HIPAA Notice of Privacy Practices

This notice explains how your personal health information in all formats may be used and shared, and how you can access it. It applies to Sanare, and its employees. We follow HIPAA guidelines to protect your health information in all formats, (e.g., digital, print or oral communication) and we may update this notice as needed. If you want more information or have any questions, you can contact our HIPAA Privacy Officer at the address provided. Please review the policy carefully.

Effective Date: 04-11-2025

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND/OR DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

The terms of this Notice of Privacy Practices ("Notice") apply to ST Management, LLC, doing business as Sanare and its employees (collectively "Sanare," "we," "us"). Sanare will use and disclose (share) certain health information of patients. We will share this as necessary to carry out treatment, payment, and health care operations as permitted by law and for the purposes described below.

We are required by the Health Insurance Portability and Accountability Act ("HIPAA") to maintain the privacy of our patients' protected health information. We also need to provide patients with notice of our legal duties and privacy practices for protected health information (“PHI”).

We are required by law to follow the terms of this Notice for as long as it remains in effect. We have the right to change the terms of this Notice as needed. We also have the right to make a new Notice effective for all PHI we collect. We are also required to let you know that there may be a part of state law that may be stricter (or more protective of you) than a standard or requirement under HIPAA. We will follow the stricter (or more protective) standard. If you want a copy of any changes to this Notice, a copy of the Notice in a different language, or information about a specific State law, you can request it by mail. Send requests to the HIPAA Privacy Officer, Sanare, 728 Sprindale Dr, Exton, PA 19341.

How We May Use and Disclose Your Health Information

The following categories explain ways that we may use and disclose ("share") health information. For each category of uses or disclosures, we will explain what we mean and give examples. Not every use or disclosure will be listed. However, all the ways we are permitted to use and share health information will fall within at least one of the categories. We will collect the minimum amount of information needed to use our services, while collecting enough information to keep your account secure. We may also collect extra information beyond the minimum amount, but you are not required to provide this information. We will use this information to enhance your experience with our services.

• For Treatment: We may use your information to provide, coordinate, and manage your care and treatment. For example, Sanare  may share your health information with another health care provider. This applies to a consult or a referral.
• For Payment: We may use and share medical information to bill and collect payment for the services we provide. This could be directly from you, or through a billing service, an insurance company, or another third party. For example, we may need to give your health plan some information about treatment you received at Sanare. This is so they can pay us or pay you back for the treatment. We may also tell your health plan about a treatment you are going to receive to make sure it's covered or get approval.
• Health Care Operations: We may use and share medical information about you for our health care operations. This includes the use and sharing of information that is needed to run Sanare. Also, to make sure that all our patients receive quality care. This includes things like:
• Trying to improve the quality, efficiency and cost of our services,
• Planning and business management,
• Assessing and improving the skills of our health care providers who take care of you,
• Working with outside organizations that check the quality of care we provide and assess, certify, or license healthcare providers, and
• Following this Notice and the law.‍
• To Business Associates: Some services are provided by or to Sanare through other companies (i.e., business associates). They might be attorneys, management service companies, consultants, collection agencies, or accreditation organizations. We may share your information with them so they can do the job we have contracted with them to do. We also sign a contract with each business associate. This requires them to keep your information safe and not share it without our permission or to follow the law.‍
• De-identified Health Information. We may use your health information to create “de-identified” information. This means the information has had certain categories of information (listed in HIPAA) removed from it. We may also share it with a business associate. They can use it to create de-identified information, even if we do not use that information. Your information will be kept safe and confidential and will only be used in ways allowed by law.

Your Choices

For certain circumstances, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions.

• Individuals Involved in Your Care or Payment of Your Care: Sanare may share health information with people you choose (e.g., a family member, relative, friend, or others who care for you) who are involved with your health care or payments. We may, for example, provide limited medical information to allow a family member to pick up a prescription for you. We try to get your written consent before sharing your information with them. If you can make your own health care decisions, Sanare will ask your permission before using your medical information for these reasons. If you cannot make health care decisions, we may share relevant medical information with family or those who care for you. This applies if we feel it is in your best interest to do so, including in an emergency. If you are a minor and receive certain treatments, we will follow additional state laws to protect you. These treatments include pregnancy, drug and/or alcohol abuse, communicable disease, or mental health.
• Disaster Relief: During a disaster, Sanare may use or share Protected Health Information with a public or private organization. The reason for this is to help with disaster relief efforts. Your information can help notify people (i.e., your family members or others responsible for your care) about where you are, your condition, or events like death.

Special Situations When Your Medical Information May Be Released:

We are allowed or required to share your information in other ways. Usually in ways that contribute to the public good, such as public health and research. Before we can do that, we must meet many conditions set by the law. For more information see: www.hhs.gov/hipaa/for-individuals/index.html.

Please note that we do not create or manage a hospital directory.

There are certain reasons why your health information will be used and/or shared, without your prior consent or authorization. These include the following:

• As Required by Law: Sanare will share your medical information when we are required to do so by federal, state, or local law.
• To Avert a Serious Threat to Health or Safety: Sanare may use and share your health information when needed to prevent a serious threat to your health and safety. This also applies to the health and safety of the public or another person. However, we would only share your information with someone able to help prevent or reduce the threat.
• Health Oversight Activities: Sanare may share your health information with health oversight agencies. This is for oversight activities authorized by law (e.g., government audits, investigations, inspections, and licensure activities). These activities are needed for the government to monitor the health care system. They also help with government programs, and compliance with civil rights laws.
• Public Health Risks: Sanare may share your health information with government officials for public health reasons. These generally are to:

• Prevent or control disease, injury, or disability.
• Report births and deaths.
• Report child abuse or neglect, or abuse of a vulnerable adult.
• Report reactions to medications or problems with products.
• Notify people of recalls of products they may be using.
• Notify a person who may have been exposed to a disease or may be at risk of contracting or spreading.
• Report to the FDA as permitted or required by law, or
• Help with public health surveillance and combat bioterrorism.

• Law Enforcement: We may release health information to a law enforcement official for certain purposes such as:
• To comply with a legal process (i.e., subpoena) or as required by law
• Information to identify or find someone (e.g., suspect, or missing person)
• Information about a person who is or is a suspected crime victim
• In situations where a death may have been from criminal conduct
• If a crime occurs on location at Sanare 
• A medical emergency not at a Sanare location, where it looks like a crime has occurred.

However, if you ask for drug dependence treatment and recovery from us, your request will be treated as confidential. We will not give your name to law enforcement unless you consent.

• Lawsuits and Disputes: We may need to share your health information if there is a legal proceeding (e.g., a court case or administrative hearing). This may be for a court or administrative order, subpoena, discovery request, or other lawful process.
• Coroners, Medical Examiners and Funeral Directors: We may give health information to a coroner or medical examiner. This may be needed to identify a deceased person. Additionally, it can help figure out the cause of death. We may also give health information to funeral directors as needed to carry out their duties.
• Organ and Tissue Donation: We may share health information with organizations involved in organ or tissue donations and transplants. This is done to help with the donating or receiving process (e.g., for organs, eyes, or tissues).
• Specialized Government Functions: We may share your health information if it relates to certain government functions (e.g., military and veterans' activities). We may also share it for national security and intelligence activities. Additional reasons we may use it include for protecting the President, and medical exams that are done by the Department of State.
• Workers' Compensation: We may share your health information for workers' compensation. We also may share it with similar programs. These programs give benefits for injuries or illnesses that happen at work.
• Inmates: If you are an inmate or under police custody, we may give your health information to them. This release is needed so they can provide you with health care. It is also needed to protect the health and safety of yourself or others. Additionally, it ensures the safety of the correctional institution.
• Research: Sanare may use and share health information about you for research. We do this as allowed by Federal Law.  This can be done with your written permission. It may also happen when the study has been reviewed for privacy protection. This review is done by an Institutional Review Board or Privacy Board before the research begins. In some cases, researchers may be allowed to use information in a limited way to figure out if the study or the participants are a good fit. We will do our best to get your consent or refusal to take part in outside research, as required by law. This will happen before we release any identifiable information about you to outside researchers.

Situations Where We Will Never Share Your Information Without Your Written Authorization:

We will not share or use your Protected Health Information in the situations listed below. We will only do this by first getting your written permission. In addition, other uses not covered in this Notice will be made only with your written permission. If you provide us permission to use or disclose health information about you pursuant to a written authorization, you may revoke that permission, in writing, at any time. If you revoke your permission, we will not longer use or disclose health information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain the records of the care that we provided to you. Sanare is dedicated to protecting the privacy of your health information and will not use or disclose your information for the following purposes without your authorization:

• Psychotherapy Notes: Sanare will not use or disclose psychotherapy notes without your written consent.
• Marketing and Sale of Private Medical Information: Sanare will not use or share your private health information for marketing purposes. We will also never sell your private health information for marketing. We will only do this if you give us your written consent.
• As Required by Privacy Law: Certain types of information are kept private and protected by state and/or federal law. Generally, Sanare cannot share it without written consent. It may also be shared if a court orders it or in other limited circumstances:

• substance abuse treatment records
• certain psychotherapy notes
• HIV/AIDS testing or test results
• genetic information
• venereal disease information
• tuberculosis information
• confidential communication with a Licensed Social Worker
• certain information related to the treatment of a minor (e.g., when the minor seeks emancipated treatment for pregnancy or treatment related to the minor's child or a sexually transmitted disease)‍
• Contact: With your prior written consent, Sanare will contact you with a call or text message, on the telephone number we have on file, to coordinate your care and provide appointment reminders. You can revoke this consent at any time by replying STOP to any text message, email dtoney@sanaretoday.com, or call 610.344.9600. ‍
• Breach Notification: We will contact you in writing within sixty (60) days if we learn of any HIPAA privacy violation. This includes when your information is accessed, used, or shared without permission. It also includes if it was not kept safe with proper security measures.‍
• Reproductive Health Information:  Federal regulations prohibit the use or disclosure of PHI by Sanare and its business associates for either of the following activities: (a) to conduct a criminal, civil, or administrative investigation into or impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided; or (b) the identification of any person for the purpose of conducting such investigation or imposing such liability. In the event Sanare receives a request for health information potentially related to the provision of reproductive health care, Sanare will obtain signed and dated attestations from external organizations, such as law enforcement, requesting protected health information (PHI) related to such reproductive healthcare stating that the information will not be used against a provider or patient in legal cases related to the provision of reproductive health care and adhere to federal regulations and guidance with respect to protecting such sensitive information.

Your Rights Regarding Your Protected Health Information

You have the following rights regarding the health information we maintain about you:

Right to Inspect and Copy Protected Health Information

You have the right to see and copy your Protected Health Information with a written request. It can be in paper or electronic format. Under federal law, you may not see or copy some types of records (e.g., psychotherapy notes, information related to civil, criminal, or administrative actions; information restricted by law; research data; and confidential information). This also applies to information that could result in harm or injury to yourself or others if shared. We have up to 30 days to provide the PHI and may charge a fee to cover the costs.

Right to Amend

You have the right to request that Sanare update the Protected Health Information we have on file for you. You can do this if you believe that it is wrong or not complete. Your request must be in writing and list what is wrong and why. Please note that a request does not necessarily mean the information will be amended. If we deny your request, we will provide you with a written denial within sixty (60) days. It will state why it was denied and your right to submit a written statement to disagree with the denial. It will also contain a description of how you may file a complaint with us or the Secretary of the U.S. Department of Health and Human Services (“DHHS”). This denial will also state that if you do not disagree in a written statement, you may ask that we include your request for amendment and the denial with any future sharing of your personal health information. This applies to the information that is the subject of your request. Copies of all requests, denials, and statements of disagreement will be included in your records. If we accept your request for amendment, we will try to inform and provide the amendment within a reasonable time to those who received your health information before the change. This also applies to those that we know have the health information that is the subject of the amendment. This includes those who may have relied on or could rely on such information to your detriment.

Right to an Accounting of Disclosures

You have the right to receive a list (accounting) of the times we have shared your health information for six (6) years prior to the date you ask. This includes who we shared it with and why. The request can be made for paper and/or electronic disclosures. It will not include disclosures made for (a) treatment, payment, and healthcare operations, (b) disclosures you authorize, (c) disclosures to you, (d) for a facility directory or to others involved in your care, (e) for national security or intelligence purposes, and (f) to correctional institutions. We will provide one accounting a year for free. A reasonable cost-based fee will be charged if you ask for another one within twelve (12) months. We will let you know the amount of the fee in advance. You can then decide whether or not you would like the additional accounting.

Right to Request Restrictions

You have a right to request that Sanare restricts and/or limits what we share with others. This may include family members, friends, and others involved in your care or payment for your care. You also have the right to restrict what we use or share for treatment, payment, and/or health care operations. Your request must be submitted in writing. It should include the specific restriction requested, whom you want it to apply to, and why you would like to impose it. Please note that Sanare is not required to agree to your request, apart from a restriction request to not share information with your health plan for care and services for which you have paid in full out-of-pocket.

Right to Request Confidential Communications

You have a right to request confidential communications from us by alternative means or at an alternative location. For example, you may ask that we send mail only to an address specified by you which may or may not be your home address. You may request we should only call you on your work phone or include which telephone numbers we are allowed or not allowed to leave messages on. You do not have to disclose the reason for your request. However, you must submit a request with instructions in writing. We will say “yes” to all reasonable requests.

Right to Obtain an Electronic Copy of Medical Records

You have the right to request an electronic copy of your medical record. You may also request it to be sent to another person or organization. This can be done when your Protected Health Information is stored in an electronic format. We will try to provide the records in the format you request. However, there may be cases where we cannot get the information in the format you request. We will then provide it in a standard electronic format or a hard copy form. There may be a fee for the work in sending the electronic medical records upon request.

Right to a Summary of your Protected Health Information

You have the right to request only a summary of your Protected Health Information. You can do this if you do not want a copy of your full record. You can also request an explanation of the information when you request your full record.

Right to Receive Notice of a Breach

If there is a breach of your unsecured Protected Health Information, you have the right to be notified. The notification will inform you of such breach.

Right to a Paper Copy of This Notice

Even if you have agreed to receive an electronic copy of this HIPAA Notice of Privacy Practices, you have the right to request we provide it in paper form. You may make such a request at any time. We will provide you with a paper copy promptly. This Notice is also available a sanaretoday.com.

Right to Choose Someone to Act for You

Other people (e.g., a legal guardian or medical power of attorney) may be able to make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.

Right to File a Complaint

If you believe we have violated your rights, you can contact us using the contact information in this Notice. You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or https://www.hhs.gov/hipaa/ filing-a-complaint/complaint-process/index.html. We will not retaliate against you for filing a complaint.

Our Responsibilities

We use security measures such as access controls, encryption, verification and secure disposal to protect the information we keep. While we strive to maintain the highest level of security, it is important to note that no security measure is 100% secure.

• We require verification of multiple factors to confirm identity before sharing Personal Health Information in any format. Printed materials containing Personal Health Information are stored in secure location, accessible only to authorized personnel.
• Personal Health Information will only be communicated verbally if it can be done in a private location or without sharing sensitive information aloud.
• We are required by law to maintain the privacy and security of your Personal Health Information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this Notice and give you a copy of it.
• We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind. However, previously released information is not covered by this request.
• We will maintain your paper or electronic medical record for as long as required by applicable law.

For more information visit: www.hhs.gov/hipaa/for-individuals/index.html

Changes to the Terms of this Notice

The effective date of this Notice is 04-11-2025, and it has been updated effective April 11th, 2025. We reserve the right to change the terms of this Notice, and the changes will apply to all information we have about you. The new notice will be available upon request, in our offices, and on our website.

Complaints or Questions

If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the Department of Health and Human Services. To file a complaint with Sanare, or to ask a question about this Notice, contact:

Sanare Privacy Officer
Name: Dorinda Toney
E-mail: dtoney@sanaretoday.com
Phone: 610.344.9600

All complaints must be submitted in writing. You will not be penalized for filing a complaint.

‍