Notice of Privacy Practices

Your Rights and Our Responsibilities
Effective:10/20/26
This notice applies to Vertically Sourced at our Wheat Ridge and Louisville locations.
Privacy contact: Dr. Shea Osuna
Phone:720-295-7756
Email: info@verticallysourced.net
Mailing address:6073 W. 44th Ave, Ste. 101, Wheat Ridge, CO 80033

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices describes how we may use and disclose your Protected Health Information (PHI) to carry out treatment, payment or health care operations (TPO) and for other purposes that are permitted or required by law. It also describes your rights to access and control your PHI. “Protected Health Information” is information about you, including demographic information that may identify you and that relates to your past, present or future physical health condition and related health care services. Please review it carefully.

OUR RESPONSIBILITIES:
By law, we are required to:
Keep your health information private
Give this Notice to you, and describe our legal duties and privacy practices, and your rights regarding your health information
If you have a personal representative, such as a legal guardian, we will treat that person as if that person is you with respect to disclosures of your health information.
We are required to notify you by first class mail or by email (if you have indicated a preference to receive information by email), of any breaches of Unsecured Protected Health Information (PHI) as soon as possible, but in any event, no later than 60 days following the discovery of the breach.
To provide you with notice, such as this Notice of Privacy Practices and abide by the terms of our most current Notice of Privacy Practices;
Notify you if we are unable to agree to a requested restriction.
The effective date of the Notice is printed on the first page.

CHANGES TO THE TERMS OF THIS NOTICE
We reserve the right to change our practices and to make the new provisions effective for all your health information that we maintain. Should our information practices change; a revised Notice of Privacy Practices will be available upon request, prominently posted in our offices, and available on our website. We will not use or disclose your health information without your authorization, except as described in our most current Notice of Privacy Practices. If you have limited proficiency in English, you may request a Notice of Privacy Practices in Spanish, or other languages.

WHEN YOU RECEIVE THE NOTICE
At your first visit, we will provide this Notice and ask you to acknowledge receipt. Your acknowledgment confirms receipt; it does not authorize disclosure of your records. If you do not sign, we will document our good-faith effort to obtain acknowledgment and continue to care for you. We may use or disclose information for treatment, payment, and health care operations only as permitted by applicable law, including any additional protections under 42 CFR Part 2. Updating this Notice does not, by itself, require existing patients to sign a new acknowledgment.

HOW WE MAY USE OR DISCLOSE YOUR HEALTH INFORMATION
In the sections below, we describe the ways we may use or disclose your health information. For each type of use or disclosure, we explain what we mean and give one or more examples. We are not able to list every possible example.

HOW YOUR HEALTH CARE INFORMATION MAY BE USED OR DISCLOSED
Medical information, including health history, is collected from you upon your initial visit and on subsequent visits, and is then stored on your electronic patient file, which we protect using safeguards required by HIPAA.

Medical information will be used in the assessment of your condition and in the need for health care or referral purposes. Some of your medical information will be transferred to a computer program for the purposes of retrieval, storage, scheduling, billing, and payment purposes.
The medical information contained in your patient file will be stored by Vertically Sourced for a period of no less than seven (7) years.

HEALTHCARE TREATMENT
• We use your health information to plan your care and treatment to serve your health needs.
• Posture analysis programs to assist in patient health care.
• In addition, we may also disclose your health care information to the person or persons responsible for your health
care, such as a parent, other family members or a nurse.

PAYMENT
• The health care we provide is considered Wellness or Preventative Maintenance Care. Most insurance policies are written specifically to reimburse for symptom care, meaning sickness care. Therefore, we do not bill any insurance company directly, nor do we provide any itemized billing statement containing health information, that your insurance company would need for patient reimbursement of services. However, as a courtesy, we can provide you with an itemized billing statement that will only contain the dates of your wellness visits and a listing of charges.
• In the case a patient submits the itemized billing statement not intended for insurance company reimbursement, and your health insurance requests your health information, then your health information may be disclosed to your health insurance company.
• In the event of an overdue balance, it is our policy to send a billing notice to your primary address on file, or by email (if you have previously given permission to receive email communications). This billing notice will contain the dates of your recent visits and a listing of overdue charges.

HEALTH CARE OPERATIONS
We may use or disclose your health information to support our day-to-day activities related to health care. For example:
• For quality and outcome assessments for improvement of care we render.
• Communicate with contracted third-party business associates for services, such as answering services, transcriptionists,
record keeping, consultants, and legal counsel.
• Communicate to you via newsletters, mailings, or other means regarding treatment options, health related information,
disease management programs, wellness programs, or other community-based initiatives or activities in which our
practice is participating.
• We may use your health information to evaluate the skills of the employees who cared for you.
• If a translator is needed to help us communicate with you, we may disclose your health information to the translator.

SPECIAL PROTECTIONS FOR SUBSTANCE USE DISORDER TREATMENT RECORDS
If we receive or maintain substance use disorder treatment records protected by 42 CFR Part 2, we will follow the additional federal confidentiality requirements that apply to those records. The permissions described elsewhere in this Notice are subject to these requirements and any other applicable law that provides greater privacy protection.
We will not use or disclose these records, or testimony describing their contents, in civil, criminal, administrative, or legislative investigations or proceedings against you without your specific written consent or a court order meeting Part 2 requirements. Before a court authorizes such use or disclosure, Part 2 requires notice and an opportunity to be heard for you or the record holder. A court order authorizing disclosure must also be accompanied by a subpoena or another legal requirement compelling disclosure. A subpoena alone is not sufficient.
Part 2 allows a patient to provide a single consent for future uses and disclosures for treatment, payment, and health care operations. When we receive Part 2 records under such consent, we may use and redisclose them as HIPAA permits, subject to Part 2's continuing restrictions on investigations and proceedings against you. Any other use or disclosure must have an applicable legal basis. A general acknowledgment of this Notice is not Part 2 consent.
If we ever intend to use Part 2 records for fundraising for our practice, we will first give you a clear and conspicuous opportunity to elect not to receive fundraising communications.

COMPLIANCE WITH THE LAW
• As Required by Law. We use or disclose health information if a law or rule requires or permits the use or disclosure. We will disclose health information to the Secretary of the Department of Health and Human Services if the Secretary wishes to check how we are following the law and protecting your health information.
• Court Orders and Other Legal Proceedings. We disclose health information in response to a court order, discovery request or subpoena, only when the applicable legal requirements are met. The additional restrictions described in the substance use disorder section above apply to Part 2 records.
• Law Enforcement. We may disclose your health information to a law enforcement official for purposes such as identifying or locating a suspect, fugitive, material witness or missing person, complying with a court order or subpoena, warrant, summons, and other law enforcement purposes, if authorized under state or federal law.
• To Avoid Harm. To avoid a serious threat to the health or safety of a person or the public, we may disclose health information to the police or other persons who can prevent or lessen the threat.
• Funeral Arrangements. We may disclose health information about a person who has died to a funeral director, coroner
or medical examiner, to help them carry out their duties. We may also disclose health information to an executor or
administrator of your estate to the extent that person is acting as your personal representative.
• Military Activity or National Security. We may disclose your health information for military, national security, prisoner and government benefits purposes. We may disclose health information about Armed Forces personnel to military authorities. We may disclose health information to federal officials who conduct national security or intelligence
operations such as protecting the President of the United States.

PUBLIC HEALTH AND SAFETY ISSUES
• As required by law, we disclose health information to public health authorities for purposes related to: preventing or controlling disease, injury or disability, reporting child abuse or neglect, reporting domestic violence, reporting to the Food and Drug Administration problems with products and reactions to medications, and reporting disease or infection exposure.
• Product Recalls

CHANGE OF OWNERSHIP
In the event that Vertically Sourced is sold or merged with another organization, your health information/record will become the property of the new owner

YOUR AUTHORIZATION IS REQUIRED FOR ALL OTHER USES OR DISCLOSURES
Most uses and disclosures of psychotherapy notes, uses and disclosures for marketing that require authorization under HIPAA, and disclosures that constitute a sale of protected health information require your written authorization.

We will not use or disclose your health information for any purpose that is not listed in this Notice of Privacy Practices, unless you have given us a signed authorization form. If, after signing the authorization form, you change your mind, you may ask us to stop any future use or disclosure. You must make your request in writing. We will honor your request, but we cannot undo any of the uses or disclosures we have already made prior to receiving your request.

YOUR PROTECTED HEALTH INFORMATION RIGHTS
You have the following rights with regard to your protected health information:
• The right to ask us not to use or disclose your health information for treatment, payment or health care operations or request restrictions on certain uses and disclosures of your health information. The right to ask us to limit the information we share. You have the right to list individuals who are involved in your care and, as a result, to whom PHI can be disclosed; a PHI Use and Disclosure Authorization form will be provided to you. We are generally not required to agree to requested restrictions, except for the following restriction on disclosures to a health plan. You also have the right to restrict payer access. If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or any operations with your health insurer. We will honor this restriction unless disclosure is required by law. You must make your request in writing to our privacy office; a Request to Restrict Disclosure to Health Plan form will be provided upon request.
• The right to ask us to send health information to you in a different way. The right to request confidential or alternative communication. After initially completing a PHI Use and Disclosure Form indicating your preferences for how we will communicate with you, you may request in the future that we communicate with you about medical matters in a certain way or at a certain location other than what was previously authorized. For example, you can ask that we only contact you at work or by email. We will accommodate reasonable requests for confidential communications. You may also request other alternative communications; you must make your request in writing to our privacy officer, a Request for Alternative Communications form will be provided upon request.
• The right to ask to see or get a copy of your health information. Upon request, we will supply you with a Request to Inspect or Copy Patient Information form. The form contains the name of our privacy official and his/her contact information. We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable fee for cost of labor, postage, and supplies associated with your request in compliance with state and federal laws regarding medical records request.
• The right to ask us to correct or amend your health information. Upon request, we will supply you with the Request to Amend Patient Record Form. You must make your request to correct your medical records in writing and explain the reasons for your request. Please be advised, however, we are not required to agree to amend your health information. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. We will respond to your request within 60 days in writing.
• The right to get a list of disclosures of your health information. You may ask us to give you a list of the times we disclosed your health information. A Request for Accounting of Disclosure of PHI form will be provided upon request. We will respond to your request within 60 days. We are not required to list all disclosures. For example, the list will not include disclosures for treatment, payment or health care operations (TPO). The first accounting of disclosures (Response to Request for Disclosure form) you request within any 12-month period will be free. For additional requests within the same period, we may charge you for the reasonable costs of providing the accounting of disclosures.
• The right to a paper copy of this Notice of Privacy Practices at any time upon request. You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically.
• The right to receive notice of a breach. We are required to notify you by first class mail or by email (if you have indicated a preference to receive information by email), of any breaches of Unsecured Protected Health Information as soon as possible, but in any event, no later than 60 days following the discovery of the breach.
• The right to file a complaint if you believe your privacy rights have been violated. If you believe your privacy rights have been violated, you may file a complaint with our privacy officer. We will supply you with a Complaint Form upon request (form contains the name of our privacy official and his/her contact information). Please submit complaints to our privacy contact in writing. Complaints to HHS generally must be filed within 180 days of when you knew or should have known of the alleged violation; HHS may extend that period for good cause.
• You may submit a formal complaint to the United States Department of Health and Human Services (DHHS) Office of Civil Rights, by sending a letter to 200 Independence Avenue, S.W., Washington, DC 20201, calling 1-877-696-6775, or visiting https://www.hhs.gov/hipaa/filing-a-complaint/index.html.
• You will not be penalized or retaliated against for filing a complaint.

YOUR CHOICES
This section addresses your choices regarding health information we may share:
• Opting In or Out of Emails and/or Texts. You have the right to designate, on our Use and Disclosures Form how you would like us to contact you, including the right to opt in/out of emails and/or texts. Emails and texts may be used for one or more of the following purposes:
• Appointment Reminders
• Billing updates/information
• Newsletters or Educational Information
• Share information with your family and friends about your condition. You may choose to give permission to allow disclosure of your health information to a family member, friend or other person who is involved in your care or payment for your care. This may include, but is not limited to, authorizing your spouse to pay for your healthcare services, or asking your spouse to deliver to you acute home care instructions you may need.
• Disclose your health information when disaster relief organizations seek your health information to coordinate your care. Note: If you are unable to communicate your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest.
• Marketing Purposes. We are required by law to receive your written authorization before we use or disclose your health information for marketing purposes. However, we may use health information to tell you about health-related benefits or services that may be of interest to you.
It is our practice to use the following means for marketing:
• Patient Appreciation Days or seasonal promotions.
• Advertising in various print or electronic media, such as on our website, social media, or newspapers
• Using patient reviews or testimonials (written or video), photographs, and other videos
Patient information is used and/or disclosed for marketing purposes only after receiving specific authorization from each patient to do so. If you consent to marketing, we may send you an email, a letter, post card, or an invitation regarding our various marketing tools.
If attending classes or groups, patients may be asked to share about their medical or health experiences for the purposes of education, or other group purposes, while other practice members are present. Participation in this type of activity during these classes or groups is not mandatory and is only done with your voluntary participation.
• Sale of your information. Under no circumstances will we sell our patient lists or your health information to a third party without your written authorization.

POTENTIAL REDISCLOSURE
Information disclosed as permitted by HIPAA may be redisclosed by the recipient and may no longer be protected by HIPAA. Other laws may continue to protect it, including the applicable protections for Part 2 records described above.