Notice of privacy practices.

1. Our duties

We are required by law to keep your protected health information ("PHI") private, to give you this notice of our legal duties and privacy practices, and to follow the notice currently in effect. We will notify you if a breach occurs that may have compromised the privacy or security of your PHI. We follow the federal HIPAA Privacy Rule and the California Confidentiality of Medical Information Act (CMIA). Where California law is more protective of your information than federal law, we follow California law.

2. How we may use and share your information

• Treatment. To provide and coordinate your care: ordering labs and imaging, sending prescriptions, and communicating with specialists, hospitals and other providers involved in your care.
• Payment. To manage your membership fees and any other charges. Pastera does not bill health insurance. However, outside labs, imaging centers, pharmacies or specialists you are referred to may bill your insurance under their own privacy practices. We do not send your PHI to a health plan for payment unless you ask us to (for example, a superbill you request).
• Health care operations. To run the practice: quality review, training, record-keeping, and working with vendors ("business associates") such as our electronic health record and messaging providers, who must sign agreements to protect your information.
• Appointment reminders and health information. To contact you about appointments, results and care options, using the methods you choose.
• People involved in your care. With a family member or friend you identify, or who is involved in paying for your care, unless you object. In an emergency or if you cannot respond, we use professional judgment.
• As required or permitted by law. For public health reporting (such as communicable disease reporting), reporting suspected abuse or neglect, health oversight, lawsuits and legal proceedings (court order or subpoena as allowed by law), law enforcement as allowed by law, coroners and funeral directors, organ donation, research approved under privacy rules, to prevent a serious threat to health or safety, workers' compensation, and specialized government functions.

3. Uses that require your written authorization

We will not use or share your PHI for the following without your written authorization: most uses of psychotherapy notes; marketing; sale of your PHI; and any other use not described in this notice. Some information has extra protection under California law (for example, certain mental health, HIV test results and genetic information) and may require your specific authorization. You may revoke an authorization in writing at any time, except to the extent we have already acted on it.

4. Substance use disorder records

If we receive records about substance use disorder treatment that are protected by federal law (42 CFR Part 2), those records have extra protection. We will not use or disclose them in civil, criminal, administrative or legislative proceedings against you unless you give written consent or a court order meeting Part 2 requirements is obtained.

5. Your rights

You have the right to:

1. Get a copy of your records. You may inspect or get a paper or electronic copy of your medical and billing records. We will respond within the time required by California and federal law and may charge a reasonable, cost-based fee.
2. Ask us to correct your records if you think they are incorrect or incomplete. We may say no, but will tell you why in writing.
3. Request confidential communications, such as contacting you at a different phone number or address. We will agree to reasonable requests.
4. Ask us to limit what we use or share. We are not required to agree, except that if you paid for a service in full yourself, you may ask us not to share it with your health plan and we will agree unless the law requires it.
5. Get a list of disclosures we made in the past six years, other than for treatment, payment, operations and certain other purposes.
6. Get a paper copy of this notice at any time, even if you received it electronically.
7. Be notified of a breach of your unsecured PHI.
8. Choose someone to act for you, such as a health care power of attorney or legal guardian.
9. File a complaint if you believe your rights were violated, with our Privacy Officer (contact above) or with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue S.W., Washington, D.C. 20201, 1-877-696-6775, www.hhs.gov/ocr/privacy/hipaa/complaints/. We will not retaliate against you for filing a complaint.

6. Changes to this notice

We may change this notice, and the changes will apply to all information we have about you. The new notice will be posted in our office and on our website at www.pasteradpc.com, and you may request a copy at any time.