HIPAA Notice of Privacy Practices

1. Our Duty to Protect Your PHI

We are required by law to maintain the privacy and security of your Protected Health Information, provide you with this Notice of our legal duties and privacy practices, notify you in the event of a breach of your unsecured PHI, and abide by the terms of this Notice currently in effect.

2. How We May Use and Disclose Your PHI

2.1 Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services. This includes consultations with other healthcare providers, referrals, telehealth services, and sharing information necessary for your care.

2.2 Payment

We may use and disclose your PHI to obtain payment for services provided, including billing, claims processing, collections, and communications with insurance companies or other third-party payers.

2.3 Healthcare Operations

We may use and disclose your PHI for our internal operations, including quality assessment and improvement, care coordination, training, auditing, compliance, licensing, accreditation, and business planning.

2.4 Other Permitted Uses and Disclosures

We may also use or disclose your PHI without your authorization for the following purposes:

• As Required by Law: When disclosure is mandated by federal, state, or local law.
• Public Health Activities: Reporting diseases, injuries, vital events, and conducting public health surveillance, investigations, or interventions.
• Health Oversight Activities: For audits, investigations, inspections, or licensing actions by health oversight agencies.
• Judicial and Administrative Proceedings: In response to a court order, subpoena, discovery request, or other lawful process.
• Law Enforcement: For law enforcement purposes as required or permitted by law, including reporting certain types of wounds, injuries, or crimes.
• Coroners, Medical Examiners, and Funeral Directors: To assist in identification, determine cause of death, or carry out duties authorized by law.
• Organ and Tissue Donation: To facilitate organ, eye, or tissue donation and transplantation.
• Research: Under certain conditions and with appropriate safeguards, for research purposes approved by an Institutional Review Board or Privacy Board.
• Serious Threat to Health or Safety: To prevent or lessen a serious and imminent threat to your health and safety or the health and safety of the public or another person.
• Workers' Compensation: As authorized by and to the extent necessary to comply with workers' compensation laws.
• Military and Veterans: As required by military command authorities for Armed Forces personnel.
• National Security and Intelligence: For national security, intelligence, and protective services for the President and others.
• Inmates: If you are an inmate of a correctional institution, for your health and safety and the health and safety of others.

3. Uses and Disclosures Requiring Your Written Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes not described in this Notice, including but not limited to:

• Marketing communications (except face-to-face communications and promotional gifts of nominal value).
• Sale of your PHI.
• Most uses and disclosures of psychotherapy notes, if applicable.
• Any other use or disclosure not described in this Notice.

You may revoke your authorization in writing at any time. Revocation will not affect any actions we took in reliance on the authorization prior to receiving your revocation.

4. Your Rights Regarding Your PHI

You have the following rights with respect to your PHI:

• Right to Access: You have the right to inspect and obtain a copy of your PHI maintained in our records. We may charge a reasonable fee for copies. We must respond within 30 days of your request (with a possible 30-day extension).
• Right to Amend: You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny the request under certain circumstances and will provide a written explanation.
• Right to an Accounting of Disclosures: You have the right to request a list of certain disclosures we have made of your PHI for the six years prior to the date of your request (excluding disclosures for treatment, payment, healthcare operations, and certain other purposes).
• Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures of your PHI. We are not required to agree to your request, except where the disclosure is to a health plan for payment or healthcare operations purposes and the PHI pertains solely to a service for which you have paid in full out of pocket.
• Right to Request Confidential Communications: You have the right to request that we communicate with you about your PHI by alternative means or at alternative locations (e.g., contacting you by mail rather than phone).
• Right to a Paper Copy of This Notice: You have the right to obtain a paper copy of this Notice upon request, even if you previously agreed to receive it electronically.
• Right to Be Notified of a Breach: You have the right to be notified if there is a breach of your unsecured PHI, as required by the HITECH Act.

5. Telehealth & Electronic Communications

We provide telehealth services in accordance with applicable federal and state laws. PHI transmitted during telehealth sessions is protected by the same safeguards as in-person encounters. We use HIPAA-compliant platforms for telehealth consultations, patient portals, and electronic communications. However, no electronic transmission is completely secure, and we cannot guarantee the absolute security of electronic communications.

Telehealth services are currently available in: Georgia, Illinois, Minnesota, Mississippi, North Carolina, Oklahoma, Tennessee, and Texas.

Marketing Quizzes & Pre-Clinical Assessments

Our public website offers educational quizzes and assessments (for example, the Wellness Quiz, Supplement Assessment, Program Quiz, and Health & Fitness Quiz). These tools are marketing and educational resources — they are not a medical evaluation, diagnosis, treatment, or a medical record, and completing one does not create a physician-patient relationship. Answers submitted through these quizzes are not Protected Health Information (PHI) under HIPAA, and we ask that visitors do not enter diagnoses, prescription medications, lab values, or other clinical detail into these tools.

All quiz traffic is transmitted over TLS-encrypted connections and stored in an access-controlled database with row-level security. Quiz submissions and step-level analytics are automatically deleted after 90 days. Aggregate analytics (for example, quiz completion counts) do not include names, email addresses, or phone numbers. If you provide contact information to receive results by email, that information is handled under our Privacy Policy and, where a Business Associate Agreement is in place with the vendor, may be forwarded to that vendor for follow-up communication.

Protected Health Information is only collected once you become an established patient of the Practice, at which point intake occurs inside our HIPAA-compliant clinical systems (telehealth platform, EHR, and patient portal) — never through a public marketing quiz.

6. Minimum Necessary Standard

When using or disclosing your PHI or when requesting PHI from another covered entity or business associate, we will make reasonable efforts to limit the information to the minimum necessary to accomplish the intended purpose, except when the disclosure is for treatment purposes, to you, pursuant to your authorization, or as otherwise required by law.

7. Business Associates

We may share your PHI with third-party service providers ("Business Associates") who perform services on our behalf that involve access to PHI, such as billing companies, IT service providers, cloud storage providers, and telehealth platform providers. All Business Associates are required to sign a Business Associate Agreement (BAA) that obligates them to safeguard your PHI in accordance with HIPAA and HITECH requirements.

8. State Law Considerations

Where state law provides greater privacy protections than HIPAA, we will comply with the more stringent requirements. This includes but is not limited to protections related to HIV/AIDS information, mental health records, substance abuse treatment records, genetic information, and reproductive health information, as applicable under the laws of Georgia, Illinois, Minnesota, Mississippi, North Carolina, Oklahoma, Tennessee, and Texas.

9. Changes to This Notice

We reserve the right to change the terms of this Notice and make new provisions effective for all PHI we maintain, including PHI created or received before the changes. The revised Notice will be posted on our website and made available upon request. The effective date of each version will be clearly noted.

10. Complaints

If you believe your privacy rights have been violated, you have the right to file a complaint with us and/or with the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR).

• To file with us: Contact our Privacy Officer at the address below.
• To file with HHS: Visit www.hhs.gov/hipaa/filing-a-complaint or call 1-800-368-1019.

You will not be retaliated against for filing a complaint.

11. Privacy Officer & Contact Information

For questions about this Notice, to exercise your rights, or to file a complaint, please contact: