Patient Rights & Required Notices

This notice explains how Warmspoken Primary Care, LLC may use and share your protected health information, the rights you have regarding that information, and our legal responsibilities. It applies to Warmspoken Primary Care and its clinicians and staff.

Your Rights

• Get a copy of your record. You may inspect or receive a paper or electronic copy of your medical record and other health information we maintain about you. • Ask us to correct your record. You may ask us to amend information that you believe is incorrect or incomplete. • Request confidential communication. You may ask us to contact you in a specific way or at a different address. • Ask us to limit what we use or share. You may request restrictions on certain uses or disclosures of your information. • Get a list of certain disclosures. You may request an accounting of certain disclosures made during the six years before your request. • Get a paper copy of this notice. You may ask for a paper copy at any time. • Choose someone to act for you. An authorized personal representative may exercise applicable rights on your behalf. • File a complaint. You may complain to us or to the U.S. Department of Health and Human Services without retaliation.

Your Choices

In certain situations, you may tell us whether to share information with family, friends, or others involved in your care or payment, and whether to share information for disaster relief. Written authorization is generally required for marketing, the sale of health information, and most uses or disclosures of psychotherapy notes.

How We May Use and Share Information

We may use or share information to treat you, run our practice, bill for services, support public health and safety, conduct permitted research, comply with law, respond to organ and tissue donation requests, work with medical examiners or funeral directors, address workers' compensation and lawful government requests, and respond to lawsuits or legal proceedings when the required conditions are met.

Your Rights

This section explains your rights and how to exercise them.

Get or inspect your records

• You may ask to see or receive an electronic or paper copy of your medical record and other health information we maintain about you. • We will usually provide a copy or summary within 30 days. If a lawful extension is needed, we will notify you in writing. • We may charge only a reasonable, cost-based fee permitted by law. Limited exceptions apply, including certain psychotherapy notes and information prepared for legal proceedings. We will explain a denial and any available review rights in writing.

Ask us to correct information

• You may ask us to amend health information that you believe is incorrect or incomplete and explain the reason for your request. • We will generally respond within 60 days, subject to a lawful extension. If we deny the request, we will explain why in writing and describe how you may submit a statement of disagreement.

Request confidential communications

• You may ask us to contact you in a specific way, such as at a preferred telephone number, or to send mail to a different address. • We will accommodate reasonable requests and will not require you to explain the reason.

Ask us to limit what we use or share

• You may ask us not to use or share certain information for treatment, payment, health care operations, or with people involved in your care. We generally are not required to agree. • If you or someone other than your health plan pays in full for a specific item or service, you may require us not to disclose information about that item or service to your health plan for payment or health care operations unless disclosure is required by law. Tell us before we submit a claim.

Get a list of certain disclosures

• You may request an accounting of certain disclosures made during the six years before your request, including who received the information and why. • The accounting generally excludes disclosures for treatment, payment, health care operations, and other exceptions allowed by law. One accounting in a 12-month period is free. We will tell you the fee for an additional request so you may change or withdraw it.

Get a paper copy of this notice

• You may ask for a paper copy at any time, even if you agreed to receive the notice electronically. We will provide it promptly.

Choose someone to act for you

• A person with legal authority, such as an authorized health care agent or guardian, may exercise applicable rights for you. We will verify that authority before acting.

File a complaint without retaliation

• You may complain to our Privacy and Security Officer or to the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.

Your Choices

For certain health information, you may tell us your preferences about what we share. Tell us what you want us to do, and we will follow your instructions when the law allows.

Family Friends and Others Involved in Your Care

You may tell us whether to share relevant information with family members, close friends, or others involved in your care or payment, or for disaster relief. If you cannot tell us your preference, we may share limited information when our professional judgment indicates that doing so is in your best interest. We may also share information when needed to lessen a serious and imminent threat to health or safety.

Uses That Usually Require Written Permission

We generally will not use or disclose your information for marketing, sell your information, or share most psychotherapy notes unless you give written authorization. Other uses or disclosures not described in this notice also require written authorization. You may revoke an authorization in writing, but the revocation will not undo actions already taken in reliance on it. If we contact you for fundraising, you may tell us not to contact you again. If a fundraising communication would use substance use disorder treatment information protected by 42 CFR Part 2, we will first give you clear notice and a choice not to receive the communication.

How We Typically Use or Share Information

Treat you

We may use your health information and share it with other professionals who are treating you. For example, we may provide relevant information to a specialist involved in your care.

Run our practice

We may use and share information to manage our practice, improve your care, and contact you when necessary. For example, we may review records to evaluate the quality of our services.

Bill for services

We may use and share information to bill and obtain payment from health plans or other entities. For example, we may send information about a visit to your health plan so it can process a claim.

Other Permitted or Required Uses and Disclosures

Public health and safety

We may share information for activities such as preventing disease, reporting product problems or adverse reactions, reporting suspected abuse or neglect, and preventing or reducing a serious and imminent threat.

Research

We may use or share information for health research when the applicable legal requirements are met.

Compliance with law

We will share information when state or federal law requires it, including with the U.S. Department of Health and Human Services when it evaluates our compliance with federal privacy law.

Organ and tissue donation

We may share information with organ procurement organizations.

Medical examiners and funeral directors

We may share information with a coroner, medical examiner, or funeral director when an individual dies.

Workers' compensation law enforcement and government requests

We may use or share information for workers' compensation claims, law enforcement purposes, authorized health oversight, and special government functions such as military or national security activities.

Lawsuits and legal proceedings

We may disclose information in response to a court or administrative order, subpoena, or other lawful process after the required conditions and protections are met.

Additional Privacy Protections

Substance Use Disorder Records

To the extent that we receive or maintain substance use disorder treatment records protected by 42 CFR Part 2, those records and testimony describing their contents may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you without your written consent or a court order issued under Part 2 after notice and an opportunity for you or the record holder to be heard. A court order authorizing disclosure must also be accompanied by a subpoena or other legal requirement compelling disclosure. Other uses and disclosures must meet applicable Part 2 requirements.

Pennsylvania Privacy Protections

Pennsylvania law may provide additional protection for HIV-related information, certain mental health records and privileged communications, and drug or alcohol treatment records. When those protections apply, we will obtain the specific written consent required by law unless a legal exception permits the use or disclosure. A general medical-record authorization may not be sufficient for confidential HIV-related information. We will follow applicable laws that are more protective than HIPAA.

Our Responsibilities

• We are required by law to maintain the privacy and security of your protected health information. • We will notify affected individuals following a breach of unsecured protected health information when required by law. • We must follow the duties and privacy practices described in the notice currently in effect and give you a copy of it. • We will not use or share your information other than as described in this notice unless you authorize us in writing or the law permits or requires the use or disclosure.

Changes to This Notice

We may change this notice and make the revised terms apply to information we already maintain and information we receive in the future, as permitted by law. A revised notice will show its effective date and will be available in our office, upon request, and on our website at www.warmspoken.com.

Questions Requests and Complaints

Warmspoken Primary Care Privacy and Security Officer Stacey Coyle, MSN, CRNP, FNP-C Warmspoken Primary Care, LLC 302 9th Street New Brighton, PA 15066 Telephone (724) 252-8372 Email questions@warmspoken.com Website www.warmspoken.com You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by writing to 200 Independence Avenue SW, Washington, DC 20201; calling 1-877-696-6775; or visiting www.hhs.gov/hipaa/filing-a-complaint. You do not need to complain to us first, and we will not retaliate against you for filing a complaint.