Notice of Privacy Practices

Effective Date: July 17, 2026

Your Information. Your Rights. Our Responsibilities.

This notice describes how medical information about you may be used and disclosed, how you can obtain access to that information, and what rights you have regarding your health information.

Please review this notice carefully.

This notice applies to Highland Healthcare and members of its workforce who provide or support healthcare services through Highland Healthcare.

Privacy Contact

For questions about this notice or to exercise your privacy rights, contact:

Privacy Officer
Highland Healthcare
300 Harding Boulevard, Suite 103
Roseville, CA 95678
Phone: 916-244-5996
Email: contact@highlandhealthcare.org

Your Rights

You have rights regarding the health information Highland Healthcare maintains about you.

Obtain a Copy of Your Medical Record

You may ask to inspect or obtain an electronic or paper copy of your medical record and other health information we maintain about you.

We will provide access, a copy, or a summary within the time required by applicable law. We may charge a reasonable, cost-based fee when permitted by law.

Certain limited information may be withheld when permitted or required by law. If access is denied, we will explain the reason in writing and tell you whether the decision may be reviewed.

Ask Us to Correct Your Medical Record

You may ask us to correct health information that you believe is inaccurate or incomplete.

We may deny the request in certain circumstances, such as when we did not create the information or determine that the existing record is accurate and complete. If we deny the request, we will explain the reason in writing within the time required by law.

You may provide a written statement of disagreement for inclusion in your record when permitted by law.

Request Confidential Communications

You may ask us to communicate with you in a particular way or at a particular location.

For example, you may ask us to:

• Call a particular telephone number

• Avoid leaving detailed voicemail messages

• Send correspondence to a different address

• Use or avoid email or text messaging

We will accommodate reasonable requests.

Ask Us to Limit What We Use or Share

You may ask us not to use or disclose certain health information for treatment, payment, or healthcare operations.

We are not always required to agree to the request. We may deny it when the restriction could affect your care or when use or disclosure is otherwise permitted or required by law.

If we agree to a restriction, we will follow it except when the information is needed to provide emergency treatment or when disclosure is otherwise required by law.

If you pay for a healthcare item or service completely out of pocket, you may ask us not to disclose information about that item or service to your health plan for payment or healthcare operations. We will agree unless disclosure is required by law.

Receive a List of Certain Disclosures

You may request an accounting of certain disclosures of your health information made during the six years before your request.

The accounting generally will not include disclosures made:

• For treatment

• For payment

• For healthcare operations

• Directly to you

• With your written authorization

• To persons involved in your care when permitted by law

• For certain other purposes excluded by law

We will provide one accounting in a 12-month period without charge. A reasonable, cost-based fee may apply to additional requests during the same period. We will notify you before charging a fee.

Receive a Copy of This Notice

You may ask for a paper copy of this notice at any time, even if you previously agreed to receive it electronically.

A current copy will also be available at our office and on our website.

Choose Someone to Act for You

If you have given another person medical power of attorney or if someone is your legal guardian or otherwise legally authorized to act for you, that person may exercise your rights and make choices regarding your health information.

We will verify the person’s authority before taking action.

File a Privacy Complaint

You may file a complaint with Highland Healthcare if you believe your privacy rights have been violated.

Contact our Privacy Officer using the information at the beginning of this notice.

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights through its HIPAA complaint process or by writing to:

U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue SW
Washington, DC 20201

You may also call HHS at 1-877-696-6775.

Highland Healthcare will not retaliate against you for filing a complaint.

Your Choices

For certain health information, you may tell us what you want us to share.

Family Members and Others Involved in Your Care

You may tell us whether we may share information with a family member, close friend, caregiver, or another person involved in your care or payment for your care.

If you are unable to communicate your preference, we may disclose limited information when we determine that doing so is in your best interest and is permitted by law.

We may also disclose information when necessary to reduce a serious and imminent threat to health or safety.

Disaster Relief

We may share limited information with an authorized disaster-relief organization so that family members or others responsible for your care can be notified of your location, condition, or status.

You may tell us not to make this disclosure when circumstances allow us to ask for your preference.

Marketing, Sale of Information, and Psychotherapy Notes

Highland Healthcare will obtain your written authorization before:

• Using protected health information for marketing when authorization is required

• Selling protected health information

• Disclosing most psychotherapy notes, if we maintain them

If you provide written authorization, you may revoke it in writing at any time. Revocation will not affect actions already taken in reliance on the authorization.

Highland Healthcare does not currently use protected health information for fundraising.

How We Typically Use or Disclose Health Information

Treatment

We may use your health information and disclose it to physicians, nurses, pharmacies, laboratories, hospitals, consultants, and other healthcare professionals involved in your care.

For example, we may send prescription information to a pharmacy or discuss relevant medical information with a specialist involved in your treatment.

Payment

We may use and disclose health information to bill for services and obtain payment from you, an insurer, a health plan, or another responsible party.

This may include verifying insurance coverage, obtaining prior authorization, submitting claims, and responding to payment questions.

Healthcare Operations

We may use and disclose health information to operate Highland Healthcare, manage services, improve the quality of care, and perform necessary administrative activities.

Healthcare operations may include:

• Quality assessment and improvement

• Staff training and evaluation

• Credentialing

• Licensing and compliance

• Auditing

• Legal and accounting services

• Business planning

• Patient safety activities

• Appointment reminders

• Care coordination

• Customer service

• Information technology and security

Business Associates

We may provide health information to contractors known as business associates that perform services on our behalf.

Examples may include billing companies, information-technology providers, medical-record vendors, secure communication providers, legal advisers, accountants, and data-storage providers.

Business associates are required by contract and law to appropriately protect protected health information.

Electronic Communications

We may contact you through telephone calls, voicemail, email, text messaging, a patient portal, or another method you authorize or request.

Ordinary email and SMS messaging may carry privacy risks. You may request an alternative reasonable method of communication by contacting our office.

Other Uses and Disclosures Permitted or Required by Law

Public Health and Safety

We may disclose health information for legally authorized public-health and safety purposes, including:

• Preventing or controlling disease

• Reporting certain communicable diseases

• Reporting adverse reactions to medications

• Assisting with product recalls

• Reporting suspected abuse, neglect, or domestic violence

• Preventing or reducing a serious threat to health or safety

• Providing information to authorized public-health agencies

We will comply with legal conditions applicable to these disclosures.

Health Oversight

We may disclose health information to health-oversight agencies for activities authorized by law, such as audits, investigations, inspections, licensing actions, and disciplinary proceedings.

Compliance With the Law

We will disclose health information when federal or California law requires us to do so.

We may disclose information to the U.S. Department of Health and Human Services when it requests information to evaluate our compliance with federal privacy law.

Research

We may use or disclose health information for research when permitted by law, such as when you provide authorization or an authorized review board approves the use without individual authorization.

Workers’ Compensation

We may use or disclose health information as authorized by workers’ compensation laws or similar programs.

Law Enforcement and Government Requests

We may disclose health information for certain law-enforcement or government purposes when the requirements of applicable law are met.

These purposes may include:

• Responding to certain warrants, subpoenas, or court orders

• Identifying or locating certain persons

• Reporting certain injuries or suspected crimes

• Responding to health-oversight agencies

• Military and veterans’ activities

• National-security activities

• Protective services authorized by law

Legal Proceedings

We may disclose health information in response to a valid court or administrative order.

We may also respond to a subpoena, discovery request, or other legal process when the legal requirements for disclosure have been satisfied.

Medical Examiners and Funeral Directors

We may disclose health information to a coroner, medical examiner, or funeral director when legally permitted and necessary for that person to perform official duties.

Organ and Tissue Donation

We may disclose health information to organ-procurement organizations or other entities involved in organ, eye, or tissue donation and transplantation when permitted by law.

Substance Use Disorder Patient Records

Certain records identifying a person as having or having had a substance use disorder may receive additional protection under 42 CFR Part 2.

To the extent Highland Healthcare maintains records protected by 42 CFR Part 2, those records will not be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding against you unless:

1. You provide written consent; or

2. The use or disclosure is authorized by an appropriate court order and accompanied by a valid subpoena or other legal mandate when required.

Part 2 records may not be used to initiate or substantiate criminal charges against you or to conduct a criminal investigation of you except as specifically permitted by federal law.

When required, we will provide advance notice and an opportunity to opt out before using Part 2 information for fundraising communications.

Additional California Privacy Protections

California law may provide protections that are more restrictive than HIPAA for certain categories of medical information.

Depending on the circumstances, additional restrictions may apply to information involving:

• Mental or behavioral health treatment

• Substance use disorder treatment

• HIV or AIDS testing and treatment

• Genetic testing

• Reproductive and sexual healthcare

• Communicable diseases

• Services to which a minor may legally consent

• Certain research information

When California law provides greater privacy protection than federal law, Highland Healthcare will follow the more protective requirement.

Our Responsibilities

Highland Healthcare is required by law to:

• Maintain the privacy and security of protected health information

• Provide you with this Notice of Privacy Practices

• Follow the privacy practices described in the current notice

• Notify affected individuals when a breach occurs that may have compromised the privacy or security of their protected health information

• Honor your rights as required by applicable law

We will not use or disclose your information for a purpose not described in this notice unless you give us written authorization or the use or disclosure is otherwise permitted or required by law.

You may revoke a written authorization at any time by notifying us in writing. Revocation will not affect information already used or disclosed in reliance on the authorization.

Changes to This Notice

Highland Healthcare may change the terms of this notice and make the revised notice effective for all health information we maintain, including information created or received before the change.

If the notice changes materially, the revised notice will be:

• Posted on our website

• Available at our office

• Provided upon request

• Distributed in another manner when required by law

The effective date displayed at the beginning of the notice identifies the version currently in effect.

Questions

Questions concerning this notice or Highland Healthcare’s privacy practices may be directed to:

Privacy Officer
Highland Healthcare
300 Harding Boulevard, Suite 103
Roseville, CA 95678
Phone: 916-244-5996
Email: contact@highlandhealthcare.org