Notice of Privacy Practices

Smile Family Dental San Francisco, California

Effective Date: January 1, 2026 Next Review: January 1, 2027

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Our Pledge Regarding Your Health Information

Smile Family Dental ("we," "our," or "the Practice") is committed to protecting the privacy of your protected health information ("PHI"). PHI is information that identifies you and relates to your past, present, or future physical or mental health, the dental care we provide to you, or payment for that care.

This Notice is provided pursuant to 45 CFR § 164.520, which is part of the federal regulations implementing the Health Insurance Portability and Accountability Act of 1996 ("HIPAA").

We are required by law to:

• Maintain the privacy of your PHI;
• Provide you with this Notice describing our legal duties and privacy practices regarding your PHI;
• Notify you in the event of a breach of your unsecured PHI; and
• Follow the terms of the Notice that is currently in effect.

2. How We May Use and Disclose Your Health Information

The following categories describe the ways we may use and disclose your PHI without your written authorization. Not every permitted use is listed; however, all uses fall into one of these categories.

2.1 For Treatment (45 CFR § 164.506)

We will use and disclose your PHI to provide, coordinate, or manage your dental care and any related services. For example, we may share your treatment records with an orthodontist or oral surgeon to whom you have been referred.

2.2 For Payment (45 CFR § 164.506)

We may use and disclose your PHI to obtain payment for the services we provide. For example, we may submit claims to your dental insurance plan, which may include your diagnosis, the procedure performed, and the date of service.

2.3 For Health Care Operations (45 CFR § 164.506)

We may use and disclose your PHI to support our internal business activities. Examples include quality assessment, staff training, accreditation activities, and reviewing the performance of our team.

2.4 Other Permitted and Required Uses

We may also use or disclose your PHI without your authorization for the following purposes, when required or permitted by law:

• Required by law — disclosures required by state, federal, or local law (45 CFR § 164.512(a));
• Public health activities — reporting to public health authorities for disease prevention (45 CFR § 164.512(b));
• Health oversight — disclosures to government agencies for audits, investigations, or licensure (45 CFR § 164.512(d));
• Judicial and administrative proceedings — disclosures in response to a court order or subpoena (45 CFR § 164.512(e));
• Law enforcement — limited disclosures for law enforcement purposes (45 CFR § 164.512(f));
• Coroners, medical examiners, funeral directors — to identify a deceased person (45 CFR § 164.512(g));
• Workers' compensation — as authorized by state workers' compensation laws (45 CFR § 164.512(l));
• Serious threat to health or safety — to prevent imminent harm (45 CFR § 164.512(j)).

2.5 Uses Requiring Your Written Authorization

The following uses of your PHI require your written authorization under 45 CFR § 164.508:

• Marketing communications;
• Sale of your PHI;
• Most uses or disclosures of psychotherapy notes (if applicable).

You may revoke your authorization at any time in writing, except to the extent we have already acted in reliance on it.

3. Your Rights Regarding Your Health Information

Under 45 CFR § 164.520(b)(1)(iv), you have the following rights with respect to your PHI:

3.1 Right to Inspect and Copy (45 CFR § 164.524)

You have the right to inspect and obtain a copy of your PHI maintained in our designated record set. You may request a copy in paper form or in the electronic format we maintain. We will respond within 30 days of your request and may charge a reasonable, cost-based fee.

3.2 Right to Request Amendment (45 CFR § 164.526)

You have the right to request that we amend PHI you believe is incorrect or incomplete. Your request must be in writing and explain the reason for the amendment. We may deny your request under limited circumstances; you will be notified in writing of any denial.

3.3 Right to an Accounting of Disclosures (45 CFR § 164.528)

You have the right to request a list of certain disclosures of your PHI made by us in the six years prior to your request. We will provide the first accounting in any 12-month period free of charge.

3.4 Right to Request Restrictions (45 CFR § 164.522(a))

You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or health care operations. We are not required to agree to your request, except where you have paid out-of-pocket in full for a service and request that the information not be disclosed to your health plan.

3.5 Right to Request Confidential Communications (45 CFR § 164.522(b))

You have the right to request that we communicate with you about medical matters in a certain way or at a certain location (for example, at work rather than at home).

3.6 Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice upon request, even if you have agreed to receive it electronically.

3.7 Right to Be Notified of a Breach (45 CFR § 164.404)

You have the right to be notified following a breach of unsecured PHI affecting your information.

4. Our Duties

We are required by law to maintain the privacy of your PHI and to provide you with notice of our legal duties and privacy practices. We are required to abide by the terms of this Notice as it is currently in effect.

We reserve the right to change this Notice. We reserve the right to make the revised Notice effective for PHI we already have about you, as well as any information we receive in the future. The most current Notice will be posted in our office and available upon request.

5. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services. To file a complaint with us, contact our Privacy Officer at the address below. You will not be retaliated against for filing a complaint.

You may also file a complaint with the HHS Office for Civil Rights at:

U.S. Department of Health and Human Services 200 Independence Avenue, S.W. Washington, D.C. 20201 1-877-696-6775 www.hhs.gov/ocr/privacy/hipaa/complaints/

6. Contact Information

Privacy Officer Smile Family Dental [Office Street Address] San Francisco, CA [ZIP] Telephone: [Office Phone] Email: [privacy@example.com]

7. Acknowledgment of Receipt

I acknowledge that I have received a copy of Smile Family Dental's Notice of Privacy Practices.

This document is based on the requirements of 45 CFR § 164.520. Consult a qualified healthcare attorney for legal review before adopting it as your practice's official Notice of Privacy Practices.