How we protect your health information.

Our commitment to your privacy

Mobile Dermatology Solutions ("we," "us," or "our") is required by law to maintain the privacy of your protected health information ("PHI"), to provide you with this notice of our legal duties and privacy practices with respect to your PHI, and to notify you following a breach of unsecured PHI. We are required to abide by the terms of this notice while it is in effect. This notice applies to all records of care generated by Mobile Dermatology Solutions, whether created by our clinicians in Florida, Utah, or any other state in which we later operate.

How we may use and disclose your health information

For treatment

We may use and disclose your PHI to provide, coordinate, or manage your dermatologic care and related services. This includes sharing information with your facility's nursing staff, your attending physician, your wound care team, pathology laboratories, and other clinicians involved in your care, so they have the information needed to treat you.

For payment

We may use and disclose your PHI to bill and collect payment for the services we provide, including submitting claims to Medicare, Medicaid, or your health insurance plan, verifying coverage, and handling billing inquiries or appeals.

For health care operations

We may use and disclose your PHI to support our business operations, such as quality assessment and improvement, staff training and clinical education, credentialing, licensing, business planning, and general administrative activities.

Individuals involved in your care or payment

We may share relevant PHI with a family member, friend, power of attorney, or other person you identify, or with facility staff involved in your care, when you agree, when you have the opportunity to object and do not, or when we can reasonably infer from the circumstances that you do not object. This is consistent with how consent is handled before any invasive procedure, as described in our patient-facing materials.

As required by law

We will disclose PHI when required to do so by federal, state, or local law.

Public health and safety

We may disclose PHI to public health authorities for purposes such as preventing or controlling disease, reporting reactions to medications, and notifying persons who may have been exposed to a communicable disease (for example, in the event of a scabies or other outbreak within a facility). We may also disclose PHI to avert a serious and imminent threat to your health or safety or that of another person.

Health oversight activities

We may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, and licensure actions.

Judicial and administrative proceedings

We may disclose PHI in response to a court or administrative order, or in certain circumstances in response to a subpoena, discovery request, or other lawful process.

Law enforcement

We may disclose PHI to law enforcement officials for purposes such as identifying or locating a suspect, responding to a court order or subpoena, or reporting a crime.

Coroners, medical examiners, and funeral directors

We may disclose PHI to a coroner or medical examiner to identify a deceased person or determine cause of death, and to funeral directors as necessary to carry out their duties.

Organ and tissue donation

We may disclose PHI to organizations that handle organ, eye, or tissue procurement or transplantation.

Research

We may disclose PHI to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your PHI.

Workers' compensation

We may disclose PHI to comply with workers' compensation laws and similar programs.

Business associates

We may disclose PHI to contractors, agents, and other "business associates" who perform functions on our behalf (such as billing, transcription, or IT services) or provide us with services. To protect your PHI, we require business associates to appropriately safeguard your information under a written agreement.

Facility directory and communications

If you are a resident of a facility we serve, we may coordinate with that facility's own directory and communication practices, but we will not use or disclose your PHI for facility directory purposes on our own initiative beyond what is necessary for treatment, payment, and operations described above.

Uses and disclosures that require your written authorization

Other than as described above, we will not use or disclose your PHI without your written authorization. Examples include:

• Marketing communications, where we would receive payment for the communication
• Sale of your PHI
• Psychotherapy notes, if any are ever created in connection with your care (not applicable to our current scope of dermatologic services)

If you provide us with a written authorization, you may revoke it in writing at any time, except to the extent we have already acted in reliance on it.

Your rights regarding your health information

You have the following rights with respect to your PHI. To exercise any of these rights, please submit a written request to our Privacy Officer using the contact information at the end of this notice.

• Right to access and copy. You have the right to inspect and obtain a copy of your PHI that we maintain, with limited exceptions. We may charge a reasonable, cost-based fee for copies.
• Right to request amendment. You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny your request in certain circumstances, and we will explain the reason in writing.
• Right to an accounting of disclosures. You have the right to receive a list of certain disclosures we have made of your PHI, other than disclosures for treatment, payment, health care operations, and certain other excepted categories.
• Right to request restrictions. You have the right to request a restriction on certain uses and disclosures of your PHI. We are not required to agree to the restriction, except where you request that we not disclose information to a health plan regarding a service you paid for entirely out of pocket, in which case we generally must agree.
• Right to request confidential communications. You have the right to request that we communicate with you about your health information by alternative means or at an alternative location.
• Right to a paper copy. You have the right to obtain a paper copy of this notice at any time, even if you agreed to receive it electronically.
• Right to choose someone to act on your behalf. If you have a power of attorney or a legal guardian, that person may exercise these rights on your behalf.
• Right to be notified of a breach. We are required to notify you following a breach of your unsecured PHI, as required by law.

Our responsibilities

We are required by law to maintain the privacy and security of your PHI, provide you with this notice describing our legal duties and privacy practices, follow the terms of this notice currently in effect, and notify you if a breach occurs that may compromise the privacy or security of your PHI.

Changes to this notice

We reserve the right to change the terms of this notice at any time. Any revised notice will be effective for all PHI we maintain, including PHI created or received before the revision. A copy of our current notice will be available at our offices and posted on our website. We will provide a copy of the current notice on request.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights.

To file a complaint with us

Jordan Heaps, Privacy Officer, Mobile Dermatology Solutions, 140 South Beach Street, Suite 202, Daytona Beach, FL 32114. Phone: 888-506-8838 · Email: office@mobiledermsolutions.com

To file a complaint with HHS

Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Washington, D.C. 20201. Phone: 1-877-696-6775 · www.hhs.gov/ocr/privacy/hipaa/complaints

You will not be retaliated against for filing a complaint.

Florida-specific provisions

In addition to the HIPAA protections described above, Florida law provides certain categories of health information with heightened protection. These categories generally require your specific written authorization before we disclose them, separate from a general authorization for release of medical records:

• HIV/AIDS test results and related information — protected under Fla. Stat. § 381.004, generally requiring specific consent for disclosure beyond what a general medical records release covers.
• Sexually transmitted infection information — protected under Fla. Stat. § 384.29.
• Mental health treatment records, where applicable — protected under Fla. Stat. § 394.4615.
• Genetic information and genetic test results — protected under Fla. Stat. § 760.40, which generally treats your genetic information as your exclusive property and restricts its use and disclosure.
• General medical record confidentiality — Fla. Stat. § 456.057 governs how Florida-licensed health care practitioners maintain and release patient records, including timeframes for providing copies upon request.

Utah-specific provisions

Utah law also provides certain protections in addition to HIPAA:

• Genetic information — protected under the Utah Genetic Testing Privacy Act (Utah Code § 26-45 et seq. or successor provisions), which restricts the collection, retention, and disclosure of genetic information and generally requires consent.
• Health care records generally — the Utah Health Care Records Access Act (Utah Code § 78B-5-618 and related provisions) governs patient access to and confidentiality of records maintained by Utah health care providers.
• Data breach notification — Utah's data breach notification law (Utah Code § 13-44-101 et seq.) sets requirements for notifying individuals in the event of certain data breaches involving personal information, which may apply in addition to the HIPAA breach notification rule referenced above.