Notice of Privacy Practices

Your Information, Your Rights, Our Responsibilities. When it comes to your health information, Bettis Wellness Clinic, LLC is dedicated to maintaining your protected health information (PHI). We are required by law to maintain the privacy of your PHI. You have the right to know how we may use and disclose your PHI as well as your rights and our obligations with respect to that information. This Notice of Privacy Practices (NPP) explains your rights and our duties, obligations, and responsibilities. Please review it carefully.

1. Permitted Uses and Disclosures

HIPAA requires us to safeguard your PHI, which includes any information that could reasonably identify you, including data about health conditions, the services provided, and payment for those services. Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), we may use and disclose your PHI without your authorization for the following reasons:

a. Treatment

To coordinate care, we may disclose your PHI to physicians, psychiatrists, psychologists, and other licensed health care providers who are involved with your healthcare where the information is necessary for their care and treatment of you.

b. Healthcare Business Operations

For efficient business operations, we may disclose your PHI for things like quality improvement, compliance, audits, training, and bookkeeping — for example, to evaluate our performance or to ensure we are in compliance with applicable laws, for appointment reminders, and health-related benefits or services.

c. Business Associates

We may disclose your PHI to our business associates who perform services on our behalf, such as billing, transcription, auditing, or legal services. These business associates are required by law and by a contract (Business Associate Agreement) to safeguard your information and use it only for the purposes we authorize.

d. Payments

We may use or disclose your PHI to bill and collect payment for the services that we provide.

2. Other Uses or Disclosures Permitted or Required by Law

There may be other instances where we are permitted or required by law to disclose your PHI, including:

a. To Avert a Serious Threat to Health or Safety

We may be permitted to disclose your PHI to prevent or reduce a serious threat to anyone's health or safety.

b. Reporting Abuse, Neglect, or Domestic Violence

We may disclose your PHI in order to report suspected abuse, neglect, or domestic violence as mandated by law.

c. Public Health Activities

We may be required to disclose your PHI for certain situations such as to prevent and control disease or to prevent or reduce a serious threat to anyone's health or safety.

d. Judicial and Administrative Proceedings

We may be required to share your PHI in response to a court or administrative order, or in response to a subpoena if required by state or federal law.

e. Law Enforcement

We may be required to disclose your PHI for law enforcement purposes as required by state and federal law.

f. Health Oversight

Disclosure may be made when required or permitted to a health oversight agency for oversight activities authorized by law.

g. Coroners, Medical Examiners, and Funeral Directors

We may be required to share your health information with a coroner, medical examiner, or funeral director.

h. Organ and Tissue Donation

We may be required to share your health information with organ procurement organizations.

i. Research

Under specific conditions, we may be permitted to disclose your PHI for health research.

j. Specialized Government Functions

We may be permitted or required to disclose your PHI for special government functions such as military, national security, and presidential protective services.

k. Workers' Compensation

We may be required or permitted to disclose your PHI for Workers' Compensation claims.

3. Uses and Disclosures Requiring Your Authorization

Other uses or disclosures not described herein will be made only with your written authorization. That authorization may be revoked at any time by sending written notice to our privacy officer at the address or email address listed below.

a. Disclosures to Family, Friends, or Others

We may provide your PHI to a family member, friend, or other individual with your authorization. You may revoke that authorization at any time. If you cannot provide authorization due to incapacity or another valid reason, we may share your PHI if we believe it is in your best interest or if we need to lessen a serious or imminent threat to health or safety.

b. Marketing or Sale of Your Information

Regarding marketing purposes or for the purpose of selling your PHI, we will never share your PHI unless you give us written permission.

4. Summary of Your Rights

When it comes to your PHI, you have certain rights. This section explains your rights and some of our responsibilities to help you.

a. Revocation of Written Authorization

You have the right to revoke any authorization that you have provided. You must provide written notice of this revocation to the address or email address below.

b. Right to Access and Obtain a Copy

You have the right to inspect and obtain a copy of your PHI that we maintain in a designated record set, which generally includes medical and billing records used to make decisions about your care. You may also request that we provide a copy of your information in electronic form or direct that a copy be sent to another person or entity of your choosing. We will provide access or copies within 30 days of your request, or notify you in writing if we need up to an additional 30 days to respond. We may charge a reasonable, cost-based fee for copying, mailing, or preparing electronic media as permitted by law.

In certain limited situations — such as when access could endanger your safety or the safety of another person — we may deny your request. If access is denied, you will receive a written explanation and, in most cases, you may request a review of the denial by another licensed healthcare professional who was not involved in the original decision. Even if you agree to receive this Notice of Privacy Practices electronically, you have the right to receive a paper copy upon request.

c. Right to Request Amendments

If you believe there is incorrect or inaccurate information in your records or other health information we have about you, you have the right to request that we correct or add to that information. Your request must be made in writing, and we must respond within 60 days. If we accept your requested amendment, we will notify you in writing and make the appropriate amendment. We will make reasonable efforts to inform persons who have received the PHI. We may deny your request but will tell you why in writing within 60 days.

d. Right to an Accounting of Disclosures

You have the right to request an accounting of certain disclosures of your PHI that we have made during the six years prior to the date of your request. This accounting includes disclosures made by us or by our business associates, except for those related to treatment, payment, and healthcare operations, or other disclosures that federal law does not require us to track. Your request must be in writing and specify the time period. We will provide the first accounting in any 12-month period at no charge; a reasonable cost-based fee may apply for additional requests within the same year.

e. Right to Request Restrictions on Use

You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations, or to persons involved in your care or payment of your care. While we are not required to agree to most requested restrictions, if we do agree, we will comply with your request except where the information is needed to provide emergency treatment or as required by law. If you pay out-of-pocket in full for a specific item or service, you have the right to request that we do not disclose information about that item or service to your health plan, and we are required to honor that restriction unless otherwise required by law.

f. Right to Request Confidential Communications

You have the right to request that we communicate with you about your health information in a certain way or at a specific location — for example, that we contact you only at your home address, by mail, or at a different telephone number or email address. We will accommodate all reasonable requests and will not require you to explain the reason for your request. To exercise this right, you must submit your request in writing and clearly state how or where you wish to be contacted.

g. Notice of Rights Concerning Part 2 Substance Use Records

Use or disclosure of Part 2 substance use disorder records generally requires your written consent. Part 2 records cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your written consent or a court order and subpoena in accordance with 42 CFR Part 2. To the extent that we have your substance use disorder patient records subject to 42 CFR Part 2, we will not share that information for investigations or legal proceedings against you without (1) your written consent or (2) a court order and subpoena.

5. Redisclosure of Protected Health Information

Information disclosed by us in accordance with this Notice of Privacy Practices may be subject to redisclosure by the recipient and may no longer be protected by the HIPAA rule.

6. Redisclosure of Substance Use Disorder Records

Substance use disorder treatment records subject to 42 C.F.R. Part 2 are protected by additional federal confidentiality requirements. When disclosed with your written consent for treatment, payment, health care operations, or other permitted purposes, such records may be redisclosed by the recipient in accordance with applicable federal and state law. However, federal law prohibits the use or disclosure of substance use disorder records in civil, criminal, administrative, or legislative proceedings against you without your specific written consent or a court order that complies with 42 C.F.R. Part 2.

7. Our Duties

We are required by law to maintain the privacy and security of your PHI. We are also required to provide you with this Notice of Privacy Practices explaining our legal duties and privacy practices, as well as your rights with respect to your health information. We must abide by the terms of this Notice of Privacy Practices currently in effect and notify you if a breach occurs that may have compromised the privacy and security of your information.

We reserve the right to change our privacy practices and the terms of this Notice at any time, provided such changes are permitted by law. If we make a material change, the revised Notice of Privacy Practices will be made available upon request, posted in our office, and on our website.

8. Complaints

If you believe your privacy rights have been violated, you have the right to file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights (OCR) by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, or by calling 1-877-696-6775.

To file a complaint with us, please submit your concerns in writing to:

• Sarah Bettis, APRN — Privacy Officer
• Bettis Wellness Clinic, LLC
• 2110 W. 75^th Street, Suite 400, Prairie Village, KS 66208
• (913) 375-2025
• bettiswellnessclinic@gmail.com

We will not penalize or retaliate against you for filing a complaint.