Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can access this information. Please review it carefully.

Effective Date: August 25, 2026

Our Commitment to Your Privacy

Change Health and Wellness PA (“we,” “us,” or “our practice”) understands that PHI about you and your health is personal. We are committed to protecting health information about you. Protected Health Information or “PHI” refers to information in your health record that identifies you or could reasonably be used to identify you, which we may keep or transmit in electronic, oral, or written form. PHI may include information such as your name, contact information, past, present, or future physical or mental health or mental conditions; payment for health care products or services; and/or prescriptions. We create a record of the care and health services you receive to provide your care and to comply with certain legal requirements. Accordingly, this Notice applies to all records of your care generated by our practice, whether made by our staff or your physician or other health care provider. This Notice describes (i) our legal duties and privacy practices regarding your PHI, including our duty to notify you following a data breach of your unsecured PHI; (ii) our permitted uses and disclosures of your PHI; and (iii) your rights regarding your PHI. We can change the terms of this Notice, and the changes will apply to all information we have about you. The new Notice will be available on request, in our office, and on our website.

How We May Use and Disclose Your Health Information

The law permits or requires us to use or disclose your PHI for various reasons. We may share your information in other ways, in accordance with applicable law and regulations. For more information on permitted uses and disclosures, see www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html. The following categories describe different ways that we may use and disclose PHI without your written authorization.

Treatment

We may use and/or disclose PHI about you to provide you with, coordinate, or manage your health care treatment and related services. We may disclose PHI about you to physicians, nurses, technicians, or other personnel involved in your care or treatment. We may use and disclose PHI to contact you as a reminder that you have an appointment for treatment or medical care at our practice. We may use and disclose PHI to tell you about or recommend possible treatment options or alternatives or health-related benefits or services.

Payment for Services

We may use and disclose PHI about you to obtain payment for services we provide to you. For example, we may contact your health insurer to verify coverage and/or to bill for services rendered.

Health Care Operations

We may use and disclose PHI about you for our health care operations, which are administrative and professional activities necessary to run our practice and ensure quality care, such as quality assessment, staff review, training, licensing, and business planning. We may also use PHI about you to decide what additional services our practice should offer, what services are not needed, and whether certain new treatments are effective.

Other Permitted or Required Uses and Disclosures Without Your Authorization

We may also use or disclose your PHI, without your written authorization, for other purposes as permitted or required by law including, but not limited to, the following. However, some of the disclosures set forth below may never occur at our practice.

• As required by law (e.g., mandatory reporting laws). We may disclose PHI about you when required to do so by federal, state, or local law.
• Public health activities, such as reporting disease, injury, or vital events.
• Health risks. We may disclose PHI about you to a government authority to report suspected abuse, neglect, or domestic violence to appropriate authorities, or avert a serious threat to health or safety.
• Health oversight activities. We may disclose health information to a health oversight agency for activities authorized by law. These activities may include audits, investigations, and inspections, which may be necessary for licensure and for the government to monitor the health care system, government programs, and compliance with civil rights laws.
• Judicial and administrative proceedings. If you are involved in a lawsuit or dispute, we may disclose your information in response to a court or administrative order, or in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute.
• Business Associates. We may disclose information to business associates who perform services on our behalf (such as billing companies); however, we require them to appropriately safeguard your information.
• Law enforcement. We may release PHI as required by law, or in response to an order or warrant of a court, or an administrative request. We may also disclose PHI in response to a request related to identification or location of an individual, victims of crime, decedents, or a crime on the premises.
• Research. We may disclose your PHI to researchers when their research has been approved by an institutional review board or privacy board that has reviewed the research proposal and established protocols to ensure the privacy of your information.
• Specialized government functions. If you are a member of the armed forces, we may release PHI about you if it relates to military and veterans’ activities. We may also release PHI about you for the purposes of national security and protective services.
• Workers’ compensation. We may disclose information as necessary to comply with laws relating to worker’s compensation or other similar programs established by law.

Uses and Disclosures Requiring Your Written Authorization

Other uses and disclosures not described in this notice will be made only with your written authorization. This includes, in most circumstances, the use or disclosure of psychotherapy notes, uses and disclosures of PHI for marketing purposes, and disclosures that constitute a sale of PHI. As set forth previously, your PHI may be used and disclosed to your designated emergency contact with your written consent and permission. If you are unavailable, incapacitated, and/or facing an emergency situation and your health care provider determines that a limited disclosure may be in your best interest, your health care provider may share the minimum necessary PHI with your emergency contact without your approval. You may revoke an authorization at any time, in writing, except to the extent we have already acted in reliance on it.

Your Rights Regarding Your Health Information

For certain health information, you can tell us your choices about what we share. You have both the right and choice to tell us whether to, or not to, share information with your family, close friends, or others involved in your care, as well as in a disaster relief situation. Please contact us and let us know your preferences and we will make reasonable efforts to follow your requests.

You have the following rights regarding PHI we maintain about you.

• Right to Inspect and Copy: You have the right to inspect and obtain a copy of PHI that may be used to make decisions about your care. Usually, this includes medical and billing records. To inspect and copy PHI that may be used to make decisions about you, you must submit your request in writing to our practice. If you request a copy of the information, we may charge a reasonable, cost-based fee for the costs of copying, mailing or other supplies associated with your request, and we will respond to your request no later than 30 days after receiving it. You may request that we provide a copy of your PHI to a family member, another person, or a designated entity. In this case, we require that you submit these requests in writing with your signature and clearly identify the designated person and where to send the PHI. We may deny your request for access in certain limited circumstances. However, if we deny your access request, we will provide you with a written denial containing the basis for our decision and explain your rights to appeal or file a complaint.
• Right to Correct or Amend Your PHI: You have the right to request that we correct or amend your PHI if you believe it is incorrect or incomplete. For these requests, you must submit these requests in writing, specify the inaccurate or incorrect PHI, and provide a reason that supports your request. We may deny your request for an amendment if you ask us to amend PHI that is not part of our record, that we did not create, that is not part of a designated record set, or that is accurate and complete. If we deny your request, we will tell you why in writing within 60 days of receiving your request. You will have the right to submit a written statement disagreeing with the denial and, if you opt not to submit this statement, you may request that we provide your original request for amendment and the denial with any future disclosures of PHI subject to the amendment. However, we may prepare a written rebuttal to any individual’s statement of disagreement, if we deem it to be necessary. We will append the material created or submitted in accordance with this paragraph to your designated record.
• Right to an Accounting of Disclosures: You have the right to receive an “accounting of disclosures,” which is a list of certain disclosures we made of PHI about you. You may ask for disclosures made up to six years before your request. We are required to provide a listing of all disclosures except disclosures for your treatment; for billing and collection of payment for your treatment; for health care operations; made to or requested by you, or that you authorized; occurring as a byproduct of permitted use and disclosures; and as a part of a limited data set of information that does not contain information identifying you. To request this list or accounting of disclosures, you must submit your request in writing to our practice and we will respond to your request within 60 days of receiving your request. We will provide this list at no charge. However, if you make more than one request in the same calendar year, we reserve the right to charge a reasonable, cost-based fee for each additional request.
• Right to Request Restrictions: You have the right to request restrictions or limitations on the PHI we use or disclose about you for treatment, payment or health care operations or to persons involved in your care. We are not required to agree to your request, and may deny your request if (i) it would affect your care; (ii) the information is needed to provide you emergency treatment; (iii) the disclosure is to the Secretary of the Department of Health and Human Services; or (iv) it is required under applicable law. Notwithstanding the preceding sentences, you have the right to request restrictions on disclosures of your PHI to health plans for payment or health care operations purposes if the PHI pertains solely to a health care item or health care service you have paid for out-of-pocket in full. To request restrictions, you must make your request in writing to our practice.
• Right to Request Confidential Communications and Choose How We Send PHI to You: You have the right to request that we communicate with you about health matters in a certain way or at a certain location (for example, only at work or by mail) or to send mail to a different address. We will agree to all reasonable requests.
• Right to Choose Someone to Act for You: If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI. We will confirm the person has this authority and can act for you before we take any action.
• Right to a Copy of This Notice: You have the right to receive a copy of this Notice in paper and/or electronically. You have the right to obtain a paper copy of this Notice at any time, even if you agreed to receive it electronically. You can receive a copy of this Notice upon request. This Notice will also be available in our office and on our website.
• Right to be Notified of a Breach: You have the right to be notified in the event that we (or a business associate) discover a breach of unsecured PHI. We will promptly notify you if a breach occurs that may have compromised the privacy or security of your PHI. We will notify you within the legally required time frame (i.e., no later than 60 days after we discover the breach).
• Right to File a Complaint: You have the right to complain if you feel we have violated your rights. We will not retaliate against you for filing a complaint. You may either file a complaint directly with us or with the Office for Civil Rights at the U.S. Department of Health and Human Services, as set forth below. All complaints must be submitted in writing.

Changes to This Notice

We reserve the right to change the terms of this Notice and to apply such changes to all PHI we already have or maintain about you, as well as any information we receive in the future. If a revision is implemented, we will make such revisions available to you by posting a copy of the current Notice in our office and on our website (if applicable), with the effective date noted. You may request a copy of the Notice currently in effect at any time.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with our practice by contacting our Privacy Officer using the contact information below, or with the U.S. Department of Health and Human Services, Office for Civil Rights, by sending a letter to 200 Independence Avenue SW, Room 509F HHH Bldg., Washington, D.C. 20201, calling 1-877-696-6775, emailing OCRComplaint@hhs.gov, or visiting https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf. We will not retaliate against you for filing a complaint. For more information on the complaint process, please visit www.hhs.gov/ocr/privacy/hipaa/complaints.

Contact Information

If you have questions about this notice or wish to exercise any of your rights, please contact our Privacy Officer: