NOTICE OF PRIVACY PRACTICES

healthAlign

Effective: 1/1/2020

Revision Dates: 1/1/2021 (no revisions needed)

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

healthAlign., its affiliates, subsidiaries and/or divisions (collectively referred to as “healthAlign”) are required by law to secure and safeguard your protected health information and we are further required to provide you with this notice explaining the Company’s privacy practices with regard to your protected health information. This Notice tells you how we may use and disclose your health information and it outlines those instances where your health information may be released without your authorization. You have certain rights regarding the privacy of your protected health information and we also describe those rights in this notice.

As used in this notice, Protected Health Information (PHI) includes both medical information regarding your care and treatment and individually identifiable personal information such as your name, address, phone number, social security number or other personal information that you provide in the course of your treatment. This information may be in electronic, written and/or oral form.

USES OR DISCLOSURES OF PHI. Generally, HealthAlign may not use or disclose your PHI without your permission and, once your permission has been obtained, we must use or disclose your PHI only as provided for in the specific terms of that permission. You may also decline the release of your information or restrict/revoke the release of information. Those rights are further outlined herein.

Some specific instances where your authorization is required before we may use or disclose your health information include, without limitation:

• Most uses and disclosures of psychotherapy notes or other records including particularly sensitive health information including substance abuse and sexually transmitted disease such as HIV/AIDS;

• Uses and Disclosures of PHI for marketing purposes; and

• Disclosures that constitute a sale of protected health information.

In certain instances, healthAlign may use/disclose PHI without your authorization. The following uses/disclosures DO NOT require your authorization:

Treatment: healthAlign may use and disclose your health information to provide, coordinate or manage your healthcare. This includes, but is not limited to, disclosures to doctors, nurses, technicians, staff and other healthcare professionals who become involved in your care. For example: healthAlign or your doctor may determine that you require the assistance of a physical therapist. After we have obtained an order from your doctor, we will contact the therapist and give them the medical and personal information needed to coordinate and provide your care.

Payment: healthAlign may use and disclose your health information to receive payment for services it has provided or to obtain authorizations for proposed treatments. For example: healthAlign may need to provide an insurance company or federally funded program such as Medicare or Medicaid/Cal, with information about your medical condition and the healthcare you require, in order for healthAlign to receive payment for services rendered by healthAlign.

Health Care Operations: healthAlign may use and disclose your health information as needed to run our operations, including, without limitation, for the educational purposes of our staff and to make sure that all of our patients receive quality care. For example: healthAlign may use your health information to review the services we provide and the performance of our staff involved in your care. Information about you may also be used to develop programs to meet your needs and the educational requirements of our employees.

Treatment Issues: We may call you with test results or to answer your questions about your care or use and disclose health information to inform you about treatment options and alternatives.

Health-Related Benefits and Services: We may use and disclose personal and health information to tell you about health- related benefits or services that may be of interest to you.

Individuals Involved In Your Care or Payment For Your Care: Unless you object, we may disclose your health information to a relative, friend or any person identified by you, if these individuals need to know about or are involved in your care, or for payment for your care.

Workers Compensation: healthAlign may disclose your health information in order to comply with laws relating to workers’ compensation or similar programs.

Public Health, Safety, Disaster Relief, Or to Divert a Threat to Health Or Safety; Victims of Abuse, Neglect, or Domestic Violence: healthAlign may use or disclose your health information to the extent necessary for public health activities and to avert a serious and imminent threat to your health or safety or the health and safety of others. healthAlign may disclose your personal and health information to the appropriate authorities if we reasonably believe that you are a possible victim of abuse, neglect, domestic violence or other crimes. Any disclosure would only be to someone able to help prevent the threat or injury.

Health Oversight: healthAlign may disclose your health information to a health oversight agency for activities authorized by law. This may include but is not limited to The Joint Commission, ACHC, surveys, investigations, inspections, licensure or disciplinary actions.

Legal Proceedings and Law Enforcement: healthAlign may disclose your health information if asked to do so by a law enforcement officer and/or in response to a subpoena, court or administrative order, warrant, discovery request or other lawful process.

Military and National Security: healthAlign may disclose your health information to authorized military command authorities or federal officials if you are in the armed forces or are a veteran, or as required for lawful intelligence, counter intelligence and other national security activities.

Coroners, Medical Examiners and Funeral Directors: We may disclose your health information to a coroner or medical examiner if necessary to identify a deceased person or to determine a cause of death, or to a funeral director in connection with the performance of their duties.

Business Associates: healthAlign may provide some services through contracts with business associates. In those instances, healthAlign requires the business associates to safeguard your information through a Business Associate Agreement.

Research; Death; Organ Donation: healthAlign may use and disclose your health information for research purposes in limited circumstances. However, all such research projects are subject to an approval process, and we will ask your permission if a researcher is to have access to your name, address, or other information that identifies you. healthAlign may disclose your health information for the purpose of facilitating organ donation and transplantation.

Required By Law: healthAlign will use or disclose your health information when required to do so by federal, state or local law.

YOUR RIGHTS REGARDING YOUR PERSONAL AND

MEDICAL INFORMATION. Although your medical record is the property of healthAlign, the information belongs to you. Federal law gives you the rights described below regarding your medical information.

Revoke Authorizations. You may revoke any authorization for the release of information, at any time. Your request should be submitted in writing to the Company’s Privacy Officer. Upon receipt, we will no longer disclose health information about you for the reasons stated in your written authorization. Disclosures made in reliance on the authorization prior to the revocation are not affected by the revocation

Inspect and Copy. With some exceptions, you may review and copy your medical information. To the extent your record is maintained electronically, you have the right to access your own electronic health record in an electronic format. You may also direct healthAlign to send the e-health record directly to a third party.

Amendments. You may ask us to amend your medical information if you feel it is incorrect or incomplete. All requests must be submitted to the Company’s Privacy Officer in writing and may be declined if: (a) we determine that the information or record that is the subject of the request was not created by us,

(b) the information is not part of your designated record set maintained by us, (c) the information is prohibited from inspection by law, or (d) the information is accurate and complete. If your request is declined, we will provide you with a written denial stating the basis of the denial, your right to submit a written statement disagreeing with the denial, and a description of how you may file a complaint with us or the Secretary of the

U.S. Department of Health and Human Services (“DHHS”).

Paper Copy of This Notice. You may request a paper copy of this notice at any time by contacting your local healthAlign office or healthAlign’s Privacy Officer.

Accounting of Disclosures. You may request a list of certain disclosures made of your medical information (“accounting of disclosures”). In some instances, the accounting may be limited by time and may exclude disclosures made for treatment, payment or health care operations.

Request Restrictions. You may request a reasonable restriction on the uses or disclosures of your medical information. If you pay for your services, in full, using your personal funds, you can ask that the information regarding the service not be disclosed to a third-party payer/health plans/insurance company since no claim is being made against the third-party payer.

Request Alternate/Confidential Communications. You may request that we communicate with you about medical matters in a confidential manner or at a specific location. For example, you may ask that we only contact you via mail to a post office box.

To exercise any of these rights you must: submit your request in writing to healthAlign. Your request should include a reason for your request and, if applicable, the action you want healthAlign to take. We may charge a fee for the costs of copying, mailing or other supplies associated with your request. We will notify you of the cost involved and you may choose to change or take back your request at that time before any costs are incurred.

BREACH NOTIFICATION REQUIREMENTS: healthAlign is required to notify you if unsecured PHI is acquired, accessed, used and/or disclosed by an unauthorized party. Under the Federal Rules, notification must occur without unreasonable delay and in no case later than 60 days of the event. Some State regulations require shorter notification periods and healthAlign shall comply with all such requirements.

CHANGES TO THIS NOTICE: We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for medical information we already have about you as well as any information we receive in the future. We will post a copy of the current notice in each healthAlign office. In addition, if material changes are made to this notice, the notice will contain an effective date for the revisions and copies can be obtained by contacting healthAlign.

QUESTIONS/GRIEVANCES: If you want further information about matters covered by this notice, are concerned that your privacy rights may have been violated, or disagree with a decision made about access to your personal and health information, you may contact healthAlign’s Privacy Officer by U.S. mail or phone at: 1910 Towne Centre Blvd, Suite 250, Annapolis, MD 21401; 667-677-9110. You may also submit a grievance/complaint to the U.S. Department of Health & Human Services, 200 Independence Ave., SW, Washington DC 20201, Phone: 202.619.0257, Toll Free: 1.877.696.6775.

healthAlign will not retaliate and you will not be penalized in any way if you choose to file a grievance complaint with us or with the U.S. Department of Health and Human Services.

Welcome Back

Terms of Service

Terms of Service

Privacy Notice

NOTICE OF PRIVACY PRACTICES