Pain Management Associates

PRIVACY NOTICE

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Privacy Notice is being provided to you as a requirement of federal law, the Health Insurance Portability and Accountability Act (HIPAA). This Privacy Notice describes how we may use and disclose your protected health information to carry out treatment, payment or health care operations and for other purposes that are permitted or required by law. It also describes your rights to access and control your protected health information in some cases. Your “protected health information” means any written, electronic or oral health information about you, including demographic data that can be used to identify you. This is health information that is created or received by your health care provider, and that relates to your past, present or future physical or mental health or condition. Protected health information is stored electronically and is subject to electronic disclosure.

This Privacy Notice describes the practices of the facility listed above and:

• Any medical staff member and any health care professional who participates in your care;

• Any volunteer we allow to help you while you are here; and

• All employees of any hospital, clinic, laboratory, or other facility affiliated with Pain Management Associates.

All of these people follow the terms of this Privacy Notice. They may also share protected health information with each other for treatment, payment or health care operations as described in this Privacy Notice.

I. Uses and Disclosures of Protected Health Information

We may use and disclose your protected health information for purposes described below.

A. Treatment. We may use and disclose your protected health information to provide, coordinate, or manage your health care and any related services. This includes the coordination or management of your health care with a third party for treatment purposes. For example, we may disclose your protected health information to a pharmacy to fill a prescription or to a laboratory to order a blood test. We may also disclose protected health information to physicians who may be treating you or consulting with the facility with respect to your care. In some cases, we may also disclose your protected health information to an outside treatment provider for purposes of the treatment activities of the other provider.

B. Payment. We may use and disclose your protected health information to receive payment for the care you receive from the facility. This may include certain communications to your health insurance company to get approval for the procedure that we have scheduled. For example, we may need to disclose information to your health insurance company to get prior approval for the surgery. We may also disclose protected health information to your health insurance company to determine whether you are eligible for benefits or whether a particular service is covered under your health plan. In order to get payment for the services we provide to you, we may also need to disclose your protected health information to your health insurance company to demonstrate the medical necessity of the services or, as required by your insurance company, for utilization review. We may also disclose patient information to another provider involved in your care for the other provider’s payment activities. This may include disclosure of demographic information to anesthesia care providers for payment of their services.

C. Operations. We may use or disclose your protected health information, as necessary, for health care operations to facilitate the function of this facility and to provide quality care to all patients. Health care operations include such activities as: quality assessment and improvement activities, employee review activities, training programs including those in which students, trainees, or practitioners in health care learn under supervision, accreditation, certification, licensing or credentialing activities, review and auditing, including compliance reviews, medical reviews, legal services and maintaining compliance programs, and business management and general administrative activities. In certain situations, we may also disclose protected health information to another provider or health plan for their health care operations.

D. Other Uses and Disclosures. As part of treatment, payment and health care operations, we may also use or disclose your protected health information for the following purposes:

• To remind you of your surgery date.

• We may, from time to time, contact you to provide information about treatment alternatives or other health-related benefits and services that we provide and that may be of interest to you.

II. Additional Protections for SUD Records Under 42 CFR Part 2

Certain records about care for a substance use disorder (‘SUD Records’) are protected by federal confidentiality rules at 42 CFR Part 2, in addition to HIPAA. These rules apply to patient‑identifying information that is created or maintained in connection with a SUD diagnosis, treatment, or referral for treatment. This section explains how we may use and disclose SUD Records.

A. General Rule - Consent Required. We generally may not use or disclose SUD Records without your written consent, unless a specific exception in 42 CFR Part 2 applies.

B. Single Consent for Treatment, Payment, and Health Care Operations (TPO). You may choose to sign a single written consent that authorizes us and our business associates to use and disclose your SUD Records for treatment, payment, and health care operations as permitted by HIPAA. Even with such consent, SUD Records remain protected by Part 2, including prohibitions on certain legal uses and redisclosures described below.

C. Required Content of Part 2 Consent. Your Part 2 consent must describe the SUD information that may be used or disclosed, the recipients, the purpose of disclosure, any expiration, and your right to revoke the consent at any time, except to the extent we have already relied on it.

D. Exceptions without consent. Without your consent, Part 2 permits limited uses and disclosures of SUD Records in a bona fide medical emergency; for qualified audit and evaluation activities; for research as permitted by Part 2 and HIPAA; pursuant to a court order that meets Part 2 requirements; for initial reports of child abuse or neglect; and for disclosures of de‑identified information.

E. Redisclosure and Notice. Without your consent, Part 2 permits limited uses and disclosures of SUD Records, including in a bona fide medical emergency; for qualified audit and evaluation activities (including appropriate government oversight); for research as permitted by Part 2 and HIPAA; pursuant to a court order that meets Part 2 requirements; for initial reports of child abuse or neglect as required by law; and for disclosures of information that have been de‑identified in accordance with HIPAA.

F. Minimum Necessary and Safeguards. We limit uses and disclosures of SUD Records to the minimum necessary and maintain safeguards, including record segmentation where appropriate, to protect SUD Records under Part 2.

G. Legal Proceedings Prohibition: SUD Records (and any testimony about their content) are protected by federal law and may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding against you without your specific written consent or a court order that complies with 42 CFR Part 2. A subpoena, discovery request, or other compulsory process alone is not sufficient to require disclosure of SUD Records. Any court order must meet the specific requirements of Part 2, including findings of good cause and limitations to what is essential for the stated purpose, along with protective measures. Even if you have signed a consent allowing use of SUD Records for treatment, payment, and health care operations, SUD Records may not be used or disclosed in legal proceedings against you unless you specifically consent to that use or a court issues a Part 2–compliant order.

H. Fundraising. We will not use or disclose SUD Records for fundraising without your written consent that satisfies 42 CFR Part 2. If you provide a consent specifically allowing fundraising uses or disclosures of your SUD Records, we will still provide a clear, simple way for you to opt out before you receive fundraising communications and at any time thereafter. Choosing not to receive fundraising communications will not affect your care or benefits. You can opt out by calling 949-588-7246, updating your preference in the patient portal, or mailing your request to 25231 Paseo De Alicia Suite 235 Laguna Hills, Ca 92653. For health information that is not protected by Part 2, we may use or disclose limited information for fundraising as permitted by HIPAA, and you have the right to opt out of receiving fundraising communications at any time.

III. Other Uses and Disclosures.

For special rules that apply to Substance Use Disorder records, see ‘Additional Protections for SUD Records (42 CFR Part 2). We may use or disclose your protected health information without your permission or authorization for a number of reasons including the following:

A. When Legally Required. We will use and disclose your protected health information when we are required to do so by any federal, state or local law.

B. When There Are Risks to Public Health. We may use and disclose your protected health information for public health activities, including:

• To prevent, control, or report disease, injury or disability as permitted by law.

• To report vital events such as birth or death as permitted or required by law.

• To conduct public health surveillance, investigations and interventions as permitted or required by law.

• To collect or report adverse events and product defects, track FDA regulated products, enable product recalls, repairs or replacements to the FDA and to conduct post marketing surveillance.

• To notify a person who has been exposed to a communicable disease or who may be at risk of contracting or spreading a disease as authorized by law.

C. To Report Suspected Abuse, Neglect Or Domestic Violence. We may notify government authorities if we believe that an individual is the victim of abuse, neglect or domestic violence. We will make this disclosure only when specifically required or authorized by law or when the individual agrees to the disclosure.

D. To Conduct Health Oversight Activities. We may use and disclose your protected health information for health oversight activities including audits; civil, administrative, or criminal investigations, proceedings, or actions; inspections; licensure or disciplinary actions; or other activities necessary for appropriate oversight as authorized by law. We will not disclose your health information under this authority if you are the subject of an investigation and your health information is not directly related to your receipt of health care or public benefits.

E. In Connection With Judicial And Administrative Proceedings. We may disclose your protected health information in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal as expressly authorized by such order. In certain circumstances, we may disclose your protected health information in response to a subpoena if we receive satisfactory assurances that you have been notified of the request or that an effort was made to secure a protective order.

F. For Law Enforcement Purposes. We may disclose your protected health information to a law enforcement official for law enforcement purposes including:

• As required by law for reporting of certain types of wounds or other physical injuries.

• Pursuant to court order, court-ordered warrant, subpoena, summons or similar process.

• For the purpose of identifying or locating a suspect, fugitive, material witness or missing person.

• Under certain limited circumstances, when you are the victim of a crime.

• To a law enforcement official if the facility has a suspicion that your health condition was the result of criminal conduct.

• In an emergency to report a crime.

G. To Coroners, Funeral Directors, and for Organ Donation. We may disclose protected health information to a coroner or medical examiner for identification purposes, to determine cause of death or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose protected health information to a funeral director, as authorized by law, in order to permit the funeral director to carry out their duties. We may disclose such information in reasonable anticipation of death. Protected health information may be used and disclosed for cadaveric organ, eye or tissue donation purposes.

H. For Research Purposes. We may use or disclose your protected health information for research when the use or disclosure for research has been approved by an institutional review board that has reviewed the research proposal and research protocols to address the privacy of your protected health information.

I. In the Event of a Serious Threat to Health or Safety. We may, consistent with applicable law and ethical standards of conduct, use or disclose your protected health information if we believe, in good faith, that such use or disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety or to the health and safety of the public.

J. For Specified Government Functions. In certain circumstances, federal regulations authorize the facility to use or disclose your protected health information to facilitate specified government functions relating to military and veterans activities, national security and intelligence activities, protective services for the President and others, medical suitability determinations, correctional institutions, and law enforcement custodial situations.

K. For Worker's Compensation. The facility may release your health information to comply with worker's compensation laws or similar programs.

L. To Business Associates. We may disclose your protected health information to third parties known as “Business Associates” that perform various activities (e.g. legal services, delivery of goods) for us and that agree to protect the privacy of your protected health information.

IV. Object

Unless you object, we may disclose to your family members or others involved in your care or payment for your care, information relevant to their involvement in your care or payment for your care or information necessary to inform them of your location and condition. We may also disclose your protected health information to disaster relief agencies so they may assist in notifying those involved in your care of your location and general condition.

Unless you object, we may disclose certain information about you including your name, your general health status and where you are in our facility in a facility directory. We may disclose this information to people who ask for you by name, and we may disclose this information plus your religious affiliation to clergy.

You may object to these disclosures. If you do not object to these disclosures or we can infer from the circumstances that you do not object or we determine, in the exercise of our professional judgment, that it is in your best interests for us to make disclosure of information that is directly relevant to the person’s involvement with your care, we may disclose your protected health information as described.

IV. Uses and Disclosures which you Authorize

Other than as stated above, we will not disclose your health information other than with a written authorization from you or your personal representative. You may revoke your authorization in writing at any time except to the extent that we have taken action in reliance upon the authorization. Information used or disclosed pursuant to this authorization may be subject to re-disclosure by the recipient and may no longer be protected by federal or state law. Subject to compliance with limited exceptions, we will not use or disclose psychotherapy notes, use or disclose your health information for marketing purposes or sell your health information, unless you have signed an authorization. You may revoke an authorization by notifying us in writing, except to the extent we have taken action in reliance on the authorization. Authorizations or consents for SUD Records must meet specific requirements under 42 CFR Part 2 and may be revoked at any time, except to the extent already relied upon. We will not use or disclose SUD Records for fundraising without a written consent that satisfies 42 CFR Part 2, and we will provide a clear opt‑out prior to sending any fundraising communications that rely on SUD Records.

V. Your Rights

You have the following rights regarding your health information:

A. The right to inspect and copy your protected health information. You may inspect and obtain a copy of your protected health information that is contained in a designated record set for as long as we maintain the protected health information. A “designated record set” contains medical and billing records and any other records that your surgeon and the facility uses for making decisions about you. We may deny your request to inspect or copy your protected health information in limited circumstances.

To inspect and copy your medical information, you must submit a written request to the Privacy Officer whose contact information is listed on the last page of this Privacy Notice. If you request a copy of your information, we may charge you a fee for the costs of copying, mailing or other costs incurred by us in complying with your request. Fees, if any, will be reasonable, cost-based, and limited to permissible components. If your information is stored electronically and you request an electronic copy, we will provide it to you in a readable electronic form and format if it is readily producible in the format you request. Please contact our Privacy Officer if you have questions about access to your medical record.

B. The right to request a restriction on uses and disclosures of your protected health information. You may ask us not to use or disclose your protected health information for the purposes of treatment, payment or health care operations. You may also request that we not disclose your health information to family members or friends who may be involved in your care or for notification purposes as described in this Privacy Notice. Your request must state the specific restriction requested and to whom you want the restriction to apply.

The facility is not required to agree to a restriction that you may request except for requests to limit disclosures to your health plan for purposes of payment or health care operations when you have paid for the item or service covered by the request out-of-pocket and in full and when the uses or disclosures are not required by law. We will notify you if we deny your request to a restriction. If the facility does agree to the requested restriction, we may not use or disclose your protected health information in violation of that restriction unless it is needed to provide emergency treatment. You may request a restriction by contacting the Privacy Officer.

C. The right to request to receive confidential communications from us by alternative means or at an alternative location. You have the right to request that we communicate with you in certain ways. We will accommodate reasonable requests. We may condition this accommodation by asking you for information as to how payment will be handled or specification of an alternative address or other method of contact. We will not require you to provide an explanation for your request. Requests must be made in writing to our Privacy Officer.

D. The right to request amendments to your protected health information. You may request an amendment of your protected health information if you believe such information is inaccurate or incomplete. In certain cases, we may deny your request for an amendment. If we deny your request for amendment, you have the right to file a statement of disagreement with us and we may prepare a rebuttal to your statement and will provide you with a copy of any such rebuttal. Requests for amendment must be in writing and must be directed to our Privacy Officer. In this written request, you must also provide a reason to support the requested amendments.

E. The right to receive an accounting. You have the right to request an accounting of certain disclosures of your protected health information made by the facility. This right applies to disclosures for purposes other than treatment, payment or health care operations as described in this Privacy Notice. We are also not required to account for disclosures that you requested, disclosures that you agreed to by signing an authorization form, disclosures for a facility directory, to friends or family members involved in your care, or certain other disclosures we are permitted to make without your authorization. The request for an accounting must be made in writing to our Privacy Officer. The request should specify the time period sought for the accounting. We are only required to maintain an accounting of disclosures of your protected health information for six years from the date of disclosure. We will provide the first accounting you request during any 12-month period without charge. Subsequent accounting requests may be subject to a reasonable cost-based fee.

F. The right to obtain a paper copy of this notice. Upon request, we will provide a separate paper copy of this notice even if you have already received a copy of the notice or have agreed to accept this notice electronically. You may also obtain a copy of the current version of our Privacy Notice at our website, www.pmaphysician.com

VI. Our Duties

We are required by law to maintain the privacy of your health information and to provide you with this Privacy Notice of our duties and privacy practices. We maintain safeguards and minimum‑necessary controls for SUD Records consistent with 42 CFR Part 2 and will include the required notice of prohibition on redisclosure when applicable. If we discover a breach by us or our Business Associates involving your unsecured protected health information, we are required to notify you of the breach by letter or other method permitted by law. We are required to abide by terms of this Privacy Notice as may be amended from time to time. We reserve the right to change the terms of this Privacy Notice and to make the new provisions effective for all future protected health information that we maintain. If we change our Privacy Notice, we will provide a copy of the revised Privacy Notice to you or your personal representative upon request.

VII. Complaints

You have the right to express complaints to the facility and to the Secretary of the U.S. Department of Health and Human Services by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/ if you believe that your privacy rights have been violated. You may complain to the facility by contacting the facility’s Privacy Officer verbally or in writing, using the contact information below. We encourage you to express any concerns you may have regarding the privacy of your information. You will not be retaliated against in any way for filing a complaint.

VIII. Contact Person

The facility’s contact person for all issues regarding patient privacy and your rights under the federal privacy standards is the Privacy Officer. Information regarding matters covered by this Notice can be requested by contacting the Privacy Officer\Contact. If you feel that your privacy rights have been violated by this facility you may submit a complaint directly to the facility’s Privacy Officer OR to the Secretary of the U.S. Department of Health and Human Services. The contact information is as follows:

Facility Name: Pain Management Associates Address: 25231 Paseo De Alicia Suite 235 City, State Zip: Laguna Hills, CA 92653 ATTN: Privacy Officer\Contact: Sahar Meshkat Telephone: 949-588-7246

IX. Effective Date

This Notice is effective February 16, 2026. We are required to abide by the terms of this privacy notice currently in effect. We may change this privacy notice at any time and to make the new notice provision effective for health information we already maintain.