Notice of Privacy Practices

California Vision and Visage is required by law to maintain the privacy of your protected health information (“PHI”), to provide you with this notice of our legal duties and privacy practices with respect to your PHI, to notify you if there is a breach of your unsecured PHI, and to abide by the terms of this notice while it is in effect.

We may use and disclose your PHI to provide, coordinate or manage your eye care and related services. For example, we may share information about your condition with a retina specialist, optometrist or other physician to whom we refer you, or with an optical laboratory to fill a prescription for glasses or contact lenses.

We may use and disclose your PHI to obtain payment for the services we provide, such as submitting claims to your health insurance company, verifying coverage or eligibility, or processing pre-authorisation requests.

We may use and disclose your PHI for our health care operations, such as quality assessment and improvement activities, training, licensing, accreditation and business planning.

• As required by law, including in response to a court order or subpoena.
• Public health activities, such as reporting to public health authorities, communicable disease reporting, and reporting reactions to medications or medical devices.
• Health oversight activities, such as audits, investigations and inspections by government agencies.
• Judicial and administrative proceedings, in response to a court or administrative order, subpoena or discovery request.
• Law enforcement purposes, under limited circumstances specified by law.
• To avert a serious threat to the health or safety of you or another person.
• Workers' compensation, if your treatment relates to a workplace injury.
• Appointment reminders and treatment options, including reminder calls, texts, emails or postcards about upcoming appointments, and information about treatment alternatives or other health-related benefits and services that may interest you.
• Business associates, such as our electronic health record vendor, patient portal provider, billing service, or optical and surgical device manufacturers who assist us in operating the practice and who are contractually required to protect your information.
• Organ and tissue donation, coroners, medical examiners and funeral directors, as applicable.
• Research, subject to specific safeguards and, in most cases, an approval process designed to protect your privacy.

Other than as described above, we will not use or disclose your PHI without your written authorisation. This includes, in particular:

• Most uses and disclosures of psychotherapy notes, if applicable
• Uses and disclosures of your PHI for marketing purposes
• Disclosures that constitute a sale of your PHI
• Any other uses or disclosures not described in this notice

You may revoke your authorisation at any time, in writing, except to the extent we have already taken action in reliance on it.

In addition to HIPAA, California's Confidentiality of Medical Information Act (CMIA, California Civil Code §56 et seq.) provides certain protections for your medical information that may be more protective than federal law in some circumstances. Where California law provides greater privacy protection than HIPAA, we follow the more protective standard. This includes:

• Genetic information. If our office orders or performs genetic testing related to your eye care — for example, testing associated with inherited retinal disease — your genetic test results are subject to heightened confidentiality protections under California law (Civil Code §56.18 and related statutes, and Insurance Code §10123.3). We will not disclose genetic test information without your written authorisation except as specifically permitted by law.
• Breach notification. If a breach of your unencrypted medical information occurs, we will notify you as required by California Civil Code §§1798.29 and 1798.82, in addition to applicable federal breach notification requirements.
• Minors. Where California law grants a minor patient the right to control disclosure of certain categories of their own medical information, we will honour those rights consistent with the law in effect at the time.

• Right to inspect and copy. You may request to inspect and obtain a copy of your medical and billing records, with limited exceptions. We may charge a reasonable, cost-based fee for copies.
• Right to request amendment. You may ask us to amend your health information if you believe it is incorrect or incomplete, for as long as we maintain the information.
• Right to an accounting of disclosures. You may request a list of certain disclosures we have made of your PHI, other than for treatment, payment, health care operations and certain other exceptions.
• Right to request restrictions. You may ask us to restrict how we use or disclose your PHI for treatment, payment or health care operations, or to a family member or friend involved in your care. We are not required to agree to all requests, but we must agree to a restriction on disclosure to a health plan if the disclosure is for payment or health care operations, is not otherwise required by law, and the information pertains solely to a service you (or someone on your behalf, other than the health plan) paid for in full out of pocket.
• Right to request confidential communications. You may ask us to communicate with you in a certain way or at a certain location — for example, only by mail, or only at a specific phone number.
• Right to a paper copy of this notice. You may request a paper copy at any time, even if you agreed to receive it electronically.
• Right to choose someone to act for you. If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.
• Right to be notified of a breach. We will notify you if a breach occurs that may have compromised the privacy or security of your PHI.
• Right to file a complaint. If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the U.S. Department of Health and Human Services. You will not be penalised or retaliated against for filing a complaint.

We are required by law to maintain the privacy and security of your protected health information, to notify you promptly if a breach occurs that may have compromised the privacy or security of your information, to follow the duties and privacy practices described in this notice, and to give you a copy of it on request. We will not use or share your information other than as described here unless you tell us we can in writing, and you may change your mind at any time by letting us know in writing.

We reserve the right to change the terms of this notice, and the changes will apply to all information we already have about you as well as any information we receive in the future. We will post a copy of the current notice in our office and on our website at https://calvv.com, and the effective date will appear at the top of the notice.

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. There will be no retaliation for filing a complaint.

• With our practice: Privacy Officer, California Vision and Visage, 18575 Gale Avenue, Suite 168, City of Industry, CA 91748 · (626) 810-0689 · info@calvv.com
• With HHS Office for Civil Rights: U.S. Department of Health and Human Services, 200 Independence Avenue S.W., Washington, D.C. 20201 · 1-877-696-6775 · www.hhs.gov/ocr/privacy/hipaa/complaints

If you have questions about this notice, or wish to exercise any of the rights described above, please contact our Privacy Officer:

• City of Industry office: 18575 Gale Avenue, Suite 168, City of Industry, CA 91748 · (626) 810-0689
• San Gabriel office: 7232 Rosemead Blvd, Suite 202, San Gabriel, CA 91775 · (626) 656-6550
• Email: info@calvv.com