HIPAA Notice of Privacy Practices

Who this notice covers

This notice applies to Thrive Comprehensive Medical Group, our workforce, and our business associates who are required to protect your information.

Your rights

You have the right to:

• Get a copy of your medical record. Ask for an electronic or paper copy of your record and other health information.
• Ask us to correct or amend your record if you think something is wrong or incomplete.
• Ask for confidential communications in a specific way, such as at a different address, phone, or through the portal.
• Ask us to limit what we use or share for treatment, payment, or healthcare operations.
• Get a list of disclosures for the 6 years before your request, excluding routine disclosures.
• Get a copy of this notice at any time.
• Choose someone to act for you, such as a medical power of attorney or parent/guardian of a minor.
• File a complaint without retaliation if you believe your privacy rights have been violated.
• Be notified if a breach occurs that compromises the privacy or security of your information.

Your choices

For certain information, you can tell us your preferences about what we share. If you have a clear preference, tell us and we will follow it.

• Family, friends, caregivers: We may share relevant information with a person involved in your care or payment if you agree or when you do not object; in an emergency, we may share if it’s in your best interest and permitted by law.
• Disaster relief: We may share to help in a disaster.
• Fundraising: We may contact you for fundraising. You can opt out of further fundraising communications at any time.
• SMS, email, and portal messaging: We use these mainly for appointments/billing and avoid including PHI in SMS. Tell us your communication preferences; you can opt out of non-required texts at any time.

We will not sell your information or use it for marketing without your written authorization. We also won’t share psychotherapy notes without your authorization except as permitted by law.

Our uses and disclosures

We typically use/share your health information in the following ways:

• Treat you: We can use/share your information with other professionals who are treating you.
• Run our practice: We can use/share your information to run our practice, improve care, and contact you.
• Bill for your services: We can use/share your information to bill and get payment from health plans or other entities.

Other ways we may use/share your information—as allowed or required by law—include public health and safety, health oversight activities, legal actions and law enforcement, medical examiners/coroners/funeral directors, organ and tissue donation, research under strict oversight or with authorization, workers’ compensation and similar programs, specialized government functions, compliance with law, correctional institutions, and immunizations to schools where permitted.

Other uses and disclosures require your written authorization. This includes most uses/disclosures of psychotherapy notes, marketing, and sale of health information. If you sign an authorization, you can revoke it at any time in writing, except to the extent we’ve already acted on it.

Our responsibilities

• We are required by law to maintain the privacy and security of your protected health information (PHI).
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this notice and give you a copy.
• We will not use or share your information other than as described here unless you tell us we can in writing.

Changes to this notice

We may change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request, in our office, and on our website with a new effective date.

How to exercise your rights or ask questions

• Submit a request for access, amendment, restriction, confidential communications, accounting, or copies of this notice through the portal or contact the Privacy Officer at helpdesk@thrivecmg.com.
• Complaints: Contact us, or file with HHS OCR at https://ocrportal.hhs.gov/ or 1-800-368-1019.

California addendum

California law, including the Confidentiality of Medical Information Act (CMIA), may offer additional protections. More protective rules may apply to certain sensitive information, such as mental health, substance use disorder records, HIV test results, genetic test results, and reproductive health. We follow the stricter law when it applies.

• Minor consent: In some cases, minors can consent to their own care. When allowed by law, information may be shared only with the minor’s permission.
• Out-of-pocket restriction: If you pay in full for a service and request no disclosure to your health plan for that service, we will comply unless law requires otherwise.
• To learn more or to exercise these state-specific rights, contact helpdesk@thrivecmg.com.

Quick reference

• We use/share your PHI to treat you, run our practice, and bill for services.
• You can access/copy, amend, restrict, choose confidential communications, get a disclosure list, get a copy of this notice, and file a complaint.
• We will not use your information for marketing, sell it, or share psychotherapy notes without your written authorization.
• We’ll notify you of breaches and follow this notice.