Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Pursuant to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), its regulations at 45 C.F.R. Parts 160–164, and the HITECH Act of 2009, this Notice describes the uses and disclosures of protected health information ("PHI") by AllergyMD LLC ("Our Practice"). Send all written requests under this Notice to: AllergyMD, ATTN: Privacy Official, 755 Commerce Drive, Suite 800, Decatur, GA 30030.

YOUR RIGHTS

Your health record is the property of Our Practice, but the information belongs to you. Requests below must be submitted in writing to the address above.

Inspect and Copy. You may inspect or obtain an electronic or paper copy of your medical and billing records and other PHI, or have a copy sent to a person you designate. We will provide a copy or summary usually within 30 days and may charge a reasonable, cost-based fee. We may deny access in limited circumstances; if denied, you will receive a written denial stating the basis, how to exercise review rights, and how to file a complaint with the Secretary of the U.S. Department of Health and Human Services ("HHS").

Request an Amendment. You may ask us to correct PHI you believe is incorrect or incomplete; you must provide a supporting reason. We may deny your request, but will tell you why in writing within 60 days.

Request Confidential Communications. You may ask us to communicate with you in a certain manner or at a certain location (e.g., work phone only, alternate mailing address). We will accommodate all reasonable requests.

Request Restrictions. You may restrict disclosure of PHI to your health plan for payment or health care operations where the item or service was paid out-of-pocket in full before the service; unless required by law, these requests will be approved. You may request other restrictions on uses or disclosures for treatment, payment, or operations, or to persons involved in your care, but we are not required to agree and may say "no" if it would affect your care (e.g., we cannot restrict access by your referring or primary care physician; our normal process is to send visit records to them). If we agree, we will comply unless the information is needed for emergency services or required by law.

Request an Accounting of Disclosures. You may request a list of certain disclosures of your PHI, other than those for treatment, payment, health care operations, or those you requested or authorized. Your request must state a period of up to six years (not before our privacy procedures were adopted) and the form you want (paper or electronic). The first list in a 12-month period is free; we will notify you of costs for additional lists before any are incurred, and you may withdraw or modify your request.

Right to a Copy of This Notice. You may request a paper copy at any time, even if you agreed to receive it electronically. This Notice is also available at www.allergymdcare.com.

Right to Breach Notification. You have the right to be notified of any impermissible acquisition, access, use, or disclosure of your unsecured PHI. We will notify you without unreasonable delay after discovering a breach.

Choose Someone to Act for You. Your healthcare proxy or legal guardian may exercise your rights and make choices about your PHI. We will confirm the person’s authority before acting.

YOUR CHOICES

Other than HIV information, we may disclose to family members or friends PHI directly relevant to their involvement in your care or payment for it, if you verbally agree, if you are given an opportunity to object and do not, or if we reasonably infer from the circumstances that you would not object (e.g., bringing your spouse into the exam room while treatment is discussed). If you are unable to give consent (absence, incapacity, or emergency), we may use professional judgment to determine that disclosure to a family member or friend is in your best interest, disclosing only PHI relevant to that person’s involvement. Tell us if you have a preference about these disclosures.

OUR USES AND DISCLOSURES

For Treatment. Staff may use your PHI, and we may share it with other healthcare professionals treating you, to provide, coordinate, or manage your care — including your referring provider, hospitals, other specialists, translators, and ancillary services. We may also use your PHI to tell you about treatment options, alternatives, and health-related benefits or services that may interest you.

For Health Care Operations. We may use and disclose your PHI to run our practice (administrative, educational, quality assurance, and business functions), improve your care, and contact you when necessary — including appointment reminders by mail, e-mail, and/or telephone (call or text), such as voice messages at the number you provide and replies to your e-mail.

For Payment. We may use and share your PHI to bill and obtain payment from health plans or other entities (e.g., prior approval or coverage determinations), including credit card companies you use to pay, and our business associates such as billing and claims-processing companies.

Other Permitted or Required Disclosures. We are allowed or required to share PHI in other ways, usually contributing to the public good, after meeting conditions in the law:

•    Public health activities: to prevent or control disease, injury, or disability; report adverse reactions to medications, vaccines, or product problems; notify of recalls; notify persons exposed to or at risk of spreading a disease; report suspected abuse, neglect, or domestic violence; or prevent or reduce a serious threat to anyone’s health or safety.

•    Research: for health research.

•    As required by law: when federal, state, or local law requires, including to HHS to verify our compliance.

•    Incidental disclosures: that occur incidental to another lawful, permitted use or disclosure.

•    Business associates: outside companies performing services for us (e.g., attorneys, accountants, software vendors), limited to the minimum information necessary and under a written contract requiring them to protect your PHI’s privacy and security.

•    Organ and tissue donation: to organizations handling organ, eye, or tissue procurement, transplantation, or donation banks.

•    Coroners, medical examiners, and funeral directors: upon an individual’s death (e.g., identification or cause of death).

•    Government requests: for workers’ compensation claims; law enforcement purposes or officials; health oversight activities authorized by law (audits, investigations, inspections, licensure); and special government functions (military, national security, presidential protective services).

•    Lawful subpoena or court order: in response to a court or administrative order, or if asked to do so by a law enforcement official in response to a warrant, summons, or similar process. We may also disclose PHI in response to a subpoena or discovery request in a lawsuit or dispute, but only if efforts have been made to notify you or to obtain a protective order.

When Written Authorization Is Required. Other than for the purposes identified in this Notice, we will not use or disclose your PHI without your specific written authorization, including for marketing purposes and the

 sale of PHI. We may, however, provide marketing materials in a face-to-face encounter and communicate about alternatives or other health-related products and services beneficial to your treatment. You may revoke an authorization by written notice; revocation is effective upon our receipt and does not undo uses or disclosures made before then. Authorization and Revocation forms are available from our staff.

Social Security Numbers. We may collect your Social Security number for identification and verification (e.g., distinguishing patients with the same name). Providing it is voluntary, and this Notice’s privacy practices apply to it.

OUR RESPONSIBILITY

We are required by law to maintain the privacy and security of your PHI and will promptly notify you of any breach that may have compromised it. We must follow the duties and privacy practices described in this Notice and give you a copy. We will not use or share your information other than as described here unless you tell us in writing that we can; you may change your mind at any time by letting us know in writing. More information: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.

Changes to the Terms of This Notice. We reserve the right to change this Notice at any time, to the extent permitted by law, effective for PHI we already hold and information we receive in the future. This Notice and any material revisions will be posted where patients receive services and at www.allergymdcare.com, with the effective date on the first page.

Questions and Complaints. To ask a question, raise a concern about our privacy practices, or learn more about your rights, contact our Privacy Official at the address above or by phone or email. If you believe your privacy rights have been violated, you may submit a written complaint to our practice, and you may file a written complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201; 1-877-696-6775; or www.hhs.gov/ocr/privacy/hipaa/complaints. We will not intimidate or retaliate against any individual who, in good faith, reports a complaint.