Notice of Privacy Practices

Effective date: September 4, 2026

Our commitment to your privacy

K. Johns Medical is required by law to maintain the privacy of your protected health information (PHI), to give you this notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect. PHI is information that identifies you and relates to your past, present, or future health, treatment, or payment for care.

How we may use and disclose your health information

We may use or disclose your health information without your written authorization for:

• Treatment. To provide, coordinate, or manage your care — for example, sharing information with a consulting specialist, laboratory, imaging center, pharmacy, hospital, or another treating clinician.
• Payment. To bill and collect payment from you, your insurance plan, or another payer, including verifying coverage, obtaining prior authorization, and determining medical necessity.
• Health care operations. For quality assessment, clinician review, training, licensing, care coordination, business management, and administrative activities.
• Appointment and care reminders. To contact you by telephone, text message, or email about appointments, prescriptions, test results, or treatment alternatives, using the contact information you provide.
• Business associates. To vendors that perform services on our behalf, such as our electronic health record, billing, and payment processing partners, each of whom is contractually required to safeguard your information.

Uses and disclosures permitted or required by law

We may use or disclose your health information without your authorization when required or permitted by law, including:

• When required by federal, state, or local law, or by court or administrative order
• For public health activities, including reporting communicable disease, adverse events, and product recalls
• To report suspected abuse, neglect, or domestic violence as required by law
• For health oversight activities such as audits, investigations, and inspections
• To avert a serious and imminent threat to the health or safety of you or another person
• For law enforcement purposes, coroners, medical examiners, and funeral directors
• For workers' compensation, organ donation, specialized government functions, and research approved by an institutional review board

Uses that require your written authorization

Most uses and disclosures of psychotherapy notes, uses for marketing purposes, and any sale of your health information require your written authorization. Other uses not described in this notice will be made only with your written authorization. You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.

Special protections

Certain categories of information, including mental health and substance use treatment records, HIV-related information, and genetic information, receive additional protection under Virginia and federal law. We follow whichever standard provides the greater privacy protection.

Your rights regarding your health information

• Access and copies. You may inspect and obtain a copy of your medical and billing records, including an electronic copy where we maintain them electronically. A reasonable, cost-based fee may apply.
• Amendment. You may request that we amend information you believe is incorrect or incomplete. We may deny the request in certain circumstances and will explain the reason in writing.
• Accounting of disclosures. You may request a list of certain disclosures we have made of your health information.
• Restrictions. You may request a restriction on uses or disclosures. We are not required to agree, except that we must honor a request to withhold information from your health plan for a service you paid for in full out of pocket.
• Confidential communications. You may ask us to contact you at an alternative address or by an alternative method.
• Paper copy. You may request a paper copy of this notice at any time, even if you agreed to receive it electronically.
• Breach notification. You will be notified if a breach occurs that compromises the privacy or security of your information.

How to exercise your rights or file a complaint

To exercise any of these rights, submit a written request to the Privacy Officer at 1233 Mall Drive, North Chesterfield, VA 23235, or call the office at 757-863-5843. If you believe your privacy rights have been violated, you may file a complaint with the practice or with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints. You will not be retaliated against for filing a complaint.

Changes to this notice

We reserve the right to change this notice and to make the revised notice effective for health information we already have as well as information we receive in the future. The current notice will always be posted on this page with its effective date, and a copy is available at the office on request.