Notice of Privacy Practices for Protected Health Information

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY

I. Uses and Disclosures of Your Medical Information:

A. Treatment, Payment, and Operations. Beyond Healthcare (sometimes referred to as “we” or “us”) is permitted to use your medical information for purposes of treating you, to obtain payment for providing medical services to you, and to assist in its health care operations. We may also use your medical records to assess the appropriateness and quality of care that you received, improve the quality of health care, and achieve better client outcomes.

An understanding of what is in your health records and how your health information is used helps you: ensure its accuracy and completeness; understand who, what, where, why, and how others may access your health information; and make informed decisions about authorizing disclosures to others.

(i) Use of your protected health information for treatment purposes. Members of your health care team will record information in your record to diagnose your condition and determine the best course of treatment for you. We will also provide your primary physician, other health care professionals, or a subsequent health care provider with copies of your records to assist them in treating you.

(ii) Use and disclosure of your protected health information for purposes of payment. We may send a bill to you or to a thirdparty payer, such as a health insurer. The information on or accompanying the bill may include information that identifies you, your diagnosis, treatment received, and supplies used.

(iii) Use and disclosure of your protected health information for healthcare operations. Health care operations consist of activities that are necessary to carry out our operations as a healthcare provider, such as quality assessment and improvement activities. For example, members of our medical staff, the risk or quality improvement manager, or members of the quality assurance team may use information in your health record to assess the care and outcomes in your cases and the competence of the caregivers. We will use this information in an effort to continually improve the quality and effectiveness of the health care and services that we provide.

B. Appointment Reminders: We may contact you to provide appointment reminders unless you specify otherwise in writing to us

C. Other purposes for which we can use your protected health information without written authorization from you: In addition to using your protected health information for purposes of treatment, payment, and health care operations, we may use or disclose your protected health information without your written authorization and without giving you an opportunity to object in the following situations:

(i) As Required by Law: We may use or disclose your protected health information as required by law. We will limit the disclosure to those portions relevant to the requirements of the law. If you travel out of state for reproductive healthcare services, we will not disclose your PHI related to those services unless required by a valid, legally binding court order or subpoena from a jurisdiction with proper authority.

(ii) Public Health Activities: We may use or disclose your protected health information to public health entities authorized to collect information for the purposes of controlling or preventing disease (including sexually transmitted diseases), injury, or disability. We may also disclose to governmental agencies authorized to receive reports of child abuse or neglect. We may disclose protected health information to the Food and Drug Administration relative to adverse effects/events with respect to food, drugs, supplements, product or product defects, or post-marketing surveillance information to enable product recalls, repairs, or replacement.

(iii) Medical Surveillance of the Workplace and Work-related Injuries: We may provide your protected health information to your employer if we are asked by your employer to provide medical services to you for purposes of medical surveillance of the workplace or a work-related illness or injury.

(iv) Victims of Abuse, Neglect, or Domestic: Violence: To the extent authorized or required by law, and in the exercise of our professional judgment, we believe the disclosure is necessary to prevent harm, we may disclose protected health information to law enforcement officials or other legally required entities.

(v) Health Oversight Activities: We may disclose your protected health information to a governmental health oversight agency overseeing the health care system, governmental benefit programs, or compliance with governmental program standards.

(vi) Judicial and Administrative Proceedings: We may disclose your protected health information in response to an order of a court or a valid subpoena.

(vii) Law Enforcement Purposes: We may disclose health information for law enforcement purposes only if required by a valid court order or subpoena. We will not disclose reproductive health information to law enforcement or government agencies unless legally compelled to do so.

(viii) Information About Deceased Individuals: We may disclose your protected health information to coroners and medical examiners to carry out their official duties, and to funeral directors as necessary to carry out their duties to the deceased individual.

(ix) Organ, Eye, or Tissue Donation: We may disclose protected health information to organ procurement agencies for the purpose of facilitating organ, eye, or tissue donation or transplantation.

(x) Research Purposes: We may disclose protected health information to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your protected health information.

(xi) Avoidance of Serious Threat to Health or Safety: We may disclose protected health information if we believe, in good faith, that such disclosure is necessary to prevent or lessen a serious and immediate threat to health and safety to yourself, another person, the public or an entity.

(xii) Certain Specialized Governmental Functions: If you are Armed Forces or foreign military personnel, we may disclose your protected health information to your appropriate military command. We may disclose your protected health information to a governmental agency as authorized by the National Security Act or for the protection of the President of the United States, as required by law.

(xiii) Correctional Institution: If you are an inmate, we may disclose your protected health information to the correctional institution or law enforcement in the course of providing care to you or the health and safety of others responsible for your custody or other inmates.

(xiv) Disclosures for Workers’ Compensation: We may disclose health information to the extent authorized by and to the extent necessary to comply with laws relating to workers compensation or other similar programs established by law. We will only disclose the minimum PHI necessary to comply with workers’ compensation laws.

We will not disclose your PHI to third parties for non-treatment purposes unless required by law or with your explicit written consent.

D. Other uses and disclosures of your protected health information will only be made with your prior written authorization. This includes but is not limited to: (i) Psychotherapy notes are kept separate from other medical records and will not be disclosed without your written authorization, except where required by law. You have the right to request access to psychotherapy notes, but providers may deny access under certain circumstances per HIPAA regulations. ; (ii) certain uses and disclosures for marketing purposes, including direct or indirect remuneration to Beyond Healthcare; we will never sell or market your PHI without your written permission. (iii) uses and disclosures that constitute a sale of your protected health information; and (iv) other uses and disclosures not described herein. You may revoke an authorization at any time, provided you do so in writing. We will honor such a revocation except to the extent that we have already taken action in reliance upon your prior authorization.

Your reproductive health information—including services related to pregnancy, contraception, fertility, miscarriage, and abortion—is protected under HIPAA. We will not disclose this information without your explicit written authorization unless compelled by a valid, legally binding court order or subpoena. We will make every reasonable effort to notify you before any such disclosure occurs, unless prohibited by law.

E. If applicable, federal regulations indicate that confidentiality of client records are protected as required by 42 C.F.R. part B, paragraph 2.22. In summary: (i) There are limited circumstances under which a part 2 program may acknowledge that an individual is present or disclose outside the part 2 program information identifying a person as having or had a substance use disorder; (ii) violation of federal laws and regulations by a part two program is a crime and suspected violations may be reported to the United States Attorney for the appropriate judicial district; (iii) an individual’s commission of a crime on the premises or against agency workforce members is not protected; (iv) reports of suspected child abuse or neglect made under state law are not protected; and (v) more information about federal regulations for a 42 C.F.R. part 2 program can be found at https://www.ecfr.gov

II. Your Individual Rights: You have the following rights under federal law with respect to your protected health information and may exercise them in the following manner:

A. The Right to Request Restrictions on the Use of Protected Health Information: You have the right to request that we restrict the use of your protected health information. You have the right to request that we limit our disclosure of your protected health information to treatment, payment, and healthcare operations and disclosures to individuals (family members) involved in your care. Such a restriction, if agreed to by us, will not prevent permitted or required uses and disclosures of protected health information. We are not required to agree to any requested restriction. You have the right to request that we do not disclose PHI to your health insurance provider if you pay out of pocket and in full for the healthcare service. This includes reproductive healthcare services such as contraception, abortion, and STI treatment. We are required to honor this request unless compelled by a valid, legally binding court order or subpoena. If we are required to disclose your PHI under such circumstances, we will notify you unless prohibited by law.

B. The Right to Receive Confidential Communications of Protected Health Information by Alternative Means: We must accommodate a reasonable written request by you to receive communications of your protected health information by alternative means (e.g., via e-mail) or at an alternative location (e.g., at your place of employment rather than at home). If you request electronic communication (e.g., email or text) about reproductive healthcare, we will take reasonable steps to protect your privacy. However, electronic communication may carry some security risks. Please let us know if you prefer alternative communication methods.

C. The Right to Inspect and Copy your Medical Records: You have the right to inspect and obtain a copy from us of your protected health information in our possession, including an electronic copy of your protected health information that we maintain electronically in a designated record. We may impose a reasonable cost-based fee for the labor involved and supplies used for creating the copy of your medical records but will not exceed amounts permitted by HIPAA regulations. We will provide access within 15 calendar days of receiving your request, with a possible 15-day extension, if necessary.

D. The Right to Amend Protected Health Information: You have the right to have us amend protected health information in our possession. You must make the request in writing and provide supporting reason(s) for the requested amendment. If we grant the request, we will notify you, and we will make the correction and distribute the correction to those who need it and those whom you identify to us that you want to receive the corrected information.

E. The Right to Receive an Accounting of Disclosures of Protected Health Information: You have the right to obtain an accounting of disclosures by us of your protected health information, other than for purposes of treatment, payment, and health care operations. You have the right to an accounting of all disclosures for up to three years, as per the HITECH Act.

F. The Right to Obtain a Paper copy of this Notice Upon Request: You have the right to receive a paper copy of this Notice upon request.

G. The Right to Opt-Out of Fundraising Communications: In the event we choose to contact you for purposes of fundraising, you will be given the opportunity to opt out of such fundraising communications. We will provide clear and conspicuous optout instructions in all fundraising communications. Opting out will not affect your treatment or benefits

III. Our Duties to Safeguard Your Protected Health Information

A. Our Duties to You: We are required by federal law to maintain the privacy of protected health information and to provide you with notice of its legal duties and privacy practices with respect to your protected health information. We will maintain the privacy of your health information, including implementing reasonable and appropriate physical, administrative, and technical safeguards to protect the information. We have the duty to mitigate any breach of privacy regarding your protected health information. If a breach occurs that affects your unsecured protected health information (PHI), Beyond Healthcare is required to notify you in writing within 60 days, as required by law. If the breach affects more than 500 individuals, we will also notify the U.S. Department of Health and Human Services (HHS) and, when required, the media. We will provide details about the breach and steps to protect yourself.

B. Privacy Notice: Beyond Healthcare is required to abide by the terms of its Privacy Notice as currently in effect.

C. Complaints: You may complain to us or the Secretary of Health and Human Services if you believe your privacy rights have been violated. You may obtain and file a Patient Privacy Complaint with our Privacy Officer or directly with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). You will never be retaliated against for filing a complaint, and your care will not be affected.

D. Contact Person and Telephone Number. If you have questions and/or would like additional information, you may contact Beyond Healthcare’s Privacy Officer(s) at: