HIPAA Notice of Privacy Practices

Lone Star Vein Institute ("Practice," "we," "our," or "us") is required by law to maintain the privacy of your protected health information (PHI), to provide you with notice of our legal duties and privacy practices with respect to PHI, and to notify you following a breach of your unsecured PHI. We are committed to protecting the confidentiality of all health information we obtain in the course of providing you with care.

What Is Protected Health Information?

Protected Health Information (PHI) is information about you — including demographic information such as your name, date of birth, or contact details — that relates to your past, present, or future physical health, the healthcare services you receive from us, or payment for those services. PHI includes information in any form: written, electronic, or verbal.

How We May Use and Disclose Your Health Information

The following describes the ways we may use and disclose your PHI. Not every use or disclosure will be listed, but we will explain the different categories of uses and disclosures.

Treatment

We may use and disclose your PHI to provide, coordinate, and manage your healthcare. For example, information about your vein condition may be shared with other members of your care team, or with a specialist to whom we refer you. We may also share your information with other providers involved in your care.

Payment

We may use and disclose your PHI to obtain payment for the services we provide. For example, we may submit your health information on claim forms to your insurance company or Medicare in order to be reimbursed for services, or to verify your insurance coverage and obtain prior authorizations before treatment.

Healthcare Operations

We may use and disclose your PHI for our internal healthcare operations. This includes activities such as quality improvement, staff training, scheduling, billing, and administrative functions necessary to operate our practice effectively and maintain the standard of care we provide.

Appointment Reminders

We may contact you using your phone number or email address to provide appointment reminders or information about treatment options that may be relevant to your care.

As Required by Law

We will disclose your PHI when required to do so by federal, state, or local law, including disclosures required by public health authorities, health oversight agencies, law enforcement, courts, and other legal proceedings.

Business Associates

We may share your PHI with third-party "business associates" — companies or individuals that perform services on our behalf, such as billing services, IT support, or legal counsel. Our business associates are contractually required to protect the privacy of your information and to use it only for the purposes for which it was disclosed.

Other Permitted Disclosures

We may also use or disclose your PHI in the following circumstances, as permitted by HIPAA:

• To lessen a serious and imminent threat to health or safety
• For public health activities, such as reporting communicable diseases
• For workers' compensation claims
• To coroners, medical examiners, or funeral directors as required
• For organ and tissue donation purposes
• For research, subject to appropriate approvals and safeguards
• To the U.S. military or national security authorities as required by law

Uses and Disclosures Requiring Your Authorization

Certain uses and disclosures of your PHI require your written authorization, including:

• Most uses and disclosures of your PHI for marketing purposes
• Sale of your PHI
• Disclosures of psychotherapy notes (if applicable)
• Any other use or disclosure not described in this Notice

You have the right to revoke an authorization at any time by submitting a written request to our Privacy Officer. Revocation will not affect actions we already took in reliance on your authorization.

Our Duties

Lone Star Vein Institute is required by law to:

• Maintain the privacy of your PHI
• Provide you with notice of our legal duties and privacy practices
• Abide by the terms of this Notice currently in effect
• Notify you following a breach of your unsecured PHI

We reserve the right to change the terms of this Notice and to make any revised Notice effective for all PHI we maintain. We will post any revised Notice at our clinic and on our website. You may request a current copy at any time.

How to File a Complaint

If you believe your privacy rights have been violated, you have the right to file a complaint with our Practice or with the U.S. Department of Health and Human Services (HHS). You will not be retaliated against in any way for filing a complaint.

To file a complaint with HHS, visit: www.hhs.gov/ocr/privacy/hipaa/complaints/

To file a complaint with our Practice, please contact our Privacy Officer using the information below.

Texas-Specific Privacy Protections

In addition to federal HIPAA protections, Lone Star Vein Institute complies with the Texas Medical Records Privacy Act (Texas Health & Safety Code, Chapter 181), which provides additional protections for health information in the State of Texas. Where Texas law provides greater privacy protections than HIPAA, we follow Texas law.