NOTICE OF PRIVACY PRACTICES

This practice is required by law to maintain the privacy of your protected health information (PHI), to provide you with this Notice of our legal duties and privacy practices, and to abide by the terms of this Notice while it is in effect. We are also required to notify you if a breach occurs that may have compromised the privacy or security of your information.

This is a joint Notice for the PrevHealth entities listed below. They are under common ownership or control and have designated themselves as a single affiliated covered entity under HIPAA. All physicians, clinicians and staff at these locations follow this Notice, and the entities may share your health information with each other for treatment, payment, and health care operations.

• PrevHealth Folsom PC: Folsom, Pennsylvania
• PrevHealth Virginia Inc.: Burke, Virginia
• PrevHealth Pilot Point PLLC: Pilot Point, Texas

We use and disclose health information about you for treatment, payment, and health care operations without your written authorization. Examples include:

• Treatment. A physician treating you for an illness consults with another physician about your treatment, or your primary care provider refers you to a specialist and shares your records with them.
• Payment. We submit a bill to your insurance company, which may need information about your diagnosis and the services you received to process the claim.
• Health Care Operations. We use your health information internally for quality assessment, staff training, licensing, and other activities needed to run and improve the practice.
• Business Associates. We may share your information with companies that perform services on our behalf, such as billing, electronic health record, and technology service providers, including providers of artificial intelligence (AI) tools that assist with clinical documentation. These business associates are required by contract and by law to protect your information.

We may also use or disclose your information, without your written authorization, for the following purposes:

• to remind you of appointments, or to tell you about treatment alternatives or health-related benefits and services.
• to a family member, friend, or other person involved in your care or payment for care, unless you object. If you are not able to tell us your preference (for example, if you are unconscious), we may share your information if we believe it is in your best interest.
• to disaster relief organizations, to help notify your family of your location and condition, unless you object.
• as required by federal, state, or local law, including reporting as mandated by the laws of Pennsylvania, Virginia, and Texas (for example, certain communicable diseases, births and deaths, and suspected abuse or neglect).
• to the U.S. Department of Health and Human Services if it wants to see that we are complying with federal privacy law.
• for public health and safety activities, such as preventing or controlling disease, helping with product recalls, reporting adverse reactions to medications, and reporting suspected abuse, neglect, or domestic violence; and to health oversight agencies for audits and investigations.
• in response to a court or administrative order, subpoena, warrant, or other lawful process.
• to law enforcement officials for limited purposes, such as identifying a suspect or reporting a crime.
• to coroners, medical examiners, or funeral directors as necessary, and to organ procurement organizations for donation purposes.
• for research purposes, subject to a formal approval process that protects your information.
• to avert a serious threat to health or safety.
• for specialized government functions, such as military, national security, or protective services.
• to a correctional institution or law enforcement official having lawful custody of you, if you are an inmate.
• for workers' compensation claims, as authorized by law.

Substance use disorder treatment records. If we have substance use disorder patient records about you that are subject to federal confidentiality rules at 42 CFR Part 2, we will not use or share information in those records in civil, criminal, administrative, or legislative investigations or proceedings against you without (1) your written consent or (2) a court order and a subpoena. This applies in all cases, including the uses and disclosures listed above.

Federal law and the laws of the states where we provide care (Pennsylvania, Virginia, and Texas) may give additional protection to certain types of records, such as records related to HIV/AIDS, drug and alcohol (substance use disorder) treatment, and mental health treatment. When those laws are more protective of your privacy than HIPAA, we will follow them, which may include obtaining your specific written consent before we disclose those records.

Pennsylvania. We obtain your specific written consent before disclosing HIV-related information, except where Pennsylvania law allows otherwise. Drug and alcohol treatment records receive additional protection, and disclosures are limited even with your consent. Mental health treatment records are protected under the Pennsylvania Mental Health Procedures Act.

Virginia. Your health records are protected by the Virginia Health Records Privacy Act (Va. Code § 32.1-127.1:03), which limits disclosure without your authorization and gives you the right to access your records. HIV test results receive additional confidentiality protection.

Texas. Under the Texas Medical Records Privacy Act, we will not sell your health information. Your health information may be disclosed electronically; we will not disclose it electronically without your authorization except for treatment, payment, health care operations, or as otherwise permitted or required by law. HIV test results and mental health records receive additional confidentiality protection.

Uses and disclosures that require your written authorization. We will not use or share your information for the following purposes unless you give us written permission: most uses and disclosures of psychotherapy notes; marketing purposes; and sale of your information.

Fundraising. PrevHealth does not currently use your information for fundraising. If we decide to, we will update this Notice first, and you can tell us not to contact you. If we have substance use disorder patient records about you that are subject to 42 CFR Part 2, we will give you clear and obvious notice in advance and a choice about whether to receive fundraising communications that use that information.

All other uses and disclosures not described in this Notice will be made only with your written authorization. You may revoke that authorization in writing at any time, except to the extent we have already relied on it.

Right to Inspect and Copy. You may request a copy of your medical and billing records, in paper or electronic form. We will usually provide a copy within 30 days of your request. We may charge a reasonable, cost-based fee. In Texas, if we keep your records electronically and you ask in writing for an electronic copy, we will provide it within 15 business days.

Right to Request Amendment. You may ask us to amend your health information if you believe it is incorrect or incomplete. We may deny the request in certain circumstances, and will explain why in writing.

Right to an Accounting of Disclosures. You may request a list of certain disclosures we made of your health information during the six years prior to your request. The list will show who we shared your information with and why. It will include all disclosures except those for treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We will provide one accounting a year for free but may charge a reasonable, cost-based fee if you ask for another one within 12 months.

Right to Request Restrictions. You may ask us to restrict how we use or disclose your information for treatment, payment, or operations, or to a family member involved in your care. We are not required to agree, except where you paid out of pocket in full for a service and ask that we not disclose it to your health plan, unless a law requires us to share that information. If we agree to your request, we may still share the information if you need emergency treatment.

Right to Request Confidential Communications. You may ask us to contact you in a specific way (for example, at a different phone number) or at a different location, and we will accommodate reasonable requests. We will not ask you the reason for your request.

Right to a Paper Copy. You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.

Right to Choose Someone to Act for You. If you have given someone medical power of attorney, or if someone is your legal guardian or other personal representative, that person can exercise your rights and make choices about your health information. We will confirm the person has this authority before we take any action.

Right to Be Notified of a Breach. You will be notified if a breach of your unsecured health information occurs.

To exercise any of these rights, please submit a written request to our Privacy Officer using the contact information below.

• Maintain the privacy and security of your health information.
• Notify you promptly if a breach occurs that may have compromised your information.
• Follow the duties and privacy practices described in this Notice and give you a copy of it.
• Not use or share your information other than as described here unless you tell us, in writing, that we can. If you tell us we can, you may change your mind at any time by letting us know in writing.

We reserve the right to change this Notice at any time. Any revised Notice will apply to all health information we maintain, including information created or received before the change. The current Notice will be posted in our office and on our website at www.prevhealth.us, and available upon request.

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be penalized or retaliated against for filing a complaint.

Office for Civil Rights, U.S. Department of Health and Human Services

200 Independence Avenue, S.W., Washington, D.C. 20201

Phone: (877) 696-6775 | www.hhs.gov/hipaa/filing-a-complaint

Questions about this Notice or how to exercise your rights should be directed to:

Contact: Privacy and Security Officer

Email: privacy@prevhealth.us

Phone: Call any PrevHealth location listed below and ask for the Privacy and Security Officer.

This Notice applies to all PrevHealth locations listed below.

Burke, Virginia

Address: 8988 Fern Park Drive, Burke, VA 22015

Phone: (571) 650-2533

Fax: (571) 650-2603

Folsom, Pennsylvania

Address: 800 W. MacDade Blvd, Suite A, Folsom, PA 19033

Phone: (267) 814-2533

Fax: (267) 814-2536

Pilot Point, Texas

Address: 1013 US Highway 377, Suite B, Pilot Point, TX 76258

Phone: (940) 217-2545

Fax: (940) 217-2204

Language assistance: Free language assistance services, including interpreters and translated materials, and auxiliary aids for people with disabilities are available on request. Please contact any PrevHealth location.

Español: Si habla español, tiene a su disposición servicios gratuitos de asistencia lingüística. Comuníquese con cualquier ubicación de PrevHealth.