Notice of Privacy Practices

Draft — pending legal review

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

1. Our duty to protect your health information

We are required by law to maintain the privacy and security of your protected health information (PHI). We are obligated to provide you with this notice of our legal duties and privacy practices with respect to your PHI. We must follow the terms of this notice as currently in effect. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.

2. How we may use and disclose your health information

The following categories describe the ways we may use and disclose your PHI without your written authorization.

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services. This includes sharing information with laboratories, pharmacies, referring providers, specialists, and other healthcare professionals involved in your care.

Payment

We may use and disclose your PHI to obtain payment for services provided to you, including billing, claims management, and collections activities. If applicable, we may disclose PHI to your health plan for coverage determinations and utilization review.

Healthcare operations

We may use and disclose your PHI for our internal operations, including quality assessment and improvement, training, credentialing, auditing, compliance activities, and business planning.

As required by law

We will disclose your PHI when required to do so by federal, state, or local law.

Public health activities

We may disclose your PHI to public health authorities for the purpose of preventing or controlling disease, injury, or disability, and to report vital events such as births and deaths.

Health oversight activities

We may disclose your PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, and licensure actions.

Judicial and administrative proceedings

We may disclose your PHI in the course of judicial or administrative proceedings in response to a court order, subpoena, discovery request, or other lawful process.

Law enforcement

We may disclose your PHI to law enforcement officials for certain law enforcement purposes, including reporting certain types of wounds, identifying or locating a suspect or missing person, or complying with a court order or grand jury subpoena.

To avert a serious threat

We may use and disclose your PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

Decedents and organ donation

We may disclose PHI to a coroner, medical examiner, or funeral director, and to organizations involved in organ, eye, or tissue procurement or transplantation.

Research

Under certain circumstances, we may use or disclose your PHI for research purposes, provided the research has been approved by an institutional review board or privacy board that has reviewed the research proposal and established protocols to ensure the privacy of your information.

Workers' compensation

We may disclose your PHI as authorized by, and to the extent necessary to comply with, workers' compensation laws and similar programs.

Military and national security

If you are a member of the armed forces, we may disclose your PHI as required by military command authorities. We may also disclose PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities.

3. Uses and disclosures requiring your written authorization

Certain uses and disclosures of your PHI require your written authorization before we may proceed. These include:

• Marketing — using your PHI to send you marketing communications (other than face-to-face communications and promotional gifts of nominal value).
• Sale of PHI — any disclosure of your PHI where we receive direct or indirect remuneration in exchange for your information.
• Psychotherapy notes — most uses and disclosures of psychotherapy notes, if applicable.
• Other uses not described in this notice — any use or disclosure of your PHI not described in this notice will be made only with your written authorization.

You may revoke a written authorization at any time by submitting a written request to our practice. Revocation will not affect any actions we took in reliance on the authorization before we received your revocation.

4. Your rights regarding your health information

Right to access and inspect your records

You have the right to request access to and obtain a copy of your PHI maintained by our practice. We may charge a reasonable, cost-based fee for copies. In limited circumstances, we may deny your request, and you may have the right to request a review of that denial.

Right to request amendment

You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny your request in certain circumstances (for example, if the information was not created by us, or if we determine the record is accurate and complete). If we deny your request, we will provide you with a written explanation.

Right to an accounting of disclosures

You have the right to request a list of certain disclosures of your PHI that we have made. This accounting does not include disclosures made for treatment, payment, or healthcare operations, among other exceptions.

Right to request restrictions

You have the right to request that we restrict certain uses or disclosures of your PHI. We are not required to agree to your request, except that we must agree to restrict disclosures to a health plan for payment or healthcare operations purposes if you have paid for the service in full out of pocket.

Right to request confidential communications

You have the right to request that we communicate with you about your health information in a certain way or at a certain location. For example, you may request that we contact you only by email or at a specific phone number. We will accommodate reasonable requests.

Right to a paper copy of this notice

You have the right to obtain a paper copy of this Notice of Privacy Practices at any time, even if you have previously agreed to receive it electronically. Contact our practice using the information below to request a paper copy.

5. Our responsibilities

We are required to:

• Abide by the terms of this Notice of Privacy Practices currently in effect.
• Notify you if we are unable to agree to a requested restriction on how your PHI is used or disclosed.
• Notify you in the event of a breach of your unsecured PHI.
• Not use or disclose your PHI in ways not described in this notice without your written authorization.

We reserve the right to change the terms of this notice and to make the new provisions effective for all PHI we maintain. If we make a material change to this notice, we will make the revised notice available to you.

6. Complaints

If you believe your privacy rights have been violated, you may file a complaint with our practice or with the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

• To our practice: contact us at hello@wellesleymedical.com.
• To the U.S. Department of Health and Human Services: Office for Civil Rights, 200 Independence Avenue SW, Washington, DC 20201. You may also file a complaint online at hhs.gov/ocr/complaints or call 1-877-696-6775.

7. Contact information

If you have questions about this notice or wish to exercise any of your rights, contact us at:

Lampert Medical, PLLC d/b/a Wellesley Medical
888 Worcester Street, Suite 130
Wellesley, MA 02482
Email: hello@wellesleymedical.com

8. Effective date

[To be set upon legal review]