Notice of Privacy Practices

Who this notice applies to

This Notice of Privacy Practices ("Notice") applies to the independent medical group responsible for your care and the licensed healthcare professionals who provide care through services facilitated by SYN Now(collectively, the "Medical Group"). Your care documents identify the specific legal entity and Provider responsible for your treatment. A Provider may give you a separate or additional notice; that notice controls with respect to the Provider's own privacy practices.

This Notice concerns protected health information ("PHI") maintained by the Medical Group. The non-clinical website operator's handling of other personal information is described in the Privacy Policy.

The Medical Group's duties

The Medical Group is required by law to:

• maintain the privacy and security of your PHI;
• provide you with this Notice describing its legal duties and privacy practices;
• follow the Notice currently in effect; and
• notify you following a breach of unsecured PHI when required by law.

How PHI may be used and disclosed

Treatment

The Medical Group may use and disclose PHI to provide, coordinate, or manage your care. For example, a Provider may review your medical history, send a prescription to a pharmacy, or share information with another clinician involved in your care.

Payment

PHI may be used and disclosed to bill for and collect payment for healthcare services, determine eligibility, manage refunds, or respond to payment questions. Services are generally cash-pay, but payment-related uses and disclosures may still occur.

Healthcare operations

PHI may be used and disclosed for operations such as quality assessment, clinician review, training, compliance, auditing, credentialing, legal services, fraud prevention, customer service supporting care, and business planning. Vendors handling PHI on behalf of the Medical Group must protect it as required by law and contract.

Individuals involved in your care

With your agreement or when otherwise permitted by law, relevant PHI may be shared with a family member, personal representative, caregiver, or other person involved in your care or payment. In an emergency or when you cannot state a preference, the Provider may share information based on professional judgment and your best interests.

Other permitted or required uses

PHI may be used or disclosed without written authorization when permitted or required for:

• public-health activities, product recalls, and adverse-event reporting;
• reporting suspected abuse, neglect, exploitation, or domestic violence;
• health oversight, licensing, audits, and inspections;
• judicial or administrative proceedings and lawful requests;
• law-enforcement purposes allowed by law;
• workers' compensation and similar programs;
• coroners, medical examiners, funeral directors, and organ donation;
• research meeting applicable legal safeguards;
• averting a serious and imminent threat to health or safety; and
• other uses or disclosures required by federal or state law.

Uses requiring authorization

Uses and disclosures not otherwise permitted by law will be made only with your written authorization. This generally includes most uses of psychotherapy notes, sale of PHI, and use of PHI for marketing. You may revoke an authorization in writing at any time, except to the extent action has already been taken in reliance on it.

Your rights

Subject to applicable law, you have the right to:

• Inspect or obtain a copy. Request electronic or paper copies of PHI in the designated record set. Reasonable, cost-based fees may apply.
• Request correction. Ask the Medical Group to amend PHI you believe is incorrect or incomplete. A request may be denied with a written explanation.
• Request confidential communications. Ask to be contacted in a particular way or at a particular location. Reasonable requests will be accommodated.
• Request restrictions. Ask to limit certain uses or disclosures. The Medical Group usually is not required to agree, except in circumstances required by law, including certain fully out-of-pocket services.
• Receive an accounting of disclosures. Request a list of certain disclosures made during the period allowed by law.
• Obtain this Notice. Request a paper or electronic copy at any time.
• Choose a representative. Authorize a personal representative to exercise rights on your behalf, subject to verification of authority.

How to exercise your rights

Contact your Provider through the patient portal or email support@synnow.com with the subject "Medical Privacy Request." Support will route the request to the Medical Group's privacy contact. You may be asked to verify your identity and submit a written request.

Complaints

You may complain to the Medical Group using the contact above if you believe your privacy rights were violated. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights through its online complaint portal at hhs.gov/hipaa/filing-a-complaint. You will not be retaliated against for filing a complaint.

Changes to this Notice

The Medical Group may change this Notice and make the revised Notice effective for PHI it already maintains and information received in the future. The current version will be posted here and made available on request.