Notice of Privacy Practices

1. Who This Notice Covers

This notice applies to the medical practice of Curio Medical Health Services, PC, doing business as Hillary Lin, MD ("the practice," "we," or "us"). It covers Dr. Lin and every member of the practice's workforce who handles your health information.

This notice is about your medical records and other health information the practice creates or receives while caring for you. How hillarylinmd.com handles website, newsletter, and coaching information is described separately in our Privacy Policy.

2. Our Duties

We are required by law to:

• Keep the privacy and security of your health information
• Give you this notice of our legal duties and privacy practices
• Follow the terms of the notice currently in effect
• Tell you promptly if a breach occurs that may have compromised the privacy or security of your information

We will not use or share your information other than as described here unless you tell us we can in writing.

3. How We Use and Share Your Health Information

3.1 Treatment

We use your information to provide your care, and we share it with others involved in your care. For example, we send orders to laboratories and imaging centers, send prescriptions to your pharmacy, and share records with another clinician when we refer you or coordinate your care. When we prescribe, pharmacies and e-prescribing networks may let us see your recent medication history.

3.2 Payment

We use your information to bill and collect payment for your care. The practice does not bill health insurance. If you ask, we will give you a superbill or receipt with the information you need to seek reimbursement from your health plan yourself. Payment processors receive only what is needed to complete a payment.

3.3 Health Care Operations

We use your information to run the practice and improve your care, for example to review the quality of our care, keep accurate records, manage scheduling, and meet legal and licensing obligations.

3.4 Business Associates

We work with companies that provide services to the practice, such as video visits, note-taking, record storage, email, and artificial intelligence (AI) tools that help draft notes, care plans, and messages. When these companies handle your health information, they sign a business associate agreement that requires them to protect it and to use it only for the services they provide to us. We do not allow them to use your health information to train their AI models or for their own purposes.

3.5 Contacting You

We may contact you by email, phone, or text about appointments, results, your care plan, and treatment options or health-related services that may interest you. The Telemedicine Consent explains how we use standard email. You can ask us to contact you a different way (see Section 6).

3.6 Family Members and Others Involved in Your Care

We may share information with a family member, friend, or other person you identify as involved in your care or in paying for it, unless you tell us not to. If you are not able to tell us your preference, for example in an emergency, we may share information if we believe it is in your best interest.

4. Other Ways We May Use or Share Your Information

The law allows or requires us to share your information in the following situations, within the limits the law sets:

• When required by law, including to the U.S. Department of Health and Human Services when it checks that we are complying with federal privacy law
• Public health and safety, such as reporting certain diseases, adverse reactions to medications, product recalls, and suspected abuse, neglect, or domestic violence
• Serious threats, to prevent or lessen a serious and imminent threat to the health or safety of you or others
• Health oversight, such as audits, investigations, inspections, and licensing reviews
• Lawsuits and legal actions, in response to a court or administrative order, or to a subpoena when the law's conditions are met
• Law enforcement, in limited circumstances, such as in response to a court-ordered warrant
• Medical examiners, coroners, and funeral directors, when a person dies
• Organ and tissue donation organizations
• Research, only when an ethics board or privacy board has approved the use and protections for your privacy are in place
• Workers' compensation claims, as the law allows
• Special government functions, such as military, national security, and presidential protective services

4.1 Stronger State Protections

Some state laws give certain information more protection than federal law, such as information about HIV, mental health, substance use, genetic testing, and reproductive or sexual health. When a law of the state where you live or receive care is more protective, we follow it.

4.2 Substance Use Disorder Records

If we receive records from a substance use disorder treatment program that are protected by federal law (42 CFR Part 2), we will not use or share those records, or testimony about their contents, in any civil, criminal, administrative, or legislative proceeding against you unless you give written consent or a court order requires it after notice and an opportunity to be heard.

5. Uses That Require Your Written Permission

We will not do the following without your written authorization:

• Use or share your information for marketing
• Sell your information
• Share psychotherapy notes, if any exist
• Use or share your information for any purpose not described in this notice

If you give us authorization, you may revoke it in writing at any time. Revoking it stops future uses and disclosures but does not undo anything we already did in reliance on it. The practice does not conduct fundraising.

6. Your Rights

To use any of these rights, contact the Privacy Officer (Section 9). We may ask you to make your request in writing; email counts.

6.1 Get a Copy of Your Records

You can see or get a copy of your medical and billing records, including an electronic copy, and you can ask us to send a copy to a person or company you choose. We will respond within 30 days, or sooner if state law requires. We may charge a reasonable, cost-based fee as the law allows.

6.2 Ask Us to Correct Your Records

You can ask us to correct information you believe is wrong or incomplete. We may say no, but we will tell you why in writing within 60 days.

6.3 Ask for Confidential Communications

You can ask us to contact you a specific way (for example, by phone only, or at a different email address) or at a different address. We will say yes to all reasonable requests.

6.4 Ask Us to Limit What We Use or Share

You can ask us not to use or share certain information for treatment, payment, or our operations. We are not required to agree, and we may say no if it would affect your care. If you pay for a service in full yourself, you can ask us not to share information about it with your health plan, and we will say yes unless a law requires us to share it.

6.5 Get a List of Those We Shared With

You can ask for a list (accounting) of the times we shared your information in the six years before your request, who we shared it with, and why. The list will not include disclosures for treatment, payment, or operations, or ones you asked us to make. We provide one list a year free and may charge a reasonable, cost-based fee for more.

6.6 Get a Paper Copy of This Notice

You can ask for a paper copy of this notice at any time, even if you agreed to receive it electronically.

6.7 Choose Someone to Act for You

If someone has your medical power of attorney or is your legal guardian, that person can use your rights and make choices about your health information. We will confirm the person has this authority before we act.

7. Changes to This Notice

We can change the terms of this notice, and the changes will apply to all information we have about you. The current notice is always available on this page, and we will give you a copy on request.

8. Complaints

If you believe your privacy rights have been violated, you can file a complaint with the Privacy Officer (Section 9). You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by mail at 200 Independence Avenue SW, Washington, DC 20201, by phone at 1-877-696-6775, or online at hhs.gov/ocr/complaints.

We will not retaliate against you for filing a complaint.

9. Contact

For questions about this notice or to use any of your rights, contact: