Notice of Privacy Practices

We are required by law to:

• Maintain the privacy and security of your protected health information
• Provide you with this Notice of our legal duties and privacy practices regarding your PHI
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your information
• Follow the terms of the Notice that is currently in effect

We may not use or disclose your PHI other than as described in this Notice, unless you give us written permission or the law requires or permits it.

We may use and disclose your PHI without your written authorization for the following purposes:

Treatment. We may use and disclose PHI to provide, coordinate, or manage your health care. For example, we may share your medication history with a compounding pharmacy filling your prescription, or send your laboratory order to a testing provider.

Payment. We may use and disclose PHI to obtain payment for services provided. For example, we may use your information to process a payment, issue a refund, or provide you with an itemized receipt.

Health Care Operations. We may use and disclose PHI to operate our practice, evaluate and improve quality of care, train personnel, and conduct administrative activities. For example, we may review records to assess treatment outcomes.

Business Associates. We may disclose PHI to third parties that perform services on our behalf, such as electronic health record platforms, telehealth platforms, and billing services. These business associates are required by written contract and by law to safeguard your information and limit how they may use it.

Appointment Reminders and Health-Related Communications. We may contact you to remind you of appointments, to follow up on your care, or to tell you about treatment alternatives or other health-related services that may be of interest to you.

We may use or disclose your PHI without your authorization in the following circumstances:

• As required by federal, state, or local law
• For public health activities, including reporting disease, injury, or vital events
• To report adverse events, product defects, or to participate in product recalls
• To report suspected abuse, neglect, or domestic violence as required or permitted by law
• For health oversight activities such as audits, investigations, inspections, and licensure
• In response to a court or administrative order, subpoena, discovery request, or other lawful process
• For law enforcement purposes as permitted by law
• To coroners, medical examiners, and funeral directors as permitted by law
• For organ, eye, or tissue donation purposes
• For research purposes, subject to approval and privacy protections required by law
• To prevent or lessen a serious and imminent threat to the health or safety of you or others
• For specialized government functions, including military and national security activities
• As authorized by and to the extent necessary to comply with workers’ compensation laws

The following uses and disclosures will be made only with your written authorization:

• Most uses and disclosures of psychotherapy notes, where such notes are maintained
• Uses and disclosures for marketing purposes
• Disclosures that constitute a sale of protected health information
• Any other use or disclosure not described in this Notice

We do not sell your protected health information.

If you provide an authorization, you may revoke it in writing at any time. A revocation stops any further use or disclosure under that authorization, but does not affect uses or disclosures we already made while it was in effect.

You have the right to:

Inspect and receive a copy of your records. You may request access to and copies of your medical and billing records, including an electronic copy where we maintain the information electronically. We may charge a reasonable, cost-based fee as permitted by law.

Request an amendment. If you believe information in your record is incorrect or incomplete, you may ask us to amend it. We may deny your request in certain circumstances, and if we do, we will explain why in writing and you may submit a statement of disagreement.

Receive an accounting of disclosures. You may request a list of certain disclosures we have made of your PHI.

Request restrictions. You may ask us to limit how we use or disclose your PHI for treatment, payment, or health care operations. We are not required to agree to most requests. However, we must agree to your request to restrict disclosure to a health plan when you have paid in full, out of pocket, for the item or service and the disclosure is not otherwise required by law.

Request confidential communications. You may ask us to contact you by a particular method or at a particular address. We will accommodate reasonable requests.

Receive a paper or electronic copy of this Notice. You may request a copy at any time, even if you agreed to receive it electronically.

Be notified of a breach. You have the right to be notified if a breach occurs that may have compromised the privacy or security of your information.

Choose someone to act for you. If you have given someone medical power of attorney, or if someone is your legal guardian, that person may exercise your rights and make choices about your information. We will verify that person’s authority before taking action.

To exercise any of these rights, contact our Privacy Officer using the information at the end of this Notice. Most requests must be submitted in writing.

In some situations you can tell us your preferences, and we will follow them where we are able. This includes sharing information with family members, friends, or others involved in your care or payment for your care, and sharing information in disaster relief situations.

If you are not present or are unable to express a preference, we may share information when we determine, using professional judgment, that doing so is in your best interest, or to lessen a serious and imminent threat to health or safety.

Some state laws provide greater privacy protection than HIPAA. Where that is the case, we follow the more protective standard.

For patients in California, this includes the California Confidentiality of Medical Information Act. For patients in New York, this includes New York law governing the confidentiality of patient records.

If you believe your privacy rights have been violated, you may file a complaint with us by contacting our Privacy Officer using the information below. We ask that complaints be submitted in writing so we can respond fully.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, by sending a letter to 200 Independence Avenue SW, Washington, D.C. 20201, by calling 1-877-696-6775, or by visiting the Office for Civil Rights complaint portal online.

We will not retaliate against you in any way for filing a complaint.

We reserve the right to change this Notice at any time. Any change will apply to all protected health information we maintain, including information created or received before the change was made.

The revised Notice will be posted on our website with a new effective date, will be available at your request, and will be provided to you at your next visit following the change.

At the start of care, you will be asked to acknowledge that you received this Notice or were given the opportunity to review it.

Your acknowledgment confirms only that you received the Notice. It is not consent to any particular use or disclosure of your information, and it does not waive any of the rights described above.

For questions about this Notice, to exercise any of your rights, or to file a privacy complaint, contact: