This notice describes how medical information about you may be used and disclosed, and how you can gain access to this information. Please review it carefully.

Protected health information (PHI), about you, is maintained as a written and/or electronic record of your contacts or visits for healthcare services with our practice. Specifically, PHI is information about you, including demographic information, that may identify you and relates to your past, present or future physical or mental health condition and related healthcare services.

Our practice is required to follow specific rules on maintaining the confidentiality of your PHI, using your information, and disclosing or sharing
this information with other healthcare professionals involved in your care and treatment. This Notice describes your rights to access and control your PHI. It also describes how we follow applicable rules and use and disclose your PHI to provide your treatment, obtain payment for services you receive, manage our healthcare operations and for other purposes that are permitted or required by law.

Your Rights Under the Privacy Rule

A Copy of This Notice: You may ask for a paper copy of this notice at any time. We reserve the right to change the terms of this Notice at any
time. Current copies of this Notice are available on DHAT’s website.

Right to Authorize Other Use and Disclosure: You have the right to authorize any use or disclosure of PHI that is not specified within this notice. For example, we would need your written authorization to use or disclose your PHI for marketing purposes, for most uses or
disclosures of psychotherapy notes, or if we intended to sell your PHI.

Right to Inspect and Copy: You may submit a written request to inspect and obtain a copy of your complete health record. We have the right
to charge a reasonable, cost-based fee for paper or electronic copies as established by federal guidelines. In most cases, we will provide requested copies within 30 days.

Right to Amend: If you feel that your PHI is incorrect or incomplete, you may request that we amend your information. You have the right
to request amendment for as long as we maintain this information. In certain cases, we may deny your request.

Right to Request Restrictions: You may ask us not to use or disclose any part of your PHI for the purposes of treatment, payment or healthcare operations. You have the right to restrict disclosure of PHI to a health plan where you paid out-of-pocket, in full, for the care or service provided. You may also request that any part of your PHI not be disclosed to family members or friends who may be involved in your care, unless provided for by law. We are not required to agree to a restriction that you may request.

Right to an Accounting of Disclosures: You may request a listing of disclosures we have made of your PHI to entities or persons outside of our practice except for those made upon your request, or for the purposes of treatment, payment or healthcare operations. We will not charge a fee for the first accounting provided in a 12-month period.

Right to Request Confidential Communications: You have the right to ask us to contact you about medical matters using an alternative method (i.e., fax, portal, telephone). You must inform us in writing how you wish to be contacted if other than the address/phone number that we have on file. We will follow all reasonable requests.

Right to Receive a Privacy Breach Notice: You have the right to receive written notification if the practice discovers a breach of your
unsecured PHI and determines through a risk assessment that notification is required.

Right to File a Complaint: If you believe your privacy rights have been violated by us, you may file a complaint with us or with the Secretary of
the Department of Health and Human Services. We will not withhold treatment or act against you for filing a complaint.

How We May Use or Disclose PHI

Treatment: We may use and disclose your PHI to provide, coordinate, or manage your healthcare and any related services. For example, your PHI may be provided to a pharmacy that would fill your prescription. We will also disclose PHI to other Healthcare Providers who may be involved in your care and treatment.

Payment: Your PHI will be used, as needed, to obtain payment for your healthcare services. In some cases, we may share information about you with your health insurance company to determine whether it will cover your treatment.

Healthcare Operations: We may use or disclose, as needed, your PHI to support the business activities of our practice, for example: quality
assessment, employee review, training of medical students, licensing, fundraising and conducting or arranging for other business activities.

Health Related Benefits and Services: We may use or disclose your PHI, as necessary, to contact you to remind you of your appointments, provide results from exams or tests, and inform you about treatment alternatives or other health related benefits and services. We may contact you regarding fundraising activities, but you will have the right to opt-out of receiving further fundraising communications.

Business Associates: There are some services that we provide through contracts with third party business associates. To protect your
health information, DHAT requires these business associates to appropriately protect your information.

Health Information Exchange (HIE): We may make your health information available electronically through an information exchange network to other providers involved in your care who request your electronic health information. The purpose of this information exchange is to
support the delivery of safer, better coordinated patient care. Participation in the information exchange is voluntary. If you do not want your information to be accessible to authorized health care providers through the HIE, you may submit a written opt-out request to your DHAT Provider’s office.

Others Involved in Your Healthcare: Unless you object, we may disclose to a member of your family, a relative, a close friend or any other
person that you identify, your PHI that directly relates to that person’s involvement in your healthcare. If you are unable to agree or object to  such a disclosure, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgement. In this case, only the PHI that is relevant to your health care will be disclosed.

Other Permitted and Required Uses and Disclosures: We may use or disclose your PHI in the following situations without your authorization: as required by law, public health issues, communicable diseases, abuse, neglect or domestic violence, health oversight, lawsuits and disputes, law enforcement, to avert a serious and imminent threat to health or safety, national security and intelligence activities or protective services, military and veterans, inmates and correctional institutions, workers’ compensation, coroners, medical examiners and funeral directors, organ and tissue donation, and other required uses and disclosures. Under the law, we must also disclose your PHI if requested by the Department of Health and Human Services to investigate or determine our compliance with the requirements of the Privacy Rule.