Notice of Privacy Practices

1. Who We Are

Aevum Integrated Health is a multi-specialty healthcare practice located in Farmville, Virginia, providing primary care, urgent care, and psychiatric services to patients in person and through virtual/telehealth visits. This Notice of Privacy Practices ("Notice") applies to all services provided by Aevum Integrated Health and all of our workforce members, including physicians, nurse practitioners, psychiatrists, therapists, staff, and volunteers.

2. Our Legal Duty

We are required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act, to:

• Maintain the privacy and security of your protected health information (PHI);
• Provide you with this Notice of our legal duties and privacy practices;
• Notify you following a breach of your unsecured protected health information;
• Follow the terms of this Notice currently in effect.

We reserve the right to change the terms of this Notice and make the new provisions effective for all PHI we maintain. If we revise this Notice, we will post the updated version on our website and make it available at our office.

3. What Is Protected Health Information?

Protected Health Information (PHI) includes any information that identifies you and relates to your past, present, or future physical or mental health condition, the healthcare we provide to you, or payment for that healthcare. This includes information in electronic, written, or oral form, such as your name, address, date of birth, medical records, diagnoses, treatment notes, psychiatric evaluations, prescription information, insurance information, and billing records.

4. How We May Use and Disclose Your Health Information

The following describes the ways we may use and disclose your PHI. Not every use or disclosure in a category will be listed; however, all permitted uses and disclosures will fall within one of the following categories.

A. Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services. For example, we may share your medical history with a specialist to whom we refer you, coordinate your primary care with your psychiatric care within our practice, or share relevant information with pharmacies to fill your prescriptions. For telehealth visits, we may use and disclose information through secure electronic communications platforms.

B. Payment

We may use and disclose your PHI to obtain payment for services rendered. This includes billing your health insurance, submitting claims to Medicare or Medicaid, verifying insurance coverage, and collecting amounts owed. For example, we may need to share information about your diagnosis and services received with your insurer in order to receive payment.

C. Healthcare Operations

We may use and disclose your PHI for our healthcare operations, which include activities such as:

• Quality assessment and improvement activities;
• Training and supervision of medical, nursing, and mental health students and residents;
• Accreditation, certification, licensing, and credentialing activities;
• Compliance and legal reviews;
• Business planning and management.

D. Appointment Reminders and Treatment Alternatives

We may contact you to remind you of your appointment by phone, text, email, or portal message, or to inform you of treatment options or other health-related benefits and services that may be of interest to you.

E. Required by Law

We will disclose your PHI when required by federal, state, or local law, including court orders, subpoenas, or other legal processes.

F. Public Health Activities

We may disclose your PHI to public health authorities for activities authorized by law, including reporting communicable diseases, adverse drug events, vital statistics, and child or adult abuse or neglect to appropriate government agencies.

G. Health Oversight Activities

We may disclose your PHI to government agencies conducting health oversight activities, such as audits, investigations, inspections, and licensing functions for oversight of the healthcare system.

H. Serious Threats to Health or Safety

We may use or disclose your PHI to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, including disclosure to law enforcement.

I. Psychiatric and Mental Health Services

We provide psychiatric services and are subject to additional protections for mental health information under Virginia law. Psychotherapy notes, which are notes recorded by a mental health professional during private counseling sessions, are subject to heightened protections and generally require your specific written authorization for most uses and disclosures beyond treatment, payment, and operations.

J. Other Disclosures

Other permitted disclosures include workers' compensation, law enforcement purposes, correctional institutions, research subject to specific safeguards, military and veterans activities, national security, organ and tissue donation, and coroners or medical examiners.

5. Uses and Disclosures That Require Your Authorization

The following uses and disclosures of your PHI require your specific written authorization before we may proceed:

• Most uses and disclosures of psychotherapy notes;
• Uses and disclosures for marketing purposes;
• Sales of your PHI;
• Any other use or disclosure not described in this Notice.

You may revoke your authorization in writing at any time, except to the extent we have already relied on it. To revoke an authorization, please submit a written request to our Privacy Officer.

6. Your Rights Regarding Your Health Information

You have the following rights with respect to your PHI. To exercise these rights, please submit your request in writing to our Privacy Officer using the contact information at the end of this Notice.

A. Right to Access and Copy

You have the right to inspect and obtain a copy of your PHI that we maintain in a designated record set, including your medical record and billing records. We may charge a reasonable cost-based fee. Under Virginia law and HIPAA, we will provide access within 30 days of your request, or 60 days if the records are maintained offsite. We may deny access in limited circumstances.

B. Right to Request Amendments

You have the right to request that we amend PHI in your designated record set if you believe it is inaccurate or incomplete. We may deny your request in certain circumstances, and you have the right to submit a statement of disagreement if your request is denied.

C. Right to an Accounting of Disclosures

You have the right to receive a list of certain disclosures we have made of your PHI during the past six years. This right does not apply to disclosures made for treatment, payment, or healthcare operations, or to disclosures made to you.

D. Right to Request Restrictions

You have the right to request that we restrict certain uses or disclosures of your PHI for treatment, payment, or healthcare operations, or to certain individuals involved in your care. We are not required to agree to your request unless it relates to a disclosure to a health plan for a service you paid for out-of-pocket in full.

E. Right to Request Confidential Communications

You have the right to request that we communicate with you about your PHI in a certain way or at a certain location. For example, you may ask us to contact you only by mail or only at a specific address or phone number.

F. Right to Notice

You have the right to receive a paper copy of this Notice upon request, even if you have agreed to receive it electronically.

G. Right to Notification of Breach

You have the right to be notified in the event of a breach of your unsecured PHI. We will notify you without unreasonable delay and in no case later than 60 days following discovery of the breach.

7. Telehealth and Virtual Care

Aevum Integrated Health provides telehealth and virtual care services. For virtual visits, we use HIPAA-compliant platforms designed to protect the privacy and security of your PHI during electronic transmission. You have the same privacy rights for telehealth services as for in-person services. We will never record virtual visits without your consent.

8. Electronic Health Records and Health Information Exchanges

We may maintain your PHI in electronic form and may participate in health information exchanges (HIEs) as permitted by law. Participation in an HIE allows your treating providers to access your records for treatment purposes. You may have rights to opt out of certain HIE sharing; please contact our Privacy Officer for more information.

9. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR). We will not retaliate against you for filing a complaint.

To file a complaint with Aevum Integrated Health, contact our Privacy Officer at the information below.

To file a complaint with HHS/OCR:

• Website: www.hhs.gov/ocr/privacy/hipaa/complaints (opens in a new tab)
• Phone: 1-800-368-1019 (TDD: 1-800-537-7697)
• Mail: Centralized Case Management Operations, 200 Independence Ave., S.W., Room 509F, HHH Bldg., Washington, D.C. 20201

10. Contact Information and Privacy Officer

For privacy-related questions, requests, or complaints, please contact us through our website or by requesting the contact information from our front desk staff.