Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

A plain-language summary

Your health information is personal, and we take its privacy seriously. In general, WellifyCare Medical S.C. may use and share your information to care for you, bill for your care, operate the practice, and comply with the law. Other uses and disclosures generally require your written authorization.

This summary does not replace the complete notice below.

1. Who This Notice Covers

This notice applies to WellifyCare Medical S.C., its clinicians, employees, trainees, volunteers, and other members of its workforce. It applies to protected health information ("PHI") that we create or receive about you in any form, including electronic, written, and verbal information.

This notice also applies to WellifyCare Guided Care when the service is provided by or on behalf of WellifyCare Medical S.C. as part of your clinical care and the information is maintained in your clinical record.

This notice does not apply to information collected solely by WellifyCare LLC, a legally separate organization, through nonclinical educational, community, marketing, or public programs unless that information is received or maintained by WellifyCare Medical S.C. as PHI. Please review the separate website Privacy Policy for information about nonclinical website and marketing data.

2. Your Rights

You have the following rights regarding your health information. To exercise a right, contact our Privacy Officer using the information in Section 9. We may ask you to submit a written request and verify your identity.

2.1 Get an Electronic or Paper Copy of Your Record

You may inspect or obtain an electronic or paper copy of the medical and billing records we maintain about you. We generally will act on your request within 30 days. If additional time is permitted by law and needed, we will tell you in writing why and when you can expect a response.

You may ask us to send a copy to another person or organization, subject to applicable legal requirements. We may charge a reasonable, cost-based fee permitted by federal and Wisconsin law. We may deny access only in limited circumstances allowed by law; when applicable, you may request a review of the denial.

2.2 Ask Us to Correct Your Record

If you believe information in your record is incorrect or incomplete, you may request an amendment. We generally will respond within 60 days. If we deny your request, we will explain why in writing, and you may submit a written statement of disagreement for inclusion in your record.

2.3 Request Confidential Communications

You may ask us to contact you in a particular way or at a particular address, phone number, or email address. We will accommodate reasonable requests.

2.4 Request Restrictions

You may ask us not to use or share certain information for treatment, payment, health care operations, or with a person involved in your care. We are not required to agree to most requests, but we will consider them and tell you our decision.

If you pay in full out of pocket for a specific health care item or service and ask us not to disclose information about that item or service to your health plan for payment or health care operations, we must honor your request unless disclosure is required by law.

2.5 Receive an Accounting of Disclosures

You may request a list of certain disclosures we made during the six years before your request. The list will not include disclosures for treatment, payment, health care operations, disclosures you authorized, and certain other disclosures excluded by law.

We will provide one accounting in any 12-month period at no charge. We may charge a reasonable, cost-based fee for an additional request during the same period after telling you the cost and giving you an opportunity to withdraw or modify the request.

2.6 Get a Copy of This Notice

You may request a paper copy of this notice at any time, even if you agreed to receive it electronically.

2.7 Choose Someone to Act for You

If someone is legally authorized to act for you, such as a health care agent, legal guardian, or other personal representative, that person may exercise your privacy rights. We will verify the person's authority before acting.

2.8 Be Notified of a Breach

We will notify you as required by law if a breach occurs that may have compromised the privacy or security of your unsecured PHI.

3. Your Choices

In certain situations, you may tell us your preferences about how we share information. Tell us what you want us to do, and we will follow your instructions when required by law.

3.1 Family, Friends, and Others Involved in Your Care

You may permit or object to sharing information relevant to your care or payment with a family member, friend, caregiver, or another person involved in your care.

If you are unable to state your preference, such as during an emergency or when you are unconscious, we may share limited information if we determine, using professional judgment, that doing so is in your best interest and is permitted by law.

3.2 Disaster Relief

We may share limited information with an authorized disaster-relief organization to help notify family or others responsible for your care about your location, condition, or death, as permitted by law.

3.3 Fundraising and Facility Directories

WellifyCare Medical S.C. does not currently use PHI for fundraising and does not maintain a facility directory. If our practices change, we will update this notice and provide any choices required by law. You may opt out of fundraising communications at any time.

4. How We May Use and Share Your Health Information Without Your Written Authorization

4.1 Treat You

We may use and share your information to provide, coordinate, and manage your care. For example, we may review your laboratory results, send a prescription to your pharmacy, obtain or share records with another treating clinician, or send an order to a laboratory or imaging facility.

4.2 Bill for Services

We may use and share your information to verify benefits, obtain prior authorization, submit claims, collect payment, and bill you for amounts you owe.

4.3 Run Our Practice

We may use and share your information for health care operations, including quality improvement, patient safety, clinician training and supervision, credentialing, compliance, auditing, care coordination, population-health activities, business planning, and legal or accounting services.

4.4 Work With Business Associates

We may share information with vendors that perform services for us, such as our electronic health record, patient portal, telehealth, billing, laboratory, secure communication, data-storage, and technology vendors. When a vendor is our business associate, we require it by contract to safeguard PHI and use it only as permitted by law and our agreement.

4.5 Contact You About Care

We may contact you about appointments, follow-up, prescriptions, test results, treatment alternatives, and health-related benefits or services that may be relevant to your care.

4.6 Comply With the Law and Support Public Interests

We may use or share information when federal or Wisconsin law requires or permits it, including for:

• public-health activities, such as disease reporting, product recalls, and reporting adverse reactions;

• reporting suspected abuse, neglect, or domestic violence as required or permitted by law;

• health-oversight activities, such as audits, inspections, licensure matters, and government program oversight;

• workers' compensation and similar programs;

• organ and tissue donation;

• coroners, medical examiners, and funeral directors;

• law-enforcement purposes in the limited circumstances permitted by law;

• judicial or administrative proceedings in response to a court or administrative order, subpoena, discovery request, or other lawful process, subject to applicable safeguards;

• military, veterans, national-security, protective-service, and correctional-institution activities when authorized by law;

• preventing or reducing a serious and imminent threat to health or safety;

• research when authorized by you or otherwise permitted by law, including when approved or waived by an Institutional Review Board or Privacy Board; and

• prescription-monitoring and controlled-substance compliance, including reviewing the Wisconsin Enhanced Prescription Drug Monitoring Program when required or permitted by law.

  
  

We will limit a disclosure to what the applicable law permits or requires.

5. Uses and Disclosures That Generally Require Your Written Authorization

We generally will obtain your written authorization before:

• using or disclosing PHI for marketing when we receive payment from a third party;

• selling PHI;

• using or disclosing most psychotherapy notes, if any;

• using or disclosing substance use disorder counseling notes, if any, when separate consent is required; or

• using or disclosing PHI for another purpose not described in this notice and not otherwise permitted or required by law.

  
  

WellifyCare Medical S.C. does not sell your PHI.

You may revoke an authorization in writing at any time. Your revocation applies going forward and does not affect actions already taken in reliance on the authorization.

6. Information With Additional Protection

Some information may receive additional protection under federal or Wisconsin law, including certain mental-health and developmental-disability treatment records, substance use disorder treatment records, HIV test results, genetic test information, and other specially protected records. When another law provides greater privacy protection than HIPAA, we will follow the more protective law.

Substance Use Disorder Records Protected by 42 C.F.R. Part 2

To the extent that we create, receive, or maintain substance use disorder patient records protected by 42 C.F.R. Part 2, we will comply with Part 2. We will not use or disclose those records in civil, criminal, administrative, or legislative proceedings against you without your specific written consent or a court order and subpoena that meet applicable legal requirements.

We do not currently use PHI for fundraising. If that changes and Part 2 records would be used, we will provide clear notice and an opportunity to opt out as required by law.

7. Our Responsibilities

We are required by law to:

• maintain the privacy and security of your PHI;

• notify you as required by law if a breach may have compromised the privacy or security of your unsecured PHI;

• follow the duties and privacy practices described in the notice currently in effect; and

• give you a copy of this notice.

  
  

We will not use or share your information other than as described in this notice unless you authorize us in writing or the law permits or requires it. If you authorize us to use or share information, you may revoke that authorization in writing at any time, subject to the limitations described above.

8. Complaints

If you believe your privacy rights have been violated, you may file a complaint with WellifyCare Medical S.C. by contacting our Privacy Officer in Section 9.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:

U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue SW
Washington, DC 20201
Phone: 1-877-696-6775
Online: https://www.hhs.gov/hipaa/filing-a-complaint/

We will not retaliate against you for filing a complaint. Filing a complaint will not affect your care or your rights as a patient.

9. Contact Us

Privacy Officer
WellifyCare Medical S.C.
18200 W. Capitol Drive, Suite 200
Brookfield, WI 53045
Phone: (262) 261-8880
Email: info@wellifycare.com

10. Changes to This Notice

We may change this notice and make the revised terms effective for all PHI we maintain, including information created or received before the change. The current notice will be available in our office, upon request, and at:

https://wellifycare.com/notice-of-privacy-practices

The notice will display its effective date. You may request a copy at any time.

Acknowledgment of Receipt — For Practice Use

I acknowledge that I have been provided a copy of WellifyCare Medical S.C.'s Notice of Privacy Practices.

Patient name: ______________________________________________

Date of birth: ____________________

Patient or personal representative signature: ______________________________________________

Date: ____________________

If signed by a personal representative, print name and relationship:

Staff use only: If acknowledgment was not obtained, document the good-faith effort made, the reason it was not obtained, and the date.