Notice of Privacy Practices

THIS NOTICE OF PRIVACY PRACTICES (THIS “NOTICE”) DESCRIBES

• HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED;
• YOUR RIGHTS WITH RESPECT TO YOUR MEDICAL INFORMATION;
• HOW YOU CAN GET ACCESS TO THIS INFORMATION;; AND
• HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR YOUR RIGHTS CONCERNING YOUR INFORMATION.

PLEASE REVIEW IT CAREFULLY.

You have a right to a copy of this Notice (in paper or electronic form) and to discuss it with our Privacy Officer at 877-349-7755 or privacy@pelagohealth.com if you have any questions.

This Notice describes the privacy practices of Quit Genius Medical, P.A., Quit Genius Medical, P.C., Quit Genius Medical of Kansas, P.A., and Quit Genius Medical of New Jersey, P.C. (“we,” “our,” or “us”). We are an organized health care arrangement, as this term is defined by HIPAA, that jointly participates in numerous activities, including assessment and improvement of our health care services. We provide services for treating individuals with substance use management, behavioral addiction and related mental health challenges through a combination of any or all of the following depending on the program and the individual’s needs: digital content and other engagement tools, coaching programs, cognitive behavioral therapy, and medication assisted treatment, which are delivered via the Pelago mobile application (our “App”) or its web-based equivalent, connected devices, chat sessions, live virtual telephone or video sessions, and in certain cases, in person meetings. Through our arrangement with Digital Therapeutics, Inc. dba Pelago, we also offer Sona, an AI-enabled chatbot that you may choose to use for mental health support or other wellbeing services in connection with your care.

This Notice applies to your health information, including protected health information (“PHI”) and substance use disorder (“SUD”) patient records protected under 42 CFR Part 2 (“Part 2”). In this Notice, we use the term “SUD records” to refer to information that is protected under Part 2. In this Notice, “health information” includes both PHI and SUD records unless we state otherwise. SUD records receive additional federal confidentiality protections, including limits on redisclosure and limits on use or disclosure in civil, criminal, administrative, or legislative proceedings against you. Where Health Insurance Portability and Accountability Act (“HIPAA”) regulations, Part 2, or state law provides greater protection, we will follow the more protective requirement. For information about how we collect, use, and share personal information other than protected health information, please see our Privacy Policy. This Notice supplements that privacy policy.

We understand that your health information is personal and we are committed to protecting and respecting your privacy. We are required by law to maintain the privacy of your health information, including your SUD records, to provide you with this notice of our legal duties and privacy practices, and to notify you following a breach of your unsecured health information. Your SUD records receive additional privacy protections under 42 CFR Part 2. Some types of your health information may also be subject to more restrictive treatment under state law, and we will protect that information in accordance with those laws.

We will let you know if an event occurs that compromises the privacy or security of your information, including your SUD records. We are required to abide by the terms of this Notice currently in effect.

We typically use or share your protected health information in the following ways without your authorization:

• Treatment: We can use your health information and share it with other health care professionals who are treating you. For example, a doctor treating you for an injury asks another doctor about your overall condition.
• Payment: We can use and share your health information to bill and get payment. For example, we give information about you to your health insurance plan so it will pay for your services.
• Health Care Operations: We can use and share your health information to run our practices, improve your care, and contact you when necessary. For example, we use your health information to manage your treatment and services.

Different rules apply to SUD records. We must have your written consent before using or sharing your SUD records for treatment, payment, or health care operations, unless Part 2 permits the use or disclosure without consent; we may rely on a consent you provided to another organization You may provide a single written consent for all future uses and disclosures of your SUD records for treatment, payment, and health care operations. If you do, we may share your SUD records with SUD treatment programs, health care providers, health plans, and their contractors or business associates for those purposes. Recipients that are covered entities or business associates may then use and disclose those records as permitted by HIPAA, including for treatment, payment, and health care operations, but they may not use or disclose the records in civil, criminal, administrative, or legislative proceedings against you unless permitted by Part 2. When required, we include a notice that reminds the recipient that federal law protects the confidentiality of SUD records and limits further disclosure.

How else can we use or share your health information without your authorization or, for SUD records, without your Part 2 consent?

We are allowed or required to use or share your health information in certain ways that contribute to the public good, support our legal obligations, or allow us to operate our program. We must meet applicable legal conditions before we use or share information for these purposes. For SUD records, we will use or disclose the information without your consent only as permitted by Part 2 and any more protective state law. We will not use or disclose your health information for any purpose not specified in this Notice unless we obtain your written authorization or, where Part 2 applies, your written consent.

• Help with safety issues: We can share your health information to prevent or lessen a threat to your health or safety or that of the general public.
• Help with public health: We can share your health information for public health purposes as permitted by law, such preventing disease. For SUD records, we may disclose records for public health purposes without your consent only if the disclosure is made to a public health authority and the information has been de-identified in accordance with HIPAA such that there is no reasonable basis to believe that the information can be used to identify you.
• Conduct research: We may use or share your information for research the required legal conditions are met, including any required Institutional Review Board or Privacy Board review and approval. For SUD records, researchers may not include identifying information in any report or otherwise redisclose patient-identifying information except as permitted by law.
• Help with medical emergencies: We may share SUD and other health records with medical personnel to the extent necessary to meet a bona fide medical emergency in which your prior written consent cannot be obtained. We can also share your identifying information to assist the federal Food and Drug Administration in notifying you or your doctor about unsafe products you may be using.
• Respond to organ and tissue donation requests: We can share health information about you with organ procurement organizations. With respect to SUD records, we will only do so with your consent.
• Work with a medical examiner or funeral director: We can share health information with a coroner, medical examiner, or funeral director if you pass away. For SUD records, we may share information as required or permitted by laws that collect information relating to cause of death.
• Report suspected abuse, neglect, or domestic violence: We may share your health information with state or local authorities if we believe you are a victim of abuse, neglect, or domestic violence and you agree to the disclosure or the disclosure is required or permitted by law. With respect to SUD records, we will only disclose without your consent if we are required to report such records under child abuse reporting laws.
• Address workers’ compensation: We can use or share health information about you for workers’ compensation claims as permitted by law. With respect to SUD records, we will only do so with your consent.
• Comply with the law and health oversight activities: We will share your information when required by state or federal law, including with the U.S. Department of Health and Human Services if it wants to see that we are complying with federal privacy law. For SUD records, disclosures for audits and evaluations are limited to recipients and purposes permitted by Part 2.
• Respond to law enforcement: We can share non-SUD health information with police or law enforcement officials as permitted by law or as required by a court order, grand jury, or administrative subpoena. For SUD records, we may disclose information to law enforcement without your consent only as permitted by Part 2, such as reporting a crime or threat of crime on our premises or against our staff, or as authorized by a Part 2 court order accompanied by a subpoena or similar legal mandate.
• Report crimes or threats of crimes on our premises or against our staff: For SUD records, we may report a crime or threat of crime committed on our premises or against our personnel, and may disclose limited information about the circumstances of the incident as permitted by Part 2.
• Respond to lawsuits and legal actions: We can share non-SUD health information in response to a court or administrative order, subpoena, discovery request, or other lawful process when permitted by law. For SUD records, we will not use or disclose records or provide testimony in a civil, criminal, administrative, or legislative proceeding against you unless you provide written consent or a court issues an order after providing you or the holder of the record with notice and an opportunity to be heard, and the order is accompanied by a subpoena or similar legal mandate.
• Respond to specialized government functions: We may use or disclose your health information to assist with certain types of government activities, including military, national security, and intelligence activities. With respect to SUD records, we will only do so with your consent where required by law.
• Work with business associates and other service providers: We may share your information with business associates and other service providers that perform services for us involving the use or disclosure of health information. We require them to protect your information and to use it only for the services they provide to us, as permitted by law and our agreements with them. For SUD records, this may include sharing information within our program, with an entity that has direct administrative control over our program, and with contractors, subcontractors, legal representatives, or other providers that help us operate the program and agree to protect your information as required by Part 2.

Uses and disclosures requiring your authorization

For any purpose other than the ones described above, we only use or share your protected health information when you give us your written authorization.

• Marketing: We must obtain your written authorization prior to using your protected health information for purposes that are considered marketing under HIPAA. We may market to you in a face-to-face encounter and give you promotional gifts of nominal value without obtaining your written authorization.
• Sale of protected health information: We will not make any disclosure of protected health information that is a sale of protected health information under HIPAA without your written authorization.

You may revoke your authorization, except to the extent that we have relied upon it, by delivering a cancellation notice to the office identified below.

POTENTIAL FOR REDISCLOSURE

We want you to be aware that when we disclose your information as described in this Notice, either with or without your authorization, it has the potential to be redisclosed by the person receiving the information. This information may no longer be subject to the protections we’ve described, or protected by the laws with which we comply.

The person receiving your information may also redisclose your SUD records. Their ability to redisclose your SUD records depends on the nature of the consent you signed. If you consent to uses and disclosures of your SUDSUD records for all future treatment, payment, and health care operations purposes, and if the recipient is an SUD program, a covered entity, or business associate, that recipient may redisclose your SUD records in accordance with HIPAA, provided they do not redisclose your SUD records for any civil, administrative, criminal, or legislative proceedings against you unless based on specific written consent or a court order. If you signed a consent that does not permit disclosures for all future treatment, payment, and health care operations purposes, the recipient has a more limited ability to redisclose your SUD records.

• Get a copy of your medical and billing records: You can ask to see or get an electronic or paper copy of your medical and billing records that we have about you. We will provide a copy or summary of your health information. We may charge a reasonable, cost-based fee.
• Ask us to correct your medical or billing records: You can ask us to correct health information about you that you think is incorrect or incomplete. We may say “no” to your request, but we’ll tell you why in writing.
• Request confidential communications: You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address by emailing us at privacy@pelagohealth.com. We will say “yes” to reasonable requests.
• Ask us to limit what we use or share: You can ask us to restrict disclosures of certain health information for treatment, payment, or health care operations, or to individuals involved in your care or payment related to your care. We are not required to agree to your request, but if we do agree, we will follow the restriction except when disclosure is needed to provide emergency treatment. If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information with your insurer or health plan for payment or our health care operations, and we will say “yes” unless a law requires us to share that information. For SUD records: You may also ask us to restrict uses or disclosures made for treatment, payment, or health care operations after you have provided consent.
• Choose someone to act for you: If you have a personal representative, such as a medical power of attorney, that person can exercise your rights and make choices about your health information. We will confirm that this person has authority before we take any action.
• Get a list of disclosures: You can ask for an accounting of when we’ve shared your health information, who we shared it with, and why during the six years before your request (or three years for electronic SUD records), as well as an accounting of other disclosures made with consent as required by HIPAA. We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make pursuant to an authorization or consent form that you signed). For SUD records, you may also request a list of certain disclosures made by an intermediary. We’ll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.
• Right to a copy of this Notice: You have the right to obtain a paper or electronic copy of this Notice upon request by contacting us at 877-349-7755 or privacy@pelagohealth.com. You may also print out a copy of this Notice by going to our website at https://signup.pelagohealth.com/?notice_of_privacy_practices.
• Right to be notified of a breach: We will notify you of any breach of your unsecured protected health information or SUD records, as required by law.
• File a complaint: If you feel we have violated your rights, you can complain to us using the information below. You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. If you ask, we can provide contact information for the Office for Civil Rights. We will not retaliate against you for filing a complaint.

We can change the terms of this Notice, and the changes will apply to all information we have about you. The new Notice will be available upon request, in our office, and on our website.

Privacy Officer at privacy@pelagohealth.com

Address: Pelago on behalf of Quit Genius Medical, P.A., Quit Genius Medical, P.C., Quit Genius Medical of Kansas, P.A., and Quit Genius Medical of New Jersey, P.C.
Attn: Privacy and Compliance
1632 1st Avenue #20163
New York, NY 10028

Telephone: +1 877-349-7755