Notice of Privacy Practices

Who We Are

COBC Brands Direct Primary Care LLC d/b/a Colorado Springs Health Collective – Direct Primary Care ("the Practice")

1497 Solitaire St, Colorado Springs, CO 80905

Privacy Officer: Logan Crist, PA-C • Email: dpc@coshealthcollective.com

Our Responsibilities

We are required by law to:

• Maintain the privacy and security of your protected health information (PHI).
• Provide you this Notice of our legal duties and privacy practices.
• Follow the terms of the Notice currently in effect.
• Notify you following a breach of unsecured PHI.
• For minors, the parent or guardian normally signs the NPP acknowledgment as the child's personal representative.

We will not retaliate against you for filing a complaint.

How We May Use and Disclose Your Information

We typically use or share your PHI in these ways:

• Treatment. To provide, coordinate, or manage your care and related services.
• Payment. To obtain or process payment for services you receive.
• Health Care Operations. For quality assurance, training, credentialing, legal/compliance, and business operations.

Minors and Adolescent Privacy

We comply with Colorado and federal privacy rules regarding minors. Some health services may be confidential to a minor under Colorado law. In those cases, we may limit disclosures to parents or guardians and restrict proxy portal access to protect the minor's privacy.

Other Uses and Disclosures Permitted or Required by Law

We may use or disclose PHI without your authorization as allowed by law, including: public health activities; health oversight activities; required reporting; judicial/administrative proceedings; law enforcement purposes; to avert a serious threat to health or safety; coroners/medical examiners; organ/tissue donation; workers' compensation; and as otherwise required by federal or Colorado law.

Note on fundraising/marketing/sale of PHI: We do not sell PHI and do not use PHI for fundraising. If we ever send forms of marketing that require authorization, we will obtain your written authorization first.

Uses and Disclosures That Require Your Authorization

We will not use or disclose your PHI for any purpose not described in this Notice unless you give us written authorization. Certain uses/disclosures always require your written authorization, including most marketing communications and any sale of PHI. If you authorize a use or disclosure, you may revoke that authorization at any time in writing.

Your Rights

You have the right to:

• Get an electronic or paper copy of your record. Ask how to access or get copies; reasonable cost-based fees may apply.
• Ask us to correct your record if you think it is incomplete or inaccurate.
• Request confidential communications (for example, to contact you at a different address/phone).
• Request restrictions on how we use/share your PHI for treatment, payment, or operations.
• Out-of-pocket restriction (mandatory). If you pay in full for a service out-of-pocket, you may request that we not disclose information about that service to your health plan.
• Get a list ("accounting") of certain disclosures we've made in the past 6 years.
• Get a paper copy of this Notice at any time.
• Choose someone to act for you. If you have given someone medical power of attorney or have a legal guardian, that person can exercise your privacy rights.

For minors, we generally treat a parent or legal guardian as the child's personal representative except where Colorado or federal law allows the minor to consent to care and limits parental access.

Our Duties If There's a Breach

We will promptly notify you following a breach of unsecured PHI, including what happened, what information was involved, steps you can take, and what we are doing to mitigate the harm.

Changes to This Notice

We may change this Notice, and the changes will apply to PHI we already have as well as information we receive in the future. The current Notice will be posted at our office and on our website, and a copy will be available upon request.

Questions or Complaints

If you have questions, want to exercise your rights, or believe your privacy rights have been violated, contact the Privacy Officer listed above. You can also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.