Notice of Privacy Practices

• We are required by law to maintain the privacy and security of your PHI.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described here unless you tell us we can in writing. You may change your mind at any time by letting us know in writing.

When it comes to your health information, you have certain rights. To exercise any of them, email support@optimalstatehealth.com.

• Get a copy of your medical record. You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. We will usually provide it within 30 days of your request and may charge a reasonable, cost-based fee.
• Ask us to correct your record. You can ask us to correct health information you think is incorrect or incomplete. We may say no, but we will tell you why in writing within 60 days.
• Request confidential communications. You can ask us to contact you in a specific way (for example, a certain phone number or email) or at a different address. We will say yes to all reasonable requests.
• Ask us to limit what we use or share. You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree if it would affect your care. If you pay for a service or item out of pocket in full, you can ask us not to share that information with your health insurer, and we will say yes unless a law requires us to share it.
• Get a list of those we have shared with. You can ask for a list (accounting) of the times we have shared your health information for six years before the date you ask, who we shared it with, and why. This excludes disclosures for treatment, payment, and operations, and certain others. We provide one accounting a year for free.
• Get a copy of this notice. You can ask for a paper copy of this notice at any time, even if you agreed to receive it electronically.
• Choose someone to act for you. If you have given someone medical power of attorney, or someone is your legal guardian, that person can exercise your rights and make choices about your health information.
• File a complaint. See the Complaints section below.

For certain health information, you can tell us your choices about what we share. You have both the right and the choice to tell us to:

• Share information with your family, close friends, or others involved in your care
• Share information in a disaster relief situation

If you are not able to tell us your preference, for example if you are unconscious, we may share your information if we believe it is in your best interest, or when needed to lessen a serious and imminent threat to health or safety.

We never share your information for marketing or sell your information unless you give us written permission.

We typically use or share your health information to:

• Treat you. For example, Dr. Ibrahim uses your history and lab results to create your plan, and we send prescriptions to your pharmacy or a compounding pharmacy and order labs from a laboratory.
• Bill for your services. For example, we use your information to process membership and treatment payments, or to provide documentation you request for insurance or HSA/FSA reimbursement.
• Run our practice. For example, to manage scheduling, improve the quality of care, and send appointment reminders, lab follow-ups, and other care-related messages by email, text, or through the patient portal.

We work with service providers, called business associates, that help us run the practice, such as our electronic health record and patient portal provider (CharmHealth), payment processor, labs, and pharmacies. They are required by contract and by law to protect your information.

We are allowed or required to share your information in other ways, usually in ways that contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can share it for these purposes:

• Public health and safety, such as reporting adverse reactions to medications or preventing disease
• Preventing or reducing a serious threat to anyone’s health or safety
• Reporting suspected abuse, neglect, or domestic violence
• Health oversight activities, such as audits and inspections by the Medical Board of California
• Complying with the law, including if the Department of Health and Human Services wants to confirm we comply with federal privacy law
• Responding to lawsuits, legal actions, court orders, or subpoenas
• Law enforcement purposes, with a law enforcement official, when permitted by law
• Working with a medical examiner or coroner
• Workers’ compensation claims
• Special government functions, such as military, national security, and presidential protective services
• Research, when approved under privacy safeguards required by law

We will not do the following without your written permission:

• Use or share your information for marketing purposes
• Sell your information
• Share psychotherapy notes, in most cases
• Any other use or disclosure not described in this notice

You can revoke your permission in writing at any time, except where we have already acted on it.

As a California practice, we also follow the California Confidentiality of Medical Information Act (CMIA) and other state laws. Where California law gives you more protection than federal law, we follow the more protective rule. This includes added protections for information about sensitive services, such as mental health, substance use, HIV status, and reproductive or sexual health.

If you believe your privacy rights have been violated, you can contact our Privacy Officer using the information below.

You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by writing to 200 Independence Avenue S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting hhs.gov/ocr/complaints.

We will not retaliate against you for filing a complaint.

We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available on request, in the patient portal, and on this page.