Notice of Privacy Practices (HIPAA)

2. How We May Use and Disclose Your PHI

The following describes the ways M Health may use and disclose your PHI without your written authorization:

2.1 Treatment

We may use and disclose your PHI to provide, coordinate, and manage your healthcare and related services. This includes sharing information among our physicians, nurses, injectors, therapists, and other providers involved in your care at M Health. For example, your aesthetics provider may review your lab results to determine whether hormonal factors are affecting your skin health, or your bodywork therapist may access your treatment notes to understand an injury history before performing fascial stretch therapy.

We may also disclose your PHI to healthcare providers outside of M Health who are involved in your care, such as referring physicians, specialists, or laboratory services, as necessary for your treatment.

2.2 Payment

We may use and disclose your PHI as necessary to obtain payment for services we provide to you. This includes submitting claims to your health insurance plan (if applicable), verifying insurance coverage, processing credit card payments through our secure payment processors, and pursuing collections for outstanding balances. For example, we may include your diagnosis and treatment information on an insurance claim form, or we may share limited billing information with a collections agency for an unpaid account.

2.3 Healthcare Operations

We may use and disclose your PHI for our internal healthcare operations. These activities include quality assessment and improvement, staff training and competency evaluation, compliance auditing, business planning, customer service, and other administrative activities necessary to run our practice. For example, we may review your medical records to evaluate the quality of care provided by our practitioners, or we may use de-identified aggregate data to analyze treatment outcomes across our patient population.

2.4 Appointment Reminders and Health-Related Communications

We may contact you to provide appointment reminders, post-treatment follow-up instructions, information about treatment alternatives, or other health-related services that may be of interest to you. These communications may be sent via phone, email, text message, or mail. You may request that we limit or change the method of these communications at any time.

2.5 As Required by Law

We may use or disclose your PHI when required to do so by federal, state, or local law. This includes mandatory reporting requirements for certain communicable diseases, suspected abuse or neglect, and other legally mandated disclosures.

2.6 Public Health Activities

We may disclose your PHI to public health authorities for public health activities and purposes, including preventing or controlling disease, injury, or disability; reporting adverse events related to medications, devices, or products; and notifying appropriate authorities of suspected abuse, neglect, or domestic violence.

2.7 Health Oversight Activities

We may disclose your PHI to health oversight agencies for activities authorized by law, including audits, investigations, inspections, licensure actions, and other proceedings necessary for the government to monitor the healthcare system and compliance with applicable laws.

2.8 Legal Proceedings

We may disclose your PHI in response to a court order, subpoena, or other lawful process, subject to the requirements of applicable law.

2.9 Law Enforcement

We may disclose your PHI to law enforcement officials in limited circumstances, including in response to a court order or warrant, to identify or locate a suspect or missing person, to report certain types of wounds or injuries, or to report a crime on our premises.

2.10 Coroners, Medical Examiners, and Funeral Directors

We may disclose your PHI to a coroner, medical examiner, or funeral director as necessary for them to carry out their lawful duties.

2.11 Workers' Compensation

We may disclose your PHI as authorized by and necessary to comply with workers' compensation laws and similar programs.

3. Uses and Disclosures Requiring Your Written Authorization

Except as described in Section 2 above, we will not use or disclose your PHI without your written authorization. Uses and disclosures that require your authorization include:

• Marketing: We will not use your PHI for marketing purposes without your written authorization. You may revoke this authorization at any time.
• Sale of PHI: We will never sell your protected health information.
• Psychotherapy Notes: If applicable, we will not disclose psychotherapy notes without your authorization (except as required by law).
• Photographs for Marketing: Use of your clinical photographs, testimonials, or before-and-after images for website, social media, or advertising purposes requires a separate written authorization. This authorization is entirely voluntary and may be revoked at any time without affecting your care.

You may revoke any written authorization at any time by submitting a written request to our Privacy Officer. Revocation will not affect uses or disclosures made in reliance on your authorization prior to revocation.

4. Your Rights Regarding Your PHI

You have the following rights regarding your protected health information maintained by M Health:

4.1 Right to Access

You have the right to inspect and obtain a copy of your PHI that is maintained in our records, including medical records, billing records, and other records used to make decisions about your care. To request access, submit a written request to our Privacy Officer. We will respond within thirty (30) days of receiving your request. We may charge a reasonable, cost-based fee for copying and mailing records. In certain limited circumstances, we may deny your request, in which case you will be notified in writing of the reason for the denial and your right to appeal.

4.2 Right to Amend

You have the right to request that we amend your PHI if you believe the information is incorrect or incomplete. To request an amendment, submit a written request to our Privacy Officer that includes the specific information you wish to amend and the reason for the amendment. We will respond within sixty (60) days. We may deny your request in certain circumstances, such as when the information is accurate and complete, or when it was not created by M Health. If we deny your request, you will be notified in writing of the reason and your right to submit a written statement of disagreement.

4.3 Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures we have made of your PHI. This accounting does not include disclosures made for treatment, payment, or healthcare operations, or disclosures made with your authorization. To request an accounting, submit a written request to our Privacy Officer specifying the time period (not to exceed six years prior to the date of your request). The first accounting in any twelve-month period is free of charge; subsequent requests may be subject to a reasonable fee.

4.4 Right to Request Restrictions

You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations. You may also request restrictions on disclosures to individuals involved in your care (such as family members). We are not required to agree to your request, except that we must agree to restrict disclosures to a health plan for services you have paid for in full out of pocket, if the disclosure is not otherwise required by law. To request a restriction, submit a written request to our Privacy Officer.

4.5 Right to Receive Confidential Communications

You have the right to request that we communicate with you about your health information in a specific way or at a specific location. For example, you may request that we contact you only at a particular phone number or email address. We will accommodate reasonable requests. To make such a request, contact our Privacy Officer.

4.6 Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time, even if you have agreed to receive it electronically. To request a paper copy, contact our front desk or Privacy Officer.

4.7 Right to Be Notified of a Breach

You have the right to be notified in the event of a breach of your unsecured PHI. M Health will notify you in accordance with applicable federal and state breach notification requirements.

5. Our Duties

M Health is required to:

• Maintain the privacy and security of your PHI as required by law.
• Provide you with this Notice of our legal duties and privacy practices regarding your PHI.
• Follow the terms of the Notice currently in effect.
• Notify you promptly in the event of a breach of your unsecured PHI.
• Not use or disclose your PHI for marketing or fundraising purposes without your explicit written authorization.
• Limit uses and disclosures to the minimum necessary to accomplish the intended purpose, except for uses related to treatment.

6. Changes to This Notice

M Health reserves the right to change the terms of this Notice and to make new provisions effective for all PHI we maintain, including PHI created or received prior to the date of the change. When we make a material change to this Notice, we will post the revised Notice on our website at mworldhealth.com/hipaa, make copies available at our facility, and update the Effective Date on the first page. We will not retroactively apply changes to reduce your privacy protections without your consent.

7. Complaints

If you believe your privacy rights have been violated, you have the right to file a complaint with M Health or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be penalized, retaliated against, or denied services for filing a complaint.

To file a complaint with M Health

To file a complaint with the U.S. Department of Health and Human Services

8. Contact Information

For questions about this Notice, to exercise any of your rights described above, or to obtain a copy of this Notice, please contact: