Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Who follows this notice

This notice applies to Bio Medical, its chiropractor, and all staff, employees, and volunteers who work at our clinic. It covers the health information we create or receive about you, including exam findings, treatment notes, and billing and payment records. This information is called "protected health information" or "PHI."

If you have any questions about this notice, contact our Privacy Contact listed in Section 9.

2. Our duties

We are required by law to:

• maintain the privacy and security of your PHI;
• give you this notice of our legal duties and privacy practices with respect to your PHI;
• notify you if a breach occurs that may have compromised the privacy or security of your unsecured PHI; and
• follow the terms of the notice that is currently in effect.

We won't use or share your PHI other than as described in this notice unless you tell us we can in writing.

3. How we may use and disclose your PHI without your written authorization

Treatment. We may use and share your PHI to provide, coordinate, or manage your care. Example: your chiropractor reviews your intake form and exam findings to decide whether SoftWave or another therapy is appropriate, or shares information with your primary care physician or a specialist you're referred to.

Payment. We may use and share your PHI to bill and collect payment for the services we provide. Example: we use your name and the services you received to process a card payment, a Health Savings Account (HSA) or Flexible Spending Account (FSA) card payment, or a refund, or to give you a receipt for reimbursement.

Health care operations. We may use and share your PHI to run our clinic, improve care, and contact you when needed. Example: we review records to evaluate the quality of care, train staff, conduct audits, and send appointment reminders.

Business associates. We may share your PHI with companies that perform services for us, such as our electronic health record, scheduling, texting, and payment providers. Each must sign a written agreement to protect your PHI.

People involved in your care or payment. We may share relevant PHI with a family member, friend, or other person you identify who is involved in your care or helps pay for it, unless you object. If you're not present or able to agree, we may share information if we believe it's in your best interest. We may also share information with disaster-relief organizations so your family can be told about your condition and location.

Other uses and disclosures permitted or required by law. We may use or share your PHI without your authorization:

• As required by law: when federal, state, or local law requires it, including to the U.S. Department of Health and Human Services (HHS) to show we're complying with federal privacy law.
• For public health activities: for example, to prevent or control disease, report adverse events or product problems to the U.S. Food and Drug Administration, or support product recalls.
• To report abuse, neglect, or domestic violence: to the appropriate government authority, when we believe you may be a victim, as the law requires or allows.
• For health oversight activities: to agencies authorized by law to oversee health care, such as the Louisiana State Board of Chiropractic Examiners, for audits, investigations, inspections, and licensing.
• For lawsuits and legal proceedings: in response to a court or administrative order, or to a subpoena or other lawful process, subject to the protections the law requires.
• For law enforcement: for certain law enforcement purposes, such as responding to a court order, warrant, or summons, or helping identify or locate a suspect, fugitive, material witness, or missing person.
• To avoid a serious threat to health or safety: to someone able to help prevent or lessen a serious and imminent threat to you, another person, or the public.
• For workers' compensation: as authorized by and to the extent necessary to comply with workers' compensation laws.
• For specialized government functions: for example, for military, national security, or protective services, as the law allows.
• To coroners, medical examiners, and funeral directors: as needed to carry out their duties.
• For organ and tissue donation: to organizations that handle organ, eye, or tissue procurement.
• For research: under limited conditions the law sets, such as approval by a privacy board.

More stringent laws. If a Louisiana or federal law gives your information greater protection than HIPAA, we'll follow that law. See Section 8 for Louisiana-specific information.

Substance use disorder treatment records. If we receive records about you from a substance use disorder treatment program covered by federal law at 42 U.S.C. § 290dd-2 and 42 C.F.R. Part 2 ("Part 2 records"), we'll protect them as that law requires. Part 2 records, or testimony describing their contents, won't be used or disclosed in any civil, criminal, administrative, or legislative proceeding against you unless you give written consent or a court issues an order that meets Part 2's requirements, after notice and an opportunity to be heard as the law provides.

4. Uses and disclosures that require your written authorization

We will not use or share your PHI for the following purposes without your written authorization:

• Psychotherapy notes. Bio Medical doesn't keep psychotherapy notes. If we ever did, most uses and disclosures of them would require your written authorization.
• Marketing. We won't use or share your PHI for marketing purposes without your written authorization, except for face-to-face communications with you or a promotional gift of nominal value. If we receive financial payment from a third party for a marketing communication, the authorization will say so.
• Sale of PHI. We will never sell your PHI without your written authorization, and the authorization will state that we'll be paid.
• Other uses and disclosures. Any use or disclosure not described in this notice will be made only with your written authorization.

You may revoke an authorization at any time by giving us written notice. Revoking it stops future uses and disclosures, but it doesn't undo anything we've already done in reliance on your authorization.

Fundraising. Bio Medical doesn't use PHI for fundraising. If we ever did, you would have the right to opt out of those communications.

5. Your rights

You have the following rights regarding your PHI. To exercise any of them, contact our Privacy Contact in Section 9. We may ask you to make certain requests in writing.

Right to inspect and get a copy of your records. You can ask to see or get a paper or electronic copy of your medical and billing records. We'll respond within 30 days of your request, as the law requires. We may charge a reasonable, cost-based fee. In limited cases we may deny your request, and we'll tell you why in writing and explain how to request a review.

Right to ask us to amend your records. If you believe information in your record is incorrect or incomplete, you can ask us in writing to correct it and tell us why. We may say no, but we'll tell you why in writing within 60 days, and you may submit a statement of disagreement.

Right to an accounting of disclosures. You can ask for a list of the times we've shared your PHI in the six years before your request, who we shared it with, and why. The list won't include disclosures for treatment, payment, or health care operations, disclosures you authorized, or certain other disclosures. We'll provide one list per 12 months free of charge, and we may charge a reasonable, cost-based fee for additional lists.

Right to request restrictions. You can ask us not to use or share certain PHI for treatment, payment, or health care operations. We're not required to agree, and we may say no if it would affect your care. However, if you pay for a service or item out of pocket in full, you can ask us not to share information about that service or item with your health plan for payment or operations purposes, and we'll agree unless a law requires us to share it.

Right to request confidential communications. You can ask us to contact you in a specific way (for example, by mobile phone only) or at a different address. We'll accommodate all reasonable requests, and we won't ask why.

Right to a paper copy of this notice. You can ask for a paper copy of this notice at any time, even if you've agreed to receive it electronically.

Right to be notified of a breach. You have the right to be notified, and we'll notify you, if a breach of your unsecured PHI occurs.

Right to choose someone to act for you. If you've given someone medical power of attorney, or someone is your legal guardian, that person can exercise your rights and make choices about your PHI. We'll confirm the person has this authority before we act.

6. Changes to this notice

We reserve the right to change the terms of this notice, and the changes will apply to all PHI we have about you, including information we created or received before the change. If we make a material change, we'll post the new notice in our office and on our website, and a copy will be available at our office or on request at 337-485-4349. The effective date will appear on the first page.

7. Complaints

If you believe your privacy rights have been violated, you can file a complaint with us by contacting our Privacy Contact in Section 9.

You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.

We will not retaliate against you for filing a complaint.

8. Louisiana notes

• Copies of records. Louisiana law (La. R.S. 40:1165.1) also gives you the right to a copy of your records. For copies you request for yourself, we'll charge no more than what both HIPAA and Louisiana law allow.
• Record retention. We keep your records for at least the period required by Louisiana law and the rules of the Louisiana State Board of Chiropractic Examiners.
• Data breaches. In addition to HIPAA, the Louisiana Database Security Breach Notification Law (La. R.S. 51:3071 et seq.) requires us to notify Louisiana residents of certain breaches of personal information, and we'll do so as that law requires.
• Legal privilege. Louisiana law recognizes a health care provider–patient privilege (Louisiana Code of Evidence art. 510) that may limit disclosure of your health information in legal proceedings.
• Minors. Generally, a parent or legal guardian acts for a minor patient and may exercise the minor's rights under this notice. Where Louisiana law allows a minor to consent to care on their own, the minor may control the related information as the law permits.
• Licensing board. The Louisiana State Board of Chiropractic Examiners oversees chiropractic practice in Louisiana and may review records as part of its oversight duties.

9. Privacy Contact

For questions about this notice, to exercise your rights, or to file a complaint with us, contact:

Privacy Contact: Dr. Brett Gschwend, chiropractor
Bio Medical
75 Center Circle, Sulphur, LA 70663
Phone: 337-485-4349

---