Notice of Privacy Practices

About this notice

The Institute for Human Optimization (“IFHO,” “we,” “us” or “our”) is committed to protecting the privacy of your protected health information (“PHI”). PHI is information about you, including demographic information, that relates to your past, present or future physical or mental health or condition; the provision of health care to you; or payment for that care, and that identifies you or could reasonably be used to identify you.

This notice applies to health care professionals, workforce members and locations operating under IFHO’s designated health care operations, including Longevity Gyms when providing or supporting services subject to HIPAA. These persons and locations may share PHI with one another as permitted by law for treatment, payment and health care operations.

Our general website practices are described separately in our Website Privacy Policy.

Our responsibilities

We are required by law to:

• Maintain the privacy and security of your PHI;
• Provide you with this notice of our legal duties and privacy practices;
• Follow the terms of the notice currently in effect;
• Apply reasonable safeguards to protect PHI from impermissible use or disclosure; and
• Notify affected individuals following a breach of unsecured PHI as required by law.

We will not use or disclose your PHI except as described in this notice or as otherwise permitted or required by law.

Your rights

Inspect and obtain a copy

You may ask to inspect or obtain an electronic or paper copy of PHI in a designated record set, such as medical and billing records. In most cases, we will act on a request within 30 days. We may charge a reasonable, cost-based fee permitted by law. We may deny access in limited circumstances; if so, we will explain the reason and any available review rights.

Request correction or amendment

You may ask us to amend PHI that you believe is incorrect or incomplete. We may deny the request in certain circumstances, but we will explain the denial in writing, generally within 60 days, and describe your right to submit a statement of disagreement.

Request confidential communications

You may ask us to contact you in a specific way or at a different address. We will accommodate reasonable requests and will not require you to explain why.

Request restrictions

You may ask us not to use or disclose certain PHI for treatment, payment or health care operations, or not to disclose it to a person involved in your care. We generally are not required to agree. If you pay for a health care item or service out of pocket in full and ask us not to disclose information about that item or service to a health plan for payment or health care operations, we must agree unless disclosure is required by law.

Receive an accounting of disclosures

You may request a list of certain disclosures of your PHI made during the six years before your request. The accounting will not include every disclosure, including most disclosures for treatment, payment or health care operations and disclosures you authorized. One accounting in any 12-month period is free; we may charge a reasonable, cost-based fee for additional requests after giving you advance notice.

Choose someone to act for you

If you have given someone medical power of attorney or if someone is your legal guardian or otherwise authorized personal representative, that person may exercise your rights and make choices about your PHI as permitted by law. We may verify the person’s authority.

Receive a paper copy

You may request a paper copy of this notice at any time. We will provide one promptly.

Your choices

For certain PHI, you may tell us your preferences about what we disclose. If you have a clear preference, tell us and we will follow your instructions when required by law.

• You may identify family members, friends or others involved in your care or payment for your care.
• You may identify a person to contact in a disaster-relief situation.
• You may tell us not to share information with persons involved in your care.

If you cannot tell us your preference—for example, if you are unconscious—we may disclose relevant PHI if we determine it is in your best interest and permitted by law. We may also disclose PHI when necessary to lessen a serious and imminent threat to health or safety.

How we may use and disclose your PHI

Treatment

We may use and disclose PHI to provide, coordinate or manage your care and related services. For example, we may share relevant information with a physician, nurse, laboratory, pharmacy or other provider involved in your care.

Payment

We may use and disclose PHI to bill for services, collect payment, determine eligibility or coverage, obtain prior authorization and coordinate benefits.

Health care operations

We may use and disclose PHI to operate our practice, improve quality, train and evaluate personnel, conduct compliance and auditing activities, manage risk, provide customer service, credential professionals and perform other permitted health care operations.

Business associates

We may disclose PHI to vendors that perform services for us and require access to PHI, such as technology, scheduling, billing, legal, consulting or records providers. We require business associates to protect PHI as required by HIPAA and applicable agreements.

Appointment reminders and health-related services

We may contact you with appointment reminders, care-related instructions, treatment alternatives or information about health-related benefits and services that may interest you, as permitted by law.

As required or permitted by law

We may use or disclose PHI without your written authorization in circumstances permitted or required by law, including:

• Public-health and safety activities, including disease prevention, product recalls and adverse-event reporting;
• Reports concerning suspected abuse, neglect or domestic violence as authorized or required by law;
• Health-oversight activities, audits, inspections, investigations and licensure matters;
• Judicial and administrative proceedings in response to a lawful process and applicable safeguards;
• Law-enforcement purposes under the conditions established by law;
• Coroners, medical examiners and funeral directors;
• Organ, eye or tissue donation and transplantation;
• Workers’ compensation and similar programs;
• Research approved or permitted under HIPAA requirements;
• Preventing or reducing a serious threat to health or safety;
• Specialized government functions, including certain military, national-security and correctional activities; and
• Other disclosures required by federal, state or local law.

When another law provides greater privacy protection, we will follow the more protective requirement to the extent it applies.

Uses requiring written authorization

Uses and disclosures not described in this notice will generally be made only with your written authorization. Most uses and disclosures of psychotherapy notes, most uses and disclosures for marketing, and disclosures that constitute a sale of PHI require authorization, subject to exceptions under law.

You may revoke an authorization in writing at any time. Revocation will not affect action already taken in reliance on the authorization or where other law permits continued use or disclosure.

Information subject to special protections

Certain records may receive additional protection under federal or Maryland law, including records concerning mental or behavioral health, substance-use-disorder treatment, HIV/AIDS, genetic information, reproductive or sexual health, and records relating to minors. We will obtain consent or authorization when required and apply any more protective law that governs the information.

If IFHO creates or maintains records subject to 42 C.F.R. Part 2, those records may receive protections beyond HIPAA and will be handled in accordance with applicable Part 2 requirements.

Electronic communications and health information exchange

We may participate in electronic health information exchange or use electronic systems to coordinate care, as permitted by law. You may have rights concerning such exchange under applicable federal or Maryland law. Ask our Privacy Officer about available options.

Ordinary email and SMS may not be fully secure. We may use them for communications permitted by law and based on your preferences. Tell us if you want us to use a different reasonable method or location for confidential communications.

Changes to this notice

We may change this notice and our privacy practices. A revised notice may apply to PHI we already maintain and to PHI created or received in the future. The current notice will be available at our facilities and on our website. The effective date appears at the top of the notice.

Questions and complaints

You may contact our Privacy Officer if you have questions, want to exercise a right or believe your privacy rights were violated. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, through the OCR Complaint Portal, by mail, or by calling HHS at 1-877-696-6775. Additional information is available at hhs.gov/hipaa/filing-a-complaint.

We will not retaliate against you for filing a complaint or exercising a privacy right.