SONA HEALTH, INC.
NOTICE OF PRIVACY PRACTICES

THIS NOTICE OF PRIVACY PRACTICES DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective October 21, 2021

If you have any questions about this Notice or our privacy practices, please contact Tasha Michaels, Director of Clinical Services, at 828-298-3636.

We understand information about you and your health is personal, and we are committed to protecting your medical information. This Notice of Privacy Practices (the “Notice”) will explain to you about the ways in which we may use and disclose your health information. The Notice also describes your rights and certain obligations we have regarding the use and disclosure of health information under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

We are required to maintain the privacy of health information that identifies you or that could be used to identify you. We are also required to provide you this Notice, to follow the terms of the Notice, and to provide you with your legal rights and our legal responsibilities regarding your health information.

HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION

The following categories describe the different ways that we may use and disclose your health information. For each category of uses or disclosures we will explain what we mean. Not every use or disclosure will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

For Treatment. We may use or disclose your health information to provide you with medical treatment or services. We may disclose medical information about you to providers, including doctors, nurses, technicians, medical students, or other personnel who are involved in taking care of you.

For Payment. We may use or disclose your health information to obtain payment for your health care services from an insurance company or third party. We may also disclose medical information to other healthcare providers for their payment purposes.

For Health Care Operations. We may use and disclose your health information as needed to support our healthcare operations. These uses and disclosures are necessary to run our company and provide quality care to our patients. For example, we may use your medical information in connection with evaluating our staff’s performance or assessing the quality of care we provide. We may combine health information about many patients to decide what additional services we should offer, what services are not needed, and whether certain new treatments are effective. Other activities for which we may disclose your medical information include but are not limited to audits; fraud and abuse detection; training programs; customer service initiatives; and other administrative functions.

To Business Associates. We may contract with individuals or entities known as Business Associates to perform various functions on our behalf or to provide certain types of services. In order to perform these functions or to provide these services, Business Associates may receive, create, maintain, transmit, use, and/or disclose your health information, but only after they agree in writing with us to implement appropriate safeguards regarding your health information.

As Required by Law. We will disclose your health information when required to do so by federal, state, or local law. For example, we may disclose your protected health information when required by national security laws or public health disclosure laws.

To Avert a Serious Threat to Health or Safety. We may use and disclose your health information when necessary to prevent a serious threat to your health and safety, or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.

SPECIAL SITUATIONS

In addition to the above, the following categories describe other possible ways that we may use and disclose your health information without your authorization. For each category of uses or disclosures, we will explain what we mean. Not every use or disclosure will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

Military. If you are a member of the armed forces, we may release your health information as required by military command authorities. We may also release health information about foreign military personnel to the appropriate foreign military authority.

Workers’ Compensation. We may release your health information for workers’ compensation or similar programs, but only as authorized by, and to the extent necessary to comply with, laws relating to workers’ compensation or similar programs that provide benefits for work-related injuries or illness.

Public Health Risks. We may disclose your health information for public health activities, which generally include to prevent or control disease, injury, or disability; to report births and deaths; to report child abuse or neglect; to report reactions to medications or problems with products; to notify people of recalls of products they may be using; or to notify a person who may have been exposed to a disease or are at risk for contracting or spreading a disease or condition.

Victims of Abuse, Neglect, or Domestic Violence. We may disclose your health information to an appropriate government authority if we reasonably believe that you have been the victim of abuse, neglect, or domestic violence. We will only make this disclosure if you agree, or when required or authorized by law.

Health Oversight Activities. We may disclose your health information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose your health information in response to a court or administrative order. We may also disclose your health information in response to a subpoena, discovery request, or other lawful process by someone involved in a legal dispute, but only if efforts have been made to tell you about the request or to obtain a court or administrative order protecting the information requested.

Law Enforcement. We may disclose your protected health information if asked to do so by a law enforcement official (i) in response to a court order, subpoena, warrant, summons, or similar process; (ii) to identify or locate a suspect, fugitive, material witness, or missing person; (iii) about the victim of a crime if, under certain limited circumstances, we are unable to obtain the victim’s agreement; (iv) about a death that we believe may be the result of criminal conduct; and (v) about criminal conduct.

Coroners, Medical Examiners, and Funeral Directors. We may release your health information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release medical information to funeral directors, as necessary to carry out their duties.

National Security and Intelligence Activities. We may release your health information to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

Inmates. If you are an inmate of a correctional institution or are in the custody of a law enforcement official, we may disclose your health information to the correctional institution or law enforcement official if necessary (i) for the institution to provide you with health care; (ii) to protect your health and safety or the health and safety of others; or (iii) for the safety and security of the correctional institution.

Research. Under certain circumstances, we may disclose your health information for research purposes. In most circumstances, we will ask for your specific permission if the researcher will have access to information that reveals who you are.

Other Uses and Disclosures. As explained above, other uses and disclosures of health information not covered by this notice of the laws that apply to us will be made only with your written permission.

YOUR RIGHTS

You have certain rights regarding health information we maintain about you, which are briefly explained below.

Right to Inspect and Copy. You have the right to inspect and copy certain health information that may be used to make decisions about your care. Usually this includes medical and billing records, but does not include psychotherapy notes or substance abuse notes, certain information compiled for or in anticipation of civil, criminal, or administrative proceedings, and information subject to laws that prohibits your access to it.

If the information you request is maintained electronically, and you request an electronic copy, we will provide a copy in the electronic format and format you request, if the information can be readily produced in that form and format; if the information cannot be readily produced in that form and format, we will work with you to come to an agreement on form and format. You must submit your request to inspect or copy your health information in writing to Director of Clinical Services. If you request a copy of the information, we may charge a reasonable fee for the costs of copying, mailing, or other supplies associated with your request.

We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to your medical information, you may request that the denial be reviewed. The person who conducts the review will not be the person who denied the request and we will comply with the outcome of the review.

Right to Amend. If you believe that health information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for so long as we keep the information.

To request an amendment, your request must be made in writing and submitted to Director of Clinical Services. You must provide a reason that supports your request. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. If we deny the request, you have the right to submit a statement of disagreement with us and any future disclosures of the disputed information will include your statement.

Right to an Accounting of Disclosures. You have the right to request a list (an “accounting”) of the times we have shared your health information with others. The accounting will not include disclosures made for purposes of treatment, payment, or health care operations; disclosures made to you; disclosures made pursuant to your authorization; disclosures for national security purposes; and disclosures incidental to otherwise permissible disclosures.

To request this list or accounting of disclosures, you must submit your request in writing to Director of Clinical Services. Your request must state the time period you want the accounting to cover, which may not be longer than six years before the date of your request. The first list you request within a 12-month period will be provided free of charge. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to Request Restrictions. You have the right to request a restriction or limitation on your health information that we use or disclose for treatment, payment, or health care operations.

We are not required to agree to your request. However, if we do agree to the request, we will honor the restriction until you revoke it or we notify you. You may not limit uses or disclosures that we are legally required or allowed to make. To request restrictions, you must make your request in writing to Director of Clinical Services. In your request, you must tell us (i) what information you want to limit; (ii) whether you want to limit our use, disclosures, or both; and (iii) to whom you want the limits to apply—for example, disclosures to your spouse.

Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail.

To make your request, you must make your request in writing to Director of Clinical Services. We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to Be Notified of a Breach. You have the right to be notified in the event that we or a Business Associate discover a breach of unsecured health information.

Right to a Paper Copy of this Notice. You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. You may ask us to give you a copy of this notice at any time from our website sonapharmacy.com or from the location where you received treatment. To obtain a copy of this notice, contact the Director of Clinical Services.

COMPLAINTS

If you believe that your privacy rights have been violated, you may file a complaint with Sona Health, Inc. or with the Office for Civil Rights of the United States Department of Health and Human Services. To register a complaint with us, please contact Director of Clinical Services. All complaints must be submitting in writing.

You will not be penalized, or in any other way retaliated against, for filing a complaint with the Office of Civil Rights or with us.