NOTICE OF PRIVACY PRACTICES AND HEALTHCARE PRIVACY POLICY — DRAFT FOR ATTORNEY REVIEW INTERNAL REVIEW NOTE: This is a structured preparation draft only. It must be reviewed and finalized by a qualified Texas healthcare compliance attorney before it is distributed to any patient, member, or the public. Sunrise Family Medical Center Austin Texas USA Effective Date: January 1 2026 Privacy Officer: Dr Sarah Chen Email: privacy@sunrisefmc.com Phone: 512-555-0100 1. OUR COMMITMENT TO YOUR PRIVACY At Sunrise Family Medical Center, protecting your health information is one of our most important responsibilities. This notice explains how we may use and share information about your health, how you can access that information, and what rights you have to protect it. We are committed to honoring those rights and to making it easy for you to exercise them. Please read this notice carefully. If you have any questions, we encourage you to contact our Privacy Officer at privacy@sunrisefmc.com or 512-555-0100. 2. WHAT THIS NOTICE COVERS AND ABOUT HIPAA This notice covers all protected health information that Sunrise Family Medical Center creates, receives, uses, or discloses about you in connection with the healthcare services we provide. Protected health information generally means individually identifiable information related to your past, present, or future physical or mental health condition, the healthcare services you receive, or the payment for those services. The Health Insurance Portability and Accountability Act, known as HIPAA, is a federal law that sets national standards for the protection of patients' health information. We are required by law to maintain the privacy of your protected health information, to give you this notice describing our legal duties and privacy practices, and to follow the terms of the notice currently in effect. Texas state law may provide additional privacy protections beyond HIPAA, and we honor those protections as well. 3. HOW WE USE AND SHARE YOUR HEALTH INFORMATION 3.1 Treatment We may use and share your health information to provide, coordinate, and manage your care. For example, if you are referred to a specialist, we may share your medical records with that specialist so they can provide you with appropriate care. 3.2 Payment We may use and share your health information to bill for the services we provide and to receive payment from your insurance plan or other payers. For example, we may send your diagnosis and treatment information to your insurance company to process a claim for your office visit. 3.3 Healthcare Operations We may use and share your health information for internal activities that help us provide quality care efficiently, such as reviewing the quality of care we provide, training our staff, and preparing for accreditation reviews. 3.4 Other Permitted Uses and Disclosures We may also use or share your health information without your authorization in the following circumstances: - Public health reporting: As required by Texas and federal law to report certain diseases or conditions to public health authorities. - Law enforcement: As required by law including in response to a valid court order or subpoena. - Family member disclosures: With your verbal agreement, to family members or others directly involved in your care who need the information to help you. - Emergency situations: To prevent or lessen a serious and imminent threat to health or safety. Each of these categories is governed by specific regulatory requirements that must be confirmed with a qualified Texas healthcare compliance attorney. 4. USES AND DISCLOSURES REQUIRING YOUR WRITTEN AUTHORIZATION Certain uses and disclosures require your written authorization before they may occur, including most uses of your health information for marketing purposes and the sale of your health information. You may revoke any authorization you have given us at any time in writing. These requirements must be confirmed with a qualified healthcare compliance attorney. 5. SENSITIVE CATEGORIES OF HEALTH INFORMATION Texas law provides additional privacy protections for mental health records under the Texas Mental Health and Developmental Disabilities Confidentiality Act (MHDDCA). Mental health records held by Sunrise Family Medical Center are subject to stricter confidentiality requirements than standard HIPAA protections and will only be disclosed in limited circumstances permitted by Texas law, generally requiring your specific written authorization. A qualified Texas healthcare compliance attorney must confirm that this section accurately reflects all applicable Texas state law requirements before this policy is finalized or distributed. 6. YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION You have important rights regarding your health information and we are committed to making them easy to exercise. 6.1 Right to Access You have the right to inspect and receive a copy of your health information held by Sunrise Family Medical Center. To request access, please submit a written request to our Privacy Officer. We will respond within 30 days of receiving your request. Records may be provided in paper or electronic format through our patient portal. Reasonable fees may apply for paper copies in accordance with applicable law. If we deny your request, we will explain the reason and your options for appeal. 6.2 Right to Request Amendment If you believe your health information is inaccurate or incomplete, you may request that we correct it. Please submit your request in writing to our Privacy Officer. We will respond within 60 days. If we deny your amendment request, we will explain why and you have the right to submit a statement disagreeing with our decision. 6.3 Right to Request Restrictions You may request that we restrict how we use or share your health information. We are not required to agree to all restriction requests, but we must honor a request to restrict disclosure to your health plan for services you have paid for in full out of pocket. 6.4 Right to Confidential Communications You may ask us to contact you about your health information at a different phone number, address, or through the patient portal. We will honor reasonable requests without requiring you to explain why. 6.5 Right to an Accounting of Disclosures You have the right to receive a list of certain disclosures we have made of your health information in the six years prior to your request. Please submit your request in writing to our Privacy Officer. We will respond within 60 days. 6.6 Right to a Paper Copy of This Notice You may request a paper copy of this notice at any time at no charge by contacting our Privacy Officer. 6.7 Right to Be Notified of a Breach If your unsecured protected health information is breached, we will notify you in accordance with the HIPAA Breach Notification Rule and applicable Texas breach notification law. 7. HOW WE PROTECT YOUR HEALTH INFORMATION Sunrise Family Medical Center uses administrative, physical, and technical safeguards to protect your health information from unauthorized access or disclosure. We train all staff members on privacy and security obligations and hold them accountable for compliance. Our electronic health records are protected through secure systems accessible only by authorized staff. 8. ELECTRONIC HEALTH INFORMATION You can access your health records securely through our patient portal. Your electronic health information is protected using industry-standard security measures including encryption and access controls. 9. HOW TO EXERCISE YOUR RIGHTS AND FILE A COMPLAINT To exercise any of your privacy rights, please contact our Privacy Officer: Dr Sarah Chen Email: privacy@sunrisefmc.com Phone: 512-555-0100 If you believe your privacy rights have been violated, you may file a complaint with us at the above contact information or with the US Department of Health and Human Services Office for Civil Rights at www.hhs.gov/ocr. We will never retaliate against you for filing a privacy complaint. This notice may be updated at any time. The effective date at the top of this notice reflects when the most recent version took effect. Updated notices will be posted at our facility, on our website, and paper copies will be available upon request. DISCLAIMER: This Healthcare Privacy Policy and Notice of Privacy Practices draft was generated by an AI drafting tool as a structured preparation and documentation aid only. It does not constitute a certified HIPAA-compliant Notice of Privacy Practices and must not be distributed to any patient, member, or the public without review and finalization by a qualified healthcare compliance attorney.