Notice of Privacy Practices

1. Our Commitment to Your Health Information

At Thunderbird Vein, we are committed to protecting the privacy of your Protected Health Information (PHI). PHI includes any individually identifiable health data created, received, or maintained by our practice relating to your physical health, medical history, vascular diagnostic testing (such as duplex ultrasound scans), or payment for healthcare services (e.g., endovenous ablation, sclerotherapy, or consultation visits).

We are required by federal and state law to:

• Maintain the privacy and security of your PHI.
• Provide you with this Notice detailing our legal duties and privacy practices.
• Abide by the terms of the Notice currently in effect.
• Notify you promptly following any security breach of unsecured PHI.

2. How We May Use and Disclose Your Health Information

We may use and disclose your PHI for Treatment, Payment, and Healthcare Operations (TPO) without requiring prior written authorization:

A. For Treatment

We use your PHI to provide, coordinate, or manage your medical care. For example, our vascular specialists and ultrasound technologists use your diagnostic scans and clinical notes to plan vein treatments (e.g., radiofrequency ablation or microphlebectomy). We may also share PHI with your primary care physician to coordinate post-procedure recovery.

B. For Payment

We use and disclose your PHI to bill and collect payment from health insurance plans, Medicare, Medicaid, or you directly. For example, we submit diagnostic coding, treatment notes, and ultrasound report documentation to your health insurer to verify medical necessity and secure reimbursement for medically indicated vein procedures.

C. For Healthcare Operations

We use your PHI to support internal operations and ensure high-quality care. For example, we evaluate provider performance, conduct quality assessment reviews of clinical outcomes, manage compliance, and audit billing records.

D. Appointment Reminders

We may contact you via phone, SMS, email, or patient portal to remind you of upcoming consultations, follow-up ultrasound appointments, or post-procedure care instructions.

3. Disclosures Required or Permitted by Law

Under federal regulations, we may disclose your PHI without your consent under specific legal circumstances:

• As Required by Law: Mandatory reporting to federal, state, or local authorities.
• Public Health & Safety: Reporting adverse medical events or preventing imminent threats to public health or safety.
• Health Oversight Activities: Audits or investigations conducted by government oversight bodies (e.g., HHS, state medical boards).
• Judicial & Administrative Proceedings: Compliance with valid court orders, subpoenas, or official discovery requests.
• Business Associates: We share PHI with trusted third-party vendors (e.g., HIPAA-compliant billing platforms, EHR software, secure form hosts). All Business Associates sign legally binding Business Associate Agreements (BAAs) committing to protect your data.

4. Uses & Disclosures Requiring Your Explicit Authorization

We will never use or disclose your PHI for the following purposes without your signed written authorization:

• Marketing Communications: We will not use your PHI for marketing purposes or share your contact details with third parties for commercial gain.
• Sale of PHI: We do not sell patient health information or contact lists under any circumstances.
• Before & After Photos: We will never publish or share your before-and-after treatment photographs on our website, social media, or marketing materials without a separate, signed Media Consent Release Form.

You may revoke any written authorization at any time in writing, except to the extent that our clinic has already acted in reliance upon it.

5. Your Rights Regarding Your Health Information

You hold specific statutory rights regarding the medical records and health information we maintain about you:

6. Website Data & Digital Privacy Notice

When interacting with our clinic via our official website:

• Web Contact Forms: Submissions made via general contact or appointment booking forms are intended for non-emergency scheduling and inquiries.
• Tracking Pixels & Analytics: Our practice does not install marketing tracking pixels (such as Meta/Facebook pixels) on clinical intake or patient form pages. General website usage data is governed by our separate Website Privacy Policy.