HIPAA Notice of Privacy Practices

1. Our Legal Duty

Pacific Spine & Rehab is a Covered Entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations (45 C.F.R. Parts 160 and 164), and is also subject to the California Confidentiality of Medical Information Act (CMIA, Civ. Code §§56–56.37). We are required by law to: (a) maintain the privacy and security of your protected health information (PHI); (b) provide you with notice of our legal duties and privacy practices with respect to PHI; (c) notify you following a breach of unsecured PHI; and (d) abide by the terms of this Notice currently in effect.

2. Definition of Protected Health Information

Protected Health Information (PHI) includes any information we maintain or transmit in any form (oral, written, or electronic) that: (a) relates to your past, present, or future physical or mental health or condition; (b) relates to the provision of healthcare to you; or (c) relates to the past, present, or future payment for the provision of healthcare, and that identifies you or could reasonably be used to identify you.

3. Permitted Uses and Disclosures Without Your Authorization

3.1 Treatment

We may use and disclose your PHI to provide chiropractic, rehab, shockwave, and related care, and to coordinate or manage your healthcare with other providers involved in your treatment.

3.2 Payment

We may use and disclose your PHI to obtain reimbursement for the treatment and services provided to you, including sharing information with insurance companies, workers' compensation carriers, personal injury attorneys (for lien-based care), MedPay and third-party liability payers, and other payers.

3.3 Healthcare Operations

We may use and disclose your PHI for our healthcare operations, including quality assessment, training, credentialing, licensing, auditing, and business management activities.

3.4 Appointment Reminders and Care Information

We may contact you by phone, voicemail, text, or email using the contact information you provide, to give appointment reminders and information about your care.

3.5 Other Permitted Disclosures

We may also use or disclose PHI without your authorization as permitted by HIPAA for:

• Public health activities and reporting
• Health oversight activities by government agencies
• Judicial and administrative proceedings pursuant to court order or subpoena
• Law enforcement purposes as required by law
• Research purposes, subject to applicable privacy board approvals
• Serious threats to health or safety
• Suspected abuse or neglect, and disclosures to coroners or medical examiners
• Workers' compensation as authorized by California law
• Military and veterans activities
• Required by law (including mandatory reporting obligations under California law)

4. Uses and Disclosures Requiring Your Authorization

The following uses and disclosures of PHI require your written authorization:

• Marketing communications
• Sale of your PHI
• Most uses and disclosures of psychotherapy notes
• Uses and disclosures not otherwise permitted by HIPAA or this Notice

California law also requires written authorization for most disclosures of medical information to third parties. You may revoke any authorization you provide at any time, in writing. Revocation will not apply to disclosures already made in reliance on your prior authorization.

5. Your Rights Regarding Your PHI

5.1 Right to Access

You have the right to inspect and obtain a copy of your medical and billing records maintained in our files. Requests must be made in writing. California law generally requires us to permit inspection within 5 business days and to provide copies within 15 days of a written request, and permits a reasonable, cost-based fee under California Health & Safety Code § 123111.

5.2 Right to Amend

You have the right to request amendment of PHI you believe is inaccurate or incomplete. We may deny your request under certain circumstances and will explain the reason in writing.

5.3 Right to an Accounting of Disclosures

You have the right to receive an accounting of certain disclosures of your PHI made in the six (6) years prior to your request, excluding disclosures for treatment, payment, and healthcare operations.

5.4 Right to Request Restrictions

You have the right to request restrictions on how we use or disclose your PHI. We are not required to agree to restrictions, except that we must comply with a restriction if: (a) the disclosure is to a health plan for payment or healthcare operations; and (b) you have paid out-of-pocket in full for the service.

5.5 Right to Confidential Communications

You have the right to request that we communicate with you about your PHI in a certain way or at an alternative address. We will accommodate reasonable requests.

5.6 Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time, even if you agreed to receive it electronically.

5.7 Right to Be Notified of a Breach

You have the right to be notified following a breach of your unsecured PHI in accordance with HIPAA and California law.

6. Electronic PHI (ePHI) Security

We maintain reasonable and appropriate administrative, physical, and technical safeguards to protect electronic PHI (ePHI) in compliance with the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C). Our patient portal is operated by ChiroTouch, which has executed a Business Associate Agreement with us.

7. Business Associates

We may disclose PHI to our Business Associates who perform functions or services on our behalf. We require Business Associates to maintain appropriate safeguards under HIPAA-compliant Business Associate Agreements (BAAs), including but not limited to ChiroTouch, PatientEngagePro, and other technology vendors.

8. Our Responsibilities

• Maintain the privacy and security of your PHI.
• Notify you promptly if a breach occurs that may have compromised your information.
• Follow the terms of the Notice currently in effect.
• Not retaliate against you for exercising your privacy rights.

9. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights at 200 Independence Avenue, S.W., Washington, D.C. 20201. California residents may also contact the California Attorney General or the California Department of Public Health. You will not be retaliated against for filing a complaint.

10. Contact Us About Your Privacy

Pacific Spine & Rehab — Oceanside
2530 Vista Way, Suite P, Oceanside, CA 92054
(760) 600-5553

Pacific Spine & Rehab — Carlsbad
2623 Gateway Rd #104, Carlsbad, CA 92009
(760) 931-8003

Email: info@pacificspinerehab.com

11. Changes to This Notice

We reserve the right to change this Notice at any time. Changes will apply to PHI we already maintain, as well as PHI we receive in the future. We will post the revised Notice on our Website and make it available in our offices with the effective date above.