Notice of Privacy Practices

1. About This Notice

CNY Neurological Consulting, PLLC ("CNY Neurological," the "Practice," "we," "us," or "our") is committed to protecting the privacy and security of your health information.

Federal law, including the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), requires us to protect the privacy and security of protected health information ("PHI"), provide you with this Notice of Privacy Practices, explain our legal duties and privacy practices, and follow the terms of the Notice currently in effect.

PHI generally includes individually identifiable information concerning your past, present, or future physical or mental health; the healthcare provided to you; or payment for your healthcare.

This Notice applies to CNY Neurological Consulting, PLLC and to members of its workforce who create, receive, maintain, or transmit PHI on behalf of the Practice.

When New York State or another applicable law provides greater privacy protection than HIPAA, we will follow the law providing the greater protection to the extent required.

2. Your Rights

You have important rights regarding your health information.

Get an Electronic or Paper Copy of Your Medical Record

You may ask to inspect or obtain an electronic or paper copy of medical records, billing records, and other health information maintained about you in a designated record set, subject to limited exceptions permitted by law.

We will respond within the time required by applicable federal and New York law.

New York Public Health Law § 18 provides additional rights concerning access to patient information. Where that law applies, a qualified person making a written request generally must be provided an opportunity to inspect records within 10 days, subject to statutory exceptions. Other rights and timelines may apply to copies of records and appeals of a denial.

Where HIPAA provides a broader right of access than New York law, we will comply with the applicable federal requirement.

We may charge only fees permitted by applicable law. We will not deny access solely because of an inability to pay where New York law prohibits such a denial.

Ask Us to Correct or Amend Your Record

You may ask us to amend health information that you believe is inaccurate or incomplete.

We may deny an amendment request when permitted by law. If we deny your request, we will provide the required written explanation and advise you of any applicable right to submit a statement of disagreement.

Request Confidential Communications

You may ask us to contact you in a particular way or at a particular location, such as at a particular telephone number or mailing address.

We will accommodate reasonable requests as required by law.

Ask Us to Limit What We Use or Share

You may request that we restrict certain uses or disclosures of your PHI for treatment, payment, or healthcare operations.

We are generally not required to agree to all requested restrictions.

However, if you pay for a healthcare item or service completely out of pocket, you may request that we not disclose information concerning that item or service to your health plan for payment or healthcare-operations purposes. We will honor that request when required by HIPAA unless disclosure is otherwise required by law.

Get an Accounting of Certain Disclosures

You may request an accounting of certain disclosures of your PHI made during the period permitted by law.

An accounting does not include every disclosure. For example, disclosures for treatment, payment, and healthcare operations generally are not included under current HIPAA accounting requirements.

We will provide the first accounting within a 12-month period without charge. A reasonable, cost-based fee may apply to additional requests when permitted by law, after advance notice to you.

Get a Copy of This Notice

You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

An electronic version is also available on our website.

Choose Someone to Act for You

If an individual has legal authority to act as your personal representative, such as a healthcare agent, legal guardian, or other legally authorized representative, that individual may exercise rights concerning your health information to the extent provided by law.

We will verify the representative's authority before acting upon a request when required.

File a Complaint Without Retaliation

You have the right to file a privacy complaint with CNY Neurological Consulting or with the U.S. Department of Health and Human Services Office for Civil Rights.

We will not retaliate against you, deny treatment, or otherwise penalize you for exercising a privacy right or filing a complaint.

3. Your Choices

For certain health information, you may tell us your preferences concerning what we share.

Subject to applicable law, you may tell us whether you want us to:

• ◆Share relevant information with family members, close friends, caregivers, or others involved in your care or payment for your care;
• ◆Share relevant information in a disaster-relief situation; or
• ◆Communicate with another person concerning your healthcare when permitted by law.

If you are unable to tell us your preference — for example, because you are unconscious or otherwise unable to communicate — we may share information when permitted by law and when, using professional judgment, we determine that disclosure is in your best interests.

We may also use or disclose information when necessary and legally permitted to prevent or lessen a serious and imminent threat to health or safety.

4. Uses and Disclosures That Generally Require Written Authorization

Except where otherwise permitted or required by law, we will obtain your written authorization before:

• ◆Using or disclosing PHI for marketing purposes when HIPAA requires authorization;
• ◆Selling PHI;
• ◆Using or disclosing most psychotherapy notes; or
• ◆Using or disclosing your PHI for another purpose not described in this Notice and not otherwise permitted by law.

CNY Neurological Consulting does not sell protected health information.

If you give us written authorization, you may revoke it in writing at any time. Revocation generally applies only to future uses and disclosures and does not undo actions already taken in reliance on a valid authorization.

5. How We Typically Use and Share Your Health Information

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare.

For example, we may share relevant information with physicians, nurse practitioners, hospitals, pharmacies, laboratories, imaging facilities, therapists, specialists, or other healthcare professionals involved in your care.

Payment

We may use and disclose PHI to bill for the services we provide and obtain payment from you, your health insurer, another health plan, or another responsible payer.

For example, we may provide diagnosis, procedure, or treatment information necessary for a health plan to process a claim.

Healthcare Operations

We may use and disclose PHI as necessary to operate our Practice and improve the care we provide.

Healthcare operations may include quality assessment, quality improvement, patient-safety activities, care coordination, credentialing, auditing, compliance, staff training, legal and business functions, fraud and abuse detection, and other activities permitted under HIPAA.

Business Associates

We may provide PHI to outside individuals or organizations that perform services for the Practice, such as billing, technology, records management, legal, accounting, or other professional services.

When HIPAA requires it, these business associates must enter into written agreements requiring them to appropriately safeguard PHI.

6. Other Uses and Disclosures Permitted or Required by Law

We may use or disclose PHI without your written authorization when federal or state law permits or requires us to do so and all applicable legal conditions have been satisfied.

These situations may include:

Public Health Activities

We may disclose PHI to authorized public-health agencies for legally permitted activities such as disease prevention and control, public-health surveillance, reporting required by law, product recalls, or reporting adverse events.

Abuse, Neglect, or Domestic Violence

We may disclose information to an appropriate authority when disclosure is authorized or required by law concerning suspected abuse, neglect, or domestic violence.

Health Oversight

We may disclose PHI to authorized health-oversight agencies for legally authorized audits, investigations, inspections, licensing, credentialing, disciplinary proceedings, or other oversight activities.

Compliance with Law

We will disclose health information when a federal, state, or local law requires us to do so, subject to all applicable limitations and protections.

Law Enforcement

We may disclose PHI to law-enforcement officials only when permitted or required by law and after satisfying applicable legal requirements.

Judicial and Administrative Proceedings

We may disclose PHI in connection with judicial or administrative proceedings when permitted by HIPAA and applicable New York law, including in response to certain court orders, subpoenas, or other lawful process.

A subpoena or request for records does not automatically override confidentiality protections that may apply to specially protected information.

Workers' Compensation

We may disclose PHI as authorized by and to the extent necessary to comply with workers' compensation laws and similar programs.

Research

We may use or disclose PHI for research when applicable HIPAA and other legal requirements have been met, such as valid authorization or appropriate approval of a waiver by an Institutional Review Board or Privacy Board.

Medical Examiners, Coroners, and Funeral Directors

We may disclose PHI to coroners, medical examiners, or funeral directors when permitted by law and necessary for them to perform their duties.

Organ and Tissue Donation

We may disclose PHI to organizations involved in organ, eye, or tissue procurement, banking, or transplantation when permitted by law.

Serious Threat to Health or Safety

Consistent with applicable law and standards of professional conduct, we may use or disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

Special Government Functions

We may make disclosures for certain legally authorized government functions, including military, national-security, protective-service, correctional, or other activities permitted under HIPAA.

7. Information Receiving Additional Protection

Certain health information is protected by laws that may be more restrictive than ordinary HIPAA requirements.

When those laws apply, CNY Neurological Consulting will comply with the additional protections.

HIV-Related Information — New York

Confidential HIV-related information is subject to heightened protection under New York Public Health Law Article 27-F.

We will disclose HIV-related information only as authorized by applicable New York and federal law. A general authorization for release of medical information may not be sufficient for a disclosure when New York law requires a specific authorization or otherwise restricts disclosure.

Genetic Test Information — New York

Genetic testing and genetic-test results may be subject to New York Civil Rights Law § 79-l and other applicable law.

Where required, genetic testing will be performed only after the legally required written informed consent.

Records, findings, and results of genetic tests covered by New York law are confidential and will not be disclosed except with legally sufficient authorization or as otherwise specifically permitted by law.

Mental-Health Information

Certain mental-health records may receive additional confidentiality protection under New York law and federal law.

When a heightened confidentiality rule applies, we will comply with that rule before using or disclosing the information.

Minors and Confidential Care

New York law gives minors independent confidentiality rights in certain circumstances and for certain categories of care.

A parent, guardian, or other representative does not automatically have an unrestricted right to every portion of a minor's medical record when New York law permits the minor to consent to care independently or otherwise restricts disclosure.

We will apply the confidentiality and access rules applicable to the particular circumstances.

Reproductive and Sexual Health Information

Information concerning reproductive or sexual healthcare is protected as PHI under HIPAA and may also be protected by New York confidentiality laws depending upon the circumstances.

We will apply all federal and New York protections in effect at the time a request for use or disclosure is made.

Nothing in this Notice should be interpreted as expanding or reducing any right or restriction established by applicable federal or New York law.

8. Substance Use Disorder Records and 42 C.F.R. Part 2

Certain substance-use-disorder ("SUD") patient records may receive additional federal confidentiality protection under 42 U.S.C. § 290dd-2 and 42 C.F.R. Part 2.

CNY Neurological Consulting is a neurological medical practice. This section does not state or imply that the Practice operates a federally assisted Part 2 substance-use-disorder treatment program.

However, to the extent the Practice receives, maintains, or rediscloses SUD patient records that remain protected by Part 2, those records will be handled in accordance with applicable Part 2 requirements.

To the extent required by Part 2, protected SUD patient records may not be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding against the patient without the patient's written consent or the court authorization and legal process required by federal law.

Additional consent and redisclosure restrictions may apply depending upon the source and nature of the record.

9. New York Medical-Record Access Rights

In addition to HIPAA rights, New York Public Health Law § 18 may provide patients and other "qualified persons" with rights to inspect and obtain patient information.

When Section 18 applies:

• ◆A written request may be required;
• ◆A qualified person generally must be provided an opportunity to inspect eligible records within 10 days of a written request;
• ◆Certain limited categories of information may lawfully be withheld;
• ◆When access is denied under New York law, applicable notice and appeal rights may exist through the New York State Department of Health; and
• ◆A patient may not be denied access solely because of inability to pay where prohibited by law.

HIPAA may provide a right of access even when a limitation exists under state law. We will evaluate requests under all applicable laws and apply the governing requirement.

Requests for medical records may also be submitted through procedures provided by the Practice or through the patient portal when available.

10. Our Responsibilities

CNY Neurological Consulting is required to:

• ◆Maintain the privacy and security of your PHI;
• ◆Provide you with this Notice;
• ◆Follow the privacy practices described in the Notice currently in effect;
• ◆Provide appropriate access to health information as required by law;
• ◆Obtain authorization when required;
• ◆Apply additional protections required by New York or other applicable law;
• ◆Notify affected individuals following a breach of unsecured PHI when notification is legally required; and
• ◆Refrain from retaliating against you for exercising your privacy rights or filing a complaint.

We will not use or disclose your PHI other than as described in this Notice or as otherwise permitted or required by law unless you authorize us in writing.

11. Breach Notification

We maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of PHI.

If a breach of unsecured PHI occurs and applicable law requires notification, we will provide the required notification without unreasonable delay and within the time limits established by law.

Other federal or New York notification obligations may also apply depending upon the circumstances.

12. Changes to This Notice

We may change the terms of this Notice and make the revised Notice applicable to all PHI we maintain, including PHI created or received before the revision.

When we materially revise this Notice, the current version will be available:

• ◆At our office;
• ◆Upon request; and
• ◆On our website at cnyneuro.com.

The effective date and revision date will appear at the beginning of the Notice.

13. Complaints

If you believe your privacy rights have been violated, you may submit a complaint directly to CNY Neurological Consulting.

You may also file a complaint with:

CNY Neurological Consulting will not retaliate against you for filing a complaint.

14. Contact the Privacy Officer

Questions concerning this Notice, requests to exercise privacy rights, requests for copies of this Notice, and privacy complaints may be directed to: