We Care About Your Privacy

Effective: February 9, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

YOUR RIGHTS

When it comes to your protected health information, you have the right to:

• Get a copy of your health and claims records
• Ask us to correct your health and claims records
• Request confidential communications
• Ask us to limit what we use or share
• Get a list of those with whom we've shared your information
• Get a copy of this privacy notice
• Choose someone to act for you
• File a complaint if you believe your privacy rights have been violated

OUR RESPONSIBILITIES

We are required by law to:

• Maintain the privacy and security of your protected health information
• Notify you promptly if a breach occurs that may have compromised your information
• Follow the duties and privacy practices described in this notice
• Give you a copy of this notice
• Only use or share your information as described here unless you authorize otherwise in writing

Our Pledge Regarding Medical Information

The privacy of your medical information is important to us. We understand that your medical information is personal, and we are committed to protecting it. We create a record of the care and services you receive at our organization. We need this record to provide you with quality care and to comply with certain legal requirements. This notice will tell you about the ways we may use and share medical information about you. We also describe your rights and certain duties we have regarding the use and disclosure of medical information.

Special Protections for Substance Use Disorder (SUD) Records (42 U.S.C. 290dd-2; 42 C.F.R. Part 2)

Some health information related to substance use disorder (“SUD”) diagnosis, treatment, or referral for treatment may be protected by federal law and regulations known as 42 C.F.R. Part 2 (“Part 2”). Part 2 provides additional privacy protections beyond HIPAA for certain SUD records.

If your records are protected by Part 2, we will not use or disclose those records for treatment, payment, or health care operations unless you give written consent (when required), except as permitted by Part 2 (by way of example, in a medical emergency or as otherwise allowed by law).

Part 2 also generally prohibits the redisclosure of Part 2 protected records unless the recipient is permitted to receive them under Part 2 and the disclosure is consistent with your consent or another Part 2 permission. Disclosures made with your written consent must be accompanied by a copy of the consent or a clear explanation of its scope.

Part 2 requires a separate written consent for disclosures of Part 2 records for civil, criminal, administrative, or legislative proceedings. A general authorization for the release of medical information is not enough for Part 2 records.

Part 2 protected records cannot be used to investigate or prosecute you without your written consent or a court order that meets Part 2 requirements. This limitation applies even when Part 2 records have been shared lawfully.

Our Legal Duty

Law Requires Us to:

• Keep your medical information private.
• Give you this notice describing our legal duties, privacy practices and your rights regarding your medical information.
• Follow the terms of the current notice

We Have the Right to:

• Change our privacy practices and the terms of this notice at any time, provided that the changes are permitted by law.
• Make the changes in our privacy practices and the new terms of our notice effective for all medical information that we keep, including information previously created or received before the changes.

Notice of Change to Privacy Practices:

Before we make an important change in our privacy practices, we will change this notice and make the new notice available upon request.

Use and Disclosure of Your Medical Information

The following section describes different ways that we use and disclose medical information. Not every use or disclosure will be listed. However, we have listed all of the different ways we are permitted to use and disclose medical information. We will not use or disclose your medical information for any purpose not listed below without your specific written authorization. Any specific written authorization you provide may be revoked at any time by writing to us.

When we disclose your health information, it may be subject to redisclosure by the recipient and may no longer be protected by federal privacy laws, unless another law limits the recipient's use or disclosure (by way of example, Part 2).

For Treatment:

We may use medical information about you to provide you with medical treatment or services. We may disclose medical information about you to doctors, nurses, technicians, medical students, or other people who are taking care of you. We may also share medical information about you to your other health care providers to assist them in treating you.

If we create or maintain records protected by Part 2, we will use or disclose those Part 2 protected records for treatment, payment, and health care operations only as permitted by Part 2.

For Payment:

We may use and disclose your medical information for payment purposes. A bill may be sent to you or a third-party payer. The information on or accompanying the bill may include your medical information.

For Data Breach Notification Purposes:

We may use your medical information to provide legally required notices of unauthorized acquisition, access or disclosure of your health information due to a breach.

For Health Care Operations:

We may use and disclose your medical information to our health care operations. This might include measuring and improving quality, evaluating the performance of employees, conducting training programs, and getting the accreditation certificates, licenses, and credentials we need to serve you.

Additional Uses and Disclosures:

In addition to using and disclosing your medical information for treatment, payment, and health care operations, we may use and disclose medical information for the following purposes:

Patient Directory:

Unless you notify us that you object, the following medical information about you will be placed in our patient directory: your name; your condition described in general terms; your religious affiliation, if any. We may disclose this information to members of the clergy or, except for your religious affiliation, to others who contact us and ask for information about you by name.

Notification:

We may use and disclose medical information to notify or help notify: a family member, your personal representative, or another person responsible for your care. We will share information about your general condition or death. If you are present, we will get your permission, if possible, before we share or give the opportunity to refuse permission. In case of emergency, and if you are not able to give or refuse permission, we will share only the health information that is directly necessary for your health care, according to our professional judgment. We will also use our professional judgment to make decisions in your best interest about allowing someone to pick up medicine, medical supplies, X-ray, or medical information for you.

Disaster Relief:

We may share medical information with a public or private organization or person who can legally assist in disaster relief efforts.

Fundraising:

We may provide medical information to one of our affiliated fundraising foundations to contact you for fundraising purposes. We will limit our use and sharing to information that describes you in general, not personal, terms and the dates of your health care. We will not use or disclose Part 2 protected records for fundraising without first giving you a clear and conspicuous opportunity to opt out. In any fundraising materials, we will provide you a description of how you may choose not to receive future fundraising communication.

Research in Limited Circumstances:

We may use medical information for research purposes in limited circumstances where the research has been approved by a review board that has reviewed the research proposal and established protocols to ensure the privacy of medical information.

Funeral Director, Coroner, Medical Examiner:

To help them carry out their duties, we may share the medical information of a person who has died with a coroner, medical examiner, funeral director, or an organ procurement organization.

Specialized Government Functions:

Subject to certain requirements, we may disclose or use health information for military personnel and veterans, for national security and intelligence activities, for protective services for the President and others, for medical suitability determinations for the Department of State, for correctional institutions and other law enforcement custodial situations and for government programs providing public benefits.

Court Orders and Judicial and Administrative Proceedings:

We may disclose medical information in response to a court or administrative order, subpoena, discovery request, or other lawful process, under certain circumstances. Under limited circumstances, such as a court order, warrant, or grand jury subpoena, we may share your medical information with law enforcement officials. We may share limited information with a law enforcement official concerning the medical information of a suspect, fugitive, material witness, crime victim, or missing person. We may share the medical information of an inmate or other person in lawful custody with a law enforcement official or correctional institution under certain circumstances.

If the requested information includes records protected by Part 2, we will only disclose those Part 2 protected records in response to a court order that meets Part 2 requirements or as otherwise permitted by Part 2. A general subpoena or request is not enough under Part 2.

Public Health Activities:

As required by law, we may disclose your medical information to public health or legal authorities charged with preventing or controlling disease, injury or disability, including child abuse or neglect. We may also disclose your medical information to persons subject to jurisdiction of the Food and Drug Administration for purposes of reporting adverse events associated with product defects or problems, to enable product recalls, repairs or replacement’s, to track products, or to conduct activities required by the Food and Drug Administration.

We may also, when we are authorized by law to do so, notify a person who may have been exposed to a communicable disease or otherwise be at risk of contracting or spreading a disease or condition.

Victims of Abuse, Neglect, or Domestic Violence:

We may use and disclose medical information to appropriate authorities if we reasonably believe that you are a possible victim of abuse, neglect, or domestic violence or the possible victim of other crimes. We may share your medical information if it is necessary to prevent a serious threat to your health or safety or the health or safety of others. We may share medical information when necessary to help law enforcement officials capture a person who has admitted to being part of a crime or has escaped from legal custody.

Workers Compensation:

We may disclose health care information when authorized or necessary to comply with laws relating to workers compensation or other similar programs.

Health Oversight Activities:

We may disclose medical information to an agency providing health oversight for overnight activities authorized by law, including audits, civil, administrative, or criminal investigations or proceedings, inspections, licensure or disciplinary actions, or other authorized activities.

Law Enforcement:

Under certain circumstances, we may disclose health information to law enforcement officials. These circumstances include reporting required by certain laws (such as the reporting of certain types of wounds), pursuant to certain subpoenas or court orders, reporting limited information concerning identification and location at the request of a law enforcement official, reports regarding suspected victims of crimes at the request of a law enforcement official, reporting death crimes on our premises, and crimes in emergencies.

Appointment Reminders:

We may use and disclose medical information for purposes of sending you appointment postcards or otherwise reminding you of your appointments.

Alternative and Additional Medical Services:

We may use and disclose medical information to furnish you with information about health-related benefits and services that may be of interest to you, and to describe or recommend treatment alternatives.

Your Individual Rights

You Have a Right to:

• Look at or get copies of certain parts of your medical information. You may request that we provide copies in a format other than photocopies. We will use the format you request unless it is not practical for us to do so. You must make your request in writing. You may ask the receptionist for the form needed to request access. There may be charges for copying and for postage if you want the copies mailed to you. Ask the front desk about our fee structure.
• Additionally, we maintain an electronic health record containing your health information, you have the right to request that we send a copy of your health information in an electronic format to you or to a third-party that you identify. We may charge a reasonable fee for sending the electronic copy of your health information.
• Receive a list of all the times we, or our business associates, shared your medical information for purposes other than treatment, payment, and health care operations and other specified exceptions.
• Request that we place additional restrictions on our use or disclosure of your medical information. We are not required to agree to these additional restrictions, but if we do, we will abide by our agreement (except in the case of an emergency).
• Request that we communicate with you about your medical information by different means or to different locations. Your request that we communicate your medical information to you by different means or at different locations must be made in writing to our HIPAA Privacy Officer.
• Request that we change certain parts of your medical information. We may deny your request if we did not create the information, you want changed or for certain other reasons. If we deny your request, we will provide you with a written explanation. You may respond with a statement of disagreement that will be added to the information you wanted changed. If we accept your request to change the information, we will make reasonable efforts to tell others, including people you name, of the change and to include the changes in any future sharing of that information.
• If you wish to receive a paper copy of this privacy notice, then you have the right to obtain a paper copy by making a verbal or written request to our staff.
• You have the right to restrict information given to your third-party payer (e.g., health insurance plan), if you fully paid for your health care services out of your own pocket. If you paid in full for services out of your own pocket, you can request that the information regarding the services not be disclosed to your third-party payer since no claim is being made against the third-party payer.
• You have the right to be notified in the event that we (or one of our Business Associates) discover a breach of your unsecured protected health information. Notice of any such breach will be made in accordance with federal requirements.

If we create or maintain records protected by Part 2, you have additional rights concerning those Part 2 records. In many circumstances you can decide whether to consent to uses and disclosures of your Part 2 protected records for treatment, payment, and health care operations, and you may revoke your Part 2 consent in writing (subject to the limits in the law for actions already taken in reliance on your consent).

Some Part 2 information, such as SUD counseling notes, may require your separate consent and may not be disclosed based on a broad consent for treatment, payment, and health care operations.

You also have the right to receive notice of how your Part 2 records may be used and disclosed and the right to opt out of fundraising communications.

If you believe your Part 2 privacy rights have been violated, you may file a complaint directly with the Secretary of the U.S. Department of Health and Human Services.

Questions and Complaints

If you have any questions about this notice, or if you think that we may have violated your privacy rights, you may speak to our HIPAA Privacy Officer or submit a written complaint. To submit a written complaint with Barrow Brain and Spine please address your correspondence to:

Barrow Brain and Spine
Attn: HIPAA Privacy Officer
2910 N. Third Ave.
Phoenix, AZ 85013
Compliance@barrowbrainandspine.com
(602) 406-4025

You may also submit a written complaint to the U.S. Department of Health and Human Services. We will not retaliate in any way if you choose to file a complaint.

Changes to This Notice

We reserve the right to change this Notice. We reserve the right to make the revised or changed Notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice in our facilities and on our website. The effective date of the Notice will be shown on the first page.