Our Privacy Obligations

The law requires us to maintain the privacy of certain health information called "Protected Health Information" ("PHI"). Protected Health Information is the information that you provide us or that we create or receive about your health care. The law also requires us to provide you with this Notice of our legal duties and privacy practices. When we use or disclose (share) your Protected Health Information, we are required to follow the terms of this Notice or other notice in effect at the time we use or share the PHI. Finally, the law provides you with certain rights described in this Notice. Furthermore, we are required to notify you following a breach of unsecured PHI.

Ways We Can Use and Share Your PHI Without Your Written Permission (Authorization)

In many situations, we can use and share your PHI for activities that are common in many hospitals and clinics. In certain other situations, which we will describe in Section 4 below, we must have your written permission (authorization) to use and/or share your PHI. We do not need any type of permission from you for the following uses and disclosures:

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND SHARED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice describes the privacy practices of SteadyMD Physician Group and/or Affiliates. It applies to the Behavioral Health Services you receive from SteadyMD Physician Group and/or its Affiliates. SteadyMD Physician Group and/or its Affiliates will be referred to herein as "we" or "us." We will share your health information among ourselves to carry out our treatment, payment, and health care operations.

Uses and Disclosures for Treatment, Payment and Health Care Operations

We may use and share your PHI to provide "Treatment," obtain "Payment" for your Treatment, and perform our "Health Care Operations." These three terms are defined as: Definitions • Treatment. We use and share your PHI to provide care and other services to you--for example, to diagnose and treat your injury or illness. In addition, we may contact you to provide appointment reminders or information about treatment options. We may tell you about other health-related benefits and services that might interest you. We may also share PHI with other doctors, nurses, and others involved in your care.

• Payment. We may use and share your PHI to receive payment for services that we provide to you. For example, we may share your PHI to request payment and receive payment from Medicare, Medicaid, your health insurer, HMO, or other company or program that arranges or pays the cost of some or all of your health care ("Your Payor") and to confirm that Your Payor will pay for health care. As another example, we may share your PHI with the person who you told us is primarily responsible for paying for your Treatment, such as your spouse or parent.
• Health Care Operations. We may use and share your PHI for our health care operations, which include management, planning, and activities that improve the quality and lower the cost of the care that we deliver. For example, we may use PHI to review the quality and skill of our physicians, nurses, and therapists. However, you have the right to restrict disclosure to a health plan for healthcare services for which you pay in full out of pocket (excluding a deductible).
• Business Associates. In addition, we may share PHI with certain others who help us with our activities, including those we hire to perform services.

Your Other Health Care Providers

We may also share PHI with your doctor and other health care providers when they need it to provide Treatment to you, to obtain Payment for the care they give to you, to perform certain Health Care Operations, such as reviewing the quality and skill of health care professionals, or to review their actions in following the law.

Disclosure to Relatives, Close Friends and Your Other Caregivers

We may share your PHI with your family member/relative, a close personal friend, or another person who you identify if we: (1) first provide you with the chance to object to the disclosure and you do not object; (2) reasonably infer that you do not object to the disclosure; or (3) obtain your agreement to share your PHI with these individuals. If you are not present at the time we share your PHI, or you are not able to agree or disagree to our sharing your PHI because you are not capable or there is an emergency circumstance, we may use our professional judgment to decide that sharing the PHI is in your best interest. We may also use or share your PHI to notify (or assist in notifying) these individuals about your location and general condition.

Public Health Activities

We are required or are permitted by law to report PHI to certain government agencies and others. For example, we may share your PHI for the following: • to report health information to public health authorities for the purpose of preventing or controlling disease, injury, or disability; • to report abuse and neglect to government authorities, including a social service or protective services agency, that are legally permitted to receive the reports; • to report information about products and services to the U.S. Food and Drug Administration; • to alert a person who may have been exposed to a communicable disease or may otherwise be at risk of developing or spreading a disease or condition; • to report information to your employer as required under laws addressing work-related illnesses and injuries or workplace medical surveillance; and • to prevent or lessen a serious and imminent threat to a person for the public's health or safety, or to certain government agencies with special functions such as the State Department.

Health Oversight Activities

We may share your PHI with a health oversight agency that oversees the health care system and ensures the rules of government health programs, such as Medicare or Medicaid, are being followed.

Judicial and Administrative Proceedings

We may share your PHI in the course of a judicial or administrative proceeding in response to a legal order or other lawful process.

Law Enforcement Purposes

We may share your PHI with the police or other law enforcement officials as required or permitted by law or in compliance with a court order or a subpoena.

Decedents

We may share PHI with a coroner or medical examiner as authorized by law. We may share your PHI with a family member who was involved in your care or payment for your care prior to death, unless such disclosure would be inconsistent with any prior expression you have communicated to us. Under federal, the privacy rights described herein will expire fifty years after your death.

Organ and Tissue Procurement

We may share your PHI with organizations that facilitate organ, eye, or tissue procurement, banking, or transplantation.

Research

We may use or share your PHI if the group that oversees our research, the Institutional Review Board/ Privacy Board, approves a waiver of permission (authorization) for disclosure or for a researcher to begin the research process.

Workers' Compensation

We may share your PHI as permitted by or required by state law relating to workers' compensation or other similar programs.

Disaster Relief

We may share your PHI to a public or private entity authorized by law or by its charter to assist in disaster relief efforts.

School Immunization Requests

We may share your PHI for purposes of school immunization requests if the school is required by law to have documentation of such immunization(s) for enrollment.

Fundraising

We may contact you to raise funds for SteadyMD Physician Group. You may tell us you do not wish to be contacted for this purpose, and will agree to remove you from the list. To do so, please contact the Privacy Officer.

As required by law

We may use and share your PHI when required to do so by any other law not already referred to above.

USES AND DISCLOSURES REQUIRING YOUR WRITTEN PERMISSION (AUTHORIZATION)

Use or Disclosure with Your Permission (Authorization)

For any purpose other than the ones described above in Section 2, we may only use or share your PHI when you grant us your written permission (authorization). For example, you will need to give us your permission before we send your PHI to your life insurance company.

Marketing

We must also obtain your written permission (authorization) prior to using your PHI to send you any marketing materials paid for by a third party. However, we may communicate with you face to face about products or services related to your treatment, case management, or care coordination, or alternative treatments, therapies, health care providers, or care settings. For example, we may not sell your PHI without your written authorization.

Uses and Disclosures of Your Highly Confidential Information

Federal and state law requires special privacy protections for certain highly confidential information about you ("Highly Confidential Information"), including: (1) any portion of your PHI that is kept in psychotherapy notes; (2) about mental health and developmental disabilities services; (3) about alcohol and drug abuse prevention, treatment and referral; (4) about HIV/AIDS testing, diagnosis or treatment; (5) about sexually transmitted disease(s); (6) about genetic testing; (7) about child abuse and neglect; (8) about domestic abuse of an adult with a disability; (9) about sexual assault; or (10) In Vitro Fertilization (IVF). Before we share your Highly Confidential Information for a purpose other than those permitted by law, we must obtain your written permission.

YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION For Further Information;

Complaints

If you want more information about your privacy rights, are concerned that we have violated your privacy rights, or disagree with a decision that we made about access to your PHI, you may contact our HIPAA Privacy Officer. You may also file written complaints with the Office for Civil Rights (“OCR”) of the U.S. Department of Health and Human Services by sending a letter to 200 Independence Avenue, S.W., Washington D.C. 20201, calling 1-877696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints. We will not take any action against you if you file a complaint with us or with the OCR.

Right to Receive Confidential Communications

You may ask us to send PHI to a different location than the address that you gave us, or in a special way, or to contact you at a different phone number. You will need to ask us in writing. For example, you may ask us to send a copy of your medical records to a different address than your home address. We will accept all reasonable requests.

Right to Revoke Your Written Permission (Authorization)

You may change your mind about your authorization or any written permission regarding your PHI by giving or sending a written "revocation statement" to the HIPAA Privacy Officer at the address below. The revocation will not apply to the extent that we have already taken action where we relied on your permission.

Right to Inspect and Copy Your Health Information

You may request copies (for a reasonable fee) and/or access to your medical record file, billing records, and other records. You have a right to a copy of your records, if part of a “designated record set” in electronic format, as reasonably available. You can review your medical records and/or ask for hard copies. Under limited circumstances, we may deny you access to a portion of your records. If you want to access your records, you may obtain a record request form from SteadyMD Physician Group and/or its Affiliates. Return the completed form to the Privacy Officer.

Right to Amend Your Records

You have the right to request that we amend PHI maintained in medical record files, billing records, and other records used to make decisions about your Treatment and payment for your Treatment. If you want to amend your records, you may obtain an amendment request form from the HIPAA Privacy Officer. After which, you can return the completed form to the HIPAA Privacy Officer. We will comply with your request unless we believe that the information that would be amended is correct and complete or that other circumstances apply. In the case of a requested amendment concerning information about the Treatment of a mental illness or developmental disability, you have the right to appeal to a state court our decision not to amend your PHI.

Right to Receive an Accounting of Disclosures

You may ask for an accounting of certain disclosures of your PHI made by us. These disclosures must have occurred before the time of your request, and we will not go back more than six (6) years before the date of your request. If you request an accounting more than once during a twelve (12) month period, we will charge you based on the rate sheet. Direct your request for an accounting to the HIPAA Privacy Officer.

Right to Request Restrictions

You have the right to ask us to restrict or limit the PHI we use or disclose about you for treatment, payment, or health care operations. With one exception, we are not required to agree to your request. If we do agree, we will comply unless the information is needed to provide emergency treatment. Your request for restrictions must be made in writing and submitted to the HIPAA Privacy Officer at the address below. We must grant your request to a restriction on disclosure of your PHI to a health plan if you have paid for the health care item in full out of pocket.

Right to Receive a Copy of this Notice

If you ask, you may obtain a copy of this Notice, even if you have agreed to receive the notice electronically.

Effective Date

This Notice is effective as of September 1, 2016.

Right to Change Terms of this Notice

We may change the terms of this Notice at any time. If we change this Notice, we may make the new notice terms effective for all Protected Health Information that we maintain, including any information created or received prior to issuing the new notice. If we change this Notice, we will post the new notice in common areas throughout our facility, and on our Internet site at www.SteadyMD.com. You also may obtain any new notice by contacting the Privacy Officer.

Federal & State Law

Federal and state laws require SteadyMD Physician Group to protect your medical information and federal law requires SteadyMD Physician Group to describe to you how we handle that information. When federal and state privacy laws differ, and the state law is more protective of your information or provides you with greater access to your information, then state law will override federal law.

Questions or Concerns

You may contact the Privacy Officer for additional information: Diane Keefe

4625 Lindell Blvd., Suite 200, St. Louis, MO 63108

info@steadymd.com

PATIENT BILL OF RIGHTS

Many states have adopted a patient bill of rights applicable to patients of physicians and/or hospitals and other health care facilities. Some of those states require that physicians and other health care providers provide a copy of the bill of rights to their patients. The portion of the bill of rights that is relevant to the Behavioral Health Services is provided to you here on behalf of SteadyMD Physician Group and/or its Affiliates. Please note that it includes patient responsibilities as well.

• A patient has the right to be treated with courtesy and respect, with appreciation of his or her individual dignity, and with protection of his or her need for privacy.
• A patient has the right to a prompt and reasonable response to questions and requests within the context of the Behavioral Health Services.
• A patient has the right to know who is providing Behavioral Health Services and who is responsible for his or her care.
• A patient has the right to know what patient support services are available, including whether an interpreter is available if he or she does not speak English.
• A patient has the right to know what rules and regulations apply to his or her conduct.
• A patient has the right to be given information by the Therapist concerning diagnosis, planned course of treatment, alternatives, risks, and prognosis.
• A patient has the right to refuse any treatment provided via the Behavioral Health Services unless otherwise required by law.
• A patient has the right to impartial access to medical treatment or accommodations, regardless of race, national origin, religion, handicap, or source of payment, subject to the technical limitations of the Behavioral Health Services.
• A patient has the right to express grievances regarding any violation of his or her rights, as stated in state law, through the grievance procedure of the health care provider which served him or her and to the appropriate state licensing agency.
• A patient is responsible for providing to the Therapist, to the best of his or her knowledge, accurate and complete information about present complaints, past illnesses, hospitalizations, medications, and other matters relating to his or her health.
• A patient is responsible for reporting unexpected changes in his or her condition to the Therapist.
• A patient is responsible for reporting to the Therapist whether he or she comprehends a contemplated course of action and what is expected of him or her.
• A patient is responsible for following the treatment plan recommended by the Therapist
• A patient is responsible for his or her actions if he or she refuses treatment or does not follow the Therapist’s instructions.

STATE SPECIFIC MENTAL HEALTH NOTIFICATIONS

FOR COLORADO RESIDENTS • Every patient record in the custody of a psychologist, except psychotherapy notes, must be available to you or your personal representative upon submission of a valid authorization for inspection of records, dated and signed by you, at reasonable times and upon reasonable notice. A summary of records pertaining to your mental health records may, upon written request accompanied by a signed and dated authorization, be made available to you or your personal representative following termination of the treatment program with the psychologist.

FOR DISTRICT OF COLUMBIA RESIDENTS • A mental health professional, mental health facility or data collector shall permit you or your representative, upon written request, to inspect and duplicate your record of mental health information maintained by the mental health professional, mental health facility or data collector within 30 days from the date of receipt of the request. A mental health professional, responsible for the diagnosis or treatment shall have the opportunity to discuss the mental health information with you or your representative at the time of such inspection.

FOR HAWAII RESIDENTS • All medical reports resulting from telehealth services are part of your health record and shall be made available to you. Patient medical records shall be maintained in compliance with all applicable state and federal requirements including privacy requirements. If you request copies of your medical records, the copies shall be made available to you unless, in the opinion of the health care provider, it would be detrimental to your health to obtain the records. If the health care provider is of the opinion that release of the records to you would be detrimental to your health, the health care provider shall advise you that copies of the records will be made available to your attorney upon presentation of a proper authorization signed by you.

FOR MICHIGAN RESIDENTS • Information in your record and other information acquired in the course of providing mental health services to you shall be disclosed to you, as an adult recipient, upon your request, if you do not have a guardian and have not been adjudicated legally incompetent. The holder of the record shall comply with your request for disclosure as expeditiously as possible but in no event later than the earlier of 30 days after receipt of the request or, if you are receiving treatment from the holder of the record, before the recipient is released from treatment.

FOR MINNESOTA RESIDENTS • Upon written request of your spouse, parent, child or sibling, if you are evaluated for or diagnosed with mental illness, a provider must ask you whether you wish to authorize a specific individual to receive information regarding your current and proposed course of treatment. If authorized, the provider shall communicate to the designated individual about your current and proposed course of treatment with such individual. In addition, a provider providing mental health treatment may disclose limited information to a family member/other person if: the request is in writing; the person lives with, provides care for, or is directly involved in your treatment and that involvement is verified by and documented in the medical record; before disclosure, you are informed in writing of the request, the person making the request, and the reason for the request; your agreement, objection or inability to consent or object is documented in the patient’s record; and disclosure is necessary for the patient’s treatment.

FOR SOUTH DAKOTA RESIDENTS • A licensee of the healing arts shall provide copies of all medical records, reports and X-rays pertinent to your health, if available, to you or your designee upon receipt by the licensee of a written request or a legible copy of a written request signed by you.

FOR PATIENTS OUTSIDE OF THE US • Patients outside the United States are allowed to communicate with our providers under the following criteria: o SteadyMD makes no representation that all products, services and/or material described on the Platform, or the Behavioral Health Services available through the Platform, are appropriate or available for use in locations outside the United States or all territories within the United States. This Platform allows you to access certain health and other medical consultation services on an informational basis (“Informational Services”). o Informational Services are available to you whether or not you meet the residency requirements. Informational Services are for general educational purposes and are not Behavioral Health Services. The information provided during informational services will not include diagnosis or treatment. SteadyMD is not a party to your relationship with a therapist or a non-therapist personnel providing Informational Services. o Informational Services does not replace consultations with qualified medical or other relevant healthcare professionals. You agree that you bear all risk associated with the use of or reliance on Informational Services, and release and hold SteadyMD, authorized therapists, and authorized non-therapist personnel providing Informational Services harmless from and against any claim, demand, action, cause of action, damage, loss, cost, liability or expense, including reasonable legal fees, which may be made or brought against or incurred or suffered by SteadyMD or an authorized therapist, or an authorized non-therapist personnel directly or indirectly as a result of, in respect of, or arising out of your reliance on Informational Services.

OUTSIDE PROFESSIONALS ON THE PLATFORM

• From time to time, outside healthcare professionals (therapists, nutritionist, dietitians for example) & organizations will contract with SteadyMD Physician Group (and affiliated physician groups) in order to use our technology to communicate with our patients. In this regard, SteadyMD Inc. operates a technology service provider for those professionals under a separate agreement, and it’s the responsibility of the partner to enter into a separate agreement with those patients they interact with on the SteadyMD platform.

LAST UPDATED: May 12, 2021