HIPAA Notice of Privacy Practices

Notice of Privacy Practices

Effective Date: February 16, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND
DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. If you are a minor, your
parent or legal guardian must read this notice and handle your privacy rights for you. PLEASE REVIEW THIS
CAREFULLY.

Our Responsibilities. Your Rights.

We are committed to safeguarding your PHI and ensuring compliance with applicable federal and state privacy
laws. When using or disclosing your PHI, we will limit the information to the minimum necessary to accomplish
the intended purpose, except in cases where this standard does not apply, such as disclosures to you or with your
written authorization. We are required by law to adhere to the terms of this notice as currently in effect. We will
notify you in writing if we make changes to this notice. You may request a copy of this notice at any time by
contacting us at the contact information provided on the last page of this notice.
You have the following rights regarding your PHI:
• Right to Access. You have the right to inspect and obtain a copy of your PHI in our designated record set,
such as medical or billing records, for as long as we maintain the information. We may charge a reasonable,
cost-based fee for copies. We will respond to your request within 30 days unless we require an extension.
• Right to Amend. If you believe your PHI is incorrect or incomplete, you may request that we amend it. We
may deny your request under certain circumstances, such as if we did not create the information. We will
respond to your request within 60 days.
• Right to Accounting of Disclosures. You have the right to request a list of certain disclosures of your PHI
made by us during the past six (6) years (or a shorter period, if applicable). The list will not include disclosures
for treatment, payment, health care operations, or disclosures you authorized. We will respond to your request
within 60 days unless we require an extension. We will provide one (1) accounting per year at no charge;
additional requests may incur a reasonable, cost-based fee.
• Right to Request Restrictions. You have the right to request restrictions on how we use or disclose your
PHI for treatment, payment, or health care operations, or to certain individuals involved in your care. We are
not required to agree to your request, except for disclosures to your health plan for services you paid for out
of pocket in full.
• Right to Request Confidential Communications. You have the right to request that we communicate
with you about your PHI in a specific way or at a specific location, such as by email or at an alternate address.
We will accommodate reasonable requests.
• Right to Paper Copy of This Notice. You have the right to receive a paper copy of this notice at any time,
even if you have agreed to receive it electronically.
How We May Use and Disclose Your Protected Health Information.
The following sections describe the ways we may use and disclose your PHI, including examples to help you
understand these uses and disclosures. Not every possible use or disclosure is listed, but all uses and disclosures
will comply with applicable laws.
1. Uses and Disclosures for Treatment, Payment, and Health Care Operations. We may use and disclose
your PHI for the following purposes without your authorization, unless otherwise restricted by law:
• Treatment. We may use your PHI to provide, coordinate, or manage your health care and related services.
We may also disclose your PHI to other health care providers involved in your care.

Example: We may share your medical records with a specialist to coordinate your
treatment plan or provide your PHI to a hospital where you are receiving care.
• Payment. We may use and disclose your PHI to bill and collect payment for the services we provide,
including submitting claims to your health insurance plan.
Example: We may send your PHI to your insurance company to verify coverage or obtain
payment for a procedure.
• Health Care Operations. We may use and disclose your PHI for activities necessary to operate our
practice, such as quality improvement, staff training, or compliance audits.
Example: We may review your PHI to evaluate the quality of care provided or train our
staff on privacy practices.

You have the right to request restrictions on how your PHI is used or disclosed for treatment, payment, or health
care operations. While we are not required to agree to your request, we will consider it carefully and notify you of
our decision.

2. Uses and Disclosures Requiring Your Authorization. For uses and disclosures of your PHI not described
in this notice, we will obtain your written authorization, except as permitted or required by law. Examples include:
• Marketing. We will not use your PHI for marketing purposes without your authorization.
• Sale of PHI. We will not sell your PHI without your authorization.
• Psychotherapy Notes. We will not use or disclose psychotherapy notes without your authorization, except
for limited purposes, such as treatment or legal compliance.
You may revoke an authorization in writing at any time, and we will stop using or disclosing your PHI for the
purposes covered by the authorization, except for actions already taken.
In addition to the uses and disclosures described above, we will abide by any more stringent requirements imposed
by applicable state laws regarding the sale or other disclosures of your PHI. If state law prohibits or further restricts
a disclosure that would otherwise be permitted under federal law, we will not make that disclosure.

3. Uses and Disclosures Permitted Without Your Authorization. We may use or disclose your PHI without
your authorization in the following situations, subject to applicable legal requirements:
• Required by Law. We may disclose your PHI when required by federal, state, or local law, provided the
disclosure complies with all applicable conditions.
• Public Health Activities. We may disclose your PHI to public health authorities for activities such as
preventing or controlling disease, reporting births and deaths, or notifying individuals of product recalls.
• Health Oversight Activities. We may disclose your PHI to government agencies for oversight activities,
such as audits or investigations of health care providers.
• Judicial and Administrative Proceedings. We may disclose your PHI in response to a court order,
subpoena, or other lawful process, subject to specific protections described below.
• Law Enforcement Purposes. We may disclose your PHI to law enforcement officials for purposes such
as identifying a suspect or reporting a crime on our premises, subject to specific protections described
below.
• Coroners, Medical Examiners, and Funeral Directors. We may disclose your PHI to coroners or
medical examiners to identify a deceased person or determine the cause of death, or to funeral directors to
carry out their duties.
• Organ and Tissue Donation. We may disclose your PHI to organizations that handle organ, eye, or tissue
donation or transplantation.

• Research. We may use or disclose your PHI for research purposes under strict conditions, such as with
approval from an Institutional Review Board.
• To Prevent a Serious Threat to Health or Safety. We may disclose your PHI to prevent a serious threat
to your health or safety or that of others.
• Specialized Government Functions. We may disclose your PHI for military activities, national security,
or to correctional institutions if you are an inmate.
• Workers’ Compensation. We may disclose your PHI to comply with workers’ compensation laws or
similar programs.
4. Reproductive Health Care Information. Reproductive health care includes care affecting the reproductive
system, such as contraception, fertility treatments, abortion, miscarriage care, and over-the-counter medications or
devices. On June 18, 2025, a federal court in Texas (Purl v. HHS) struck down certain 2024 HIPAA Privacy Rule
provisions that provided additional protections for reproductive health care information, ruling that the U.S.
Department of Health and Human Services exceeded its authority. As a result, we handle PHI related to
reproductive health care under standard HIPAA rules and applicable state laws. When we receive PHI about
reproductive health care provided by another health care provider, we presume such care was lawful unless we
have clear evidence to the contrary.
5. Special Protections for Substance Use Disorder Treatment Records. If we maintain records of your SUD
treatment from a federally assisted program, these records are protected by federal law under 42 CFR Part 2,
“Confidentiality of Substance Use Disorder Patient Records.” These protections apply to information that could
identify you as having or having had a substance use disorder. The following rules apply:
• Limitations on Use and Disclosure. We will not use or disclose your SUD treatment records, or
testimony about them, in civil, criminal, administrative, or legislative proceedings against you without your
written consent or a court order accompanied by a subpoena or other legal requirement.
Example: We will not disclose your SUD treatment records to a court for use in a
criminal proceeding against you unless you provide written consent or a court issues
an order with a valid subpoena.
• Redisclosure Warning. If we disclose your SUD treatment records to an entity not covered by HIPAA,
such as a social service agency, that information may be redisclosed by the recipient and may no longer be
protected by federal privacy laws.
Example: If we share your SUD treatment records with a non-HIPAA-covered entity,
that agency may share the information with others, and it will no longer be protected by
HIPAA or federal law under 42 CFR Part 2.
• Your Rights. You have the right to request restrictions on how your SUD treatment records are used or
disclosed for treatment, payment, or health care operations. You may also file a complaint if you believe
your privacy rights have been violated, and we will not retaliate against you for doing so. Complaints about
SUD records can be filed with the U.S. Department of Health and Human Services.
• Fundraising Communications. If we plan to contact you for fundraising purposes and maintain SUD
treatment records, we will notify you of our intent and provide you with an opportunity to opt out of
receiving such communications.
6. Disclosures to Business Associates. We may share your PHI with our business associates, such as billing
companies or electronic health record vendors, who perform services on our behalf. We require these business
associates to sign agreements to protect your PHI in accordance with HIPAA and 42 CFR Part 2 where applicable.
7. Disclosures to Family, Friends, or Others Involved in Your Care. We may disclose your PHI to a family
member, friend, or other person you designate as involved in your care or payment for your care, unless you object.
If you are not present or are incapacitated, we may disclose your PHI if we believe it is in your best interest.

Notice of PHI Breach.

If a breach of your PHI occurs, we will notify you as required by federal and state law.
Complaints.
If you believe your privacy rights have been violated, you may file a complaint us or with the Office for Civil Rights
at the U.S. Department of Health and Human Services.
To file a complaint with us, please write to us using the contact information provided below. All complaints must
be submitted to us in writing. We will not retaliate against you for filing a complaint.

For complaints related to SUD treatment records, you may also contact the U.S. Department of Health and Human
Services at:
Office for Civil Rights
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
Phone: (800) 368-1019
Changes to This Notice.

We reserve the right to change this notice at any time from time to time and make the revised notice effective for
PHI we already have about you as well as any PHI we receive in the future. We will post a copy of the current
notice in our office and/or on our website, with the effective date stated. You may request a paper copy of the
current notice at any time.

Contact Information.

For questions about this notice, to request a paper copy, or to file a complaint, please contact:
Sage Dermatology and Mohs Surgery
(801)882-9995
11760 South 700 East, Suite 112
Draper, Utah 84020