We may use and disclose your PHI for the following purposes without obtaining your written authorization :

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services. This includes sharing PHI with other healthcare providers, specialists, laboratories, pharmacies, hospitals, and home health agencies involved in your care; coordinating referrals; sending appointment reminders by phone, text, email, or patient portal; and providing information about treatment alternatives or services we offer.

Payment

We may use and disclose your PHI to obtain payment for services we provide. This includes verifying coverage and benefits with your health insurance plan, obtaining prior authorizations, submitting claims, billing you or a responsible party, and working with our billing partner (MedSelect Partners) and collection efforts as permitted by law

Healthcare Operations

We may use and disclose your PHI for activities necessary to operate our practice, including quality assessment and improvement, credentialing and performance review of staff and providers, training, accreditation and licensing, audits, legal services, business planning, and general administration.

Business Associates

We contract with outside organizations (“Business Associates”) to perform services on our behalf — for example, billing, electronic health records, IT support, accounting, and document storage. These Business Associates may receive PHI in the course of performing their services. We require each Business Associate to sign a written agreement obligating them to safeguard your PHI in compliance with HIPAA. 

Other Permitted Uses and Disclosures

We may also use or disclose your PHI without your authorization as permitted by 45 CFR § 164.512 and other applicable law, including:

• To avoid a serious and imminent threat to your health or safety, or to the health or safety of others.
• As required by federal, state, or local law, including reporting of suspected child abuse, elder
  abuse, domestic violence, neglect, or certain other events.
• For workers’ compensation purposes, to the extent authorized by and necessary to comply with workers’ compensation laws.
• For public health activities, including reporting of communicable diseases, vital statistics (births and deaths), adverse drug reactions, vaccine administration to immunization registries, and FDA-regulated product safety.
• For health oversight activities, including audits, inspections, investigations, and licensure or disciplinary actions by government agencies.
• In response to a court order, subpoena, warrant, summons, discovery request, or other lawful process in judicial or administrative proceedings.
• To law enforcement officials as permitted by law — for example, to identify or locate a suspect, fugitive, material witness, or missing person; to report deaths that may have resulted from criminal conduct; or to report certain crimes.
• To coroners, medical examiners, and funeral directors, and to organ procurement organizations, as necessary to carry out their duties.
• For specialized government functions, such as military and veterans’ activities, national security and intelligence activities, protective services for the President, and correctional institutions.
• For research purposes when an Institutional Review Board or privacy board has approved a waiver of authorization, or where other research-related conditions under HIPAA are met.
• To the Secretary of Health and Human Services for purposes of investigating or determining our compliance with HIPAA.

Unless you instruct us otherwise, we may disclose your PHI in the following situations. You have the right to object to these disclosures — in writing or verbally to our staff — and we will accommodate reasonable objections:

• To a family member, relative, close personal friend, or other person you identify, the information directly relevant to that person’s involvement in your care or payment for your care.
• To notify, or assist in notifying, a family member, personal representative, or another person responsible for your care of your location, general condition, or death.
• To disaster relief organizations, such as the American Red Cross, to coordinate notification of family members in an emergency.

Most uses and disclosures of PHI not described above will be made only with your written
authorization. This expressly includes:

• Most uses and disclosures of psychotherapy notes.
• Most uses and disclosures of PHI for marketing purposes.
• Any disclosure that constitutes a sale of your PHI.

You may revoke your authorization at any time, in writing, by contacting our Privacy Officer (see Section 9). Revocation will not apply to any uses or disclosures we already made in reliance on your authorization.

You have the following rights regarding your PHI. To exercise any right, please submit a written request to our Privacy Officer. We will respond within the timeframes required by law.

Right to Request Restrictions

You may request that we restrict our use or disclosure of your PHI for treatment, payment, or healthcare operations, or to persons involved in your care. We are not required to agree to most requested restrictions. However, we are required to agree to your request to restrict disclosure of PHI to a health plan if (a) the disclosure is for payment or healthcare operations and is not otherwise required by law, and (b) the PHI relates solely to a service for which you, or someone on your behalf, has paid us in full out of pocket.

Right to Confidential Communications

You may request that we communicate with you about your health matters in a particular way or at a particular location — for example, by mailing materials to a P.O. box rather than your home address, or by calling a specific phone number. We will accommodate reasonable requests.

Right to Inspect and Copy

You have the right to inspect and obtain a copy of the PHI in your designated record set, including in an electronic format if we maintain the records electronically. We may charge a reasonable, cost-based fee for copies. In limited circumstances permitted by law (for example, where we determine that access could endanger you or another person), we may deny your request, and you may have a right to have the denial reviewed.

Right to Request Amendment

You may request that we amend PHI we maintain about you if you believe the information is incorrect or incomplete. We may deny your request if, for example, the information was not created by us, is not part of the records used to make decisions about you, or is accurate and complete. If we deny your request, you may submit a written statement of disagreement that will be included with the disputed information.

Right to an Accounting of Disclosures

You have the right to receive a list (“accounting”) of certain disclosures we have made of your PHI. The accounting will not include disclosures made for treatment, payment, or healthcare operations; disclosures made to you; disclosures you authorized; or certain other disclosures specifically excluded by law. You are entitled to one accounting in any 12-month period at no charge; we may charge a reasonable, cost-based fee for additional accountings.

Right to a Paper Copy of This Notice

You may obtain a paper copy of this Notice at any time, even if you have agreed to receive it electronically. A current copy is also posted on our website at www.completecareofiowa.com.

Right to Be Notified of a Breach

You have the right to be notified following a breach of your unsecured PHI. We will notify you in writing without unreasonable delay, and in no case later than 60 days after we discover the breach, in accordance with 45 CFR §§ 164.400–414.

Right to Choose a Personal Representative

You may designate a personal representative to exercise your rights and make decisions about your
PHI on your behalf. We may require documentation of that person’s authority before disclosing PHI to them.

In general, a parent or legal guardian acts as the personal representative of a minor child and has the right to access the child’s PHI. Iowa law and federal law recognize specific situations in which a minor may consent to their own care — for example, certain reproductive, mental health, or substance-use services — and in those situations, the minor controls the PHI related to that care. We will follow applicable state and federal law in determining what PHI may be disclosed to a parent or guardian.

We use OptiMantra as our patient portal to communicate with you securely about appointments, results, and other healthcare matters. Standard email and text messaging are not fully secure methods of communication. If you choose to contact us by unencrypted email or text, you acknowledge the inherent risk that your information could be intercepted by an unauthorized person. We will not include sensitive PHI in unencrypted communications without your request or agreement. Please do not send protected health information to our general email address (info@completecareofiowa.com). For matters involving your medical record, please use the patient portal or call our office.

We are prohibited by the Genetic Information Nondiscrimination Act (GINA) from using or disclosing your genetic information for underwriting purposes by a health plan.

We reserve the right to change this Notice and our privacy practices at any time. Any revised Notice will apply to all PHI we maintain, including information created or received before the revision. We will post the current Notice in our reception area and on our website. You may obtain a copy of the current Notice from our reception desk or our Privacy Officer.

If you believe your privacy rights have been violated, you may file a written complaint with our Privacy Officer using the contact information below. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights:

U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
Toll-Free: 1-877-696-6775
Website: www.hhs.gov/ocr/privacy/hipaa/complaints/

We will not retaliate against you or take any adverse action against you for filing a complaint.

If you have any questions about this Notice, wish to exercise any of the rights described above, or wish
to file a complaint, please contact our Privacy Officer:

This Notice of Privacy Practices is effective May 14, 2026, and supersedes all prior versions.