Notice of
Privacy Practices

Stewart Foot & Ankle is a podiatric medical practice located in Olympia, Washington, operated by Dr. Benton Stewart, DPM. As a healthcare provider, we are a "covered entity" under HIPAA and are required to protect the privacy of your protected health information.

"Protected Health Information" (PHI) means any information we create or receive that relates to your past, present, or future physical or mental health condition, the provision of healthcare to you, or the payment for that healthcare — and that could reasonably identify you.

The following describes the ways we may use and disclose your PHI without your written authorization. Not every use or disclosure will be listed, but all permitted uses and disclosures will fall within one of the following categories.

Treatment

We may use your PHI to provide, coordinate, and manage your healthcare and related services. For example, we may share your health information with other physicians or healthcare providers involved in your care, such as a specialist or hospital, if we refer you for additional treatment.

• Diagnosing and treating foot and ankle conditions
• Ordering diagnostic imaging, lab tests, or referrals to other providers
• Coordinating care with other treating physicians, therapists, or facilities
• Communicating with pharmacies regarding prescriptions
• Providing follow-up reminders, care instructions, and post-treatment support

Payment

We may use and disclose your PHI to obtain payment for services we provide. This includes submitting claims to your insurance carrier, verifying benefits, and billing you or a third-party payer for services rendered.

• Submitting claims to your insurance carrier (Aetna, Premera Blue Cross, Cigna, and others)
• Verifying insurance benefits and prior authorization
• Billing and collecting payment from you or a responsible party
• Responding to coverage inquiries from your health plan
• Processing HSA, FSA, or other health account transactions

Healthcare Operations

We may use and disclose your PHI for our internal healthcare operations. These activities are necessary to run our practice and ensure quality care for all patients.

• Quality assessment, improvement, and patient satisfaction activities
• Training and supervision of clinical and administrative staff
• Business planning, practice management, and administration
• Conducting audits, compliance reviews, and accreditation activities
• Legal, risk management, and insurance functions

Appointment Reminders & Treatment Alternatives

We may use your PHI to contact you as a reminder that you have an appointment scheduled, or to provide information about treatment alternatives or other health-related services that may be of interest to you. You may request that we contact you by a specific method or at a specific location.

In addition to treatment, payment, and healthcare operations, we may use or disclose your PHI in the following circumstances without your prior written authorization:

Business Associates

We may share your PHI with third-party "business associates" — companies or individuals who perform services on our behalf, such as billing companies, IT service providers, or our patient portal provider (YourHealthFile). We require all business associates to sign a Business Associate Agreement (BAA) committing them to protect your PHI in accordance with HIPAA.

Disclosures Requiring Your Written Authorization

For uses and disclosures beyond those described in this Notice, we will ask for your written authorization before sharing your information. This includes:

• Marketing communications — we will not use your PHI to market products or services without your written consent
• Sale of PHI — we do not sell your health information under any circumstances
• Psychotherapy notes — require a separate, specific authorization
• Most other disclosures not specifically described in this Notice

Certain categories of health information are entitled to greater privacy protections under federal and Washington State law. We apply additional safeguards to the following types of information and will not disclose them without appropriate authorization or legal requirement:

• Mental health and psychiatric records — subject to stricter disclosure rules under Washington law (RCW 71.05)
• Substance use disorder treatment records — protected under federal 42 CFR Part 2 and Washington law (RCW 70.96A)
• HIV/AIDS status and testing — special restrictions on disclosure under Washington law (RCW 70.24)
• Genetic information — protected under the Genetic Information Nondiscrimination Act (GINA)
• Reproductive health information — additional protections under the Washington My Health MY Data Act
• Gender-affirming care information — additional protections under Washington State law
• Minor patients — certain information about minors may be protected from disclosure even to parents or guardians, as required by applicable law

You have the following rights regarding your protected health information. To exercise any of these rights, please submit a written request to our Privacy Officer. We may charge a reasonable, cost-based fee for certain requests as permitted by law.

We are required by law to maintain the privacy of your protected health information, provide you with this Notice of our privacy practices, notify you following a breach of your unsecured PHI, and abide by the terms of this Notice currently in effect.

Administrative Safeguards

We have adopted comprehensive policies and procedures to protect your PHI. This includes designating a Privacy Officer, training all staff on privacy practices and their obligations, conducting regular risk assessments, and implementing sanctions for violations of our privacy policies.

Physical Safeguards

We control physical access to our office, equipment, and records to prevent unauthorized access to PHI. Paper records are stored securely, and access is limited to authorized personnel only. Workstations are positioned and locked to prevent unauthorized viewing of patient information.

Technical Safeguards

We use technical security measures to protect electronic PHI (ePHI), including access controls, audit controls, integrity controls, and transmission security. Our patient portal uses industry-standard encryption and authentication practices. Electronic communications containing PHI are transmitted using secure, encrypted channels.

If you believe your privacy rights have been violated, or that we have not complied with our obligations under HIPAA or this Notice, you may file a complaint with our practice or with the U.S. Department of Health and Human Services. We will not retaliate against you in any way for filing a complaint.

File a Complaint With Our Practice

Contact our Privacy Officer in writing at the address listed in Section 10. We take all complaints seriously and will investigate promptly. We will respond to your complaint within a reasonable timeframe and notify you of our findings.

File a Complaint With the Federal Government

You may file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR):

• Online: www.hhs.gov/hipaa/filing-a-complaint
• Phone: 1-800-368-1019  |  TDD: 1-800-537-7697
• Mail: U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, D.C. 20201

File a Complaint With Washington State

You may also contact the Washington State Department of Health or the Washington State Attorney General's Office regarding complaints about healthcare providers or consumer health data privacy:

• WA Dept. of Health: www.doh.wa.gov  |  1-800-525-0127
• WA Attorney General (My Health MY Data Act): www.atg.wa.gov

Website Analytics & Cookies

Our website may use cookies and analytics tools (such as Google Analytics) to understand how visitors use the site and to improve the patient experience. This data is anonymized and aggregated and does not include your protected health information. You may disable cookies through your browser settings without affecting your ability to receive care at our office.

Patient Portal

Our patient portal is provided by YourHealthFile, a third-party platform. When you use the portal to book appointments, view records, or communicate with our office, that platform's own security practices and privacy policy also apply. We have a Business Associate Agreement (BAA) in place with our portal provider, requiring them to protect your PHI in accordance with HIPAA. We encourage you to review YourHealthFile's privacy policy at their website.

Electronic Communications

If you contact us by standard email or text message, please be aware that these channels are not fully encrypted and carry inherent privacy risks. We recommend using our secure patient portal for any communications that include your health information. By choosing to contact us via standard email or text, you acknowledge and accept the privacy risks of those communication methods.

Telehealth Services

Where telehealth visits are offered, they are conducted using HIPAA-compliant platforms with appropriate encryption and access controls. Your PHI transmitted during telehealth sessions is subject to the same protections described in this Notice.

Website Forms

Any information submitted through contact forms or appointment request forms on this website is transmitted securely via HTTPS. We do not use website form submissions for any purpose other than responding to your inquiry and scheduling your care.

Washington State provides additional health privacy protections in certain situations. Where Washington State law is more stringent than HIPAA, we follow Washington State law. The following state laws may apply to your health information:

• RCW 70.02 — Washington Health Care Information Act: Governs the use and disclosure of health care information by providers in Washington, and establishes patient rights to access and control their health records
• Washington My Health MY Data Act (SB 1155, eff. 2024): Provides additional consumer health data protections including reproductive health data, precise geolocation data in connection with health services, gender-affirming care, mental health data, and other sensitive categories
• RCW 70.24 — Sexually Transmitted Infections: Strict restrictions on the disclosure of STI-related testing and treatment information without patient consent
• RCW 70.96A — Substance Use Disorder: Additional confidentiality protections for records related to substance use disorder assessment and treatment
• RCW 71.05 — Mental Health: Special protections governing the disclosure of mental health treatment records
• RCW 70.46 — Home Health: Applicable confidentiality provisions for home health service records

For questions about this Notice, to exercise your privacy rights, to request a paper copy of this Notice, or to submit a written complaint, please contact our Privacy Officer: