Notice of Privacy Practices

Your information. Your rights. Our responsibilities. This Notice of Privacy Practices (“Notice”) explains how Los Altos Neurology may use and disclose protected health information about you, the rights you have regarding that information, and the duties we have to protect it.

1. Your Rights

When it comes to your health information, you have the rights described below. Some rights are subject to limited exceptions under federal or California law. Contact our Privacy Officer for instructions or forms.

Inspect and obtain a copy of your records

• You may ask to inspect or obtain an electronic or paper copy of medical and billing records maintained about you in a designated record set.
• California law generally requires us to permit inspection during business hours within five working days after receiving a valid request and to transmit requested copies within 15 days, subject to limited exceptions.
• When records are maintained electronically, we will provide them in the electronic form and format you request if they are readily producible that way, or in another readable electronic format agreed upon with you.
• We may charge only a reasonable, cost-based fee permitted by law. California law may entitle you to a no-cost copy of relevant records in certain circumstances.
• We will not withhold records solely because you have an unpaid bill for healthcare services.
• Access may be limited for certain information, including psychotherapy notes, information prepared for legal proceedings, and other information that federal or California law allows us to withhold. California law also provides specific procedures when a clinician determines that direct access to certain mental-health records presents a substantial risk of significant adverse consequences.

You may also have access to portions of your health information through the Practice’s designated patient portal. Portal access does not replace your right to request records that are not available through the portal.

Ask us to amend or correct your record

• You may ask us in writing to amend health information that you believe is incorrect or incomplete.
• We may deny the request in circumstances allowed by law, such as when the information was not created by us, is not part of the record available for inspection, or is accurate and complete. If we deny the request, we will explain the reason in writing and describe any further rights you may have.
• We generally respond within 60 days and may extend that period once when permitted by law.

California addendum right: After inspecting your records, you may submit a written addendum of up to 250 words for each item or statement you believe is incomplete or incorrect. You must clearly state that you want the addendum made part of your record. We will attach it to the disputed portion and include it when that portion is later disclosed, as required by California law.

Request confidential communications

You may ask us to contact you in a particular way or at a particular location—for example, only at a specified telephone number, through the patient portal, or by mail to a different address. We will accommodate reasonable requests. Please tell us whether and how we may leave voicemail, send email or text messages, or communicate with another person.

Ask us to limit what we use or disclose

• You may ask us not to use or disclose certain information for treatment, payment, healthcare operations, or to persons involved in your care. We are not generally required to agree, and we may decline when the restriction could interfere with care or is not operationally feasible.
• If we agree, we will follow the restriction except when the information is needed for emergency treatment or another use or disclosure is required or permitted despite the restriction by law.
• If you, or someone other than your health plan on your behalf, pay in full out of pocket for a specific item or service, you may ask us not to disclose PHI about that item or service to your health plan for payment or healthcare operations. We will agree unless the disclosure is required by law.

Receive an accounting of certain disclosures

You may request a list of certain disclosures of your PHI made during the six years before your request, including who received the information and why. The accounting will not include every disclosure—for example, it generally will not include disclosures for treatment, payment, healthcare operations, disclosures to you, disclosures you authorized, and certain other disclosures excluded by law. One accounting in a 12-month period is provided without charge; a reasonable cost-based fee may apply to additional requests after advance notice.

Obtain a copy of this Notice

You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically. The current Notice is also available on our website and at our service locations.

Choose someone to act for you

If a person has legal authority to act for you—such as an agent under a valid healthcare power of attorney, a court-appointed guardian or conservator, or another legally authorized personal representative—that person may exercise your rights to the extent permitted by law. We may request documentation of that authority before acting.

A parent or guardian ordinarily acts for a minor, but California law gives minors independent confidentiality and access rights for certain services to which they may legally consent. In those circumstances, a parent or guardian may not be entitled to access the related records. We will determine personal-representative authority under applicable law and the circumstances.

File a complaint without retaliation

You may complain to the Practice if you believe your privacy rights were violated or have questions about this Notice. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you, deny care, or treat you differently for filing a good-faith complaint or exercising a privacy right.

2. Your Choices

For certain uses and disclosures, you may tell us your preferences. Tell us clearly what you want us to do, and we will follow your instructions when the law permits.

Family, friends, caregivers, and others involved in your care

You may authorize us to share relevant information with family members, close friends, caregivers, or other persons involved in your care or payment for your care. We may ask you to identify the persons with whom we may communicate and what information may be shared.

If you are present and able to decide, we will ordinarily seek your agreement or give you an opportunity to object. If you are unable to tell us your preference—for example, because of incapacity or an emergency—we may share relevant information when, in our professional judgment and as permitted by federal and California law, doing so is in your best interest. We may also share limited information with disaster-relief organizations as allowed by law.

Because Los Altos Neurology is an outpatient practice, we do not maintain a hospital patient directory. A hospital or other facility where you receive care may have a separate directory policy and privacy notice.

3. How We Typically Use and Disclose Your Information

We may use or disclose PHI without your written authorization for the following purposes, subject to federal and California law. We use reasonable safeguards and, when required, limit information to the minimum necessary for the purpose.

Treatment

We may use PHI to diagnose and treat you and may share it with physicians, hospitals, therapists, laboratories, imaging centers, pharmacies, home-health providers, facilities, emergency personnel, and other professionals involved in your care.

Example: We may send a consultation note or imaging report to your primary-care physician or another specialist coordinating your treatment.

Payment

We may use and disclose PHI to obtain payment, determine benefits, verify coverage, submit claims, respond to utilization review, collect amounts due, and coordinate benefits. This may involve health plans, billing services, collection services, or other persons responsible for payment.

Example: We may provide diagnosis and service information to your health plan so that it can process a claim or determine coverage.

Healthcare operations

We may use and disclose PHI to operate the Practice and improve care. These activities may include quality assessment, care coordination, patient safety, credentialing, professional review, staff training, auditing, compliance, legal and accounting services, business planning, cybersecurity, records management, licensing, accreditation, and professional-liability activities.

Example: We may review records internally to evaluate quality of care or may provide necessary information to a consultant helping us improve privacy and security.

Business associates and service providers

We may disclose PHI to vendors and contractors that perform services for us—such as electronic health record, patient portal, scheduling, billing, secure communications, document storage, IT, cybersecurity, legal, accounting, or shredding services. When required, these business associates must sign agreements requiring them to protect PHI and use it only as permitted.

Appointment reminders and health-related communications

We may use limited PHI to contact you about appointments, follow-up care, test results, treatment alternatives, care coordination, and health-related benefits or services that may be relevant to you. These communications are not a substitute for emergency care, and receipt of this Notice is not consent to promotional calls or texts when separate consent is required.

4. Other Uses and Disclosures Permitted or Required by Law

We may use or disclose PHI for the following purposes only when the legal requirements for the disclosure are satisfied. California law may be more protective than HIPAA, and we will follow the more protective law when it applies.

Public health and safety

We may disclose PHI to authorized public-health or safety authorities for activities such as preventing or controlling disease, injury, or disability; reporting certain diseases or events; reporting adverse reactions or product defects; assisting with recalls; conducting public-health surveillance or investigations; and preventing or reducing a serious and imminent threat to health or safety.

Abuse, neglect, and domestic violence

We may disclose information to an authorized governmental or protective-services agency when required or permitted by law to report suspected child abuse, elder or dependent-adult abuse, neglect, or domestic violence. We will follow applicable notice and safety requirements.

Health oversight

We may disclose PHI to health-oversight agencies for activities authorized by law, including audits, investigations, inspections, licensure or disciplinary matters, accreditation, and monitoring of healthcare programs or compliance.

Complying with law and government requests

We will disclose PHI when federal or California law requires it, including to the U.S. Department of Health and Human Services when it is reviewing our compliance with federal privacy law. We may make other disclosures to government agencies for lawful purposes, including certain military, national-security, protective-service, correctional, or benefit-administration functions, when the conditions of applicable law are met.

Workers’ compensation

We may disclose PHI as authorized by and to the extent necessary to comply with workers’ compensation and similar programs that provide benefits for work-related injuries or illness.

Law enforcement, legal proceedings, and administrative proceedings

We may disclose PHI for law-enforcement purposes or in response to a court or administrative order, subpoena, discovery request, warrant, or other lawful process only when the requirements of federal and California law are satisfied. We will evaluate legal demands for medical information and will not disclose more than the law permits or requires.

California law imposes additional requirements on certain foreign subpoenas, warrants, reproductive-health-related demands, and disclosures for immigration enforcement. We will not disclose medical information for immigration enforcement except when specifically authorized or required or permitted by applicable law.

Coroners, medical examiners, funeral directors, and organ donation

We may disclose PHI to a coroner, medical examiner, forensic pathologist, funeral director, organ-procurement organization, or tissue bank when permitted or required by law and relevant to the person’s lawful duties.

Research

We may use or disclose PHI for research when you authorize it or when an institutional review board, privacy board, or other legal provision permits the use or disclosure without authorization. Research disclosures must meet applicable federal and California requirements. Participation in research treatment requires any separate consent and authorization required by law.

Avert a serious threat

Consistent with applicable law and professional standards, we may use or disclose PHI when we believe in good faith that disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and the disclosure is made to someone reasonably able to prevent or lessen the threat.

5. Uses and Disclosures That Generally Require Written Authorization

Uses and disclosures not described in this Notice will be made only with your written authorization unless another law permits or requires them.

• Marketing: We will obtain written authorization for uses or disclosures of PHI for marketing when authorization is required. Certain communications about your treatment, care coordination, or health-related services available through the Practice may be permitted without authorization.
• Sale of PHI: Los Altos Neurology does not sell your PHI. Any disclosure that legally constitutes a sale of PHI would require your written authorization unless an exception applies.
• Psychotherapy notes: Most uses and disclosures of psychotherapy notes, if we maintain any, require written authorization, subject to limited exceptions.
• Fundraising: Los Altos Neurology does not currently use PHI to solicit charitable contributions or conduct fundraising.

You may revoke an authorization in writing at any time. A revocation will not affect actions already taken in reliance on the authorization or other uses or disclosures permitted by law.

6. Additional Federal and California Protections

California’s Confidentiality of Medical Information Act and other federal and state laws may provide protections that are more restrictive than HIPAA. When another law provides greater privacy protection, requires a special authorization, or limits disclosure more strictly, we will follow that law.

Additional protections may apply to particular categories of information, including mental-health records and psychotherapy notes; substance-use-disorder information; HIV/AIDS-related information; genetic information; reproductive and sexual-health information; information concerning communicable diseases; and records relating to care to which a minor may lawfully consent. The specific rules depend on the information, the purpose of the disclosure, and the circumstances.

7. Electronic Communications and Patient Portal

We use reasonable administrative, technical, and physical safeguards to protect PHI. No method of electronic communication or storage is completely risk-free. Use the Practice’s designated patient portal for clinical communications when directed to do so. Ordinary email, public website forms, and text messaging may not be appropriate for sensitive or urgent information.

You may request reasonable confidential-communication methods. Communication preferences do not prevent disclosures required by law, and we may use another reasonable method when necessary for patient safety, emergency care, or legal compliance.

8. Our Responsibilities

• We are required by law to maintain the privacy and security of your PHI.
• We must provide you with this Notice of our legal duties and privacy practices and follow the Notice currently in effect.
• We will notify affected individuals following a breach of unsecured PHI when notification is required by law.
• We will not use or disclose your information other than as described in this Notice unless you give written authorization or the law permits or requires the use or disclosure.
• We will not retaliate against you for exercising a privacy right or filing a complaint.

9. Changes to This Notice

We reserve the right to change the terms of this Notice and to make the revised Notice effective for all PHI we maintain, including information created or received before the revision. When we make a material change, we will revise the Notice promptly. The current version will be available upon request, at our service locations, and on our website at losaltosneurology.com/notice-of-privacy-practices/.

10. Questions and Complaints

Contact our Privacy Officer for questions, requests, or complaints about privacy practices or your rights:

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201; telephone 1-877-696-6775; or through the HHS complaint portal at hhs.gov/hipaa/filing-a-complaint.

We will not retaliate against you for filing a complaint.

---

Acknowledgment of receipt. If we ask you to sign an acknowledgment, your signature confirms only that you received or were offered this Notice. It is not an authorization to use or disclose PHI, is not an agreement with every provision, and does not waive any privacy right. If an acknowledgment is not obtained, we will document our good-faith effort as required by law.