Notice of Privacy Practices.

Colores Cosmetic Surgery (“the clinic,” “we,” “us” or “our”) is committed to protecting the privacy of your health information. This Notice of Privacy Practices describes how we may use and disclose your protected health information (“PHI”) to carry out treatment, payment and health care operations, and for other purposes permitted or required by law. It also describes your rights regarding your PHI and our legal duties to protect it.

PHI is information that identifies you (or could reasonably be used to identify you) and that relates to your past, present or future physical or mental health, the health care you receive, or payment for that care. This includes your medical records, surgical and consultation records, billing information, and clinical photographs. We are required by law to maintain the privacy of your PHI, to provide you with this notice of our legal duties and privacy practices, and to abide by the terms of the notice currently in effect.

We may use and disclose your PHI without your written authorization for the following purposes:

Treatment. We use and share your PHI to provide, coordinate and manage your care. For example, your surgeon may share your medical history, imaging and clinical photographs with the anesthesiologist and operating-room nursing staff before a breast augmentation, and with your primary care physician to coordinate follow-up care.

Payment. We use and disclose your PHI to bill and obtain payment for the services we provide. For example, we may send information about a reconstructive procedure (such as the diagnosis, procedure performed and supporting clinical documentation) to your health plan to obtain prior authorization or to be reimbursed.

Health care operations. We use and disclose your PHI to run the clinic and to improve the quality and safety of the care we deliver. For example, we may review before-and-after records of liposuction cases as part of an internal surgical-outcomes and quality-improvement review, or use your information to train our clinical staff.

We may use or disclose your PHI without your authorization in the following circumstances, subject to the conditions and limits set by law:

• As required by law — when federal, state or local law requires the use or disclosure.
• Public health activities — for example, to prevent or control disease, report adverse events related to products or medical devices, or report births and deaths.
• Victims of abuse, neglect or domestic violence — to a government authority authorized to receive such reports.
• Health oversight activities — such as audits, investigations, inspections and licensure activities by oversight agencies.
• Judicial and administrative proceedings — in response to a court or administrative order, subpoena or other lawful process.
• Law enforcement — for purposes such as responding to a court order or warrant, identifying or locating a suspect, or reporting certain injuries.
• Coroners, medical examiners and funeral directors — to permit them to carry out their duties.
• Organ and tissue donation — to organizations that handle procurement, banking or transplantation.
• Research — under conditions approved by an Institutional Review Board or privacy board.
• To avert a serious threat to health or safety — when necessary to prevent a serious threat to your health and safety or to the public.
• Specialized government functions — such as military and veterans’ activities, national security and protective services.
• Workers’ compensation — as authorized by and to the extent necessary to comply with workers’ compensation laws.
• Business associates — to vendors who perform services on our behalf (such as billing or IT providers), who are contractually required to protect your PHI.
• Appointment reminders & treatment alternatives — to remind you of appointments and to tell you about treatment options or health-related benefits and services that may be of interest to you.

Other uses and disclosures of your PHI that are not described above will be made only with your written authorization. This includes, in particular:

• Marketing — most uses and disclosures of PHI for marketing purposes.
• Before-and-after, testimonial or other identifiable photographs and images — any use of your clinical or cosmetic photographs or images on our website, social media, advertising, brochures or other marketing materials.
• Sale of PHI — any disclosure that constitutes a sale of your protected health information.
• Psychotherapy notes — most uses and disclosures of psychotherapy notes, where applicable.

If you give us a written authorization, you may revoke it in writing at any time. Your revocation will stop any future uses or disclosures made under that authorization, except to the extent that we have already acted in reliance on it. To revoke an authorization, contact our Privacy Officer at the address or phone number below.

You have the following rights with respect to your PHI. To exercise any of these rights, submit your request to our Privacy Officer using the contact information below; certain requests must be in writing.

• Inspect and copy your records. You may inspect and obtain a copy of your medical and billing records, in the form and format you request if readily producible. We may charge a reasonable, cost-based fee.
• Request an amendment. You may ask us to amend PHI you believe is incorrect or incomplete. We may deny your request in certain cases and will explain the reason in writing.
• Accounting of disclosures. You may request a list of certain disclosures of your PHI that we made, other than disclosures for treatment, payment, health care operations and a few other exceptions.
• Request restrictions. You may ask us to restrict how we use or disclose your PHI. We are not required to agree to all requests; however, we must agree to your request to restrict disclosure to a health plan for a service or item you have paid for in full, out of pocket.
• Request confidential communications. You may ask us to communicate with you about your health matters in a certain way or at a certain location (for example, by mail to a specific address).
• Paper copy of this notice. You have the right to a paper copy of this notice at any time, even if you have agreed to receive it electronically.
• Notification of a breach. You have the right to be notified if there is a breach of your unsecured PHI.

We are required by law to maintain the privacy of your PHI, to provide you with this notice of our legal duties and privacy practices with respect to your PHI, and to abide by the terms of the notice that is currently in effect. We are also required to notify you following a breach of your unsecured protected health information.

If you believe your privacy rights have been violated, you may file a complaint with the clinic’s Privacy Officer at the address or phone number below. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR), by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.

We will not retaliate against you in any way for filing a complaint.

We reserve the right to change this notice and to make the revised notice effective for PHI we already have about you, as well as any information we receive in the future. We will post the current notice in the clinic and on our website. You may obtain a copy of the current notice at any time from our front desk or by contacting our Privacy Officer.

If you have any questions about this notice, wish to exercise any of your rights, or want to request a paper copy, please contact:

Colores Cosmetic Surgery — Privacy Officer
117 S 17th Ave, Hollywood, FL 33020, USA
Phone: (954) 589-1508