NOTICE OF PRIVACY PRACTICES

This practice is required by law to maintain the privacy of your protected health information (PHI), to provide you with this Notice of our legal duties and privacy practices, and to abide by the terms of this Notice while it is in effect. We are also required to notify you if a breach occurs that may have compromised the privacy or security of your information.

We use and disclose health information about you for treatment, payment, and health care operations without your written authorization. Examples include:

• Treatment. A physician treating you for an illness consults with another physician about your treatment, or your primary care provider refers you to a specialist and shares your records with them.
• Payment. We submit a bill to your insurance company, which may need information about your diagnosis and the services you received to process the claim.
• Health Care Operations. We use your health information internally for quality assessment, staff training, licensing, and other activities needed to run and improve the practice.
• Business Associates. We may share your information with companies that perform services on our behalf, such as billing, electronic health record, and technology service providers, including providers of artificial intelligence (AI) tools that assist with clinical documentation. These business associates are required by contract and by law to protect your information.

We may also use or disclose your information, without your written authorization, for the following purposes:

• to remind you of appointments, or to tell you about treatment alternatives or health-related benefits and services.
• to a family member, friend, or other person involved in your care or payment for care, unless you object.
• as required by federal, state, or local law, including reporting as mandated by Pennsylvania law (for example, certain communicable diseases, births and deaths, and suspected abuse or neglect).
• to public health authorities for disease prevention or control, and to health oversight agencies for audits and investigations.
• in response to a court or administrative order, subpoena, warrant, or other lawful process.
• to law enforcement officials for limited purposes, such as identifying a suspect or reporting a crime.
• to coroners, medical examiners, or funeral directors as necessary, and to organ procurement organizations for donation purposes.
• for research purposes, subject to a formal approval process that protects your information.
• to avert a serious threat to health or safety.
• for specialized government functions, such as military, national security, or protective services.
• to a correctional institution or law enforcement official having lawful custody of you, if you are an inmate.
• for workers' compensation claims, as authorized by law.

Pennsylvania law and other federal laws may give additional protection to certain types of records, such as records related to HIV/AIDS, drug and alcohol (substance use disorder) treatment, and mental health treatment. When those laws are more protective of your privacy than HIPAA, we will follow them, which may include obtaining your specific written consent before we disclose those records.

Uses and disclosures that require your written authorization. We will not use or share your information for the following purposes unless you give us written permission: most uses and disclosures of psychotherapy notes; marketing purposes; and sale of your information.

All other uses and disclosures not described in this Notice will be made only with your written authorization. You may revoke that authorization in writing at any time, except to the extent we have already relied on it.

• Right to Inspect and Copy. You may request a copy of your medical and billing records, in paper or electronic form. We will usually provide a copy within 30 days of your request. We may charge a reasonable, cost-based fee.
• Right to Request Amendment. You may ask us to amend your health information if you believe it is incorrect or incomplete. We may deny the request in certain circumstances, and will explain why in writing.
• Right to an Accounting of Disclosures. You may request a list of certain disclosures we made of your health information during the six years prior to your request.
• Right to Request Restrictions. You may ask us to restrict how we use or disclose your information for treatment, payment, or operations, or to a family member involved in your care. We are not required to agree, except where you paid out of pocket in full for a service and ask that we not disclose it to your health plan, unless a law requires us to share that information.
• Right to Request Confidential Communications. You may ask us to contact you in a specific way (for example, at a different phone number) or at a different location, and we will accommodate reasonable requests. We will not ask you the reason for your request.
• Right to a Paper Copy. You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.
• Right to Choose Someone to Act for You. If you have given someone medical power of attorney, or if someone is your legal guardian or other personal representative, that person can exercise your rights and make choices about your health information. We will confirm the person has this authority before we take any action.
• Right to Be Notified of a Breach. You will be notified if a breach of your unsecured health information occurs.

To exercise any of these rights, please submit a written request to our Privacy Officer using the contact information below.

• Maintain the privacy and security of your health information.
• Notify you promptly if a breach occurs that may have compromised your information.
• Follow the duties and privacy practices described in this Notice and give you a copy of it.
• Not use or share your information other than as described here unless you tell us, in writing, that we can. If you tell us we can, you may change your mind at any time by letting us know in writing.

We reserve the right to change this Notice at any time. Any revised Notice will apply to all health information we maintain, including information created or received before the change. The current Notice will be posted in our office and on our website at www.prevhealth.us, and available upon request.

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be penalized or retaliated against for filing a complaint.

Office for Civil Rights, U.S. Department of Health and Human Services

200 Independence Avenue, S.W., Washington, D.C. 20201

Phone: (877) 696-6775 | www.hhs.gov/ocr/complaints

Questions about this Notice or how to exercise your rights should be directed to:

Contact: Privacy and Security Officer

Burke, Virginia

Address: 8988 Fern Park Drive, Burke, VA 22015

Phone: (571) 650-2533

Fax: (571) 650-2603

Folsom, Pennsylvania

Address: 800 W. MacDade Blvd, Suite A, Folsom, PA 19033

Phone: (267) 814-2533

Fax: (267) 814-2536

Pilot Point, Texas

Address: 1013 US Highway 377, Pilot Point, TX 76258

Phone: (940) 217-2545

Email: privacy@prevhealth.us