Notice of Privacy Practices

Overview

Derm Wellness PC is committed to protecting the privacy of your health information. This Notice of Privacy Practices explains how we may use and disclose your protected health information (“PHI”), your rights regarding your PHI, and our responsibilities regarding your health information.

This notice is provided pursuant to the federal Health Insurance Portability and Accountability Act (“HIPAA”) and other applicable privacy laws.

Your Health Information

When you receive healthcare services from Derm Wellness PC, we create and maintain a medical record containing information about your health, treatment, and payment for services.

This information may include your medical history, diagnoses, photographs, examination findings, treatment plans, prescriptions, test results, pathology reports, insurance information, and billing information.

We are required by law to maintain the privacy of your protected health information and to provide you with this notice explaining our legal duties and privacy practices.

How We May Use and Disclose Your Health Information

We may use or disclose your health information without your separate written authorization when permitted or required by law.

1. Treatment

We may use or disclose your health information to provide, coordinate, or manage your healthcare. For example, we may share relevant information with another physician, dermatologist, laboratory, pathology provider, pharmacy, or other healthcare professional involved in your care.

2. Payment

We may use or disclose your health information to obtain payment for services we provide. For example, we may send information to your health insurance company to determine eligibility, obtain authorization, submit claims, receive payment, or appeal a claim.

3. Healthcare Operations

We may use or disclose your health information for healthcare operations. Healthcare operations may include activities such as quality assessment, staff training, credentialing, compliance, auditing, business planning, and improving the quality and efficiency of our services. Federal HIPAA rules specifically permit covered healthcare providers to use and disclose PHI for treatment, payment, and healthcare operations, subject to applicable requirements.

Other Permitted or Required Uses and Disclosures

We may also use or disclose your health information when permitted or required by applicable law, including:

• When required by federal, state, or local law;
• For public health activities;
• To report certain communicable diseases;
• To report adverse events or product problems;
• For health oversight activities;
• To comply with lawful administrative or legal proceedings;
• In response to certain subpoenas, court orders, or other lawful processes;
• For law enforcement purposes when legally permitted;
• To medical examiners, coroners, or funeral directors when permitted by law;
• For organ donation and transplantation purposes;
• For certain research purposes when permitted by law;
• To prevent or lessen a serious and imminent threat to health or safety;
• For workers’ compensation purposes when permitted by law;
• For disaster-relief purposes; and
• For other purposes required or permitted by applicable federal or Massachusetts law.

Communication With Family and Others Involved in Your Care

When appropriate and permitted by law, we may disclose relevant health information to a family member, close friend, or other person you identify as being involved in your healthcare or payment for your healthcare. We may also disclose information to persons involved in your care when, using professional judgment, we determine that doing so is in your best interest. You may request restrictions on these disclosures as described below.

Appointment Reminders and Healthcare Communications

We may contact you using the telephone number, email address, mailing address, patient portal, or other contact information you provide.

These communications may include:

• Appointment reminders;
• Scheduling communications;
• Prescription-related communications;
• Follow-up communications;
• Billing communications;
• Patient portal notifications; and
• Other communications relating to your healthcare.

We will make reasonable efforts to protect the privacy of these communications.

Your Rights Regarding Your Health Information

Right to Inspect and Obtain a Copy

You generally have the right to inspect and obtain a copy of your medical and billing records, subject to certain legal exceptions. You may request your records in paper or electronic form when available. We may charge a reasonable fee as permitted by applicable law.

Right to Request an Amendment

If you believe information in your medical record is incorrect or incomplete, you may request that we amend the information. We may deny an amendment request when permitted by law, but we will provide you with a written explanation when required.

Right to Request Confidential Communications

You may request that we communicate with you about your healthcare in a particular way or at a particular location. For example, you may request that we contact you at a specific telephone number or mailing address. We will consider reasonable requests as required by law.

Right to Request Restrictions

You may request restrictions on how we use or disclose your health information. We are not required to agree to every restriction request. However, when you pay for a healthcare item or service completely out-of-pocket and request that the information not be disclosed to your health plan for payment or healthcare operations, we will generally agree to the restriction when required by HIPAA, unless disclosure is otherwise required by law.

Right to an Accounting of Certain Disclosures

You generally have the right to request a list of certain disclosures of your health information made by us during the six years preceding your request, subject to exceptions provided by law.

Right to Receive a Copy of This Notice

You may request a paper copy of this Notice of Privacy Practices at any time. You may also request an electronic copy when available. Our current notice will be made available at our office and, if applicable, on our website.

Right to Choose a Personal Representative

If you have a legally authorized personal representative, that person may exercise certain rights on your behalf as permitted by law. We may require documentation establishing the person’s authority to act on your behalf.

Right to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with Derm Wellness PC or with the U.S. Department of Health and Human Services Office for Civil Rights. You will not be retaliated against for filing a privacy complaint.

Uses and Disclosures Requiring Your Written Authorization

Certain uses and disclosures of your health information require your written authorization under HIPAA and applicable law.

For example, we generally will obtain your written authorization before:

• Using or disclosing your PHI for purposes that require authorization under HIPAA;
• Making other disclosures for which applicable law requires written authorization.

You may revoke an authorization in writing at any time to the extent permitted by law. Revocation will not affect actions already taken in reliance on the authorization.

Special Protections for Certain Information

Certain types of health information may receive additional protections under federal or Massachusetts law. These may include information relating to mental health, substance-use-disorder treatment, HIV/AIDS, genetic information, reproductive or sexual health, and other specially protected information. Derm Wellness PC will comply with applicable federal and Massachusetts laws governing such information.

Breach Notification

If a breach of your unsecured protected health information occurs that requires notification under applicable law, we will provide notification as required by law.

Our Responsibilities

Derm Wellness PC is required by law to:

• Maintain the privacy and security of your protected health information;
• Provide you with this Notice of Privacy Practices;
• Follow the privacy practices described in this notice;
• Notify affected individuals as required by law following a reportable breach; and
• Provide you with a copy of this notice upon request.

We reserve the right to change our privacy practices and this Notice of Privacy Practices. If we materially change this notice, we will make the revised notice available as required by law.

Questions or Privacy Concerns

If you have questions about this notice or believe your privacy rights have been violated, please contact:

Complaints to the U.S. Department of Health and Human Services

You may also submit a complaint to the U.S. Department of Health and Human Services, Office for Civil Rights.

You may obtain information about filing a HIPAA complaint through the Office for Civil Rights at 800-368-1019.

Derm Wellness PC will not retaliate against you for filing a complaint.