HIPAA Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

About this notice

This notice applies to Huntsman Spinal Clinic Inc. It explains how we may use and disclose your protected health information, your rights, and our responsibilities.

Effective date: October 1, 2026.

Your health information

Protected health information includes identifiable information about your health, the care you receive, and payment for care, whether recorded electronically, on paper, or communicated verbally. This notice describes the handling of that information by the clinic. It is separate from the Website Privacy Policy, which describes the approval website and its browsing and form features.

Your rights

See or receive a copy of your records

You may ask to inspect or receive an electronic or paper copy of medical and billing records and other information used to make decisions about you. Contact the clinic to learn how to submit a request. We will generally act within 30 days. If a legally permitted extension is needed, we will provide a written explanation and the expected completion date. A reasonable, cost-based copying fee may apply where allowed by law.

Some information is excluded from the HIPAA access right. If we deny access, we will explain the reason in writing and describe any available review or complaint rights. We will not require you to explain why you want access.

Request a correction

You may ask us to amend health information you believe is incorrect or incomplete. We may ask for the request and the reason in writing. We will generally respond within 60 days, with a written explanation if a permitted extension is needed. If we deny the request, we will explain why and how you may submit a statement of disagreement. An amendment request does not necessarily result in removal of the original entry.

Request confidential communications

You may ask us to contact you in a particular way or at a particular location, such as using a different phone number or mailing address. We will accommodate reasonable requests. Tell us how to reach you safely; you do not need to give a reason for this request.

Ask for limits on use or disclosure

You may ask us to restrict information used or shared for treatment, payment, health care operations, or with people involved in your care. We are not required to agree to every restriction. If we agree, we will follow the restriction except as permitted by law, including when information is needed for emergency treatment.

If you pay for a health care item or service completely out of pocket, you may ask us not to disclose information about that item or service to your health plan for payment or health care operations. We must agree when the disclosure is not required by law and the information relates solely to that fully paid item or service.

Receive an accounting of disclosures

You may request an accounting of certain disclosures made during the six years before your request, or a shorter period you specify. This does not include every sharing of information: disclosures for treatment, payment, health care operations, disclosures you authorized, and other legally excluded disclosures generally do not appear in the accounting. One accounting in a 12-month period is free. We will explain any permitted charge for additional requests before proceeding.

Receive this notice and use a representative

You may request a paper copy of this notice even if you agreed to receive it electronically. A person legally authorized to act for you, such as a guardian or a person with applicable medical power of attorney, may exercise rights on your behalf. We will verify that person’s authority and apply any legal limits before acting on a request.

Typical uses and disclosures

Treatment

We may use information to evaluate you, provide care, coordinate services, and consult with other professionals involved in your treatment. For example, a spine surgeon may review imaging or discuss your condition with a referring clinician. Information may also be shared with pharmacies filling prescriptions and laboratories performing tests. Sharing with family or others involved in your care is subject to the choices and limits described below.

Payment

We may use or disclose information to bill for services, obtain payment, verify benefits, or request authorization. For example, we may give your health plan information needed to process a claim, obtain authorization for care, and maintain payment records. Billing companies, government benefit programs, or collection agencies may receive information when permitted by law and subject to applicable safeguards. Applicable restrictions, including an agreed restriction for a service paid in full out of pocket, still apply.

Health care operations

We may use and disclose information for permitted practice operations, such as quality improvement, professional review, staff training, auditing, compliance, and management. We may contact you about appointments, referrals, test results, follow-up care, treatment alternatives, or health-related services as allowed by law. Staff may ask the reason for your visit or use a sign-in process; appropriate safeguards must limit unnecessary disclosures. Please respect other patients’ privacy when visiting the office.

Service providers that act as business associates may receive information needed to perform permitted functions for us. We have written agreements with our business associates requiring them and their subcontractors to protect the confidentiality and security of health information. The minimum-necessary standard applies where required by law; it does not apply to every type of disclosure, including certain disclosures for treatment.

Your choices and written authorization

When appropriate, you may tell us whether to share relevant information with family, friends, or others involved in your care or payment, or with organizations assisting in disaster relief. We will give you an opportunity to agree or object when practicable. If you cannot express a preference, we may share relevant information based on professional judgment and your best interests, as the law allows.

Uses and disclosures not described in this notice require your written authorization unless otherwise permitted or required by law. Most uses and disclosures of separately maintained psychotherapy notes, marketing uses and disclosures that require authorization, and disclosures that constitute a sale of protected health information require written authorization. A general website inquiry is not such an authorization.

You may revoke an authorization in writing at any time. Revocation will not undo actions already taken in reliance on it, and other exceptions allowed by law may apply. The clinic can explain how to submit a revocation.

If we conduct permitted fundraising, you may opt out of future fundraising communications. Your decision will not affect treatment or payment. If fundraising would use records protected by 42 CFR Part 2, we will provide a clear opportunity to choose not to receive those communications before using that information.

Other legally permitted or required disclosures

We may use or disclose information for the following purposes only when the applicable legal conditions are met. These categories do not authorize unrestricted access to your records.

• Public health and safety: reporting disease, adverse medication reactions, product problems, suspected abuse or neglect, or addressing a serious threat to health or safety as permitted by law.
• Health oversight: authorized audits, investigations, inspections, licensing, and other oversight of health care or government benefit programs.
• Research: research conducted under an authorization, a qualifying waiver, or another permission recognized by the privacy rules.
• Required by law: disclosures required by applicable law, including to HHS to determine compliance with federal privacy requirements.
• Legal proceedings and law enforcement: disclosures in response to qualifying court orders, subpoenas, or lawful requests after applicable requirements and protections are satisfied.
• Workers’ compensation: disclosures authorized by laws concerning work-related illness or injury.
• Organ donation and deceased individuals: permitted disclosures to organ-procurement organizations, coroners, medical examiners, or funeral directors.
• Special government functions: disclosures permitted for military, national-security, protective-service, or correctional purposes under the relevant legal conditions.

Substance use disorder records and additional protections

If we receive or maintain substance use disorder patient records protected by 42 CFR Part 2, additional restrictions apply. We will not use or disclose those records, or testimony describing their contents, in civil, criminal, administrative, or legislative proceedings or investigations against you without your written consent or a qualifying court order and subpoena, as required by Part 2. Consent for treatment, payment, and operations does not by itself authorize these uses against you.

Information disclosed under HIPAA may be redisclosed by the recipient and may no longer be protected by HIPAA. Other laws can continue to apply, including Part 2 restrictions on using protected substance use disorder records in proceedings against you. If applicable state or federal law gives information greater protection than HIPAA, we will follow the more protective requirement.

Our responsibilities

• Maintain the privacy of protected health information and the safeguards required by applicable law.
• Provide a notice explaining legal duties and privacy practices, and follow the notice currently in effect.
• Notify affected individuals following a breach of unsecured protected health information when notification is required by law.
• Use and disclose information only as permitted by law and obtain authorization when required.
• Provide a process for privacy questions and complaints without retaliation.

Questions, requests, and complaints

For medical-record questions and requests, call the front desk at the number below. Staff can explain how to submit a request and any identity or authorization checks needed. For privacy questions, complaints, or concerns about a records decision, call the clinic and ask for Arica, Privacy Officer, or write to the address below.

The front desk handles initial medical-record questions and requests. Privacy concerns should be directed to Arica. Call before sending records or sensitive information to confirm the appropriate destination and process. Please use the clinic phone or mailing address for privacy questions and complaints.

You may also complain directly to the U.S. Department of Health and Human Services Office for Civil Rights. Visit HHS’s health-information privacy complaint page, call 1-877-696-6775, or write to 200 Independence Avenue, S.W., Washington, D.C. 20201. We will not retaliate against you for exercising a privacy right or filing a complaint.

Changes and availability

We reserve the right to revise this notice and make a revision applicable to information we already maintain, as well as information received in the future, where permitted by law. The updated notice will state its effective date and will be available on the website, at the clinic, and on request.

Acknowledgment of receipt

The clinic may ask you to acknowledge receiving its notice during patient intake. Reading this webpage or submitting a website inquiry does not sign that acknowledgment or authorize unrelated uses of your health information. Ask the front desk for a copy of this notice.

More about your privacy rights

For additional information about health-information privacy, visit the U.S. Department of Health and Human Services HIPAA information for individuals.