HIPAA Notice of
Privacy Practices

Your rights

Contact our Privacy Officer to exercise these rights. We may ask you to submit a written request and verify your identity or your representative’s authority.

Inspect and obtain your records

You may inspect or request a paper or electronic copy of health and billing information in your designated record set. Where New York Public Health Law §18 applies, we provide an opportunity to inspect records within 10 days of a written request and copies within a reasonable time. HIPAA access requests are acted on within 30 days; if a permitted extension is necessary, we explain the reason and completion date in writing. We follow shorter applicable state deadlines. We provide an available requested format, or an agreed readable alternative.

Any permitted fee is reasonable and cost-based, subject to HIPAA and New York limits; paper copies do not exceed 75 cents per page. We do not deny access solely because you cannot pay, and we do not charge for records needed to support an application, claim, or appeal for government benefits where New York law requires free copies. Certain records, such as separately maintained psychotherapy notes, may be excluded from the access right. If we deny access, we explain the basis and any available review or appeal rights, including applicable New York medical-record access review procedures.

Request a correction

You may ask us in writing to amend information you believe is inaccurate or incomplete and explain why. We respond within 60 days, with a written notice if a permitted extension is needed. We may deny a request for reasons allowed by law, but will explain why and how to submit a statement of disagreement.

Choose confidential communications

You may request contact at a particular telephone number, address, or by another method. We accommodate reasonable requests without requiring you to explain your reason.

Request limits on sharing

You may request restrictions on information used or disclosed for treatment, payment, operations, or to people involved in your care. We need not accept every request unless the law requires it. If you pay in full out of pocket for a service and ask us not to disclose that information to your health plan for payment or operations, we must honor that request unless disclosure is required by law. An agreed restriction may have a limited exception for emergency treatment.

Receive an accounting of disclosures

You may request an accounting of disclosures covered by HIPAA’s accounting requirement during the previous six years, or a shorter period. This generally excludes treatment, payment, operations, disclosures you authorized, and other exceptions allowed by law. We respond within 60 days; if a permitted extension is needed, we provide the reason and completion date in writing. One accounting in a 12-month period is free. For additional requests, we explain any reasonable fee in advance so you can withdraw or modify your request.

Receive this notice and use a representative

You can receive a free paper copy even if you previously agreed to electronic delivery. A legally authorized representative may exercise rights within the scope of their authority. We verify that authority and apply any exceptions protecting patients from abuse, neglect, or endangerment.

How we may use and disclose information

The following categories explain uses permitted or required by HIPAA. They do not override stricter New York laws or 42 CFR Part 2. We obtain additional consent or authorization whenever required and limit disclosures as the law requires.

• Treatment: To assess your needs, prescribe medication, and coordinate care—for example, discussing medication interactions with another treating clinician.
• Payment: To bill and obtain payment—for example, submitting diagnosis and service information to your insurer, subject to applicable restrictions.
• Health care operations: To operate the practice, evaluate quality, manage records, and conduct permitted administrative activities. For example, we may review treatment records to evaluate and improve the quality of our services. Service providers handling information on our behalf must have required confidentiality agreements and safeguards.
• Care-related contact: To send appointment reminders or discuss treatment alternatives and health-related services, subject to your communication preferences and applicable law.
• People involved in your care: To share relevant information with people you identify when you agree or have an opportunity to object. If you cannot express a preference, limited sharing based on professional judgment may occur when legally permitted and in your best interests. Similar rules apply to disaster-relief notifications.
• Public health and safety: For legally authorized reporting of disease, medication reactions, product problems or recalls, suspected abuse or neglect, and other public-health activities. We may disclose information to address a serious and imminent threat when allowed by all applicable laws.
• Oversight and legal requirements: For authorized audits, licensing, inspections, government investigations, and disclosures required by law, including to HHS to assess compliance.
• Judicial proceedings and law enforcement: Only when applicable legal conditions are satisfied. A request or subpoena does not automatically authorize release; we apply privilege, consent, court-order, and other protections that govern the information.
• Research: With your authorization or an applicable legally approved exception, such as an authorized review-board waiver, and any additional safeguards required for protected records.
• Other limited purposes: When permitted by law, for workers’ compensation, organ or tissue donation, medical examiners, coroners, funeral directors, and authorized military, national-security, protective-service, or correctional functions.

When your written permission is needed

Other uses and disclosures not described in this notice will be made only with your written authorization. Most uses or disclosures of separately maintained psychotherapy notes, marketing uses requiring authorization, and sales of protected health information require a specific written authorization. General treatment consent is not authorization for these activities.

You may revoke an authorization in writing at any time, except to the extent we have already relied on it or another legal exception applies. Revocation cannot undo a prior lawful disclosure.

If we send fundraising communications, you may opt out of further communications; this will not affect treatment or payment. Before any fundraising communication using Part 2 information, we provide clear, conspicuous notice and an advance opportunity to choose whether to receive it.

Information disclosed to a recipient may be redisclosed and may no longer be protected by HIPAA. Other laws, including Part 2 and New York confidentiality laws, may continue to protect it.

Additional New York privacy protections

When New York law provides greater confidentiality or access protections than HIPAA, we follow the applicable stronger protection.

• Mental health information: We protect clinical confidentiality and applicable professional privileges. Records subject to Mental Hygiene Law §§33.13 and 33.16 have additional disclosure and access rules. We obtain written consent where required unless a specific statutory exception authorizes disclosure; a general HIPAA permission alone is insufficient.
• HIV-related information: Public Health Law Article 27-F limits disclosure of confidential HIV-related information. We use a legally sufficient HIV-specific release when required, or disclose only under a permitted statutory exception. We provide required redisclosure notices when applicable.
• Genetic testing: Information protected by Civil Rights Law §79-l is disclosed only with the required written informed consent or a specific legal exception.
• Adolescents and representatives: Access depends on the service, consent authority, and applicable law. Parents do not automatically receive every record when a minor may legally consent independently or other confidentiality protections apply. We evaluate these rights before releasing information.
• Other sensitive care: Additional protections may apply to substance use, sexual and reproductive health, and gender-affirming care. We apply applicable New York confidentiality, privilege, and shield-law restrictions when assessing requests, including out-of-state proceedings.

Substance use disorder records: 42 CFR Part 2

North Fork Wellness provides psychiatric evaluations, medication management, and psychotherapy. We do not currently operate a dedicated substance use disorder treatment program. We may nevertheless receive or maintain records protected by the federal substance use disorder confidentiality law, 42 CFR Part 2. The following safeguards apply to those records. Not every reference to substance use in a general psychiatric record is a Part 2 record.

Consent and permitted sharing

When Part 2 requires your consent, a valid written consent is needed before protected records may be used or disclosed, unless a specific Part 2 exception applies. A consent may cover future treatment, payment, and health care operations. You may revoke consent in writing, except to the extent actions have already been taken in reliance on it. Contact our Privacy Officer for help with consent choices and restrictions.

If we receive Part 2 records under a valid consent for treatment, payment, and health care operations, HIPAA may permit us and other covered entities or business associates to use and redisclose them without obtaining a new consent for each use. This does not remove the restrictions on using records against you in investigations or proceedings, or stronger protections under New York law. Records received under other permissions remain subject to the limits of those permissions and applicable law.

Investigations and proceedings against you

Part 2 records, and testimony describing their contents, will not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you without your specific written consent or a qualifying Part 2 court order. Before such an order is issued, you or the record holder must receive the notice and opportunity to be heard required by Part 2. An order authorizing use or disclosure must be accompanied by a subpoena or a similar legal requirement compelling disclosure before the records are used or disclosed. Consent for proceedings against you must be separate from consent for other purposes.

Additional safeguards

We evaluate each request under Part 2 rather than assuming that a general HIPAA permission, law-enforcement request, or subpoena allows release. Separately maintained substance use disorder counseling notes have additional consent protections. Any disclosure under an exception must satisfy that exception’s specific requirements and applicable New York law.

Before using Part 2 records for fundraising on behalf of the practice, we will provide a clear and conspicuous opportunity to elect not to receive fundraising communications. Your choice does not affect your treatment or payment. You may report suspected violations to our Privacy Officer or to HHS using the complaint procedures below, without retaliation.

Our responsibilities

We must maintain the privacy and security of your protected health information, provide this notice, and follow the notice currently in effect. We must notify you following a breach of your unsecured protected health information, without unreasonable delay and within the time required by law. We apply appropriate safeguards to paper and electronic information, including information used in telehealth and through service providers.

Ordinary email may not be secure. Please contact us for a secure way to send clinical records or sensitive information. We consider reasonable confidential-communication requests. This website does not collect medical details through this notice, and viewing the notice does not authorize recording, marketing, or other optional uses of your information.

Changes to this notice

We may revise our privacy practices and this notice as permitted by law, and apply the revised terms to information already held as well as information received later. We post the revised notice and effective date on our website, make it available at the practice, and provide a copy on request.

Acknowledgment of receipt

We provide this notice no later than your first service encounter, including electronic service delivery, except as permitted in emergencies. We make a good-faith effort to obtain your written acknowledgment of receipt and document why it could not be obtained when necessary. An acknowledgment documents receipt; it is not permission to disclose information beyond what the law allows and does not waive your rights.