HIPAA Notice of Privacy Practices

Effective Date: February 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN ACCESS THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

We are required by law to maintain the privacy and security of your Protected Health Information (“PHI”) and to provide you with this Notice of our legal duties and privacy practices in accordance with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 42 CFR Part 2 where applicable, and other federal and state privacy laws.

1. Our Commitment to Protecting Your Health Information

We create and maintain records of your health and the care and services you receive. We are required by law to:

• Maintain the privacy and security of your PHI
• Provide you with this Notice of our legal duties and privacy practices
• Follow the terms of this Notice currently in effect
• Notify you promptly if a breach occurs that may compromise the privacy or security of your information

2. How We May Use and Disclose Your PHI

We may use and disclose your PHI without written authorization for:

Treatment
To provide and coordinate your care.
Example: Sharing exam notes or imaging with a referring provider.

Payment
To bill and receive payment for services.
Example: Sending claims to insurance companies.

Healthcare Operations
To run and improve our practice.
Examples include quality review, staff training, scheduling, and administrative activities.

3. Uses and Disclosures Required or Allowed by Law

We may disclose PHI without authorization when required or permitted by law, including:

• Public health reporting
• Abuse or neglect reporting
• Health oversight and audits
• Court or administrative proceedings
• Workers’ compensation
• Law enforcement requests
• Coroners or medical examiners
• Organ donation
• Approved research
• Preventing serious threats to health or safety

When other laws are more restrictive than HIPAA, we will follow the more stringent law.

4. Special Notice Regarding Substance Use Disorder (SUD) Records (42 CFR Part 2)

Certain health information related to substance use disorder diagnosis, treatment, or referral may be protected by federal law (42 CFR Part 2) in addition to HIPAA.

If we create, receive, or maintain records that are subject to 42 CFR Part 2, those records are entitled to additional privacy protections under federal law.

a. Uses and Disclosures of SUD Records
Substance use disorder records may require your written consent for certain uses or disclosures, unless otherwise permitted by law. Where permitted, such records may be used or disclosed for treatment, payment, and healthcare operations consistent with applicable federal requirements.

b. Limits on Use in Legal Proceedings
Substance use disorder treatment records received from programs subject to 42 CFR Part 2, or testimony relaying the content of such records, shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your written consent or a court order that meets applicable federal requirements.

c. Additional Protections
Substance use disorder records are subject to specific federal restrictions on use and redisclosure. We will comply with these protections where applicable.

5. Redisclosure Notice

Information disclosed by us may be redisclosed by the recipient and may no longer be protected by HIPAA.

However, certain information such as substance use disorder records may remain protected by federal law and cannot be redisclosed without appropriate authorization or legal authority.

6. Fundraising Communications (If Applicable)

If we ever use or disclose information for fundraising purposes related to services provided, you will be given a clear opportunity to opt out of receiving such communications.

We will not use or disclose substance use disorder records for fundraising without your prior written consent.

7. Uses and Disclosures Requiring Written Authorization

We will obtain your written authorization for:

• Marketing uses not permitted by law
• Sale of PHI
• Most uses of psychotherapy notes
• Uses not described in this Notice
• Most disclosures of substance use disorder records

You may revoke authorization in writing at any time.

8. Your Rights Regarding Your PHI

You have the right to:

Inspect and obtain copies
Request copies of your medical or billing records.

Request amendment
Request corrections to inaccurate or incomplete information.

Request confidential communications
Ask us to contact you in a specific way or location.

Request restrictions
Request limits on uses or disclosures.
If you pay in full out-of-pocket, you may request we not disclose that service to your insurer.

Accounting of disclosures
Request a list of certain disclosures from the past six years.

Paper copy
Request a paper copy of this Notice anytime.

Breach notification
Receive notice if your PHI is compromised.

File a complaint
You may file a complaint without retaliation.

Contact us:
Greschner Foot and Ankle Specialists
Phone: 304-584-3838
Address: 511 Burroughs Street, STE 101
Morgantown, WV 26505

You may also file a complaint with:
U.S. Department of Health & Human Services
Office for Civil Rights
www.hhs.gov/ocr/privacy/hipaa/complaints/

9. How We Protect Your Information

We use administrative, technical, and physical safeguards including:

• Secure electronic health record systems
• Encryption and secure transmissions
• Role-based access controls
• Staff HIPAA training
• Secure storage and disposal procedures

10. Accessibility and Non-Discrimination

We comply with applicable federal nondiscrimination and accessibility laws.
This Notice is available in alternative formats or languages upon request.

11. Changes to This Notice

We reserve the right to change this Notice at any time.
Changes will apply to all PHI we maintain.

Updated versions will be:

• Posted in our office
• Available on our website
• Provided upon request