Notice of Privacy Practices

We are required by law to:

• Keep your PHI private and secure;
• Give you this Notice of our legal duties and privacy practices;
• Follow the terms of the Notice currently in effect;
• Notify you if a breach occurs that may have compromised the privacy or security of your unsecured PHI.

We may use and disclose your PHI without your written authorization for the following purposes:

• Treatment. To provide and coordinate your care. For example, sharing your records with another clinician or pharmacy involved in your treatment.
• Payment. To bill and collect payment for your care. For example, submitting claims to your insurance plan or verifying your coverage.
• Health care operations. To run our practice. For example, quality review, staff training, and practice management.
• Appointment reminders and care communications. We may contact you to remind you of an appointment or follow up on your care. Reminders include only your name, appointment date and time, and provider name.

We may also use or disclose your PHI in these limited situations, as permitted or required by law:

• As required by law, including mandated reporting of suspected abuse or neglect and responses to court orders.
• Public health activities, such as legally required reporting to public health authorities.
• Health oversight activities, such as audits and inspections by agencies that oversee health care.
• Judicial and administrative proceedings, in response to a court order or, in limited circumstances, a subpoena.
• Law enforcement, in limited circumstances defined by law.
• To avert a serious threat to your health or safety, or the health or safety of another person or the public.
• Coroners, medical examiners, and funeral directors, as necessary to carry out their duties.
• Workers' compensation claims, as authorized by law.
• Specialized government functions, such as military or national security purposes required by law.

With your verbal agreement, we may share information relevant to a family member's or friend's involvement in your care or payment for your care. In an emergency, or if you are not able to agree, we may share what is directly relevant using professional judgment, in your best interest. You can limit or end this sharing at any time by telling us.

We will obtain your written authorization before using or disclosing your PHI for any purpose not described in this Notice, including:

• Psychotherapy notes. Most uses and disclosures of psychotherapy notes require your authorization.
• Marketing. We do not use your PHI for marketing without your authorization.
• Sale of information. We do not sell your PHI, and any sale would require your authorization.

You may revoke an authorization at any time, in writing. Revocation does not affect uses or disclosures we made while the authorization was in effect.

Maryland law provides additional protections for mental health records. Where Maryland law is more protective than HIPAA, we follow Maryland law.

You have the following rights regarding your health information. To exercise any of them, contact our Privacy Officer using the information at the end of this Notice.

• Access. You may inspect and obtain a copy of your medical record, in paper or electronic form. We will respond within 30 days and may charge a reasonable, cost-based fee for copies.
• Amendment. You may ask us to correct information you believe is inaccurate or incomplete. We may deny the request in certain cases, and we will tell you why in writing.
• Accounting of disclosures. You may request a list of certain disclosures of your PHI we have made in the past six years.
• Restrictions. You may request limits on how we use or disclose your PHI. We are not required to agree to every request, but if you pay for a service in full out of pocket and ask us not to share that information with your health plan, we will honor that request unless a law requires the disclosure.
• Confidential communications. You may ask us to contact you in a specific way or at a specific location, for example by mail rather than phone. We will accommodate reasonable requests.
• Personal representative. If you have given someone a medical power of attorney, or someone is your legal guardian, that person may exercise your rights on your behalf.
• Breach notification. You have the right to be notified if a breach compromises the privacy or security of your unsecured PHI.
• Paper copy of this Notice. You may request a paper copy at any time, even if you agreed to receive it electronically. It is also available at our front desk.

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer using the contact information below, or with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/privacy/hipaa/complaints. We will never retaliate against you for filing a complaint.

We may change this Notice at any time. Changes apply to the PHI we already have as well as PHI we receive in the future. The current Notice is always posted on this page and available at our office, with its effective date at the top.

To exercise your rights, ask a question, or raise a concern, contact our Privacy Officer at (301) 524-4659 or privacy@paraviewhealth.com.

Effective date: August 5, 2026.