HIPAA Notice of Privacy Practices

01

Our Legal Duty

Cellara Pain Institute (“Cellara,” “we,” “us,” or “our”) is required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and applicable Pennsylvania laws to maintain the privacy and security of your Protected Health Information (PHI).

PHI is information about you, including demographic data, that can reasonably be used to identify you and that relates to your past, present, or future physical or mental health or condition, the provision of health care to you, or the payment for that care.

We are required to:

• Provide you with this Notice of our legal duties and privacy practices with respect to your PHI.
• Abide by the terms of the Notice currently in effect.
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your unsecured PHI.

Note regarding Substance Use Disorder Records: Cellara Pain Institute is not a federally assisted Substance Use Disorder (SUD) treatment program under 42 CFR Part 2.

02

How We May Use and Disclose Your PHI

We may use and disclose your PHI for the following purposes without your written authorization:

For Treatment: We may use your PHI to provide, coordinate, or manage your health care and any related services. For example, our physicians and clinical staff will use your medical history, imaging, and prior treatment records to develop your pain management plan and perform interventional procedures. We may also disclose your PHI to other healthcare providers who are treating you or whom we consult regarding your care.

For Payment: We may use and disclose your PHI to bill and collect payment for the treatment and services you receive. For example, we may share information with your commercial PPO insurance plan to determine out-of-network benefits, obtain prior authorization, or process claims. Cash-based services (such as peptide and regenerative therapies) do not involve insurance billing.

For Health Care Operations: We may use and disclose your PHI for our clinic operations. These uses are necessary to run Cellara Pain Institute and ensure you receive quality care. For example, we may use your PHI to evaluate the performance of our staff, conduct quality assurance activities, or for business planning and management. We may also use PHI to contact you with appointment reminders or follow-up communications.

Business Associates: We may share your PHI with third-party “business associates” that perform various activities (e.g., electronic health record management, billing, scheduling) for us. We require our business associates to appropriately safeguard your PHI through written Business Associate Agreements (BAAs).

Individuals Involved in Your Care: Unless you object, we may disclose your PHI to a family member, relative, close friend, or any other person you identify, if the information is directly relevant to their involvement in your care or payment for your care.

As Required by Law: We will disclose your PHI when required to do so by federal, state, or local law, including applicable Pennsylvania statutes governing medical records and patient privacy.

Public Health Activities: We may disclose your PHI for public health activities, such as reporting adverse reactions to medications or products, or preventing or controlling disease, injury, or disability.

Health Oversight Activities: We may disclose PHI to a health oversight agency for audits, investigations, inspections, and licensure activities necessary for the government to monitor the health care system and compliance with civil rights laws.

Law Enforcement and Legal Proceedings: We may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process. We may also disclose PHI to law enforcement officials under certain circumstances, such as to identify or locate a suspect, fugitive, or missing person.

To Avert a Serious Threat to Health or Safety: We may use and disclose your PHI when necessary to prevent a serious and imminent threat to your health and safety or the health and safety of the public or another person.

03

Uses and Disclosures Requiring Your Written Authorization

Other uses and disclosures of your PHI not covered by this Notice or applicable laws will be made only with your written authorization. Specifically, we must obtain your written authorization for:

• Marketing: Most uses and disclosures of PHI for marketing purposes.
• Sale of PHI: Disclosures that constitute a sale of your PHI.
• Psychotherapy Notes: Most uses and disclosures of psychotherapy notes (if applicable).

If you provide us with written authorization, you may revoke it at any time, in writing, except to the extent that we have already taken action in reliance on your authorization.

04

Your Privacy Rights

You have the following rights regarding the PHI we maintain about you:

Right to Inspect and Copy: You have the right to inspect and obtain a copy of your PHI that is used to make decisions about your care, including medical and billing records. You must submit your request in writing. We may charge a reasonable, cost-based fee for the costs of copying, mailing, or other supplies associated with your request.

Right to Request an Amendment: If you believe that the PHI we have about you is incorrect or incomplete, you may ask us to amend the information. You must submit your request in writing and provide a reason that supports your request. We may deny your request under certain circumstances, such as if we determine the information is accurate and complete.

Right to an Accounting of Disclosures: You have the right to request an “accounting of disclosures.” This is a list of the disclosures we made of your PHI, excluding disclosures made for treatment, payment, health care operations, disclosures made to you, disclosures authorized by you, and certain other exceptions. Your request must be in writing and state a time period, which may not be longer than six years.

Right to Request Restrictions: You have the right to request a restriction or limitation on the PHI we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a limit on the PHI we disclose to someone involved in your care. We are not required to agree to your request, except that we must agree to a request to restrict disclosure of PHI to a health plan for payment or health care operations purposes if the PHI pertains solely to a health care item or service for which you, or someone on your behalf, have paid us in full out-of-pocket.

Right to Request Confidential Communications: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. We will accommodate all reasonable requests. Your request must be in writing and specify how or where you wish to be contacted.

Right to a Paper Copy of This Notice: You have the right to a paper copy of this Notice at any time, even if you have agreed to receive this Notice electronically. To request a paper copy, please contact our office.

05

Changes to This Notice

We reserve the right to change this Notice. We reserve the right to make the revised or changed Notice effective for PHI we already have about you as well as any information we receive in the future. We will post a copy of the current Notice on our website (https://cellarapain.com) and in our clinic. The Notice will contain the effective date.

06

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services.

To file a complaint with us, please contact our HIPAA Privacy Officer using the information below. All complaints must be submitted in writing.

To file a complaint with the U.S. Department of Health and Human Services, visit www.hhs.gov/ocr/privacy/hipaa/complaints.

You will not be penalized or retaliated against for filing a complaint.

07

Contact Information

If you have any questions about this Notice, require further information, or wish to exercise your rights, please contact our HIPAA Privacy Officer, Mohamed Osman, MD.