HIPAA Notice of Privacy Practices

Last updated: February 9, 2026

This Notice of Privacy Practices (“Notice”) describes how medical information about you may be used and disclosed and how you can access this information. Please review it carefully.

This Notice applies to all Protected Health Information (“PHI”) created, received, maintained, or transmitted by Upper West Side Derm (“we,” “us,” or “our”), whether in written, electronic, or oral form.

Our Responsibilities

We are required by law to:

• Maintain the privacy and security of your PHI.
• Provide you with this Notice explaining our legal duties and privacy practices.
• Follow the terms of this Notice currently in effect.
• Notify you if a breach occurs that may have compromised the privacy or security of your PHI.

How We May Use and Disclose Your Health Information

The following categories describe the ways we may use and disclose your PHI. Not every use or disclosure is listed, but all permitted uses fall within these categories.

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services. This may include sharing information with physicians, therapists, nurses, or other healthcare professionals involved in your care.

Payment

We may use and disclose your PHI to bill and receive payment for services provided to you. This may include disclosures to insurance companies, health plans, or other payers.

Healthcare Operations

We may use and disclose your PHI for healthcare operations, including quality assessment and improvement activities, training, licensing, accreditation, auditing, compliance, and business planning.

Uses and Disclosures Without Your Authorization

We may use or disclose your PHI without your authorization as required or permitted by law, including for:

• Public health activities (such as reporting certain diseases or adverse events).
• Health oversight activities (such as audits, investigations, inspections, and licensure).
• Legal proceedings and law enforcement purposes, as permitted by law.
• Compliance with workers’ compensation laws.
• To prevent or lessen a serious threat to health or safety, consistent with applicable law.

Uses and Disclosures Requiring Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes not described in this Notice, including:

• Most uses and disclosures of psychotherapy notes.
• Marketing purposes (where an authorization is required by law).
• Sale of PHI.

You may revoke an authorization at any time by submitting a written request, except to the extent that we have already taken action based on your authorization.

Special Protections for Substance Use Disorder Records (42 C.F.R. Part 2)

Certain health information related to the treatment of Substance Use Disorders (SUD) is subject to additional federal confidentiality protections under 42 C.F.R. Part 2.

If this practice creates, receives, or maintains records that identify an individual as having sought or received Substance Use Disorder treatment, those records are afforded heightened protections beyond standard HIPAA requirements. In general, such information may not be used or disclosed without the patient’s written consent, except as expressly permitted or required by law.

Federal law further prohibits the use or disclosure of Substance Use Disorder records in civil, criminal, administrative, or legislative proceedings against the patient, except as authorized by a court order or otherwise permitted under applicable regulations.

Patients have specific rights related to Substance Use Disorder records, including limitations on disclosures and the right to revoke certain authorizations, subject to applicable legal requirements.

These additional protections apply only to information covered by 42 C.F.R. Part 2 and do not necessarily apply to all health information maintained by this practice.

Your Rights Regarding Your Health Information

You have the right to:

• Inspect and obtain a copy of your medical and billing records, and other PHI we maintain about you, as permitted by law.
• Request a correction (amendment) to your PHI if you believe it is incorrect or incomplete, as permitted by law.
• Request restrictions on certain uses and disclosures of your PHI (we are not required to agree to all requested restrictions, except where required by law).
• Request confidential communications (for example, that we contact you at an alternative phone number or address).
• Receive an accounting of disclosures of your PHI, as permitted by law.
• Obtain a paper copy of this Notice at any time, even if you agreed to receive it electronically.
• Be notified following a breach of unsecured PHI, as required by law.

Requests must typically be submitted in writing. We may deny certain requests as permitted or required by law.

Changes to This Notice

We reserve the right to change this Notice at any time. Any changes will apply to all PHI we maintain. The revised Notice will be available on our website at https://www.upperwestsidedermatology.com and upon request.

Contact Us

If you have any questions about your privacy rights or this Notice, You can contact us:

• By visiting this page on our website: Contact Us