36 Research: We might disclose your protected health information to researchers when an institutional review board or privacy board has: (1) reviewed the research proposal and established protocols to ensure the privacy of the information; and (2) approved the research. Inmates: If you are an inmate of a correctional institution, we might disclose your protected health information to the correctional institution or to a law enforcement official for: (1) the institution to provide health care to you; (2) your health and safety and the health and safety of others; or (3) the safety and security of the correctional institution. Workers’ Compensation: We might disclose your protected health information to comply with workers’ compensation laws and other similar programs that provide benefits for work-related injuries or illnesses. Public Health and Safety: We might disclose your protected health information to the extent necessary to avert a serious and imminent threat to your health or safety or the health or safety of others. Required by Law: We might use or disclose your protected health information when we are required to do so by law. For example, we must disclose your protected health information to the U.S. Department of Health and Human Services upon their request for purposes of determining whether we are incompliance with federal privacy laws. Legal Process and Proceedings: We might disclose your protected health information in response to a court or administrative order, subpoena, discovery request, or other lawful process, under certain circumstances. Under limited circumstances, such as a court order, warrant, or grand jury subpoena, we might disclose your protected health information to law enforcement officials. Law Enforcement: We might disclose to law enforcement officials limited protected health information of a suspect, fugitive, material witness, crime victim, or missing person. We might disclose protected health information where necessary to assist law enforcement officials to capture an individual who has admitted to participation in a crime or has escaped from lawful custody. Military and National Security: We might disclose to military authorities the protected health information of Armed Forces personnel under certain circumstances. We might disclose to federal officials protected health information required for lawful intelligence, counterintelligence, and other national security activities. OTHER USES AND DISCLOSURES OF YOUR PROTECTED HEALTH INFORMATION: Other uses and disclosures of your protected health information that are not described above will be made only with your written authorization. For example, in general and subject to specific conditions, we will not use or disclose your psychiatric notes; we will not use or disclose your protected health information for marketing; and we will not sell your protected health information, unless you give us a written authorization. If you provide us with such an authorization, you may revoke the authorization in writing, and this revocation will be effective for future uses and disclosures of protected health information. How- ever, the revocation will not be effective for information that we already have used or disclosed in reliance on your authorization. BREACH OF UNSECURED PROTECTED HEALTH INFORMATION: You must be notified in the event of a breach of unsecured protected health information. A “breach” is the acquisition, access, use, or disclosure of protected health information in a manner that com- promises the security or privacy of the protected health information. Protected health information is considered compromised when the breach poses a significant risk of financial harm, damage to your reputation, or other harm to you. This does not include good faith or inadvertent disclosures or when there is no reasonable way to retain the information. You must receive a notice of the breach as soon as possible and no later than 60 days after the discovery of the breach. HIPAA Uses and Disclosures of Medical Information (cont’d) Individual Rights Access: You have the right to look at or get copies of the protected health information contained in a designated record set, with limited exceptions, including your protected health information maintained in an electronic format. You may request that we provide copies in a format other than photocopies. We will use the format you request unless we cannot reasonably do so. For example, if your protected health information is available in an electronic format, you may request access electronically and that this be transmitted directly to someone you designate. You must make a request in writing to obtain access to your protected health information. You may obtain a form to request access by using the contact information listed at the end of this notice. You may also request access by sending a letter to the address at the end of this notice. If you request copies, we might charge you a reasonable fee for each page, and postage if you want the copies mailed to you. If you request an alternative format, we might charge a cost-based fee for providing your protected health information in that format. But any fee must be limited to the cost of labor involved in responding to your request if you requested access to an electronic health record. If you prefer, we will prepare a summary or an explanation of your protected health information, but we might charge a fee to do so. We might deny your request to inspect and copy your protected health information in certain limited circumstances. Under certain conditions, our denial will not be reviewable. If this event occurs, we will inform you in our denial that the decision is not reviewable. If you are denied access to your information and the denial is subject to review, you may request that the denial be licensed health care professional chosen by us will review your request and the denial. The person performing this review will not be the same person who denied your initial request.