HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Last updated: May 21, 2025

This Notice of Privacy Practices (“Notice”) describes the privacy practices of Emerald Medical Practice P.C. (AZ), Emerald Medical Practice P.C (CA), Emerald Medical Practice P.A. (KS), Centennial Medical Practice P.C. (ID), and Ruby Medical Practice P.C. (NJ) (collectively, “Emerald”, “we”, “us”, “our”), all of which provide health care services.

This Notice describes the ways in which we may use and disclose your medical or billing records or other health information about you (“Protected Health Information” or “PHI”). We are committed to maintaining your privacy and we take our responsibility for safeguarding your PHI very seriously.This Notice also describes your rights and certain obligations we have regarding the use and disclosure of your PHI and how you can access your PHI.

The Notice is published on the General Medicine website (generalmedicine.co).You acknowledge receipt of this Notice by indicating your acknowledgment when signing up for services on the website.You can receive a copy of this Notice by asking for one, or by printing a copy from the website at anytime.

Our Responsibilities under HIPAA

Under HIPAA, we are required to:

• Protect the privacy and security of your PHI.All of our personnel are required to maintain the confidentiality of PHI and receive appropriate privacy training.
• Provide you with this Notice explaining our duties and practices regarding your PHI.
• Promptly notify you of any breach that has compromised the privacy of your PHI.
• Follow the duties and practices described in this Notice and provide you with a copy of this Notice.

Uses and Disclosures of Your PHI That Do Not Require Your Authorization

We use and disclose PHI in a number of ways related to your treatment, payment for your care and our healthcare operations.Some specific examples of how we may use or disclose your PHI without your authorization are listed below:

Treatment

• We can use your PHI and share it with other professionals who are treating you and for care coordination purposes.
• For example, we may share your PHI with other healthcare providers such as doctors, nurses and laboratories to meet your healthcare needs.

Payment

• We can use and disclose your PHI to bill and collect payment for products and services we provided to you.
• For example, we may provide your PHI to your insurance company or health plan to obtain payment for services we have provided to you.

Health Care Operations

• We can use and share your PHI to run our practice, improve our services, improve your care, and contact you when necessary.
• For example, we may use your PHI to improve the quality and effectiveness of the health care services we provide.
• We may also disclose your PHI to third party "business associates" that perform various services on our behalf, such as technology, transcription, billing, and collection services. In these cases, we will enter into a written agreement with the business associates to require they protect the privacy of your PHI.

How else can we use or share your Protected Health Information?

We may also use and disclose your Protected Health Information without your authorization as in the following circumstances:

• To an authorized public health authority or individual to:
• Protect public health and safety
• Prevent or control disease
• Assist with product recalls
• Report adverse reactions to medications or other problems with prescription drugs
• To government entities authorized to receive reports regarding abuse, neglect, or domestic violence. We only make this disclosure if you agree or when we are required or authorized by law to make the disclosure.
• To a health oversight agency for activities authorized by law, such as audits, investigations and inspections. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, other government regulatory programs and civil rights laws.
• For research purposes, as permitted by law. For certain research activities, an Institutional Review Board (IRB) or Privacy Board may approve uses and disclosures of your PHI without your authorization.
• As required by law, including with the Department of Health and Human Services if it wants to determine whether we are complying with federal law.
• To law enforcement officials for certain specific purposes, such as reporting certain types of injuries.
• In the course of legal proceedings. For example, we may disclose your PHI in response to a court order.
• To coroners, medical examiners, or funeral directors so that they can carry out their duties.
• To organizations that handle procurement, transplantation, or banking of organs, eyes, or tissues.
• If you verbally agree to the use or disclosure and in certain other situations, we may make the following uses and disclosures of your PHI. We may disclose certain PHI to your family, friends, and anyone else whom you identify as involved in your health care or who helps pay for your care; the PHI we disclose would be limited to the PHI that is relevant to that person's involvement in your care or payment for your care. We may also make these disclosures after your death as authorized by applicable law unless doing so is inconsistent with any prior expressed preference. We may use or disclose your information to notify or assist in notifying a family member, personal representative, or any other person responsible for your care regarding your location, general condition, or death. We may also use or disclose your PHI to disaster-relief organizations so that your family or other persons responsible for your care can be notified about your condition, status, and location.
• If there is a serious threat to your health and safety or the health and safety of the public or another person, we may use and disclose your PHI in a very limited manner to someone able to help lessen the threat.
• In certain circumstances, HIPAA authorizes us to use or disclose your PHI to authorized federal officials for the conduct of national security activities and other specialized government functions.
• If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose your PHI to the correctional institution or law enforcement official to assist them in providing you health care, protecting your health and safety or the health and safety of others, or providing for the safety of the correctional institution.
• As necessary to comply with laws related to workers’ compensation or other similar programs

Please note that we may de-identify your PHI and use and disclose the de-identified data for any purpose permitted by law.

Please be aware that state and other federal laws may have additional requirements that we must follow or may be more restrictive than HIPAA on how we use and disclose certain of your PHI. If there are specific more restrictive requirements, even for some of the purposes listed above, we may not disclose your PHI without your written permission as required by such laws. For example, we may be required by law to obtain your written permission to use and/or disclose your mental illness, developmental disability, or substance use disorder treatment records, HIV, STD, or other communicable disease related information, or your genetic test results in certain situations.

Uses and Disclosures of Your PHI That Require Us to Obtain Your Authorization

Other permitted and required uses and disclosures will be made only with your authorization. We will not use and disclose your psychotherapy notes without your written authorization except as otherwise permitted by law. We will not use or disclose your PHI in any of the following circumstances, unless you give us written authorization to do so or as otherwise permitted by HIPAA:

• For marketing purposes
• Sale of your PHI

If you provide us authorization to use or disclose your PHI, you may revoke that authorization in writing at any time by sending a revocation request to the address listed below. We are unable to take back any disclosures we have already made based on your authorization.

Your Rights Regarding Your Protected Health Information
Under HIPAA, you have certain rights regarding your PHI. All requests or communications to us to exercise your rights discussed below must be submitted in writing to our HIPAA Privacy Officer at the following address:Privacy Officer, 50 W Broadway Ste 333, PMB 518579, Salt Lake City, Utah 84101.You can also submit a request via email at:privacy@generalmedicine.co.

• You have the right to request an electronic or paper copy of your PHI we maintain about you.We may charge a reasonable fee for the cost of preparing and sending your PHI in accordance with applicable law and you should usually receive copies of your PHI within 30 days.In certain circumstances, we may deny your request, but we will explain the basis for our denial.
• You can ask us to amend PHI that you think is incorrect or incomplete.Your request must be in writing, and it must explain why the information should be amended.In certain circumstances, we may deny your request, but we will provide you with a written explanation. You may respond with a statement of disagreement and ask that the statement be included with your PHI.
• You can ask that we communicate with you about your PHI in confidence by alternative means or to an alternative address.We will accommodate your request if it is reasonable.We will not ask you the reason for your request.
• You can ask us to limit the way that we use or disclose your PHI for treatment, payment or healthcare operations.We are not required to agree to your request for additional restrictions, except when a restriction has been requested regarding a disclosure to a health plan where the patient has paid for services in full and where the purpose of the disclosure is for payment or health care operations and is not otherwise required by law.
• You can ask us for a list of instances in which we disclosed your PHI for certain. Please note that certain disclosures need not be included in the accounting we provide to you. You can request disclosures made up to six years before your request.If you request this list more than once in a one-year period, we may charge you a reasonable, cost-based fee for responding to these additional requests.
• You can request a paper copy of this Notice.

Changes To This Notice

We may change this Notice from time to time.We reserve the right to make the new Notice provisions effective for all PHI we currently maintain, as well as any PHI we receive in the future. We will make any such changes to this Notice by posting the revised Notice on our website and the date of the last update will be clearly indicated at the top of the Notice.

Questions and Complaints

Complaints about this Notice or how we handle your PHI should be directed to our HIPAA Privacy Officer. You may also submit a formal complaint to the Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.We will not retaliate against you for filing a complaint.

We must follow the duties and privacy practices described in this Notice. If you have any questions regarding our privacy practices or this Notice, please contact our Privacy Officer, 50 W Broadway Ste 333, PMB 518579, Salt Lake City, Utah 84101, or by email at privacy@generalmedicine.co.