Notice of Privacy Practices

Protected Health Information

Protected health information ("PHI") is information about you, including demographic information, that identifies you or could reasonably be used to identify you, and that relates to your past, present, or future physical or mental health condition, the provision of health care to you, or payment for health care services. This Notice also describes your rights regarding your PHI.

Uses and Disclosures of Protected Health Information

Your PHI may be used and disclosed by our health care providers, workforce members, and certain third parties involved in your care for the purpose of providing health care services to you, obtaining payment, supporting health care operations, and for other purposes permitted or required by law.

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your health care and related services, including care coordination with third parties. For example, we may share PHI with a health care provider to whom you have been referred to ensure appropriate diagnosis or treatment.

Payment

We may use and disclose your PHI to bill for services and to obtain payment from health plans or other payers. This may include eligibility determinations, coverage verification, prior authorization, and review of services for medical necessity.

Health Care Operations

We may use or disclose PHI to support our health care operations, including but not limited to quality assessment and improvement, care coordination, training, credentialing, legal and compliance activities, audits, fraud and abuse detection, and information technology support such as artificial intelligence.

Uses and Disclosures Without Authorization

We may use or disclose your PHI without your authorization as permitted or required by law, including for:

• Public health activities
• Health oversight activities
• Abuse, neglect, or domestic violence reporting
• FDA-related purposes
• Judicial or administrative proceedings
• Law enforcement purposes
• Coroners, medical examiners, funeral directors, and organ donation organizations
• Certain research activities
• National security or military activities
• Workers' compensation
• Correctional institutions or inmates

We are also required to disclose PHI to you upon request and to the Secretary of the U.S. Department of Health and Human Services when necessary to determine HIPAA compliance. State law may impose additional restrictions.

Uses and Disclosures Requiring Authorization

Any other uses and disclosures of your PHI will be made only with your written authorization, unless otherwise permitted or required by law.

We will not use or disclose your PHI for marketing purposes or sell your PHI without your authorization. Your PHI will not be used for fundraising purposes.

You may revoke an authorization at any time in writing, except to the extent that action has already been taken in reliance on the authorization.

Highly Confidential Information

Certain PHI is subject to enhanced protections under federal and state law ("Highly Confidential Information"). Disclosure of Highly Confidential Information for purposes not otherwise permitted by law generally requires your specific written authorization.

Your Rights

You have the right to:

• Inspect and obtain a copy of your PHI
• Request amendments to your PHI
• Request restrictions on certain uses or disclosures (including required restrictions for services paid in full out-of-pocket)
• Request confidential communications
• Receive an accounting of disclosures (subject to HIPAA exceptions)
• Obtain a paper copy of this Notice at any time

Revisions to This Notice

We reserve the right to revise this Notice and make the revised Notice effective for PHI we maintain now or in the future. Material changes will be posted at www.goodhealthim.com.

Breach Notification

We will notify you without unreasonable delay, and no later than 60 days after discovery, if a reportable breach of your unsecured PHI occurs, consistent with applicable law.

Health Information Exchange

We may participate in a Health Information Exchange ("HIE") and may share PHI through the HIE as permitted by law to improve care coordination and public health outcomes.

Complaints

You may file a complaint with our HIPAA Privacy Officer or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.

Our Duties and Contact Information

We are required by law to maintain the privacy of your PHI, provide you with this Notice, and comply with its terms. Contact us below with questions or concerns: