HIPAA Notice of Privacy Practices

1About this notice

This Notice of Privacy Practices is issued by [TO CONFIRM: medical group name] (the "Medical Group," "we," "us," or "our"), the independent medical group whose licensed Providers evaluate and treat patients who use Surna Health. Surna Health LLC ("Surna") operates the technology platform and presents this notice on the Medical Group's behalf. When Surna handles your health information for the Medical Group, it does so as a business associate under a written agreement.

Independent pharmacies that fill your prescriptions have their own notices of privacy practices, which they provide to you.

2Our legal duties

We are required by law to maintain the privacy of your protected health information ("PHI"), to give you this notice of our legal duties and privacy practices, to notify you if there is a breach of your unsecured PHI, and to follow the terms of the notice currently in effect.

3How we may use and disclose your health information

Treatment

We use your intake answers, history, messages, and lab results to decide whether treatment is appropriate and what to prescribe, and we share what a pharmacy or lab needs to fill a prescription or run a test.

Payment

We use and share your information to bill and collect payment for the services and medication you receive, including through Surna as our payment-collection agent.

Health care operations

We use your information to run our practice: quality review, Provider oversight and training, customer support, audits, and compliance with legal and professional obligations.

Business associates

We share your information with companies that perform services for us, such as Surna, our technology, messaging, and lab vendors, under written agreements that require them to protect it.

Communications with you

We may contact you about appointments, refills, test results, and treatment options by secure message, email, text, or phone, as you have agreed.

4Other uses and disclosures the law requires or permits

• When required by federal, state, or local law.
• For public health activities, such as preventing disease, reporting adverse reactions to medications to the FDA, and reporting product problems.
• To report suspected abuse, neglect, or domestic violence to the authorities required to receive such reports.
• For health oversight activities, such as audits, investigations, and licensure.
• In response to a court or administrative order, subpoena, or other lawful process.
• For law enforcement purposes, as the law allows.
• To avert a serious and imminent threat to the health or safety of a person or the public.
• To coroners, medical examiners, and funeral directors, and for organ and tissue donation.
• For research that meets the privacy protections the law requires.
• For specialized government functions, such as military, veterans, and national security purposes, and for workers' compensation as the law allows.

Some states give certain information, such as information about reproductive health, mental health, substance use disorder treatment, or HIV, more protection than federal law. Where a state law is stricter, we follow it.

5Uses that require your written authorization

• Most uses and disclosures of psychotherapy notes.
• Uses and disclosures for marketing purposes.
• Any sale of your PHI. We do not sell your PHI.
• Any other use or disclosure not described in this notice.

You may revoke an authorization in writing at any time, except to the extent we have already acted on it.

6Your rights

• Get a copy of your records. You can ask to see or get an electronic or paper copy of your medical record. We may charge a reasonable, cost-based fee.
• Ask us to correct your record. You can ask us to correct information you think is incorrect or incomplete. We may say no, and will tell you why in writing.
• Request confidential communications. You can ask us to contact you in a specific way or at a specific address. We will agree to reasonable requests.
• Ask us to limit what we use or share. We are not required to agree, except that if you pay for a service in full out of pocket, you can ask us not to share that information with your health insurer for payment or operations.
• Get a list of disclosures. You can ask for a list of the times we shared your information in the six years before your request, with certain exceptions.
• Get a copy of this notice. You can ask for a paper copy at any time, even if you agreed to receive it electronically.
• Choose someone to act for you. If someone is your legal guardian or has your medical power of attorney, they can exercise your rights.

To exercise any of these rights, contact our Privacy Officer using the details in Section 9.

7Complaints

If you believe your privacy rights have been violated, you can complain to our Privacy Officer, or to the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints, by calling 1-877-696-6775, or by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201.

We will not retaliate against you for filing a complaint.

8Changes to this notice

We can change the terms of this notice, and the changes will apply to all information we have about you. The current notice will be posted on this page with its effective date and will be available on request.

9Privacy Officer contact

Questions about Surna's own handling of information are covered in our Privacy Policy.