THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our employees may gather information about your medical history and your current health. This notice explains how that information may be used and shared with others. It also explains your privacy rights regarding this kind of information. The terms of this notice apply to health information created or received by Kane-Wanger Rheumatology and is effective as of 09/08/2025.

We are committed to protecting patient privacy. We are required by the Health Insurance Portability and Accountability Act (HIPAA) to provide you with this notice and to make sure that: your identifiable medical information is kept private; you understand our legal duties and privacy practices with respect to medical information about you; the terms of the notice that are currently in effect are followed; and you are notified in the event of a breach of any unsecured protected health information about you. You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.

Uses and Disclosures

We typically use or share your health information in the following ways:

• Treatment – we can use your health information and share it with other professionals who are treating you. Example: A doctor treating you for an injury asks another doctor about your overall health condition.
• Payment – we can use and share your health information to bill and get payment from health plans or other entities. Example: We give information about you to your health insurance plan so it will pay for your services.
• Healthcare Operations – we can use and share your health information to run our practice, improve your care, and contact you when necessary. Example: We use health information about you to manage your treatment and services.
• Legal Requirements – if required by law, such as reporting abuse, public health risks, workers' compensation claims, or responding to a court order.

Other Uses and Disclosures

We are allowed or required to shared your information in other ways that contribute to the public good, such as public health and research. We are required to meet several conditions in the law before we can share your information for these purposes, which may include the following:

• Public Health and Safety – we can share health information for situations such as preventing disease, helping with product recalls, or reporting adverse reactions to medications.
• Support Research – we can use or share your information for health research.
• Organ and Tissue Donation – we can share health information about you with procurement organizations.
• Medical Examiner or Funeral Director – we can share health information with a coroner, medical examiner, or funeral director when an individual dies.

All other uses and disclosures require prior authorization. You have the right to receive a copy of the authorization and the right to revoke the authorization at any time.

HIPAA Privacy Rule to Support Reproductive Health Care Privacy

This rule prohibits the disclosure of protected health information related to lawful reproductive health care. We will comply with this rule to protect patient confidentiality by taking the steps below:

• We will not disclose PHI related to reproductive health care for the purpose of investigating or imposing liability on any individual for seeking, obtaining, or providing lawful health care services;
• If requested to disclose PHI potentially related to reproductive health care, we will obtain a signed attestation from the requesting party stating that the disclosure is not for a prohibited purpose; and
• Comply with all applicable state and federal laws regarding the privacy and confidentiality of reproductive health information.

It is the practice's presumption that reproductive health care provided by a person other than us is lawful unless we have actual knowledge that is was not lawful.

Notice Regarding the Use of Technology

We may use electronic software, services, and equipment, including without limitation to email, video conferencing technology, cloud storage and servers, internet communication, cellular network, voicemail, facsimile, electronic health record, and related technology ("Technology") to share Protected Health Information (PHI) with you or third-parties subject to the rights and restrictions contained herein. In any event, certain unencrypted storage, forwarding, communications and transfers may not be confidential. We will take measures to safeguard the data transmitted, as well as ensure its integrity against intentional or unintentional breach or corruption. However, in very rare circumstances security protocols could fail, causing a breach of privacy or PHI.

Your Rights

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to assist you.

Access to Records

• You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you.
• We will provide a copy or a summary of your health information, within 60 days of your request. We may charge a reasonable, cost-based fee.

Request Restrictions

• You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request, and we may say "no" if it would affect your care.
• If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say "yes" unless a law requires us to share that information.

Confidential Communications

• You can ask us to contact you in a specific manner (for example, home or office phone) or to send mail to a different address. We will say "yes" to all reasonable requests.

Amend Records

• You can ask us to correct inaccuracies in your health record. We may say "no" to your request, but we will tell you why in writing within 60 days.

Receive a Record of Disclosures

• You can ask for a list (accounting) of the times we've shared your health information for six years prior to the date you ask, who we shared it with, and why.
• We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We'll provide one accounting per year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.

Your Choices

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions. In these cases, you have both the right and choice to tell us to:

• Share information with your family, close friends, or others involved in your care
• If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.
• We will make sure the person has this authority and can act for you before we take any action.
• If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

Complaints or Questions

If you believe your privacy rights have been violated, you may file a complaint with us by emailing us at GwenMD@kane-wangerrheum.com, or by filing a complaint with the US Department of Health and Human Services Office for Civil Rights at https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf.