Effective date: August 13, 2026

1. Our Commitment to Your Privacy

Access Multi-Specialty Medical Clinic, Inc. is committed to protecting the privacy of your health information. We are required by law to: maintain the privacy of Protected Health Information (“PHI”); provide you with this Notice of our legal duties and privacy practices; notify affected individuals following a breach of unsecured PHI; and abide by the terms of the Notice currently in effect.

We follow the federal Health Insurance Portability and Accountability Act (“HIPAA”), the California Confidentiality of Medical Information Act (“CMIA”), and — for substance use disorder records — the federal regulations at 42 CFR Part 2 (see Section 9). Where these laws differ, we follow the standard that provides you greater protection.

2. How We May Use and Disclose Your Health Information

For most uses and disclosures involving treatment, payment, and health care operations, we are not required to obtain your authorization:

• Treatment. We share your health information among the psychiatrists, therapists, nurses, and other professionals involved in your care, and with pharmacies, laboratories, and providers to whom we refer you, to coordinate and provide your treatment, whether in person or by telehealth.
• Payment. We use and disclose your health information to bill and obtain payment, including insurance verification, eligibility, claims, and prior authorization.
• Health Care Operations. We use your health information for quality assessment, staff review, care coordination, training, and general administration of the Practice.

We may also use or disclose your health information, subject to applicable law and (for substance use disorder records) the additional protections in Section 9, to:

• Provide appointment reminders and information about treatment alternatives or health-related benefits and services. With your consent (verbal or written), reminders and related messages may be sent by telephone, text message (SMS), or email through our practice-management system, and you may opt out at any time;
• Share information with a family member, friend, or other person you involve in your care, when you agree or, in limited circumstances, in an emergency;
• Comply with uses and disclosures required by law;
• Support public health activities and report abuse, neglect, or domestic violence;
• Respond to health oversight activities, judicial and administrative proceedings, and lawful law enforcement requests;
• Assist coroners, medical examiners, and funeral directors, and support organ or tissue donation;
• Conduct research with appropriate safeguards and approvals;
• Prevent or lessen a serious and imminent threat to the health or safety of a person or the public, consistent with applicable law;
• Address specialized government functions, workers’ compensation, and correctional-institution requirements.

3. Uses and Disclosures Requiring Your Written Authorization

Uses and disclosures other than those described above will be made only with your written authorization. In particular, the following always require your authorization:

• Psychotherapy notes. These are notes recorded by a mental health professional documenting or analyzing a counseling session and kept separate from the rest of your record. Their use and disclosure require your authorization, except in the limited circumstances permitted by law.
• Marketing communications that involve payment to us by a third party.
• Sale of PHI. We will never sell your PHI.

You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.

4. Your Rights Regarding Your Health Information

• Inspect and copy. You have the right to inspect and receive a copy of your health information, including an electronic copy of records maintained electronically, subject to limited exceptions (for example, certain psychotherapy notes). We may charge a reasonable, cost-based fee.
• Amend. You may request that we amend health information you believe is incorrect or incomplete.
• Accounting of disclosures. You may request a list of certain disclosures we have made of your PHI for up to six (6) years prior to your request, excluding disclosures for treatment, payment, and health care operations and certain others permitted by law.
• Request restrictions. You may request restrictions on certain uses and disclosures. You also have the right to restrict disclosure to your health plan of information about a service you paid for in full, out of pocket.
• Confidential communications. You may request that we communicate with you by alternative means or at an alternative location (for example, a specific phone number or mailing address).
• Paper copy. You have the right to a paper copy of this Notice, even if you agreed to receive it electronically.
• Breach notification. You have the right to be notified following a breach of your unsecured PHI.
• Revoke authorization. You may revoke any authorization you previously gave, as described in Section 3.

To exercise any of these rights, please contact our Privacy Officer using the information in Section 10.

5. Our Duties

We are required to maintain the privacy of your PHI, provide this Notice describing our legal duties and privacy practices, abide by the terms of the Notice currently in effect, notify you following a breach of unsecured PHI, and obtain your authorization for uses and disclosures not otherwise permitted by law.

6. Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for all PHI we maintain, as well as information we receive in the future. The current Notice will be posted in our office and on this Website, and will show its effective date. You may obtain a copy at any time upon request.

7. Complaints

If you believe your privacy rights have been violated, you may file a complaint without fear of retaliation:

• Internal complaint. Contact our Privacy Officer at (415) 857-1151 or by mail at P.O. Box 351, Burlingame, CA 94011-0351.
• Federal complaint. File with the U.S. Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue, S.W., Washington, D.C. 20201; by calling 1-877-696-6775; or via www.hhs.gov/ocr/privacy/hipaa/complaints.

We will not retaliate against you in any way for filing a complaint.

8. Business Associates

We may share your PHI with third parties, known as “business associates,” who perform services on our behalf — for example, Microsoft Corporation, which provides our Microsoft 365 email and the Microsoft 365 appointment request form, and Practice Fusion, our electronic health record and practice-management provider, which also supports appointment reminders. Our business associates are contractually required, under a Business Associate Agreement, to protect your PHI in accordance with HIPAA.

9. Substance Use Disorder (SUD) Records — 42 CFR Part 2

To the extent we provide substance use disorder diagnosis, treatment, or referral for treatment and qualify as a “Part 2 program,” records that would identify you as having or having had a substance use disorder are protected by the federal regulations at 42 CFR Part 2, which are generally more restrictive than HIPAA. Specifically:

• Written consent. Most disclosures of Part 2 records — including to family members, employers, and many others — require your prior written consent that meets Part 2’s specific requirements.
• Prohibition on redisclosure. Information disclosed with your consent may not be redisclosed except as permitted by your written consent or as otherwise allowed by Part 2. Disclosures we make are accompanied by a written notice prohibiting redisclosure.
• Limited exceptions. Part 2 permits certain disclosures without consent, such as bona fide medical emergencies, qualified audits and evaluations, certain research, a court order that meets Part 2 requirements, reports of suspected child abuse or neglect, and information about a crime on program premises or against program personnel.
• Separate handling. Part 2 records — including any submitted through our online appointment intake form — are compartmentalized and maintained with additional safeguards, separately from other treatment information.

Consistent with the current Part 2 rules, which align more closely with HIPAA, you may choose to provide a single written consent authorizing future uses and disclosures for treatment, payment, and health care operations, and certain HIPAA rights and breach-notification protections apply to Part 2 records. You may revoke your consent in writing at any time, except to the extent we have already acted in reliance on it.

10. Contact Information / Privacy Officer

To exercise your rights, ask questions, or file a complaint regarding this Notice, please contact:

Privacy Officer
Access Multi-Specialty Medical Clinic, Inc.
P.O. Box 351, Burlingame, CA 94011-0351
Phone: (415) 857-1151  |  Fax: (650) 727-0551
Email: info@accessmultispecialty.com

Effective date of this Notice: August 13, 2026.