Notice of Privacy Practices

1. How This Notice Applies

CNY Neurological Consulting, PLLC ("CNY Neurological," "the Practice," "we," "us," or "our") is required by law to maintain the privacy and security of your protected health information (PHI). We are required to provide you with this Notice of Privacy Practices, which describes how we may use and disclose your PHI and your rights with respect to that information.

"Protected health information" means individually identifiable health information that we create, receive, maintain, or transmit in connection with providing healthcare services to you, including information about your past, present, or future physical or mental health condition, the provision of healthcare to you, or payment for that care.

We are required to follow the terms of this Notice currently in effect. We reserve the right to change the terms of this Notice and to make the new Notice effective for all PHI we maintain. If we make a material change to this Notice, we will post the revised Notice in our office and on our website.

2. How We May Use and Disclose Your Health Information

The following categories describe the ways we may use and disclose your PHI without your written authorization. Not every use or disclosure in a category will be listed, but all permitted uses and disclosures will fall within one of these categories.

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and any related services. For example, we may share your information with other healthcare providers involved in your care, such as specialists, hospitals, laboratories, or pharmacies.

Payment

We may use and disclose your PHI to obtain payment for services we provide to you. For example, we may submit claims to your health insurance carrier and include information about your diagnosis and treatment to obtain reimbursement.

Healthcare Operations

We may use and disclose your PHI for our healthcare operations, including quality assessment and improvement activities, provider performance evaluation, training programs, accreditation, licensing, credentialing, and other business management activities necessary to operate the Practice.

Business Associates

We may share your PHI with business associates — companies or individuals that perform services on our behalf — under written agreements that require them to protect the privacy and security of your information in accordance with HIPAA.

Public Health and Safety Activities

We may disclose your PHI to public health authorities for activities such as disease reporting, vital statistics, and public health surveillance, as permitted or required by law.

Reporting Abuse, Neglect, or Domestic Violence

We may disclose your PHI to appropriate government authorities when we are legally authorized or required to report suspected abuse, neglect, or domestic violence.

Health Oversight Activities

We may disclose your PHI to health oversight agencies for activities authorized by law, such as audits, investigations, inspections, and licensure activities.

Judicial and Administrative Proceedings

We may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process, subject to applicable legal requirements.

Law Enforcement

We may disclose your PHI to law enforcement officials for purposes permitted by law, such as identifying or locating a suspect, reporting a crime, or complying with a court order or warrant.

Serious Threats to Health or Safety

We may use or disclose your PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, consistent with applicable law and ethical standards.

Workers' Compensation

We may disclose your PHI as authorized by and to the extent necessary to comply with workers' compensation laws and other similar programs.

Research

We may use or disclose your PHI for research purposes when the research has been approved by an institutional review board or privacy board that has reviewed the research proposal and established protocols to protect the privacy of your information, or when other conditions required by HIPAA are satisfied.

Medical Examiners, Coroners, and Funeral Directors

We may disclose PHI to medical examiners, coroners, and funeral directors as permitted by law and as necessary to carry out their duties.

Organ and Tissue Donation

If you are an organ donor, we may disclose your PHI to organizations involved in organ procurement, transplantation, or tissue banking as permitted by applicable law.

3. Other Uses and Disclosures

Other uses and disclosures of your PHI not described in this Notice will be made only with your written authorization, except as otherwise required or permitted by law.

You may revoke an authorization you have given us at any time by submitting a written revocation to the Practice. Your revocation will be effective for future uses and disclosures, but will not affect uses or disclosures already made in reliance on your prior authorization.

4. Uses and Disclosures Requiring Your Written Authorization

The following uses and disclosures generally require your written authorization before we may proceed:

• Most uses and disclosures of psychotherapy notes
• Uses and disclosures of your PHI for marketing purposes
• Sale of your PHI
• Other uses and disclosures not described in this Notice or otherwise permitted by law

CNY Neurological Consulting does not engage in marketing uses of PHI or sell protected health information.

Reproductive Health Privacy

Federal and New York law provide certain protections for reproductive health information. [PRACTICE TO CONFIRM — ATTORNEY REVIEW REQUIRED] Because federal regulations and judicial decisions in this area have changed recently, this section must be reviewed by qualified New York healthcare counsel immediately before publication to ensure it accurately reflects currently enforceable requirements.

5. Specially Protected Categories of Information

Certain categories of health information are subject to stricter federal or New York State protections beyond standard HIPAA requirements. When the Practice possesses information in these categories, additional legal requirements may apply to its use and disclosure:

• Substance Use Disorder Records: Records relating to substance use disorder treatment programs may be subject to additional federal protections under 42 C.F.R. Part 2.
• Psychotherapy Notes: Notes recorded by a mental health professional in individual, group, joint, or family counseling sessions are subject to heightened protections under HIPAA.
• HIV-Related Information: New York Public Health Law Article 27-F provides specific protections for HIV-related information.
• Genetic Information: Genetic information is subject to protections under HIPAA and the Genetic Information Nondiscrimination Act (GINA).
• Mental Health Records: New York Mental Hygiene Law provides additional protections for certain mental health records.

Not all of these categories are necessarily maintained by this neurology practice. Where the Practice does possess such information, it will comply with the applicable heightened protections.

6. Your Rights Regarding Your Health Information

You have the following rights with respect to your PHI. To exercise any of these rights, please contact our Privacy Officer using the information in Section 9.

Right to Inspect and Obtain Copies

You have the right to inspect and obtain a copy of your medical and billing records that we maintain, with limited exceptions. You may request records in paper or electronic format. We may charge a reasonable, cost-based fee for copies as permitted by HIPAA and applicable New York law. We will respond to your request within the timeframe required by law.

Right to Request Corrections or Amendments

You have the right to request that we amend your PHI if you believe it is inaccurate or incomplete. We may deny your request under certain circumstances permitted by law. If we deny your request, we will explain the reason in writing.

Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures we have made of your PHI. This right does not apply to disclosures made for treatment, payment, or healthcare operations, or to certain other disclosures.

Right to Request Restrictions

You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree to most requested restrictions, but if we do agree, we are bound by that agreement except in certain emergency situations. However, we are required to agree to a restriction on disclosing your PHI to a health plan for payment or healthcare operations purposes when the disclosure relates to a healthcare item or service for which you have paid out of pocket in full.

Right to Request Confidential Communications

You have the right to request that we communicate with you about your health information in a certain way or at a certain location. For example, you may ask that we contact you only at a specific telephone number or address. We will accommodate reasonable requests.

Right to a Paper or Electronic Copy of This Notice

You have the right to receive a paper copy of this Notice at any time, even if you have agreed to receive it electronically. You may request a copy from our office or print this page.

Right to Choose a Personal Representative

You may designate a personal representative — such as a family member, legal guardian, or healthcare proxy — to act on your behalf with respect to your PHI, subject to applicable law and the Practice's verification procedures.

Right to Revoke an Authorization

You may revoke a written authorization you have given us at any time by submitting a written revocation to the Practice. Your revocation will not affect uses or disclosures already made in reliance on your prior authorization.

Right to File a Complaint Without Retaliation

You have the right to file a complaint with us or with the U.S. Department of Health and Human Services if you believe your privacy rights have been violated. We will not retaliate against you for filing a complaint. See Section 8 for complaint instructions.

7. Our Duties

CNY Neurological Consulting, PLLC is required by law to:

• Maintain the privacy and security of your protected health information
• Provide you with this Notice of Privacy Practices
• Follow the terms of the Notice currently in effect
• Notify you following a breach of your unsecured PHI as required by applicable law
• Limit uses and disclosures of your PHI to those permitted or required by law
• Obtain your written authorization for uses and disclosures that require it
• Not retaliate against you for exercising your privacy rights or filing a complaint

8. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with CNY Neurological Consulting or with the U.S. Department of Health and Human Services Office for Civil Rights. You will not be penalized or retaliated against for filing a complaint.

To File a Complaint with the Practice

Contact our Privacy Officer using the information in Section 9 below. You may submit your complaint in writing or by telephone.

To File a Complaint with the U.S. Department of Health and Human Services

9. Contact the Privacy Officer

For questions about this Notice, to exercise your rights, or to file a complaint with the Practice, please contact: