HIPAA Notice of Privacy Practices

This Notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

1. What Is Protected Health Information (PHI)

PHI is information about you — including demographic information — that may identify you and that relates to your past, present, or future physical or mental health or condition; the provision of health care to you; or the past, present, or future payment for the provision of health care to you. PHI includes information in any form — oral, written, or electronic.

2. How We May Use & Disclose Your PHI

We may use and disclose your PHI for the following purposes without your written authorization:

Treatment

We may use and disclose your PHI to provide, coordinate, and manage your healthcare and related services. For example, your physician may use your medical history to evaluate your eligibility for treatment, and may share relevant information with affiliated pharmacies or consultants involved in your care.

Payment

We may use and disclose your PHI to obtain payment for the healthcare services provided to you. This may include billing, claims processing, and collection activities.

Healthcare Operations

We may use and disclose your PHI for our internal healthcare operations, including quality assessment, training, licensing, and compliance activities. These activities support the delivery of care and maintain the integrity of our clinical and administrative operations.

As Required by Law

We will disclose your PHI when required to do so by federal, state, or local law, including to public health authorities, law enforcement, or to avert a serious threat to health or safety.

Business Associates

We may share your PHI with third parties known as "Business Associates" (such as billing services, data hosting providers, or analytics companies) who perform services on our behalf. Business Associates are contractually required to protect PHI and may use it only for the purposes for which they were engaged.

3. Uses & Disclosures Requiring Your Authorization

Other uses and disclosures of your PHI — beyond those described above — will be made only with your written authorization, including:

• Most uses and disclosures of psychotherapy notes
• Uses and disclosures of PHI for marketing purposes
• Sales of your PHI

You may revoke a written authorization at any time, in writing. The revocation will not affect any uses or disclosures made prior to the date of revocation.

4. Your Rights Regarding Your PHI

Right to Access Your Records

You have the right to request access to your medical records and PHI. We will provide access or a copy in the format you request if we are able to do so, within 30 days of your request (with a possible 30-day extension).

Right to Request Amendment

If you believe your PHI is inaccurate or incomplete, you may request that we amend it. We may deny the request under certain circumstances, but we will document any denial and allow you to submit a statement of disagreement.

Right to an Accounting of Disclosures

You have the right to request an accounting of disclosures of your PHI made in the past six years, other than disclosures for treatment, payment, and healthcare operations; disclosures you authorized; and certain other exceptions.

Right to Request Restrictions

You may request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree to your request, except in limited circumstances (e.g., if you paid out of pocket in full for a service and ask us not to disclose to a health plan).

Right to Confidential Communications

You may request that we communicate with you about your PHI by alternative means or at alternative locations (e.g., by email only, at a specific address). We will accommodate reasonable requests.

Right to Receive a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice upon request, even if you agreed to receive this Notice electronically.

5. Our Duties

Eleva MD is required by law to:

• Maintain the privacy of your PHI
• Provide you with this Notice of Privacy Practices
• Notify you following a breach of unsecured PHI as required by 45 CFR §§ 164.400–414
• Abide by the terms of the Notice currently in effect

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already maintain about you. The revised Notice will be posted on our website and will be available upon request.

6. Breach Notification

In the event of a breach of unsecured PHI, Eleva MD will notify affected individuals without unreasonable delay and no later than 60 days from discovery of the breach. Notification will describe the nature of the breach, the type of information involved, steps taken to mitigate harm, and the actions you may take to protect yourself. Breaches affecting 500 or more individuals will also be reported to the U.S. Department of Health and Human Services (HHS) and, where required, to prominent media outlets.

7. How to Exercise Your Rights & File a Complaint

To exercise any of your rights, or if you believe your privacy rights have been violated, please contact our Privacy Officer:

You also have the right to file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights:

• Website: hhs.gov/hipaa/filing-a-complaint
• Phone: 1-800-368-1019

We will not retaliate against you for filing a complaint.

8. Changes to This Notice

We reserve the right to change the terms of this Notice at any time. We will post the revised Notice on our website. The new Notice will apply to PHI we currently maintain, as well as any PHI we create or receive in the future.