Effective date: November 1, 2023

This Notice of Privacy Practices (this “Notice”) is required by law. The Notice describes how your medical information may be used and disclosed, Farfalla Integrative Health LLC’s (the “Company”) privacy practices regarding your health information, how you can obtain access to this information, and your rights and the Company’s legal obligations with respect to your protected health information.

Please review this Notice carefully. The Company reserves the right to change the terms of this Notice and privacy policies at any time. You will be notified of any changes. You may request a copy of this Notice from the Company. If you have any questions, please contact Christine McDevitt at info@farfallaintegrativehealth.com.

Federal law requires that the Company ensures your protected health information (PHI) is kept private. PHI is information in your file/electronic record that can be used to identify you. It includes data about your past or present health condition, the provision of health care services, or the payment for such services.

Each time you attend a session with the Company, a record of your session is made containing health information. This record contains information about your condition and the treatment the Company provides during the session. The Company may use or disclose this information to:

• Plan your care and treatment;
• Communicate with other health professionals involved in your care;
• Keep record of the treatment you receive;
• Educate health professionals;
• Participate in medical research;
• Evaluate the Company’s services;
• Improve the care the Company provides; and
• Obtain payment for the services you received.

Understanding the contents of your file and how your health information is used helps you to:

• Ensure that the Company has accurate information;
• Better understand who may have access to your health information; and
• Make more informed decisions when authorizing disclosure to others.

HOW THE COMPANY MAY USE OR DISCLOSE YOUR HEALTH INFORMATION

The Company is required to maintain your confidential file/electronic records for a period of six (6) years. However, there are circumstances under which your information could be used or disclosed.

The following list describes the ways that the Company uses and discloses health information. This is not an exhaustive list; however, all the ways the Company is permitted to use and disclose PHI will fall into one of these categories:

• For Treatment: The Company may use or disclose your health information to provide you with the services. The Company may disclose health information about you to your doctors, nurses, therapists, or other Company personnel who are involved in your case.
• For Payment: The Company may use or disclose your health information so that the treatment and services you receive at the Company may be billed to you or a third party.
• For Health Care Operations: The Company may use and share your health information to make sure the Company is giving you the best care possible. The Company uses your health information to check the Company’s quality, improve services, and test clinical guidelines. The Company may combine your health information with others to see what extra services should be offered, which services the Company should stop, and whether certain treatments are working well. The Company uses your health information for professional reviews, performance checks, and training. It can also be used for obtaining accreditations, certificates, licenses, and for doing reviews and audits, including for compliance and medical reviews, legal services, and other compliance programs. The Company may use your health information for the general business and management activities of the Company, including solving complaints, customer service, and due diligence. In some cases, the Company may share your health information with another organization that also follows HIPAA rules for its own operations, but in those cases, the Company will remove your identifiable information so that the health information can be used to study healthcare without revealing your identity.

OTHER PERMISSIBLE USES OF YOUR HEALTH INFORMATION

• Business Associates. There are certain services provided by the Company through contracts with its business associates. This may include medical directors, attorneys, electronic health record companies, or copy services utilized when making copies of your file. When these services are contracted, the Company may disclose your health information so that the Company’s associates are able to complete the agreed upon services and bill you or your third party for services rendered. The Company requires its business associates to use the same level of care as the Company when safeguarding your information.
• Service Providers. Services you receive from the Company may be provided as part of a larger treatment plan involving other healthcare participants.
• Health-Related Benefits, Services, and Reminders. The Company may contact you to provide session reminders, to provide information about treatment alternatives, or to provide health-related benefits and services.
• Individuals Involved in Your Care or Payment for Your Care. Unless you object, the Company may disclose your health information to a power of attorney (POA) or guardian involved in your care. The Company may also give information to an individual who pays for your care.
• As Required by Law. The Company will disclose your health information when required to do so by local, state, or federal law.
• To Avert a Serious Threat to Health or Safety. The Company may use and disclose your health information to prevent a serious threat to your health and safety or the health and safety of the public or another person, but only to the extent necessary to avert such a threat.
• Research. The Company may use and disclose your health information for research purposes. All research projects are subject to an approval process that includes an evaluation of the proposed project and its use of PHI. The Company may disclose your health information to people preparing to conduct a research project so long as the health information reviewed does not leave the Company.
• Workers’ Compensation. The Company may disclose your health information for workers’ compensation or similar programs that provide benefits for work-related injury or illness.
• Reporting. Federal and state laws may require or permit the Company to disclose certain health information relating to the following:
  • Public Health Risks. The Company may disclose health information about you for public health purposes, including:
    • Prevention or control of disease, injury, or disability;
    • Reporting births and deaths;
    • Reporting child abuse or neglect;
    • Reporting reactions to medications;
    • Notifying a person who may have been exposed to a disease or may be at risk of contracting or spreading a disease; and
    • Notifying the appropriate government authority if the Company believes you are a victim of abuse, neglect, or domestic violence. We will only make this disclosure if you consent or if we are authorized by law to do so.
  • Health Oversight Activities. The Company may disclose your health information to a health oversight agency for activities authorized by law. These oversight activities may include audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
• Law Enforcement. The Company may disclose health information when requested by a law enforcement official:
  • In response to a court order, subpoena, warrant, summons, or similar process;
  • To identify or locate a suspect, fugitive, material witness, or missing person;
  • About you if you are the victim of a crime, and if, under certain limited circumstances, the Company is unable to obtain your agreement;
  • About a death the Company believes may be the result of criminal conduct;
  • About criminal conduct at the Company;
  • In emergency circumstances to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime.
• Coroners, Medical Examiners, and Funeral Directors. The Company may disclose your health information to a coroner or medical examiner. This may be necessary to identify a deceased person or determine the cause of death. The Company may also disclose medical information to funeral directors as necessary to carry out their duties.
• National Security and Intelligence Activities. The Company may disclose your health information to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

OTHER USES OF HEALTH INFORMATION

Other uses and disclosures of your health information not covered by this notice, or the applicable laws, will be made only with your prior and express written consent. If you provide the Company with consent to use or disclose health information about you, you may revoke that consent, in writing, at any time. If you revoke your consent, the Company will no longer use or disclose health information about you for the reasons covered by your written authorization. You understand that the Company is unable to revoke any disclosures already made, and that the Company is required to retain the records of the care provided to you.

YOUR HEALTH INFORMATION RIGHTS

You have the following rights regarding your health information:

1. The Right to Request Limits on Uses and Disclosures of Your PHI. You may request a restriction or limitation on the health information the Company uses or discloses about you. By way of example, you could ask that the Company not disclose information about your session to another provider who is helping with your care. However, the Company is not required to agree to your request. All requests must include (1) what information you want to limit; (2) whether you want to limit use, disclosure, or both; and (3) to whom the limitations apply.
2. The Right to Inspect and Obtain Copies of Your PHI. With some exceptions, you may review and request a copy of your health information. You must submit a written request to Christine McDevitt. The Company may charge a fee for the costs associated with your request.
3. The Right to Request Confidential Communications. You have the right to request that you receive your health information in a specific way or at a specific location. For example, you may ask that the Company send information to a particular email account or to your work address. The Company will comply with all reasonable requests submitted in writing which specify how or where you wish to receive these communications.
4. The Right to Amend Your PHI. You have the right to request that the Company amends your health information if you believe it is incorrect or incomplete. Your request and the reason for it must be made in writing. The Company is not required to change your health information and will provide you with written information about the denial if this occurs. The Company may deny your request if it does not have the information, if it did not create the information, or if the information is accurate and complete as is. If the Company denies your request, you may submit a written statement of your disagreement. If you do not file a written objection, you still have the right to ask that your request and the denial be attached to any future disclosures of your PHI.
5. The Right to An Accounting of Disclosures. You have the right to ask for a list of times the Company has shared your health information with others. This does not include times when the Company has shared information for your treatment, for billing purposes, or for running healthcare operations. If you want a list of disclosures, please write to Christine McDevitt. You may request a physical or digital copy of this list. The first list you request within a year is free. If you ask for more lists within the same year, the Company may charge you for the cost of generating them.
6. The Right to a Paper or Electronic Copy of This Notice. You have the right to receive a copy of this notice either on paper or via email.

If you believe the Company has violated your privacy rights or has mishandled your health information, please discuss it with your practitioner. You may submit that complaint in writing via email at info@farfallaintegrativehealth.com.

If you are not satisfied with how the Company handles your complaint, you may submit a formal complaint to the Office for Civil Rights (OCR) in the Department of Health and Human Services at https://www.hhs.gov/hipaa/filing-a-complaint/index.html. The Company will not penalize you in any way if you choose to file a complaint.

AMENDMENTS TO THIS NOTICE

The Company reserves the right to amend this notice at any time. Any amendments made will be effective for health information the Company already maintains about you as well as all health information received in the future.

Christine McDevitt, MS, OTR/L

Farfalla Integrative Health LLC

info@farfallaintegrativehealth.com