HIPAA Notice of Privacy Practices

INTRODUCTION

Spine 33 Rehab PLLC ("Spine 33 Rehab," "we," "us," or "our") is committed to protecting the privacy and security of your protected health information. This Notice of Privacy Practices ("Notice") describes how we may use and disclose your protected health information, your rights regarding that information, and our legal obligations to you as a patient.

We are required by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations to maintain the privacy of your protected health information, to provide you with this Notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect.

This Notice applies to all protected health information created, received, maintained, or transmitted by Spine 33 Rehab PLLC in connection with your physical therapy care, regardless of whether that information is in paper, electronic, or oral form.

SECTION 1 — WHAT IS PROTECTED HEALTH INFORMATION

Protected health information ("PHI") is any information that identifies you and relates to your past, present, or future physical or mental health condition, the provision of healthcare to you, or payment for healthcare services provided to you. Examples of PHI include your name and contact information when combined with your health condition, your diagnosis and treatment records, your home exercise program, your appointment history, your billing and payment records, and any clinical notes or documentation created during your care.

SECTION 2 — HOW WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION

The following describes the ways we may use and disclose your protected health information. Not every use or disclosure in a category will be listed. However all of the ways we are permitted to use and disclose information will fall within one of the categories below.

A. Uses and Disclosures for Treatment

We may use and disclose your protected health information to provide you with physical therapy treatment and related services. This includes sharing information with other healthcare providers involved in your care. For example if your provider determines that you need to be referred to a physician, orthopedic specialist, or other healthcare professional for evaluation or co-management we may share relevant portions of your health information with that provider to facilitate coordinated care. We may also use your health information to create home exercise programs, document your clinical progress, and communicate with you about your treatment plan between sessions.

B. Uses and Disclosures for Payment

We may use and disclose your protected health information for payment purposes. Because Spine 33 Rehab PLLC operates as a cash-pay practice we do not bill health insurance companies directly. However payment-related uses of your information may include processing your payment through our secure payment platform, generating itemized superbills for your personal submission to your insurance company for potential out-of-network reimbursement, verifying the eligibility of your HSA or FSA card for payment, and maintaining billing records as required by law.

C. Uses and Disclosures for Healthcare Operations

We may use and disclose your protected health information for our internal healthcare operations. These activities are necessary to maintain the quality of care we provide and to operate our practice effectively. Healthcare operations uses include quality assessment and improvement activities, reviewing the qualifications and performance of our providers, training and supervision activities, compliance with applicable laws and regulations, business planning and development activities, and conducting or arranging for legal and accounting services.

D. Uses and Disclosures Required by Law

We will disclose your protected health information when required to do so by federal, state, or local law. This includes mandatory reporting requirements under Tennessee state law such as reporting of certain communicable diseases, child abuse, elder abuse, or other conditions required to be reported to public health authorities.

E. Uses and Disclosures for Public Health Activities

We may disclose your protected health information to public health authorities authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability.

F. Uses and Disclosures to Avert a Serious Threat to Health or Safety

We may use or disclose your protected health information when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and the disclosure is to a person or persons reasonably able to prevent or lessen the threat.

G. Disclosures to Business Associates

We may disclose your protected health information to our business associates who perform functions or activities on our behalf that require access to your information. We require all business associates to sign a Business Associate Agreement obligating them to protect the privacy and security of your health information in accordance with HIPAA. Our current business associates who may have access to your protected health information include SimplePractice our HIPAA-compliant practice management and telehealth platform and Google Workspace our HIPAA-compliant business communication platform.

H. Uses and Disclosures With Your Authorization

For all uses and disclosures of your protected health information not described in this Notice we will obtain your prior written authorization before using or disclosing your information. You have the right to revoke any authorization you have given us at any time by submitting a written revocation request to info@spine33rehab.com. Revocation will be effective for future uses and disclosures but will not affect uses or disclosures already made in reliance on your authorization.

Uses and disclosures that always require your written authorization include the use or disclosure of psychotherapy notes, the use or disclosure of your health information for marketing purposes, and the sale of your health information.

SECTION 3 — YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION

You have the following rights regarding your protected health information. To exercise any of these rights please submit a written request to info@spine33rehab.com. We will respond to all requests within 30 days.

A. Right to Access and Obtain a Copy of Your Records

You have the right to inspect and obtain a copy of your medical records and other protected health information that we use to make decisions about your care. This includes your evaluation notes, treatment documentation, home exercise programs, billing records, and other clinical records maintained by Spine 33 Rehab PLLC.

To request access to your records submit a written request to info@spine33rehab.com specifying the records you wish to access and your preferred format for receiving them. We will provide access to your records within 30 days of receiving your request. We may charge a reasonable cost-based fee for producing copies of your records.

We may deny your request to access your records in limited circumstances permitted by law. If we deny your request we will provide a written explanation of the reason for the denial and information about how to request a review of the denial.

B. Right to Request Amendment of Your Records

You have the right to request that we amend your protected health information if you believe it is inaccurate or incomplete. To request an amendment submit a written request to info@spine33rehab.com identifying the specific information you believe is inaccurate or incomplete and explaining why an amendment is warranted.

We will respond to your amendment request within 60 days. We may deny your request if we determine that the information is accurate and complete, was not created by Spine 33 Rehab PLLC, is not part of the records you would be permitted to inspect and copy, or is not information we are required to maintain. If we deny your request we will provide a written explanation and information about how to submit a statement of disagreement.

C. Right to an Accounting of Disclosures

You have the right to request an accounting of certain disclosures we have made of your protected health information during the six years prior to your request. This accounting does not include disclosures made for treatment, payment, or healthcare operations purposes, disclosures made to you, disclosures made pursuant to your written authorization, or certain other disclosures permitted or required by law.

To request an accounting of disclosures submit a written request to info@spine33rehab.com specifying the time period for which you are requesting the accounting. We will provide the first accounting you request in any 12-month period free of charge. For subsequent requests within the same 12-month period we may charge a reasonable cost-based fee.

D. Right to Request Restrictions on Uses and Disclosures

You have the right to request that we restrict certain uses and disclosures of your protected health information beyond what is described in this Notice. For example you may request that we not share your health information with a specific individual or that we restrict certain types of disclosures.

We are not required to agree to your requested restriction in most circumstances. However if we do agree to a restriction we are bound by that agreement except in emergency situations. To request a restriction submit a written request to info@spine33rehab.com specifying the information you want restricted and the persons to whom the restriction should apply. We will notify you in writing of our decision.

E. Right to Request Confidential Communications

You have the right to request that we communicate with you about your health information in a specific way or at a specific location. For example you may request that we contact you only by email or only at a specific email address.

We will accommodate all reasonable requests. We will not require you to explain your reason for the request. To request confidential communications submit a written request to info@spine33rehab.com specifying your preferred method and location of communication.

F. Right to Receive a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice of Privacy Practices at any time even if you have agreed to receive it electronically. To request a paper copy contact us at info@spine33rehab.com or at the contact information provided at the end of this Notice. We will provide a paper copy promptly upon request at no charge.

G. Right to Be Notified of a Breach

You have the right to receive notification in the event that Spine 33 Rehab PLLC discovers a breach of your unsecured protected health information. We will notify you of any such breach without unreasonable delay and in no case later than 60 days after discovery of the breach as required by the HIPAA Breach Notification Rule.

H. Right to File a Complaint

You have the right to file a complaint if you believe your privacy rights have been violated. You may file a complaint directly with Spine 33 Rehab PLLC by contacting us at info@spine33rehab.com. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr/privacy/hipaa/complaints or by calling 1-800-368-1019.

We will not retaliate against you in any way for filing a complaint with us or with the Office for Civil Rights. Filing a complaint will not affect your ability to receive care from Spine 33 Rehab PLLC.

SECTION 4 — OUR DUTIES

Spine 33 Rehab PLLC is required by law to maintain the privacy and security of your protected health information. We are required to provide you with this Notice of our legal duties and privacy practices with respect to your health information. We are required to notify you in the event of a breach of your unsecured protected health information. We are required to follow the terms of the Notice currently in effect. We are required to not use or disclose your health information in a manner inconsistent with this Notice without your written authorization except as permitted or required by law.

SECTION 5 — CHANGES TO THIS NOTICE

We reserve the right to change the terms of this Notice of Privacy Practices at any time. Any changes we make to our privacy practices will apply to health information we already have about you as well as any health information we receive in the future. Changes to this Notice will be effective for all protected health information we maintain at the time the change becomes effective.

The current version of this Notice will always be posted on our website at spine33rehab.com/hipaa-notice with the effective date clearly indicated at the top of the document. If we make a material change to this Notice we will provide notice of the change to current patients through our SimplePractice patient portal.

SECTION 6 — TELEHEALTH-SPECIFIC DISCLOSURES

Spine 33 Rehab PLLC provides physical therapy services exclusively through telehealth delivery. The following additional disclosures apply specifically to our telehealth practice.

All telehealth sessions are conducted through SimplePractice's HIPAA-compliant video platform. We do not record telehealth sessions without your express written consent. Your health information transmitted during telehealth sessions is protected by the same privacy and security standards applicable to in-person care under Tennessee Code Annotated Section 63-1-155 and applicable federal law. Telehealth services are provided only to patients physically located in states where Spine 33 Rehab PLLC holds active physical therapy licensure or PT Compact Privilege at the time of service.

SECTION 7 — CONTACT INFORMATION

For questions about this Notice, to exercise your rights as described above, or to file a privacy complaint with Spine 33 Rehab PLLC please contact our Privacy Officer at the following.

Spine 33 Rehab PLLC — Privacy Officer

Email: info@spine33rehab.com

Phone: (901) 609-4923

Website: spine33rehab.com

Tennessee PT License: 16706

To file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights contact the following.

Office for Civil Rights U.S. Department of Health and Human Services 200 Independence Avenue SW Washington DC 20201 Phone: 1-800-368-1019 Website: hhs.gov/ocr