Notice of Privacy Practices

Form 8.0 · Effective October 1, 2026 · Printable PDF

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Protected health information (PHI) about you is maintained as a written and/or electronic record of your contacts or visits for healthcare services with our practice. PHI is information about you, including demographic information (such as name, address, and phone number), that may identify you and relates to your past, present, or future physical or mental health condition and related healthcare services.

This Notice describes your rights to access and control your PHI. It also describes how we use and disclose your PHI to provide your treatment, obtain payment for services you receive, manage our healthcare operations, and for other purposes that are permitted or required by law.

Our Responsibilities

IM Clinic LLC is required by law to maintain the privacy and security of your PHI and to provide you with this Notice of our legal duties and privacy practices. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information. We must follow the duties and privacy practices described in this Notice. We will not use or share your information other than as described here unless you tell us in writing that we may.

We reserve the right to change the terms of this Notice at any time, and the changes will apply to all information we have about you. The current Notice will be posted in our office and on our website at imclinic.org/forms, and a copy is available on request.

Your Rights Under the Privacy Rule

Please feel free to discuss any of these rights with our staff.

• Right to a copy of this Notice: You have the right to a paper copy of this Notice at any time, even if you have agreed to receive it electronically. Call our office or ask at your next visit.
• Right to inspect and copy your PHI: You may inspect and obtain a copy of your health record, including an electronic copy of information we maintain electronically. We may charge a reasonable, cost-based fee as permitted by federal and state law.
• Right to request confidential communications: You may ask us to contact you by an alternative method (for example, email, text, or telephone) or at an alternative location (for example, a cell phone number or a different address). Please make this request in writing using our form. We will accommodate all reasonable requests.
• Right to request restrictions: You may ask us, in writing, not to use or disclose part of your PHI for treatment, payment, or healthcare operations. We are not required to agree, except as follows: if you, or someone on your behalf, pay in full out-of-pocket for a service, you may ask us not to share information about that service with your health plan, and we must agree unless the law requires us to share it. If we agree to a restriction, we will follow it except in an emergency when the information is needed for your treatment.
• Right to request an amendment: You may ask us to correct PHI you believe is incorrect or incomplete for as long as we maintain it. In certain cases we may deny your request, and we will explain why in writing.
• Right to an accounting of disclosures: You may request a list of certain disclosures we have made of your PHI to persons or organizations outside our office.
• Right to choose someone to act for you: If you have given someone healthcare power of attorney, or if someone is your legal guardian or personal representative, that person can exercise your rights and make choices about your PHI. We will verify that the person has this authority before we act.
• Right to authorize other uses and to revoke: Uses and disclosures not described in this Notice will be made only with your written authorization. You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.
• Right to a breach notice: You will receive written notification if we discover a breach of your unsecured PHI and a risk assessment determines that notification is required.

How We May Use or Disclose Your Health Information

The following examples describe the types of uses and disclosures we are permitted to make. They are not meant to be exhaustive.

• Treatment: We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services, including with third parties involved in your care. For example, we may disclose PHI to a pharmacy that fills your prescriptions or to other healthcare providers involved in your treatment.
• Payment: We may use your PHI as needed to obtain payment for your healthcare services, including activities your health plan may undertake before it approves or pays for services, such as determining eligibility or coverage.
• Healthcare Operations: We may use or disclose your PHI to support the business activities of our practice, including business planning and development, quality assessment and improvement, medical review, legal services, auditing, and patient safety activities.
• Virtual Scribes and AI-Assisted Documentation: To help document your visit, our providers may use a virtual scribe (a trained person who listens to your visit remotely or reviews a recording of it) and/or an artificial intelligence (AI) scribe, a software tool that listens to or records your visit and produces a draft note. Some virtual scribes may be located outside the United States. Your provider reviews and finalizes every note; neither the scribe nor the AI tool makes medical decisions. Scribe services and AI vendors are bound by HIPAA Business Associate Agreements, may use your information only to help document your care, and must protect it as we do. Visit recordings are deleted once your note has been completed. If you do not want a scribe or AI tool used, tell your provider verbally at that visit, in person or at the start of a telehealth visit; this will not affect your care.
• Business Associates: We contract with outside companies (business associates) that perform services for us, such as billing, electronic health records, document management, transcription, and scribe services. They are required by written agreement to protect your information.
• Appointment Reminders and Health-Related Communications: We may contact you by phone, text message, email, or mail to remind you of appointments, provide results of exams or tests, and tell you about treatment alternatives or health-related benefits and services offered by our office.
• Health Information Exchange: We may participate in a health information organization or similar network that allows the electronic exchange of information for treatment, payment, or healthcare operations.
• Others Involved in Your Healthcare: Unless you object, we may disclose to a family member, relative, close friend, or any other person you identify the PHI that directly relates to that person's involvement in your care. If you are unable to agree or object, we may disclose such information if, in our professional judgment, it is in your best interest; only the PHI that is necessary will be disclosed. We may also use or disclose PHI to notify a family member, personal representative, or other person responsible for your care of your general condition or death.
• Other Permitted and Required Uses and Disclosures: We may use or disclose your PHI without your written authorization: as required by law; for public health activities; for health oversight activities; in cases of abuse, neglect, or domestic violence; to comply with Food and Drug Administration requirements; for research under approved safeguards; in legal proceedings; for law enforcement purposes; to coroners, medical examiners, and funeral directors; for organ and tissue donation; to avert a serious threat to health or safety; for military, veterans, and national security activities; for workers' compensation; regarding inmates in a correctional facility; and to the Department of Health and Human Services when it investigates our compliance with the Privacy Rule.

Uses That Require Your Written Authorization

We will not do the following without your written authorization: use or disclose your PHI for marketing purposes; sell your PHI; or use or disclose psychotherapy notes, except as permitted by law.

Substance Use Disorder Records: If we receive records about you from a substance use disorder treatment program that are protected under federal law (42 CFR Part 2), we will not use or disclose those records, or testimony about their content, in any civil, criminal, administrative, or legislative proceeding against you unless you give written consent or a court issues an order after giving you notice and an opportunity to be heard.

State Law: Where Alabama law provides greater protection for certain information than federal law, we will follow the more protective law.

Privacy Complaints and Questions

If you have questions about this Notice or believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

Effective Date: October 1, 2026 · Publication Date: October 1, 2026 · Supersedes: Form 7.20

Questions about this notice? Call IM Clinic at (256) 715-9598, email office@imclinic.org, or write to us at 420 Lowell Dr. SE, Suite 102, Huntsville, AL 35801.