HIPAA Notice of Privacy Practices

1. Our Legal Duty

Pacific Spine & Rehab is a Covered Entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations (45 C.F.R. Parts 160 and 164). We are required by law to: (a) maintain the privacy and security of your protected health information (PHI); (b) provide you with notice of our legal duties and privacy practices with respect to PHI; (c) notify you following a breach of unsecured PHI; and (d) abide by the terms of this Notice currently in effect.

2. Definition of Protected Health Information

Protected Health Information (PHI) includes any information we maintain or transmit in any form (oral, written, or electronic) that: (a) relates to your past, present, or future physical or mental health or condition; (b) relates to the provision of healthcare to you; or (c) relates to the past, present, or future payment for the provision of healthcare, and that identifies you or could reasonably be used to identify you.

3. Permitted Uses and Disclosures Without Your Authorization

3.1 Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and any related services, including sharing information with other healthcare providers involved in your treatment.

3.2 Payment

We may use and disclose your PHI to obtain reimbursement for the treatment and services provided to you, including sharing information with insurance companies, workers' compensation carriers, personal injury attorneys (for lien-based care), and other payers.

3.3 Healthcare Operations

We may use and disclose your PHI for our healthcare operations, including quality assessment, training, licensing, auditing, and business management activities.

3.4 Other Permitted Disclosures

We may also use or disclose PHI without your authorization as permitted by HIPAA for:

• Public health activities and reporting
• Health oversight activities by government agencies
• Judicial and administrative proceedings pursuant to court order or subpoena
• Law enforcement purposes as required by law
• Research purposes, subject to applicable privacy board approvals
• Serious threats to health or safety
• Workers' compensation as authorized by California law
• Military and veterans activities
• Required by law (including mandatory reporting obligations under California law)

4. Uses and Disclosures Requiring Your Authorization

The following uses and disclosures of PHI require your written authorization:

• Marketing communications
• Sale of your PHI
• Most uses and disclosures of psychotherapy notes
• Uses and disclosures not otherwise permitted by HIPAA or this Notice

You may revoke any authorization you provide at any time, in writing. Revocation will not apply to disclosures already made in reliance on your prior authorization.

5. Your Rights Regarding Your PHI

5.1 Right to Access

You have the right to inspect and obtain a copy of your PHI maintained in our records. Requests must be made in writing. We will provide access within thirty (30) days and may charge a reasonable, cost-based fee as permitted under California Health & Safety Code § 123111.

5.2 Right to Amend

You have the right to request amendment of PHI you believe is inaccurate or incomplete. We may deny your request under certain circumstances and will explain the reason in writing.

5.3 Right to an Accounting of Disclosures

You have the right to receive an accounting of certain disclosures of your PHI made in the six (6) years prior to your request, excluding disclosures for treatment, payment, and healthcare operations.

5.4 Right to Request Restrictions

You have the right to request restrictions on how we use or disclose your PHI. We are not required to agree to restrictions, except that we must comply with a restriction if: (a) the disclosure is to a health plan for payment or healthcare operations; and (b) you have paid out-of-pocket in full for the service.

5.5 Right to Confidential Communications

You have the right to request that we communicate with you about your PHI in a certain way or at a certain location. We will accommodate reasonable requests.

5.6 Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time, even if you agreed to receive it electronically.

5.7 Right to Be Notified of a Breach

You have the right to be notified following a breach of your unsecured PHI in accordance with HIPAA and California law.

6. Electronic PHI (ePHI) Security

We maintain reasonable and appropriate administrative, physical, and technical safeguards to protect electronic PHI (ePHI) in compliance with the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C). Our patient portal is operated by ChiroTouch, which has executed a Business Associate Agreement with us.

7. Business Associates

We may disclose PHI to our Business Associates who perform functions or services on our behalf. We require Business Associates to maintain appropriate safeguards under HIPAA-compliant Business Associate Agreements (BAAs), including but not limited to ChiroTouch, PatientEngagePro, and other technology vendors.

8. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights. You will not be retaliated against for filing a complaint.

9. Changes to This Notice

We reserve the right to change this Notice at any time. Changes will apply to PHI we already maintain, as well as PHI we receive in the future. We will post the revised Notice on our Website and make it available in our offices.