Notice of Privacy Practices

1. Our Responsibilities

Mobile Aesthetics MD is required by applicable law to:

• Maintain the privacy and security of protected health information
• Provide you with this notice describing our legal duties and privacy practices
• Follow the terms of the notice currently in effect
• Notify affected individuals following a breach of unsecured protected health information when notification is required
• Honor applicable rights described in this notice

Protected health information generally includes identifiable information relating to your past, present or future physical or mental health, healthcare services or payment for healthcare.

2. Uses and Disclosures for Treatment, Payment and Healthcare Operations

We may use and disclose protected health information without your written authorization for treatment, payment and healthcare operations as permitted by law.

Treatment

We may use and disclose your information to provide, coordinate or manage your care. This may include sharing information with physicians, nurses, pharmacies, laboratories, consultants and other healthcare professionals involved in your treatment.

For example, a treating clinician may send a prescription to an appropriately licensed pharmacy or review relevant information with another healthcare professional involved in your care.

Payment

We may use and disclose information to bill and collect payment for services and to perform related financial activities. This may include communicating with payment processors, health plans when applicable, or other responsible parties.

Healthcare operations

We may use and disclose information for activities necessary to operate the practice, including:

• Quality assessment and improvement
• Clinical review and care coordination
• Training and supervision
• Credentialing and professional review
• Licensing, auditing and compliance
• Business planning and administration
• Customer service and complaint resolution
• Fraud prevention and security

Business associates

We may disclose protected health information to service providers that perform functions involving such information on our behalf. When required, these business associates must enter into written agreements requiring them to safeguard the information appropriately.

Appointment reminders and care communications

We may use your contact information to provide appointment reminders, scheduling communications, follow-up instructions, information about treatment alternatives and other communications related to your care.

3. Other Uses and Disclosures Permitted or Required by Law

We may use or disclose protected health information without written authorization in other circumstances permitted or required by law, including:

• When required by federal, state or local law
• For public-health activities and legally required reporting
• To report suspected abuse, neglect or domestic violence when authorized or required
• For health-oversight activities, audits, investigations and inspections
• In response to a valid court order, subpoena or other lawful process
• For certain law-enforcement purposes
• To coroners, medical examiners and funeral directors as permitted by law
• For organ and tissue donation purposes when applicable
• For approved research activities when legal requirements are satisfied
• To prevent or lessen a serious and imminent threat to health or safety
• For workers’ compensation and similar programs as authorized by law
• For certain specialized government functions as permitted by law

We will limit uses and disclosures to the minimum necessary information when that standard applies.

4. Uses and Disclosures Requiring Written Authorization

Uses and disclosures of protected health information not otherwise permitted or required by law generally require your written authorization.

We will obtain an appropriate authorization for uses or disclosures requiring authorization, including certain marketing activities and any sale of protected health information.

We do not sell protected health information.

If you provide written authorization, you may revoke it in writing at any time. Revocation will not affect actions already taken in reliance on the authorization.

5. Your Privacy Rights

Subject to applicable law and certain limitations, you may have the following rights regarding your protected health information.

Right to inspect and obtain a copy

You may request to inspect or obtain an electronic or paper copy of protected health information maintained in a designated record set. We may charge a reasonable, cost-based fee where permitted.

Right to request an amendment

If you believe information in your record is incorrect or incomplete, you may request an amendment. We may deny the request in certain circumstances and will explain an applicable denial in writing.

Right to an accounting of disclosures

You may request a list of certain disclosures made during the legally specified period. The accounting does not include every type of disclosure, such as many disclosures made for treatment, payment or healthcare operations.

Right to request restrictions

You may request restrictions on certain uses or disclosures. We are generally not required to agree to every requested restriction.

If you pay in full out of pocket for a healthcare item or service, you may request that we not disclose information about that item or service to a health plan for payment or healthcare operations. We will honor that request when required by law unless disclosure is otherwise required.

Right to confidential communications

You may request that we communicate with you through a particular method or at a particular location. We will accommodate reasonable requests as required by law.

Right to a paper or electronic copy of this notice

You may request a paper copy of this notice at any time, even if you previously agreed to receive it electronically.

Right to choose a personal representative

A person with legal authority to act on your behalf may exercise applicable privacy rights for you. We may require documentation establishing that authority.

Right to receive breach notification

You have the right to receive notification following a breach of unsecured protected health information when notification is required by law.

How to exercise your rights

Submit a written request to the Privacy Officer using the contact information at the end of this notice. We may verify your identity and authority before processing a request.

6. Electronic Communications and Telehealth

Mobile Aesthetics MD may use electronic systems for scheduling, patient intake, telehealth, clinical documentation, prescriptions, laboratory coordination, payment and patient communications.

We use reasonable safeguards appropriate to the information and communication method. However, ordinary email and text messages may present privacy risks and should not be used to send sensitive medical information unless specifically authorized or directed through an approved process.

Certain telehealth services may be available only to eligible patients physically located in Georgia at the time of the appointment. Telehealth availability is subject to provider licensure, patient identity and location verification, clinical appropriateness, technology requirements and applicable law.

7. Personal Representatives and Minors

We may recognize a legally authorized personal representative and permit that person to exercise applicable privacy rights on a patient’s behalf. We may request documentation confirming the person’s authority.

Privacy rights involving minors are handled according to applicable consent, parental-access and confidentiality laws. In certain circumstances, a minor may have legal authority to consent to care or control access to particular information.

We may decline to treat a person as a personal representative when permitted by law, including when doing so is reasonably necessary to protect the patient from abuse, neglect or endangerment.

8. Changes to This Notice

We reserve the right to revise this Notice of Privacy Practices and make the revised notice effective for protected health information already maintained as well as information received in the future, as permitted by law.

The current notice will be available on our website and upon request. The effective date appears at the top of the notice.