Your Information. Your Rights. Our Responsibilities.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Commitment to Your Privacy

AmpleHealth is committed to protecting the privacy and security of your protected health information (PHI). PHI includes information that identifies you and relates to your past, present, or future physical or mental health or condition, the health care you receive, or payment for that care. This Notice explains how we may use and disclose your PHI, your rights regarding your information, and our responsibilities under the Health Insurance Portability and Accountability Act (HIPAA), the California Confidentiality of Medical Information Act (CMIA), and other applicable federal and California laws.

Your Rights

• Get an electronic or paper copy of your medical record. You may ask to inspect or obtain an electronic or paper copy of your medical record and other health information we maintain about you. We will provide access within the time required by law and may charge only fees permitted by law.
• Ask us to correct your medical record. If you believe information is incorrect or incomplete, you may ask us to amend it. We may deny the request in certain circumstances, but we will explain the reason in writing.
• Request confidential communications. You may ask us to contact you in a specific way, such as at a particular phone number, email address, or mailing address. We will accommodate reasonable requests as required by law.
• Ask us to limit what we use or share. You may ask us not to use or disclose certain PHI for treatment, payment, or health care operations. We are not required to agree to every request. If you pay in full out of pocket for a service or item and ask us not to disclose information about that service or item to your health plan for payment or health care operations, we will honor the request unless disclosure is required by law.
• Get a list of certain disclosures. You may request an accounting of certain disclosures of your PHI made during the six years before your request. The accounting does not include all disclosures, such as many disclosures for treatment, payment, or health care operations.
• Get a copy of this Notice. You may request a paper copy at any time, even if you agreed to receive it electronically.
• Choose someone to act for you. If you have given someone medical power of attorney, or if someone is your legal guardian or otherwise legally authorized to act for you, that person may exercise your rights as permitted by law.
• Receive breach notification. We will notify you as required by law if a breach occurs that may have compromised the privacy or security of your unsecured PHI.
• File a complaint. You may complain if you believe your privacy rights have been violated. We will not retaliate against you for filing a complaint.

Your Choices

For certain health information, you may tell us your preferences about what we share. These choices may include:

• Sharing information with family members, close friends, or others involved in your care or payment for your care.
• Sharing information in a disaster relief situation.
• Receiving fundraising communications, if AmpleHealth conducts fundraising. You may tell us not to contact you again.

If you are unable to tell us your preference, for example because you are unconscious, we may share information when we believe it is in your best interest and the disclosure is permitted by law.

Uses and Disclosures Requiring Your Written Authorization

We will obtain your written authorization for uses or disclosures of PHI when required by law. In particular:

• Most uses and disclosures of psychotherapy notes require written authorization, subject to limited exceptions permitted by law.
• We will not sell your PHI without written authorization when authorization is required by law.
• Most uses and disclosures of PHI for marketing require written authorization, subject to exceptions permitted by law.
• Other uses and disclosures not described in this Notice will be made only with your written authorization unless otherwise permitted or required by law.

You may revoke an authorization in writing at any time, except to the extent that we have already acted in reliance on it.

How We Typically Use and Share Your Health Information

Treatment

We may use your PHI and share it with physicians, nurses, specialists, laboratories, pharmacies, hospitals, therapists, and other health care professionals involved in your care.

Payment

We may use and disclose PHI to bill for services and obtain payment from you, your health plan, Medicare, Medi-Cal, or another payer.

Health Care Operations

We may use and disclose PHI to operate our practice, coordinate care, improve quality, train staff, conduct compliance activities, evaluate performance, manage services, and contact you when necessary.

Appointments, Results, Referrals, and Health-Related Services

We may contact you about appointments, test results, referrals, treatment alternatives, follow-up care, preventive services, and other health-related services that may be of interest to you.

Business Associates

We may share PHI with vendors and service providers that perform functions for us, such as billing, electronic health records, technology, records management, analytics, and clinical documentation support. When required, these organizations must protect PHI under written agreements and applicable law.

Other Uses and Disclosures Permitted or Required by Law

Public Health and Safety

We may disclose PHI for legally authorized public health activities, including preventing disease, reporting certain communicable diseases, product recalls, adverse reactions to medications, suspected abuse or neglect, and preventing or reducing a serious threat to health or safety.

Health Oversight

We may disclose PHI to authorized health oversight agencies for audits, investigations, inspections, licensure, disciplinary actions, and other activities permitted by law.

Research

We may use or disclose PHI for research when the research has been approved through a process that meets applicable legal requirements, or when your authorization or another lawful basis permits it.

Complying With the Law

We will disclose PHI when federal or California law requires us to do so, including to the U.S. Department of Health and Human Services when it is reviewing our compliance with federal privacy law.

Organ and Tissue Donation

We may disclose PHI to organ procurement organizations or others involved in organ, eye, or tissue donation and transplantation as permitted by law.

Coroners, Medical Examiners, Funeral Directors, and Deceased Individuals

We may disclose PHI to coroners, medical examiners, funeral directors, organ procurement organizations, and, when permitted by law, family members or others who were involved in the deceased individual's care or payment for care.

Workers' Compensation, Law Enforcement, and Government Requests

We may disclose PHI as authorized by workers' compensation laws and for certain law enforcement, military, national security, correctional, and other government purposes when permitted or required by law.

Lawsuits and Legal Actions

We may disclose PHI in response to certain court or administrative orders, subpoenas, discovery requests, or other lawful process, subject to applicable federal and California protections.

Specially Protected Information and California Privacy Protections

California law and other federal laws may provide protections that are more restrictive than HIPAA for certain categories of information. These may include certain mental health and psychotherapy records, substance use disorder records, HIV/AIDS-related information, genetic information, reproductive or sexual health information, and other sensitive medical information. When a more protective law applies, AmpleHealth will follow the applicable additional requirements.

California law also provides protections concerning confidential communications and certain sensitive services. We will honor applicable California requirements regarding authorization, access, disclosure, and confidential communications.

Substance Use Disorder Records Protected by 42 CFR Part 2

To the extent AmpleHealth creates or maintains substance use disorder patient records that are subject to 42 CFR Part 2, those records receive additional federal confidentiality protections. We will not use or disclose Part 2 records in civil, criminal, administrative, or legislative investigations or proceedings against you without your written consent or a court order and subpoena that meet applicable Part 2 requirements. Additional consent, notice, accounting, fundraising, and redisclosure protections may apply to Part 2 records as required by federal law.

Telehealth, Electronic Communications, and Technology

When we provide services through telehealth or communicate electronically, we use reasonable and appropriate administrative, technical, and physical safeguards to protect your health information as required by applicable law. Electronic communications can carry privacy risks. You may request confidential communications or tell us if you prefer a particular method of communication. Patients should use secure devices and networks whenever possible.

AmpleHealth may use electronic health record systems and approved technology, including clinical documentation tools, to support patient care and practice operations. Vendors that create, receive, maintain, or transmit PHI on our behalf are required to protect that information as required by applicable law and, when applicable, a Business Associate Agreement.

Our Responsibilities

• We are required by law to maintain the privacy and security of your PHI.
• We must provide you with this Notice of our legal duties and privacy practices and follow the Notice currently in effect.
• We will notify you as required by law if a breach occurs that may have compromised the privacy or security of your information.
• We will not use or disclose your information other than as described in this Notice unless you authorize us in writing or another law permits or requires the use or disclosure.
• We will comply with applicable California privacy and medical-information laws when they provide additional protections.

Changes to This Notice

We may change the terms of this Notice and make the revised Notice effective for all PHI we maintain, including information created or received before the change. The current Notice will be available upon request, posted in a clear and prominent location at our offices, and prominently available on our website.

Questions or Complaints

If you have questions about this Notice, want to exercise a privacy right, or believe your privacy rights have been violated, please contact AmpleHealth's Privacy Officer. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. AmpleHealth will not retaliate against you for filing a complaint.

Email: hello@ample.health  |  Website: www.amplehealth.com

AmpleHealth Locations Covered by This Notice

• 6620 Coyle Avenue, Suite 202, Carmichael, CA 95608 | Phone: 916-966-8500 | Fax: 916-966-8555
• 3270 Arena Boulevard, Suite 405, Sacramento, CA 95834 | Phone: 916-418-4595 | Fax: 916-418-4594