Notice of Privacy Practices

This is a summary. A Notice of HIPAA Privacy Practices containing a more complete description of the uses and disclosures of your health information is available to you on request — call 302-696-6238 or email osywinhc@gmail.com and we will provide it.

About HIPAA

The Health Insurance Portability & Accountability Act of 1996 (HIPAA) is a federal law that requires that all medical records and other individually identifiable health information used or disclosed by us in any form — whether electronically, on paper, or orally — are kept properly confidential. This Act gives you, the patient, significant rights to understand and control how your health information is used. HIPAA provides penalties for covered entities that misuse personal health information.

How we may use and disclose your information

We may use and disclose your medical records for each of the following purposes: treatment, payment, and health care operations.

• Treatment means providing, coordinating, or managing health care and related services by one or more health care providers.
• Payment means such activities as obtaining payment or reimbursement for services, billing or collection activities, and utilization review.
• Health care operations include managing your electronic medical record to facilitate diagnostic medical consultations with participating physicians, as well as conducting quality assessment and improvement activities, auditing functions, cost-management analysis and customer service.

We may also create and distribute de-identified health information by removing all references to individually identifiable information.

We may contact you to provide information about our services or other health-related services that may be of interest to you.

Any other uses and disclosures will be made only with your written authorization. You may revoke such authorization in writing, and we are required to honor and abide by that written request, except to the extent that we have already taken actions relying on your authorization.

Your rights

You have the following rights with respect to your protected health information, which you can exercise by presenting a written request to the Corporate Compliance Officer.

• You have the right to ask for restrictions on the ways we use and disclose your health information for treatment, payment and health care operations. You may also request that we limit our disclosures to persons assisting your care. We will consider your request, but are not required to accept it.
• You have the right to request that you receive communications by alternative means or at alternative locations. For example, you may ask that we only contact you at home or by mail.
• Except under certain circumstances, you have the right to inspect and copy medical, billing and other records used to make decisions about you. If you ask for copies of this information, we may charge you a nominal fee for copying and mailing.
• If you believe that information in your records is incorrect or incomplete, you have the right to ask us to correct the existing information or add missing information. Under certain circumstances, we may deny your request, such as when the information is accurate and complete.

When we may share information without your consent

As a general rule, your information is not released without your written consent, only the minimum necessary information is released, and every disclosure is documented. Information may be released without your consent in the following circumstances:

• Medical emergency — disclosure to medical personnel where necessary to protect life. Documentation is required.
• Suspected child abuse or neglect — mandatory reporting to authorities.
• Suspected abuse or neglect of a vulnerable adult — report to protective services.
• Court order or subpoena — a valid court order is required, and the legal documentation is kept in the chart.
• Crimes on program premises or against staff — law enforcement may be notified.
• Threat of harm to self or others — duty to warn and protect.
• Medical personnel for treatment purposes — limited information shared for emergency medical care.
• Audit or program evaluation — auditors and evaluators are allowed access.
• Qualified Service Organization Agreements — contracted organizations under agreement.
• Public health reporting requirements — required disease or safety reporting.
• Federal or state licensing authorities — access granted during inspections and compliance reviews.
• Research with confidential safeguards — release allowed under an approved research protocol.
• Internal program communications — staff sharing information for treatment and operations.

Substance use records carry extra protection — 42 CFR Part 2

Which programs are covered

42 CFR Part 2 applies to any program that involves substance abuse education, treatment or prevention, and is regulated or assisted by the federal government.

What information is protected

42 CFR Part 2 applies to all records relating to the identity, diagnosis, prognosis, or treatment of any patient in a substance abuse program that is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States.

How protected information can be shared

Information can be shared if written consent is obtained. A written consent form requires ten elements:

1. The names or general designations of the programs making the disclosure
2. The name of the individual or organization that will receive the disclosure
3. The name of the patient who is the subject of the disclosure
4. The specific purpose or need for the disclosure
5. A description of how much and what kind of information will be disclosed
6. The patient’s right to revoke the consent in writing and the exceptions to that right or, if the exceptions are included in the program’s notice, a reference to the notice
7. The program’s ability to condition treatment, payment, enrollment or eligibility of benefits on the patient agreeing to sign the consent, by stating either that the program may not condition these services on the patient signing the consent, or the consequences for the patient refusing to sign
8. The date, event or condition upon which the consent expires if not previously revoked
9. The signature of the patient, and/or other authorized person
10. The date on which the consent is signed

When used in a criminal-justice setting, expiration of the consent may be conditioned upon completion of, or termination from, a program instead of a date.

Mandatory disclosures

42 CFR Part 2 allows for disclosure where the state mandates child abuse and neglect reporting, when cause of death is being reported, or with the existence of a valid court order.

Permitted disclosures

Programs are permitted to disclose patient-identifying information in cases of medical emergency, in reporting crimes that occur on program premises or against staff, to entities having administrative control, and to qualified service organizations, outside auditors, evaluators, central registries and researchers.

Questions, requests and complaints

To exercise any of the rights above, or to request the full Notice of HIPAA Privacy Practices, contact us:

• Phone: 302-696-6238
• Email: osywinhc@gmail.com
• Post: Corporate Compliance Officer, OSYWIN Healthcare Services, 113 Gloucester Blvd, Lower Level Suite, Middletown, DE 19709

You also have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, if you believe your privacy rights have been violated. You will not be penalized or retaliated against for filing a complaint.

Published on this website 5 October 2026. This summary is provided by OSYWIN Healthcare Services and is drawn from its policy and procedure manual.