Notice of Privacy Practices

1. Important Scope Limitation

HARPER MD does not collect Protected Health Information (PHI) through its public website.

• Website forms, chats, and scheduling tools are not HIPAA-covered systems
• You should not submit medical information through the website
• PHI is collected only after you become a patient and enter information into our designated patient management system

This distinction is intentional and important.

2. Our HIPAA Obligations

Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), HARPER MD is required to:

• Maintain the privacy of your PHI
• Provide you with this Notice
• Follow the terms of this Notice
• Notify you in the event of a breach of unsecured PHI as required by law

3. How We Collect & Store PHI

HARPER MD uses a HIPAA-regulated patient management system (Pabau) to collect, store, and manage PHI related to patient care.

• PHI is collected only within Pabau or other designated HIPAA-compliant systems
• Pabau is independently responsible for maintaining its own HIPAA compliance and security controls
• HARPER MD accesses PHI only as permitted for treatment, payment, and healthcare operations

4. How We May Use and Disclose PHI

A. Treatment

To provide, coordinate, or manage your healthcare and related services.

B. Payment

To obtain payment for services provided, including billing and internal accounting.

C. Healthcare Operations

For clinic operations such as quality assessment, training, compliance, and administrative activities.

5. Other Permitted Uses & Disclosures

We may also use or disclose PHI:

• As required by law
• For public health activities
• For health oversight activities
• For legal proceedings or law enforcement when legally required
• To prevent serious threats to health or safety

All disclosures are made in accordance with HIPAA requirements.

6. Uses & Disclosures Requiring Authorization

We will not use or disclose your PHI for purposes outside those described above without your written authorization, including:

• Marketing communications involving PHI
• Sale of PHI
• Any use not otherwise permitted by HIPAA

You may revoke authorization at any time in writing.

7. Your Rights Regarding Your PHI

You have the right to:

• Access your PHI
• Request corrections to your PHI
• Request restrictions on certain uses or disclosures
• Request confidential communications
• Receive an accounting of disclosures
• Obtain a paper copy of this Notice

Requests must be submitted in writing and are subject to applicable legal requirements.

8. Communication Limitations

Electronic communications outside of Pabau (email, SMS, website messages) may not be HIPAA-secure. HARPER MD limits PHI communication to secure systems whenever required but cannot guarantee security outside designated platforms.

9. Data Safeguards

HARPER MD maintains administrative, technical, and physical safeguards appropriate to protect PHI accessed through its systems. However, no system is immune to risk. Pabau maintains its own safeguards independently. HARPER MD is not responsible for third-party system failures beyond its control.

10. Complaints & Non-Retaliation

If you believe your privacy rights have been violated, you may file a complaint with HARPER MD or with the U.S. Department of Health and Human Services (HHS). HARPER MD will not retaliate against you for filing a complaint.

11. Changes to This Notice

HARPER MD reserves the right to modify this Notice. Changes will apply to all PHI we maintain and will be made available upon request and on our website where applicable.