Notice of Privacy Practices
This Privacy Policy explains how information may be collected, used, disclosed, and protected when you
use the Galleria Women's Health website or related online features. It does not replace the separate
Notice of Privacy Practices, which governs protected health information under HIPAA, or the Patient
Policies & Practice Agreement, which governs patient-care operations.
1. Purpose of This Notice
Galleria Women's Health is required by law to maintain the privacy of protected health information, to
provide individuals with notice of our legal duties and privacy practices, and to follow the terms of the
Notice currently in effect. Protected health information, or PHI, generally means individually identifiable
health information that relates to your past, present, or future physical or mental health, healthcare
services, or payment for healthcare services.
This Notice explains how we may use and disclose PHI, describes your rights regarding PHI, and explains our
responsibilities under the Health Insurance Portability and Accountability Act of 1996, as amended, its
implementing regulations, and other applicable federal and Nevada privacy laws.
This Notice is separate from our Website Privacy Policy, which addresses website-related information
practices such as contact forms, cookies, analytics, and online tools. This Notice governs PHI created,
received, maintained, or transmitted in connection with patient care and healthcare operations.
2. Who Must Follow This Notice
This Notice applies to Galleria Women's Health, Deepali Kashyap MD PLLC, its physicians, advanced practice
providers, clinical staff, administrative staff, employees, contractors, business associates where
applicable, and other members of the practice workforce who may create, receive, access, use, disclose, or
maintain PHI in connection with treatment, payment, healthcare operations, or other permitted activities.
All members of our workforce are expected to follow this Notice and applicable privacy and security
policies. Independent healthcare providers, laboratories, imaging centers, hospitals, pharmacies, insurance
carriers, and other third parties may maintain their own privacy notices and privacy practices.
3. Our Privacy Responsibilities
We are required by law to protect the privacy and security of PHI, to notify affected individuals following
a breach of unsecured PHI when required by law, and to follow the duties and privacy practices described in
this Notice.
We will not use or disclose PHI except as permitted or required by law, as authorized by you in writing, or
as otherwise described in this Notice. When the law requires us to obtain your written authorization, you
may revoke that authorization in writing at any time, except to the extent we have already acted in reliance
on it.
Where federal or state law provides greater privacy protection for certain information, including certain
reproductive health information, minor consent services, substance use disorder information, HIV or sexually
transmitted infection information, genetic information, mental health information, or other specially
protected records, we will comply with the law that provides the greater protection when applicable.
4. Your Rights Regarding Your Health Information
You have the rights described below with respect to PHI maintained by Galleria Women's Health. To exercise a
right, you may be required to submit a written request, provide identity verification, or complete a
practice-approved form. We will respond to requests in accordance with applicable law.
4.1 Right to Inspect and Receive a Copy
You may request to inspect or receive a copy of certain health information maintained in your medical
record. We may provide the information electronically or on paper, depending on the form and format
requested and our ability to produce it. We may charge a reasonable, cost-based fee where permitted by law.
We may deny a request in limited circumstances permitted by law, and certain denials may be subject to
review.
4.2 Right to Request an Amendment
You may ask us to correct or amend health information that you believe is inaccurate or incomplete. The
request must explain the reason for the requested amendment. We may deny the request if the information is
accurate and complete, was not created by us, is not part of the record maintained by us, or is not
information you are permitted to inspect or copy. If we deny the request, you may submit a written statement
of disagreement where permitted by law.
4.3 Right to Request Confidential Communications
You may ask us to communicate with you about health matters in a particular way or at a particular location,
such as by calling a specific phone number or mailing information to a specific address. We will accommodate
reasonable requests when required by law and when the request can be reasonably implemented.
4.4 Right to Request Restrictions
You may ask us to limit certain uses or disclosures of PHI for treatment, payment, or healthcare operations.
We are not required to agree to every restriction request, except where the law requires us to agree. If you
pay out of pocket in full for a healthcare item or service and ask us not to disclose information about that
item or service to your health plan for payment or healthcare operations, we will honor the request unless
disclosure is required by law.
4.5 Right to an Accounting of Disclosures
You may request a list of certain disclosures of PHI made by us during a time period specified by law. The
accounting will not include all disclosures, such as disclosures for treatment, payment, healthcare
operations, disclosures made to you, disclosures made pursuant to your authorization, or other disclosures
excluded by law.
4.6 Right to Receive a Paper Copy of This Notice
You may request a paper copy of this Notice at any time, even if you have agreed to receive it
electronically. A current version may also be made available through our office or on our website.
4.7 Right to Choose a Personal Representative
If you have given someone medical power of attorney, if someone is your legal guardian, or if another person
has legal authority to act for you, that person may exercise your rights and make choices about your PHI to
the extent permitted by law. We may require documentation before recognizing a person as your personal
representative.
4.8 Right to Be Notified of Certain Breaches
You have the right to be notified if a breach of unsecured PHI occurs and notification is required by law.
4.9 Right to File a Complaint
You may file a complaint with Galleria Women's Health or with the U.S. Department of Health and Human
Services, Office for Civil Rights, if you believe your privacy rights have been violated. We will not
retaliate against you for filing a complaint, participating in an investigation, or exercising your privacy
rights.
5. Your Choices Regarding Certain Uses and Disclosures
For certain health information, you may tell us your preferences about what we share. If you have a clear
preference about how we share information in the situations described below, please tell us. We will follow
your instructions when required by law and when the request can be reasonably implemented.
5.1 Family, Friends, and Individuals Involved in Your Care
Unless you object or the law requires a different approach, we may share relevant information with a family
member, friend, caregiver, or other person involved in your care or payment for your care when, in our
professional judgment, doing so is in your best interest and is permitted by law. We may also disclose
information to notify or assist in notifying a family member, personal representative, or another person
responsible for your care about your location, general condition, or death, as permitted by law.
5.2 Disaster Relief and Serious Threats
We may share information with disaster relief organizations or appropriate persons to help coordinate
notification efforts or to prevent or lessen a serious and imminent threat to health or safety, as permitted
by law.
5.3 Marketing, Sale of PHI, and Fundraising
We will obtain your written authorization before using or disclosing PHI for marketing purposes or before
selling PHI, except where an exception is permitted by law. We do not currently use PHI for fundraising
communications. If we ever use PHI for fundraising, we will provide a clear way to opt out of future
fundraising communications where required by law.
5.4 Psychotherapy Notes and Other Special Records
If we ever maintain psychotherapy notes as defined by HIPAA, we will not use or disclose them without
written authorization except as permitted or required by law. Other specially protected records will be
handled according to applicable federal and state law.
6. Uses and Disclosures for Treatment, Payment, and Healthcare Operations
We may use and disclose PHI for treatment, payment, and healthcare operations without your written
authorization, as permitted by HIPAA and applicable law.
6.1 Treatment
We may use and disclose PHI to provide, coordinate, or manage your healthcare and related services. This may
include sharing information with physicians, nurse practitioners, nurses, laboratories, imaging centers,
pharmacies, hospitals, specialists, or other healthcare professionals involved in your care.
6.2 Payment
We may use and disclose PHI to bill for services, obtain payment, verify benefits, obtain prior
authorization, submit claims, process payments, coordinate benefits, collect amounts owed, and communicate
with health plans or other responsible payers.
6.3 Healthcare Operations
We may use and disclose PHI to operate the practice and improve the quality of care. Healthcare operations
may include quality assessment, staff training, credentialing, licensing, compliance activities, audits,
business planning, patient safety activities, customer service, legal services, and other administrative
functions necessary to operate the practice.
6.4 Business Associates
We may disclose PHI to vendors, contractors, consultants, or service providers who perform services for us
and who need access to PHI to perform those services. When required by HIPAA, these business associates must
agree in writing to appropriately safeguard PHI and to use or disclose it only as permitted by law and by
their agreement with us.
7. Other Uses and Disclosures Permitted or Required by Law
We may use or disclose PHI without your written authorization in the following circumstances, when permitted
or required by federal or state law. These disclosures will be limited to the information required or
permitted for the specific purpose.
7.1 Public Health and Safety
We may disclose PHI for public health activities, including disease prevention and control, public health
reporting, reporting adverse events or product problems, reporting births and deaths, reporting suspected
abuse, neglect, or domestic violence where permitted or required by law, and preventing or reducing serious
threats to health or safety.
7.2 Required by Law
We may use or disclose PHI when required to do so by federal, state, or local law, including disclosures to
the U.S. Department of Health and Human Services to demonstrate compliance with federal privacy law.
7.3 Health Oversight Activities
We may disclose PHI to health oversight agencies for activities authorized by law, including audits,
investigations, inspections, licensure, disciplinary proceedings, and compliance reviews.
7.4 Legal Proceedings
We may disclose PHI in response to a court or administrative order, subpoena, discovery request, or other
lawful process, subject to applicable legal requirements and safeguards.
7.5 Law Enforcement and Government Requests
We may disclose PHI to law enforcement or government officials when permitted or required by law, including
for identification, locating a person, reporting certain injuries, complying with legal process, or
responding to certain government functions.
7.6 Workers' Compensation
We may disclose PHI as authorized by and to the extent necessary to comply with workers' compensation or
similar programs established by law.
7.7 Coroners, Medical Examiners, Funeral Directors, and Organ Donation
We may disclose PHI to coroners, medical examiners, funeral directors, or organ procurement organizations
when permitted by law and when necessary for their duties.
7.8 Research
We may use or disclose PHI for research when permitted by law, including when an institutional review board
or privacy board has approved the research and applicable safeguards, when authorization has been obtained,
or when another legal basis permits the use or disclosure.
7.9 Inmates or Persons in Custody
If you are an inmate or in the custody of a law enforcement official, we may disclose PHI to the
correctional institution or law enforcement official when permitted by law and necessary for your health,
the health and safety of others, or the administration of the institution.
8. Reproductive Health Information
Because Galleria Women's Health provides women's health and reproductive health services, certain requests
for PHI may involve reproductive health information. We will handle reproductive health information in
accordance with applicable federal and Nevada law, including any privacy protections, presumptions, or
attestation requirements that apply to requests for PHI potentially related to reproductive healthcare.
We will not use or disclose PHI for a purpose prohibited by applicable law. When a request for PHI requires
an attestation or additional legal safeguards, we will follow applicable procedures before making the
disclosure.
9. Minor Patients and Personal Representatives
Parents, guardians, and other personal representatives may have rights to access and make decisions about a
minor patient's PHI, subject to federal and Nevada law. In certain circumstances, minors may have privacy
rights or may independently consent to specific services under applicable law. When the law gives a minor
confidentiality rights, we will follow the applicable legal requirements.
We may require documentation of legal authority before recognizing a person as a personal representative. We
may also decline to treat a person as a personal representative where permitted by law, including where we
reasonably believe doing so could endanger the patient or is not in the patient's best interest.
10. Patient Portal, Electronic Communications, and Contact Information
The patient portal is the preferred method for secure, non-urgent patient communications. Routine laboratory
and imaging results may be communicated through the portal or during a follow-up visit. Urgent or critical
results may also be communicated by telephone when appropriate.
Patients are responsible for keeping telephone numbers, email addresses, mailing addresses, and portal
access information current. If you ask us to communicate by email, text message, voicemail, or another
method that may not be fully secure, we may do so where permitted by law and according to practice policy,
but you should understand that certain communication methods may carry privacy or security risks.
Website contact forms, regular email, voicemail, and social media are not appropriate for emergencies or
detailed medical communications. For medical emergencies, call 911 or proceed to the nearest emergency
department.
11. Medical Records and Fees
Requests for medical records must be submitted with proper authorization and will be processed in accordance
with HIPAA, Nevada law, and practice procedures. Fees may apply where permitted by law, including reasonable
fees for copying, electronic transmission, postage, or other lawful charges.
12. Authorizations and Revocation
Uses and disclosures of PHI not otherwise permitted or required by law generally require your written
authorization. This includes, subject to applicable exceptions, uses and disclosures for certain marketing
purposes, sale of PHI, and certain disclosures of psychotherapy notes if such notes are maintained by the
practice.
You may revoke an authorization in writing at any time. Revocation will not affect actions we already took
in reliance on the authorization before receiving the revocation, and it may not apply where the
authorization was obtained as a condition of insurance coverage or where other law permits continued use or
disclosure.
13. Minimum Necessary Standard
When using, disclosing, or requesting PHI for purposes other than treatment, we will make reasonable efforts
to limit the PHI to the minimum necessary to accomplish the intended purpose, as required by law. The
minimum necessary standard does not apply to certain uses and disclosures, including disclosures to
healthcare providers for treatment, disclosures made to you, disclosures made pursuant to your
authorization, disclosures required by law, or other disclosures exempted by HIPAA.
14. Breach Notification
If a breach of unsecured PHI occurs and notification is required by law, we will notify affected individuals
and any required government agencies or other parties in accordance with applicable breach notification
requirements.
15. Complaints
If you believe your privacy rights have been violated, you may file a complaint with Galleria Women's Health
using the contact information below. You may also file a complaint with the U.S. Department of Health and
Human Services, Office for Civil Rights. Complaints to OCR may be submitted electronically through the OCR
Complaint Portal or as otherwise permitted by OCR procedures.
We will not retaliate against you for filing a complaint, assisting with an investigation, or exercising any
right described in this Notice.
16. Changes to This Notice
We reserve the right to change this Notice at any time. A revised Notice may apply to PHI we already
maintain as well as PHI we receive in the future, to the extent permitted by law. When we make a material
change, we will make the revised Notice available through our office and, when applicable, on our website.
The effective date of the Notice will appear at the top of the document.
17. Contact Information
For questions about this Notice, requests to exercise privacy rights, requests for records, or complaints
about privacy practices, please contact:
