Notice of Privacy Practices

Who this notice covers

This notice comes from Aeternitas Health, PLLC (“we,” “us,” or “the Practice”). We are a physician-led practice in Charlotte, North Carolina. It applies to every clinician and staff member who works with us. It covers all health information we create, receive, or keep about you. We call it “health information” in this notice.

Our website privacy policy is a different document about website visitor data. You can read it at https://aeternitas.health/privacy-policy/.

Our duties to you

The law requires us to keep your health information private. It requires us to give you this notice of our legal duties and privacy practices. It requires us to notify you after a breach of your unsecured health information. We must follow the notice currently in effect.

We may change this notice. Any change applies to all health information we already hold and any we create later. We will post the new notice on our website and make it available at our office.

How we may use and share your health information

We may use and share your health information for treatment, payment, and health care operations without a separate written permission. Here is what each means, with examples.

Treatment. We use your information to care for you. Your care team reviews your records to plan and coordinate your care. We send orders to outside laboratories and imaging vendors, and they return your results to us. We may share information with another clinician who is treating you, such as a specialist or hospital. Your physician explains genetic results in a live visit. Results are part of your health record, and the visit does not limit your legal access rights.

Payment. We are a cash-pay practice. We do not bill commercial insurance, Medicare, or Medicaid. We use your information to bill you and process your card payments. Your rights to your health records are described below. Separate reimbursement documentation and any payer-specific limits are addressed in your service agreement.

Health care operations. We use your information to run the Practice and improve care. Examples include reviewing quality, training staff, planning services, keeping records secure, and resolving complaints.

Business associates. Some work is done by outside companies under written agreements. Examples include our electronic health record, patient portal, scheduling, payment, and document storage vendors. The agreements require them to protect your information and use it only for that work.

Other ways we may use or share your information without your permission

The law allows or requires us to share health information in the situations below. We share only what the situation requires.

• When required by law. We share information when a federal or state law requires it.
• Public health. We may report a communicable disease to a public health authority.
• Abuse or neglect. We may report suspected abuse, neglect, or exploitation of a child or a vulnerable adult.
• Health oversight. We may share information with agencies that license or inspect health care providers.
• Legal proceedings. We may respond to a court order, or to a subpoena that meets legal requirements.
• Law enforcement. We may share limited information with law enforcement as the law allows.
• Serious threats to health or safety. We may share information to prevent a serious and imminent threat to you or others.
• Coroners, medical examiners, funeral directors, and organ donation. We may share information needed for these purposes.
• Research. We share information for research only with the protections the law requires. Those include review board approval or your written permission.
• Workers’ compensation, military, national security, and correctional settings. We may share information as the law allows for these special purposes.

Family, caregivers, and people involved in your care. For routine sharing with family or friends, we ask you to use our optional Caregiver Designation and Authorization form. You may change or revoke it. Without that form, we may share information when required by law or permitted to address a serious and imminent threat. We may also share relevant information in an emergency or during incapacity when legally permitted and in your best interest. We verify a legal representative’s authority separately.

Records from substance use disorder programs. We protect records covered by 42 CFR part 2 under that law. We will not use or disclose these records in proceedings against you without the required consent or court process. This protection also covers testimony about the records. This includes civil, criminal, administrative, and legislative proceedings. A qualifying court order requires notice and an opportunity for you or the record holder to be heard. The order must also be accompanied by a subpoena or another legal requirement compelling disclosure.

Fundraising. We do not use your health information for fundraising.

Uses that require your written permission

We need your specific written authorization before we can do any of the following:

• Psychotherapy notes. Most disclosures of psychotherapy notes require your authorization. The Therapy records section explains these notes.
• Marketing. We will not use your health information for marketing without your written authorization. Letting us use your statements in marketing takes a separate, optional form. It is never a condition of your care.
• Sale of your information. We do not sell your health information. Any sale would require your written authorization.
• Any other use. Anything not described in this notice requires your written authorization.

You can revoke any authorization in writing at any time. This stops future uses but does not undo actions we already took.

Therapy records

If you receive therapy with us, your therapist keeps chart records. Any psychotherapy notes are kept separately as described below.

Your chart holds your treatment plan, progress notes, and brief summaries. Your physician and authorized care team can use these records to coordinate care. The other lawful uses described in this notice also apply.

Psychotherapy notes are different from your chart. They document or analyze counseling conversations and meet the legal definition of psychotherapy notes. They exclude diagnoses, treatment plans, symptoms, and progress summaries. They are kept separately in a therapist-only record. A title such as “genogram” does not determine whether a document qualifies.

We do not routinely share these notes with your care team. Uses or disclosures generally require a separate authorization. Specific legal exceptions include the therapist’s treatment use and qualifying supervised training within the Practice. Other exceptions include defending a proceeding you bring and certain required or legally permitted disclosures. These can include specified oversight, death-related, or serious-threat situations.

HIPAA’s access right does not include psychotherapy notes. We follow any applicable law that gives you greater access.

Your therapist can tell you at any time what is shared with the team.

Technology we use

Our patient portal. We send clinical information, results, and messages through our secure patient portal.

Text and email notifications. If you agree on our registration form, we send appointment, billing, and portal notifications by text and email. Ordinary text and email are not guaranteed to be secure. You can change your choice at any time.

Telemedicine. Some visits take place by secure video, telephone, or electronic messaging. These visits are part of your medical record and are protected the same way.

AI-enabled documentation tools. We may use AI-enabled tools, including ambient listening, to help draft visit notes and support care coordination. They do not replace your physician’s judgment. Your physician reviews and finalizes every note. We will tell you before an ambient listening tool records a visit. You may decline its use for that visit.

Stricter laws

Where a stricter federal or North Carolina law applies to your information, we follow it.

Your rights

To use any right below, contact our Privacy Officer using the details at the end of this notice.

Get a copy of your records. You can ask to see or get a copy of your health record. We may ask you to put the request in writing. We will respond within 30 days. If we need more time, we may take up to 30 more days and will tell you why in writing. We can give you an electronic copy in the format you ask for, when readily producible. We may charge a reasonable, cost-based fee for copies. Psychotherapy notes and information prepared for a legal proceeding are not included. If we deny a request, we will explain the reason in writing and any available review and complaint rights.

Ask us to correct your records. If you think something in your record is wrong or incomplete, you can ask us to amend it. Your request must be in writing and give a reason. We will respond within 60 days. If we need more time, we may take up to 30 more days and will tell you why in writing. We may say no if the record is accurate and complete. We may also say no if someone else created it, unless that person is no longer available to amend it. If so, you can add a written statement of disagreement to your record.

Get a list of disclosures. You can ask for a list of certain disclosures we made in the six years before your request. It excludes disclosures for treatment, payment, or operations, to you, or under your authorization. The first list in any 12-month period is free. We may charge a reasonable, cost-based fee for more within that period and will tell you the cost first.

Ask us to limit what we use or share. You can ask us to restrict how we use or share your information for treatment, payment, or operations. We are not required to agree. If we do agree, we will honor it except in an emergency. One restriction is required by law. If you pay in full yourself, you can ask us not to share that service with a health plan. We must agree, unless the law requires the disclosure. Tell us if you want this restriction recorded and applied to a service you paid for in full.

Ask for confidential communications. You can ask us to contact you a specific way or at a specific place. For example, you may want only portal messages, or only a certain phone number. We will honor reasonable requests. You do not need to tell us why.

Choose someone to act for you. Someone with a medical power of attorney for you, or your legal guardian, may exercise your rights. We will confirm their authority first.

Be told about a breach. We will notify you if a breach may have compromised the privacy or security of your unsecured health information.

Get a paper copy of this notice. You can ask for a paper copy at any time. You can also read it on our website.

Complaints

If you believe your privacy rights have been violated, you can complain to us. Contact our Privacy Officer using the details below. You can also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. Their complaint information is at www.hhs.gov/ocr. We will not retaliate against you for filing a complaint. Your care with us will not change.

Contact

Privacy Officer: Dr. Corey Helton, owner
Aeternitas Health, PLLC
330 Billingsley Rd #211, Charlotte, NC 28211
Phone: 704-200-9911
Email: legal@aeternitas.health