the Notice to comply with policy, rules, or regulatory changes, and we are required to maintain each version for a minimum of six years.
Right to Protection of Substance Use Disorder Records (42 CFR Part 2)
We are required by federal law to protect the privacy of your substance use disorder (SUD) treatment records under 42 CFR Part 2, which provides confidentiality safeguards beyond HIPAA. We may not use or disclose your SUD treatment records without your written consent unless federal law allows it, subject to the limited exceptions listed in Section 6 above. Any recipient of your SUD treatment information is prohibited from redisclosing it unless you give written permission or the disclosure is otherwise permitted by Part 2. You may request restrictions on how this information is used, request an accounting of disclosures, receive a copy of this Notice, and file a complaint without fear of retaliation.
9. Some of Our Privacy Obligations and How We Perform Them
We are required by law to maintain the privacy and security of your protected health information, and to notify you promptly if a breach occurs that may have compromised it. We must follow the duties and privacy practices described in this Notice and provide you with a copy. We will not use or share your information except as described, unless you provide written consent, and you may change your mind at any time by letting us know in writing. If we update this Notice, we will provide you the revised version the next time you seek treatment from us.
Contact Information
If you have questions about this Notice, or a complaint or concern, please contact:
Shift Therapy & Wellness, HIPAA Officer
314 E 1st Ave, Suite 701
Rome, GA 30161
(706) 314-8504 · admin@shift.physio
Effective Date: 2/12/2026