Notice of Privacy Practices (HIPAA)

Your Health Information

Protected health information may include information about:
- Your physical or mental health
- Medical conditions
- Diagnoses
- Medications
- Treatment and treatment plans
- Laboratory results
- Behavioral health services
- Appointment history
- Insurance and billing information
- Information that identifies you and relates to the healthcare you receive

We are required by law to maintain the privacy and security of your protected health information and to follow the privacy practices described in this notice.

How We May Use and Share Your Information

Treatment
We may use and disclose your health information to provide, coordinate or manage your healthcare.
For example, information may be shared among healthcare professionals involved in your treatment or with another healthcare provider when necessary to coordinate your care.

Payment
We may use and disclose your health information for billing and payment purposes.
For example, we may provide information to your insurance company or health plan to determine eligibility, obtain authorization or receive payment for services provided.

Healthcare Operations
We may use and disclose your information for activities necessary to operate our practice and improve the quality of care we provide.

This may include:
- Quality assessment and improvement
- Staff training
- Credentialing
- Compliance activities
- Administrative operations
- Business planning
- Auditing
- Patient service improvement

HIPAA permits covered providers to use and disclose PHI for treatment, payment and healthcare operations without obtaining a separate authorization in many circumstances.

Other Uses and Disclosures Permitted by Law

We may also use or disclose your health information when permitted or required by law, including for purposes such as:
- Public health activities
- Reporting suspected abuse, neglect or domestic violence when legally required
- Health oversight activities
- Judicial or administrative proceedings
- Certain law-enforcement purposes
- Workers’ compensation matters
- Preventing or reducing a serious threat to health or safety
- Compliance with federal, state or local law
- Government functions when legally permitted
- Coroners, medical examiners or funeral directors as allowed by law

Only the minimum information reasonably necessary will be disclosed when required by applicable privacy rules.

Your Choices

In certain situations, you may have choices regarding how your information is shared.

Depending on the circumstances, you may tell us your preferences regarding:
- Sharing information with family members, friends or others involved in your care
- Disaster relief situations
- Certain communications regarding your care
- Certain marketing or fundraising communications

We will follow your instructions when required by law.

Uses Requiring Your Written Authorization

For uses or disclosures not otherwise permitted by law or described in this notice, we will generally obtain your written authorization.

You may revoke an authorization in writing at any time, except to the extent that we have already acted in reliance on it.

We will not sell your protected health information or use it for purposes requiring authorization without obtaining the authorization required by law.

Behavioral and Mental Health Information

Because Heart Own Medical Services provides behavioral and mental health services, certain records may receive additional protections under federal or state law.

We will follow applicable requirements governing the confidentiality of mental health, psychiatric and other specially protected records.

Additional authorization may be required before certain information can be disclosed.

Substance Use Disorder Records

Certain substance use disorder treatment records may receive additional protections under federal law, including 42 CFR Part 2, when applicable.

Federal requirements governing HIPAA Notices of Privacy Practices were updated in 2026 to address protections associated with certain substance use disorder records. HHS.gov

Where those protections apply, Heart Own Medical Services will use and disclose such information only as permitted by applicable law.

Your Rights

You have important rights regarding your protected health information.

Get a Copy of Your Medical Record

You may ask to inspect or receive a copy of your medical and billing records, subject to certain legal limitations.

Copies may be provided electronically or on paper where available.

Ask Us to Correct Your Record

If you believe information in your medical record is incorrect or incomplete, you may ask us to correct or amend it.

We may deny certain requests as permitted by law, but we will explain the reason when required.

Request Confidential Communications

You may ask us to contact you in a specific way.

For example, you may request that we contact you at a particular telephone number or mailing address.

We will accommodate reasonable requests as required by law.

Ask Us to Limit What We Use or Share

You may ask us not to use or disclose certain health information for treatment, payment or healthcare operations.
We are not required to agree to every request.

In certain situations involving services paid for completely out of pocket, you may have additional rights to restrict disclosure to a health plan.

Get a List of Certain Disclosures

You may request an accounting of certain disclosures of your health information.

This generally does not include disclosures made for treatment, payment or healthcare operations or other disclosures excluded by law.

Get a Copy of This Notice

You may request a paper copy of this Notice of Privacy Practices at any time, even if you have agreed to receive it electronically.

Choose Someone to Act for You

If you have given someone medical power of attorney or if someone is legally authorized to act on your behalf, that person may exercise your privacy rights when permitted by law.

File a Complaint

You may file a complaint if you believe your privacy rights have been violated.

You may complain directly to Heart Own Medical Services or to the U.S. Department of Health and Human Services Office for Civil Rights.

You will not be retaliated against or denied care for filing a privacy complaint.
HHS identifies these rights as core components of a provider’s Notice of Privacy Practices.

Our Responsibilities

Heart Own Medical Services is required to:
- Maintain the privacy and security of your protected health information
- Follow the privacy practices described in this notice
- Provide you with a copy of this notice
- Notify affected individuals when a breach occurs that may have compromised the privacy or security of protected health information, when required by law
- Follow applicable federal and state privacy requirements

If another law provides greater privacy protection than HIPAA, we will follow the more protective requirement when applicable.

Electronic Communications

Heart Own Medical Services may communicate with patients electronically when appropriate.
Electronic communications may include:
- Appointment information
- Patient intake instructions
- Administrative communications
- Secure patient communications
- Email or text communications where permitted

Patients should avoid sending detailed medical information through general website contact forms or ordinary email unless specifically instructed to do so.

Sensitive health information should be submitted only through designated patient forms, secure systems or other methods provided by Heart Own Medical Services.

Website Forms

General website forms are intended primarily for appointment requests and general inquiries.

Submitting information through the website does not automatically establish a provider-patient relationship.

If you are asked to provide detailed medical information, please use only the patient intake process or other designated secure method provided by Heart Own Medical Services.

Business Associates

We may work with third-party service providers that perform functions on our behalf and may require access to protected health information.

When HIPAA requires it, these organizations are considered Business Associates and are contractually required to appropriately safeguard protected health information.

Examples may include certain:
- Billing providers
- Electronic health record providers
- Healthcare technology providers
- Administrative service providers
- Secure communication providers

Security of Your Information

We maintain administrative, technical and physical safeguards intended to protect protected health information from unauthorized access, use or disclosure.

Although reasonable safeguards are maintained, no electronic communication or information system can be guaranteed to be completely secure.

Changes to This Notice

We may change the terms of this Notice of Privacy Practices.

Changes may apply to all protected health information we maintain, including information created or received before the revised notice takes effect.

When this notice is materially updated, the revised version will be available upon request, at our office and on our website.

Questions or Privacy Concerns

If you have questions about this notice, your privacy rights or the way Heart Own Medical Services handles protected health information, please contact our office.

Heart Own Medical Services
Phone: 472-248-6144
Website: heartownmedical.com