1. Our Commitment to Your Privacy

AvaOne Heart and Wellness (“AvaOne,” “we,” “us,” or “our”), a service of AvaOne LLC, is required by federal law to maintain the privacy of your Protected Health Information (PHI), to provide you with this Notice of our legal duties and privacy practices with respect to your PHI, to notify you following a breach of unsecured PHI, and to abide by the terms of the Notice currently in effect.

For purposes of this Notice, “Protected Health Information” or “PHI” means individually identifiable health information that we create, receive, maintain, or transmit in any form (electronic, paper, or oral) about your past, present, or future physical or mental health, the healthcare services provided to you, or the payment for those services.

This Notice applies to all PHI created or received by AvaOne at both of our locations:

    • 2 Lincoln Hwy, Suite 311B, Edison, NJ 08820
    • 1420 NJ-36, Hazlet, NJ 07730

2. How We May Use and Disclose Your PHI

The following describes the ways we may use and disclose your PHI. Not every use or disclosure will be listed. However, all of the ways we are permitted to use and disclose your PHI will fall within one of the following categories.

2.1 For Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services. This includes sharing your PHI with physicians, nurses, medical assistants, and other healthcare personnel involved in your care. We may also disclose your PHI to healthcare providers outside of AvaOne who are involved in your treatment, such as specialists, laboratories, imaging facilities, or pharmacies.

Example: If your AvaOne physician refers you to a specialist, we may share relevant portions of your medical record with that specialist to support your care.

2.2 For Payment

We may use and disclose your PHI to obtain payment for the healthcare services we provide to you. Because AvaOne is a self-pay practice, we do not submit claims to health insurance plans, Medicare, Medicaid, or any other third-party payer. However, we may use your PHI to:

    • Process your payment for services rendered
    • Provide you with detailed receipts or superbills that you may choose to submit to your insurance carrier for out-of-network reimbursement
    • Coordinate payment through Health Savings Accounts (HSAs) or Flexible Spending Accounts (FSAs)

Example: We may provide you with an itemized receipt containing your diagnosis and procedure codes so that you can submit it to your commercial insurance for possible reimbursement.

2.3 For Healthcare Operations

We may use and disclose your PHI to support the business activities of our practice. These activities include, but are not limited to:

    • Quality assessment and improvement activities
    • Reviewing the performance of our healthcare providers
    • Training programs for medical staff
    • Licensing, credentialing, and accreditation activities
    • Business planning and management
    • General administrative activities

Example: We may use your PHI to evaluate the quality of care our physicians provide and to identify opportunities for improvement.

2.4 Appointment Reminders and Follow-Up Communications

We may contact you by telephone, text message, or email to remind you of upcoming appointments, confirm scheduled visits, provide follow-up communications after your visit, or discuss administrative matters related to your care. When you provide your telephone number or email address, you authorize us to contact you through those channels.

2.5 Treatment Alternatives and Health-Related Benefits

We may use and disclose your PHI to tell you about treatment alternatives, health-related products or services, or other benefits that may be of interest to you.

2.6 Individuals Involved in Your Care

Unless you object, we may disclose your PHI to a family member, friend, or other person you identify as being involved in your care or the payment for your care.

2.7 As Required by Law

We will use and disclose your PHI when required to do so by federal, state, or local law.

2.8 To Avert a Serious Threat to Health or Safety

We may use and disclose your PHI when necessary to prevent a serious threat to your health and safety or to the health and safety of the public or another person. Any disclosure will be made only to someone able to help prevent the threat.

2.9 Public Health Activities

We may disclose your PHI for public health activities, including:

    • Preventing or controlling disease, injury, or disability
    • Reporting births, deaths, or suspected abuse or neglect
    • Reporting reactions to medications or problems with medical products
    • Notifying persons of recalls of products they may be using
    • Notifying persons who may have been exposed to a disease or may be at risk of contracting or spreading a disease

2.10 Health Oversight Activities

We may disclose your PHI to health oversight agencies for activities authorized by law, such as audits, investigations, inspections, and licensure.

2.11 Judicial and Administrative Proceedings

We may disclose your PHI in response to a court order, subpoena, discovery request, or other lawful process, subject to applicable legal requirements.

2.12 Law Enforcement

We may disclose your PHI to law enforcement officials when required by law or in response to valid legal process.

2.13 Coroners, Medical Examiners, and Funeral Directors

We may disclose your PHI to coroners, medical examiners, and funeral directors as necessary for them to perform their duties.

2.14 Research

Under certain circumstances, we may use and disclose your PHI for research purposes when the research has been approved by an institutional review board or when other conditions are met that protect your privacy.

2.15 Military and Veterans

If you are a member of the armed forces, we may release your PHI as required by military command authorities.

2.16 Workers' Compensation

We may release your PHI as necessary to comply with workers’ compensation laws and other similar programs.

2.17 National Security and Intelligence Activities

We may release your PHI to authorized federal officials for intelligence, counter-intelligence, and other national security activities authorized by law.

2.18 Business Associates

We may disclose your PHI to third parties who perform services on our behalf and require access to your PHI to do so. These parties are called “Business Associates.” Before disclosing your PHI to a Business Associate, we require the Business Associate to sign a written Business Associate Agreement (BAA) that requires them to safeguard your PHI in accordance with HIPAA.

Our Business Associates include, but are not limited to:

    • Our electronic health information system provider (which stores your patient records)
    • Email and text message communication providers
    • Payment processors
    • Other service providers who require access to PHI to perform their services

3. Uses and Disclosures That Require Your Written Authorization

Certain uses and disclosures of your PHI require your specific written authorization. These include:

    • Marketing communications that involve financial compensation to AvaOne from a third party
    • Sale of your PHI
    • Most uses and disclosures of psychotherapy notes (AvaOne does not maintain psychotherapy notes)
    • Any other use or disclosure not described in this Notice

If you provide us with written authorization, you may revoke that authorization at any time by submitting a written revocation to our Privacy Officer. Your revocation will be effective except to the extent we have already relied on your authorization.

4. Your Rights Regarding Your PHI

You have the following rights regarding your PHI:

4.1 Right to Inspect and Copy

You have the right to inspect and obtain a copy of your PHI that we maintain in a “designated record set,” which generally includes your medical and billing records. To inspect or obtain a copy, you must submit a written request to our Privacy Officer. We may charge a reasonable, cost-based fee for copies as permitted by law. We will respond to your request within 30 days.

In limited circumstances, we may deny your request. If we deny your request, we will provide you with a written explanation of the reason for the denial and information about your right to have the denial reviewed.

4.2 Right to Amend

If you believe your PHI is incorrect or incomplete, you have the right to request that we amend it. Your request must be in writing and must provide the reason for the requested amendment. We may deny your request under certain circumstances, including if the PHI was not created by us, is not part of the designated record set, is not available for inspection under HIPAA, or is accurate and complete. If we deny your request, we will provide you with a written explanation

4.3 Right to an Accounting of Disclosures

You have the right to request an “accounting of disclosures,” which is a list of certain disclosures we have made of your PHI. This list does not include disclosures made for treatment, payment, healthcare operations, disclosures made to you, disclosures made pursuant to your authorization, and certain other disclosures.

Your request must specify the period, which may not be longer than six years from the date of your request. The first accounting you request in any 12-month period is free. We may charge a reasonable, cost-based fee for additional accountings within the same 12-month period.

4.4 Right to Request Restrictions

You have the right to request a restriction on how we use or disclose your PHI for treatment, payment, or healthcare operations. You also have the right to request a restriction on the PHI we disclose to someone involved in your care.

Except in limited circumstances, we are not required to agree to your request. However, if we do agree, we will comply with your request unless the information is needed to provide you with emergency treatment.

You have the right to request that we not disclose PHI to a health plan for purposes of payment or healthcare operations if the PHI pertains solely to a healthcare service or item for which you have paid us in full out of pocket. Because AvaOne is a self-pay practice and does not submit claims to health plans, this restriction generally does not apply to our services.

4.5 Right to Request Confidential Communications

You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you may request that we contact you only at your home telephone number, only by email, or only at a specific mailing address. We will accommodate reasonable requests

4.6 Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time, even if you have agreed to receive it electronically. You may obtain a paper copy at either of our office locations or by contacting our Privacy Officer

4.7 Right to Notification of a Breach

You have the right to be notified in the event of a breach of your unsecured PHI. We will notify you consistent with federal and state law requirements.

4.8 Right to File a Complaint

If you believe your privacy rights have been violated, you have the right to file a complaint with our Privacy Officer or with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against for filing a complaint.

To file a complaint with the U.S. Department of Health and Human Services, you may contact:

Office for Civil Rights
 U.S. Department of Health and Human Services
 200 Independence Avenue, S.W.
 Washington, D.C. 20201

Telephone: 1-877-696-6775
 Website: www.hhs.gov/ocr/privacy/hipaa/complaints/

5. Our Legal Duties

We are required by law to:

    • Maintain the privacy and security of your PHI
    • Provide you with this Notice describing our legal duties and privacy practices with respect to your PHI
    • Follow the terms of the Notice currently in effect
    • Notify you in the event of a breach of your unsecured PHI

6. Changes to This Notice

We reserve the right to change the terms of this Notice at any time. The revised Notice will apply to PHI we already have about you as well as any PHI we receive in the future. We will post the revised Notice at both of our office locations and on our website at avaonewellness.com/hipaa-notice/. You may also request a copy of the revised Notice from our Privacy Officer.

The effective date of any revision will be shown at the top of the Notice.

7. Contact Our Privacy Officer

If you have questions about this Notice, want to exercise any of your rights, or wish to file a complaint about our privacy practices, please contact our Privacy Officer:

Privacy Officer
 AvaOne Heart and Wellness
 Attn: Chirag D. Patel, MD (Privacy Officer)
 2 Lincoln Hwy, Suite 311B
 Edison, NJ 08820

Phone: (973) 679-6949
 Email: info@avaonewellness.com

8. Acknowledgment of Receipt

At your first visit to AvaOne, you will be asked to sign a written acknowledgment confirming that you have received a copy of this Notice. If you decline to sign the acknowledgment, we will document that a copy of the Notice was provided to you.

Your refusal to sign the acknowledgment will not affect your right to receive care at AvaOne

9. Related Notices

This HIPAA Notice of Privacy Practices is one of several notices that govern your relationship with AvaOne Heart and Wellness. Please also review: