Notice of Privacy Practices

Please Review This Notice Carefully

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, HOW YOU CAN GET ACCESS TO THIS INFORMATION, AND YOUR RIGHTS CONCERNING THAT INFORMATION. This Notice applies to protected health information maintained by Sleep Balance Academy PC in connection with care furnished by or on behalf of SBA. An independent clinician or organization may provide a separate notice when required by law.

1Your Rights

You have the rights described below. Additional rights may apply under state law or another federal confidentiality law.

• Get an electronic or paper copy of your health information. You may inspect or obtain a copy of your medical record and other protected health information we maintain about you. We generally provide access within 30 days of a valid request and may charge only a reasonable, cost-based fee permitted by law.
• Ask us to correct your record. If you believe health information is incorrect or incomplete, you may request an amendment. We may deny the request in circumstances permitted by law, but if we do, we will explain the denial in writing, generally within 60 days, and explain any right to submit a statement of disagreement.
• Request confidential communications. You may ask us to contact you in a particular way or at a particular location. We will accommodate reasonable requests as required by law.
• Ask us to limit uses or disclosures. You may ask us to restrict certain uses or disclosures for treatment, payment, or health care operations. We are not required to agree to every request. If you pay in full out of pocket for an item or service and ask us not to disclose that information to your health plan for payment or operations, we will honor the request unless disclosure is required by law.
• Get an accounting of disclosures. You may request a list of certain disclosures made during the six years before your request. The accounting does not include disclosures that the law excludes, such as many disclosures for treatment, payment, and health care operations. One accounting in a 12-month period is free; additional accountings may be subject to a reasonable, cost-based fee where permitted.
• Get a paper copy of this Notice. You may request a paper copy at any time, even if you agreed to receive it electronically.
• Choose someone to act for you. A legally authorized personal representative may exercise your rights. We will verify the person's authority before acting.
• Complain without retaliation. You may complain to SBA or directly to the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate or treat you differently for filing a complaint.

2Your Choices

In certain circumstances, you may tell us your preference about sharing information with family members, close friends, caregivers, or others involved in your care or payment for your care, and about sharing information for disaster relief. If you cannot express a preference, we may use professional judgment and applicable law to act in your best interests. We generally need your written authorization before using or disclosing protected health information for marketing where HIPAA requires authorization, selling protected health information, or disclosing most psychotherapy notes. We do not sell protected health information. If we ever use protected health information for fundraising, you will have any notice and opt-out rights required by law.

3How We May Use and Disclose Your Health Information

We may use or disclose protected health information without your written authorization for purposes permitted by law, including:

• Treatment. To provide, coordinate, or manage your care and to communicate with other professionals involved in treatment.
• Payment. To bill for services, process payment, determine coverage, or obtain reimbursement where applicable.
• Health care operations. To run the practice, improve quality, supervise and train, conduct compliance and audit activities, manage credentials and staffing, obtain legal and accounting services, and perform other health care operations permitted by law.
• Public health and safety. For legally permitted public-health activities, product or device recalls, adverse-event reporting, reporting suspected abuse or neglect when authorized or required, and preventing or reducing a serious and imminent threat to health or safety.
• Research. For research activities that satisfy the authorization, waiver, de-identification, limited-data-set, or other requirements of applicable law.
• Required by law and oversight. When federal or state law requires disclosure, including to health-oversight agencies and HHS for compliance reviews.
• Organ donation, death, and related functions. To organ procurement organizations, coroners, medical examiners, or funeral directors where applicable.
• Workers' compensation, law enforcement, and specialized government functions. Only in circumstances and subject to conditions permitted by law.
• Judicial and administrative proceedings. In response to a court or administrative order, subpoena, discovery request, or other lawful process when the requirements of HIPAA and any more protective law have been satisfied.

4Substance Use Disorder Records Protected by 42 CFR Part 2

To the extent we create or maintain records subject to 42 CFR part 2, those records receive additional federal confidentiality protections. Part 2 records may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you without your written consent or a court order and subpoena or similar legal mandate that satisfies Part 2. Where you provide a valid consent for treatment, payment, and health care operations involving Part 2 records, those records may be used and redisclosed as permitted by applicable law, subject to Part 2's special restrictions on use in proceedings against you. You may revoke a consent as permitted by law. If Part 2 information is ever used for fundraising, we will provide the advance notice and choice required by law.

5More Protective Laws

Some state and federal laws provide additional confidentiality protections for certain information, which may include mental health records, substance-use-disorder records, genetic information, HIV-related information, minor-consent services, or other sensitive records. When a law that applies to us is more protective than HIPAA, we follow the more protective rule.

6Our Responsibilities

We are required by law to maintain the privacy and security of protected health information, provide this Notice, and follow the duties and privacy practices described in the Notice currently in effect. We will notify affected individuals when a breach requires notice under applicable law. We require business associates that handle protected health information on our behalf to protect the information and use it only as permitted by law and contract. We will not use or disclose protected health information for a purpose not described in this Notice unless you authorize us in writing or another law permits or requires the use or disclosure. You may revoke an authorization in writing, except to the extent we already relied on it.

7Changes to This Notice

We may change this Notice and make the revised Notice effective for protected health information we already maintain as well as information created or received after the change. The current Notice will be available on our website and upon request. We will provide or post revisions as required by law.

8Questions, Requests, and Complaints

Privacy Contact: Sleep Balance Academy PC Phone: 877-230-0324 Email: support@sleepbalanceacademy.com 350 W 6th #151 Dubuque, IA 52004 You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. Information about filing a complaint is available at hhs.gov/ocr/complaints. You do not have to complain to SBA first.