Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THAT INFORMATION. PLEASE REVIEW THIS NOTICE CAREFULLY.

In accordance with the Health Insurance Portability and Accountability Act of 1996 and regulations promulgated thereunder, commonly known as HIPAA and federal Privacy Rule, 45 CFR parts 160 and 164 (the “Privacy Rule”) and applicable state law, the Practice is committed to maintaining the privacy of your protected health information (“PHI”). PHI includes information about your health condition and the care and treatment you receive from the Practice and is often referred to as your health care or medical record. This Notice explains how your PHI may be used and disclosed to third parties. This Notice also details your rights regarding your PHI.

Your Protected Health Information

We collect protected health information from you through treatment, payment and related healthcare operations, the application and enrollment process, and/or healthcare providers or health plans, or through other means, as applicable. Your protected health information that is protected by law broadly includes any past, present and future healthcare information.

Your protected health information includes any information that is created or received through oral, written or electronic communications by certain health care entities, including health care providers, such as physicians and hospitals, as well as health insurance companies or plans. The law specifically protects health information that contains data consisting of eighteen (18) identifiers described in the HIPAA Privacy Rule including, but not limited to, your name, address, social security number, date of birth, and others that could be used to identify you as the individual patient associated with that health information.

How the Practice May Use and Disclose Your Protected Health Information

Generally, we may not use or disclose your protected health information without your permission. Further, once your permission has been obtained, we must use or disclose your protected health information in accordance with the specific terms of that permission.

Uses and Disclosures Requiring Authorization:

• Psychotherapy Notes: Most uses and disclosures of psychotherapy notes.
• Marketing Purposes: Uses and disclosures of PHI for marketing purposes unless:
  • The communication occurs face-to-face;
  • It consists of marketing gifts of nominal value;
  • It is regarding a prescription refill reminder for a prescription currently prescribed or a generic equivalent;
  • It is for treatment pertaining to existing condition(s) and the Practice does not receive any financial remuneration in either case or cash equivalent; and/or
  • Communication from a healthcare provider recommends or directs alternative treatments, therapies, healthcare providers, or settings of care when the Practice does not receive any financial remuneration for making the communication.
• Sale of PHI: Disclosures that constitute a sale of protected health information.

Uses and Disclosures Permitted Without Express Consent:

The Practice, in accordance with this Notice and without asking for your express consent or authorization, may use and disclose your PHI for the following purposes:

• Treatment: To provide you with the health care you require, the Practice may use and disclose your PHI to health care professionals, whether on the Practice’s staff or not, to provide, coordinate, plan, and manage your health care.
  • Examples: (a) provision, coordination, or management of health care by providers; (b) consultation between health care providers relating to a patient; or (c) referral of a patient from one provider to another.
• Payment: To get paid for services provided to you, the Practice may provide your PHI, directly or through a billing service, to a third party who may be responsible for your care, including insurance companies and health plans.
  • Examples: (a) billing and collection activities; (b) health plan actions to determine eligibility, coverage, or adjudication of claims; (c) medical necessity and utilization review; (d) disclosure to consumer reporting agencies; and (e) providing Medicare with required service information for reimbursement.
• Health Care Operations: To operate in accordance with applicable law and insurance requirements, and to provide quality, efficient care, the Practice may compile, use, and disclose your PHI.
  • Examples: (a) development of clinical guidelines; (b) case management and care coordination; (c) reviewing qualifications and training of professionals; (d) underwriting and premium rating; (e) medical review, legal services, and auditing; and (f) general administrative activities, customer service, and data analysis.

Other Uses & Disclosures Permitted or Required by Law

The Practice may use or disclose your PHI without your consent or authorization in the following instances:

• De-identified Information: Using or disclosing health information that removes all 18 identifiable characteristics so it cannot be used to identify you.
• Business Associates: Disclosing PHI to third-party entities assisting us with essential functions (e.g., billing companies) under signed written assurances to safeguard your data.

Please Note: Mobile numbers and consent data collected for text messaging (SMS) are strictly protected and will not be shared with third-party business associates, vendors, or affiliates for marketing or advertising purposes.

• Family/Friends or Personal Representatives: Disclosing relevant PHI to a family member, close friend, or personal representative involved in your care or payment for care.
  • If present: Disclosed if you agree or if we reasonably infer you do not object.
  • If absent: Disclosed only if professional judgment determines it is in your best interest.
• Emergency Situations: Obtaining or rendering emergency treatment (consent attempted as soon as possible) or coordinating disaster relief efforts.
• Public Health Activities: Reporting to public health authorities to prevent or control disease, injury, disability, adverse events, or for workplace surveillance.
• Abuse, Neglect, or Domestic Violence: Reporting to social service or protective agencies to prevent serious harm.
• Health Oversight Activities: Audits, civil/criminal investigations, inspections, or licensure actions required by law.
• Judicial and Administrative Proceedings: Responding to court orders, warrants, subpoenas, or legal processes.
• Law Enforcement Purposes: Identifying/locating suspects, fugitives, witnesses, missing persons, or reporting crimes in emergencies.
• Coroners, Medical Examiners, and Funeral Directors: Identifying a deceased person, determining cause of death, or carrying out funeral duties.
• Organ, Eye, or Tissue Donation: Coordinating organ donation activities if you are a donor.
• Research: Participating in approved research activities subject to legal privacy safeguards.
• Avert a Serious Threat to Health or Safety: Preventing or lessening an imminent threat to a person or the public.
• Specialized Government Functions: Military and veteran activities, national security, intelligence activities, and presidential protective services.
• Workers’ Compensation: Complying with workers’ compensation laws for work-related injuries or illnesses.
• Treatment Alternatives: Coordinating care and informing you of treatment alternatives, health products, or services.

Please Note: Mobile data, text messaging originator opt-in data, and text consent information will not be used, sold, or shared for marketing or promotional distribution.

• Advice of Appointment and Services: Contacting you for appointment reminders via:
  • a) Postcards mailed to your address;
  • b) Phone calls or voicemails; and
  • c) Text messages (SMS) if you have opted in.
• Inmates: Disclosing PHI to correctional facilities or law enforcement to provide care or protect safety and security.

Text Messaging (SMS) Privacy Practices

• Data Collection and Consent: We collect mobile phone numbers when voluntarily shared via web forms, registration portals, or opt-in checkboxes. Opting in authorizes the Practice to send automated operational texts, interactive appointment reminders, clinical follow-ups, and practice updates.
• Strict Privacy Baseline: Text messaging originator opt-in data, mobile numbers, and text consent details are securely maintained and will not be sold, rented, leased, or shared with third parties, business partners, or affiliates for promotional or marketing campaigns.
• Rates and Message Frequency: Message and data rates may apply based on your carrier. Message frequency varies according to your appointment schedule and administrative interactions.
• Opt-Out and Help: You can cancel SMS enrollment at any time by replying STOP to any text message. A final automated SMS confirming your unsubscription will be sent. For technical support, reply HELP or contact our Privacy Office.

All Other Situations Require Specific Authorization

Except as described above, we will not use or disclose your PHI without your written authorization. You may revoke an authorization in writing at any time, except to the extent that action has already been taken in reliance on it.

Your Rights With Respect to Your Protected Health Information

Under HIPAA, you have the following rights regarding your medical records:

• (a) Revoke Authorization: Submit a written request to the Privacy Officer to revoke any consent at any time.
• (b) Request Special Restrictions: Request limits on how your PHI is used/disclosed for treatment, payment, or operations. The Practice is not required to agree unless it pertains to out-of-pocket payments (see below).
• (c) Restriction for Out-of-Pocket Payments: Request that we restrict PHI disclosures to a health plan if the service was paid in full out-of-pocket at the time of service.
• (d) Receive Confidential Communications: Request to receive communications by alternative means or at alternative locations (e.g., specific mailing addresses).

Inspect and Copy Your PHI

You have the right to inspect and copy your PHI. Written requests must be sent to the Privacy Officer. A reasonable, cost-based fee may be charged for copies, postage, and supplies. Access may be denied in specific limited circumstances (e.g., psychotherapy notes or legal proceedings), and written explanation of denial will be provided.

Amend Your PHI

If you feel your PHI is incorrect or incomplete, you may submit a written request for an amendment stating your reason. The Practice may deny the request if the record was not created by us, is accurate, or is not part of the designated record set. If denied, you retain the right to file a written statement of disagreement.

Receive an Accounting of Disclosures

You have the right to request a list of disclosures made of your PHI during the six (6) years prior to your request date. Disclosures for treatment, payment, operations, or direct patient authorization are excluded. The first accounting within a 12-month period is free; subsequent requests may incur a reasonable cost-based fee.

Additional Rights

• Request Special Authorization: Submit written requests for disclosures not outlined in this Notice.
• Paper Copy: Request a physical paper copy of this Privacy Notice from our office or website at any time.

Questions or Complaints

If you believe your privacy rights have been violated, or if you have questions regarding this Notice, you may contact the Practice’s Privacy Officer by phone, mail, or email.

You may also file a formal complaint with the Secretary of the U.S. Department of Health and Human Services (DHHS) within 180 days of the alleged violation. You will not be penalized or retaliated against for filing a complaint.

Amendments to This Privacy Policy

We reserve the right to revise or amend this Privacy Policy at any time. Revised terms will apply to all PHI maintained by the Practice. Any changes will be distributed within 60 days of the effective date of the revision.

Practice’s Requirements

• The Practice is required by federal law to maintain the privacy of your PHI and provide this Privacy Notice.
• The Practice must abide by the terms currently stated in this Notice.
• The Practice reserves the right to update these terms and will distribute any revised Notices prior to implementation.