PROVIDER NOTICE OF PRIVACY PRACTICES(HIPAA)

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective June 18, 2026

oncoMD, PLLC is required by law to protect the privacy of your health information. We are also required to provide you this notice, which explains how we may use information about you and when we can give out or "disclose" that information to others. You also have rights regarding your health information that are described in this notice. We are required by law to abide by the terms of this notice.

The terms “information” or “health information” in this notice include information we maintain that reasonably can be used to identify you and that relates to your physical or mental health condition, the provision of health care to you, or the payment for such health care. We will comply with the requirements of applicable privacy laws related to notifying you in the event of a breach of your health information.

We have the right to change our privacy practices and the terms of this notice. If we make a material change to our privacy practices, and if we maintain a website, we will post a copy of the revised notice on our website. If we maintain a physical delivery site, we will also post a copy at our office. The notice will also be available upon request. We reserve the right to make any revised notice effective for information we already have and for information that we receive in the future.
We collect and maintain oral, written and electronic information to administer our business and to provide products, services, and information of importance to our enrollees. We maintain physical, electronic, and procedural security safeguards in the handling and maintenance of our enrollees’ information, in accordance with applicable state and federal standards, to protect against risks such as loss, destruction, or misuse.

How We Collect, Use, and Disclose Information

We collect, use, and disclose your health information to provide that information:

• To you or someone who has the legal right to act for you (your personal representative) in order to administer your rights as described in this notice; and

• To the Secretary of the Department of Health and Human Services, if necessary, to confirm we are meeting our privacy obligations

We may collect, use, and disclose health information for your treatment, to bill for your health care, and to operate our business. For example, we may collect, use, and disclose your health information:

• For Payment, including to obtain payment for health care services. For example, we may collect information from, or disclose information to, your health plan in order to obtain payment for the medical services we provide to you.

• For Treatment, including to aid in your treatment or the coordination of your care. For example, we may share information with doctors to help them provide medical care to you.

• For Health Care Operations, as necessary to operate and manage our business activities related to providing and managing your health care. For example, we might analyze data to determine how we can improve our services. We may also de-identify health information in accordance with applicable laws.

• To Provide You Information on Health-Related Programs or Products such as alternative medical treatments and programs or about health-related products and services, subject to limits imposed by law.

• For Reminders we may send you about your care, such as appointment reminders with providers who provide medical care to you, or reminders related to medicines prescribed for you.

• For Communications to You about treatment, payment, or health care operations using telephone numbers or email addresses you provide to us.

We may also collect, use, and disclose your health information for the following purposes under limited circumstances and subject to certain requirements:

• As Required by Law to following the laws that apply to us.

• To Persons Involved with Your Care or who help pay for your care, such as a family member, when you are incapacitated or in an emergency, or when you agree or fail to object when given the opportunity. If you are unavailable or unable to object, we will use our best judgment to decide if the disclosure is in your best interest. Special rules apply regarding when we may disclose health information about a deceased individual to family members and others. We may disclose health information to any persons involved, prior to the death, in the care or payment for care of a deceased individual, unless we are aware that doing so would be inconsistent with a preference previously expressed by the deceased.

• For Public Health Activities such as reporting or preventing disease outbreaks to a public health authority. We may also use and disclose your information to the Food and Drug Administration (FDA) or persons under the jurisdiction of the FDA for purposes related to safety or quality issues, adverse events or to facilitate drug recalls.

• For Reporting Victims of Abuse, Neglect or Domestic Violence to government authorities that are authorized by law to receive such information, including a social service or protective service agency.

• For Health Oversight Activities to a health oversight agency for activities authorized by law, such as licensure, governmental audits, and fraud and abuse investigations.

• For Judicial or Administrative Proceedings such as in response to a court order, search warrant or subpoena.

• For Law Enforcement Purposes to a law enforcement official for purposes such as providing limited information to locate a missing person or report a crime.

• To Avoid a Serious Threat to Health or Safety to you, another person, or the public, by, for example, disclosing information to public health agencies or law enforcement authorities, or in the event of an emergency or natural disaster.

• For Specialized Government Functions such as military and veteran activities, national security and intelligence activities, and the protective services for the President and others.

• For Workers’ Compensation as authorized by, or to the extent necessary to comply with, state workers compensation laws that govern job-related injuries or illness.

• For Research Purposes such as research related to the evaluation of certain treatments or the prevention of disease or disability, if the research study meets federal privacy law requirements, or for certain activities related to preparing a research study.

• To Provide Information Regarding Decedents to a coroner or medical examiner to identify a deceased person, determine a cause of death, or as authorized by law. We may also use and disclose information to funeral directors as necessary to carry out their duties.

• For Organ Donation Purposes to entities that handle procurement, banking or transplantation of organs, eyes, or tissue to facilitate donation and transplantation.

• To Correctional Institutions or Law Enforcement Officials if you are an inmate of a correctional institution or under the custody of a law enforcement official, but only if necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

• To Business Associates that perform functions or services on our behalf if the information is necessary for such functions or services. Our business associates are required, under contract with us and pursuant to federal law, to protect the privacy of your information.

• To Health Information Exchanges (HIE) in which we participate. An HIE is a way for doctors’ offices, hospitals, and other healthcare organizations that provide you with care to share and have access to your health information. In emergency situations where you may be unable to provide information, an HIE allows your care providers to quickly view your medical history to take note of allergies or medical conditions that may affect your treatment. HIEs follow applicable state and federal privacy laws on who can access data and for what purpose. If you have questions about whether your information is being shared with an HIE, contact your provider at the number listed in the “Exercising Your Rights” section below.

• Additional Restrictions on Use and Disclosure. Some federal and state laws may require special privacy protections that restrict the use and disclosure of certain sensitive health information, including:

1. Alcohol and Substance Use Disorder

2. Biometric

3. Child or Adult Abuse or Neglect, including Sexual Assault

4. Communicable Diseases

5. Genetic

6. HIV/AIDS

7. Mental Health

8. Minors

9. Prescriptions

10. Reproductive or Sexual Health

11. Sexually Transmitted Diseases

Except for uses and disclosures described in this notice, we will use and disclose your health information only with a written authorization from you. This includes, except for limited circumstances allowed by federal privacy law, not using or disclosing psychotherapy notes about you, selling your health information to others, or using or disclosing your health information for certain marketing communications, without your written authorization. Once you give us authorization to use and disclose your health information, you may take back or "revoke" your written authorization at any time in writing, except if we have already acted based on your authorization. For more information on how to revoke your authorization, use the contact information below under the section titled “Exercising Your Rights.” Note that once your health information has been disclosed, it could be redisclosed by the recipient and no longer protected by federal privacy laws.

What Are Your Rights

You have the following rights with respect to your health information:

• You have the right to ask to restrict our uses or disclosures of your information for treatment, payment, or health care operations. You also have the right to ask to restrict disclosures to family members or to others who are involved in your health care or payment for your health care. Any request for restrictions must be made in writing. Please note that while we will try to honor your request and will permit requests consistent with our policies, we are not required to agree to any request for restriction except where you have paid for an item or service in full out-of-pocket and request that we not disclose information about that item or service to your health plan. If we do agree with your request for restrictions, we will honor your limits unless it is an emergency situation.

• You have the right to ask to receive confidential communications of information in a different manner or at a different place (for example, sending information to a P.O. Box instead of your home address). We will accommodate reasonable requests. In certain circumstances, we will accept your verbal request to receive confidential communications; however, we may also require you to confirm your request in writing. In addition, any request to modify or cancel a previous confidential communication request must be made in writing. Mail your request to the address listed below.

• You have the right to request to see and obtain a copy of certain health information we maintain about you such as medical records and billing records. If we maintain a copy of your health information electronically, you will have the right to request that we send a copy of your health information in an electronic format to you. You can also request that we provide a copy of your information to a third party that you identify. In some cases, you may receive a summary of this health information. You must make a written request to inspect or obtain a copy of your health information or have your information sent to a third party. Mail your request to the address listed below. In certain limited circumstances, we may deny your request. If we deny your request, you may have the right to have the denial reviewed. We may charge a reasonable fee for any copies.

• You have the right to ask to amend certain health information we maintain about you such as medical records and billing records if you believe the information is wrong or incomplete. Your request must be in writing and provide the reasons for the requested amendment. Mail your request to the address listed below. In certain circumstances, we may deny your request. If we deny your request, you may have a statement of your disagreement added to your health information.

• You have the right to request an accounting of certain disclosures of your information made by us during the six years prior to your request. This accounting will not include disclosures of information made: (i) for treatment, payment, and health care operations purposes; (ii) to you or pursuant to your authorization; (iii) to correctional institutions or law enforcement officials; and (iv) other disclosures for which federal law does not require us to provide an accounting. Any request for an accounting of disclosures must be made in writing.

• You have the right to a paper copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. If we maintain a website, you may also obtain a copy of this notice on our website.

• In certain states, you may have the right to withhold written consent to the disclosure of reproductive health care services information in certain cases. Depending on your state of residence, we may be required to obtain your written consent before releasing information about your reproductive health care services in certain civil actions or proceedings, subject to some exceptions. In such cases where we are required to obtain your consent, you have the right to withhold your consent.

Exercising Your Rights

Name of Contact Person: Dr. Tejash Patel
Telephone: 713-487-6748

You may also notify the Secretary of the U.S. Department of Health and Human Services of your complaint. We will not take any action against you for filing a complaint.