Privacy Practices

NOTICE OF PRIVACY PRACTICES 

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND  DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. 

PLEASE REVIEW IT CAREFULLY.

Effective Date: September 19, 2025

This joint Notice of Privacy Practices (“Notice”) applies to the following organizations: 

Avance Care P.A. (“Avance Care”), FastMed P.C., and FastMed Primary Care P.C. along with  their respective affiliated practices and individual providers, participate in an Organized  Health Care Arrangement (OHCA) to provide coordinated, high-quality care across our respective networks. An OHCA is a clinically integrated setting in which individuals may  receive care from more than one health care provider or an organized system of healthcare  in which more than one healthcare provider participates. 

These providers include their employees, staff, trainees, personnel, volunteers, students,  and other healthcare professionals. Both of these entities, their sites, and locations follow the terms of this Notice. In addition, these entities, sites, and locations may share your  health information with each other for treatment, payment, and/or healthcare operations  as described by this Notice. 

Collectively, these entities will be referred to as “we” or “us” in this Notice. We may share  medical information with each other for treatment, payment, and operational purposes.  The law allows us to do so to provide efficient healthcare services. Moreover, certain  healthcare providers within this arrangement may participate in clinically integrated  networks for purposes of joint utilization review, quality assessment and improvement, or  payment activities, and those providers may share medical information with the network  participants as necessary to carry out the joint activities of the network.  

Important Disclaimer 

The above providers are giving you this joint Notice. Each provider in this joint Notice is its  own healthcare provider. Each provider is individually responsible for its own activities. This  includes complying with privacy laws and all the healthcare services it provides. We do not  provide healthcare services mutually or on each other’s behalf. We may share health  information as allowed by law. 

WE HAVE A LEGAL DUTY TO PROTECT HEALTH INFORMATION ABOUT YOU.

We are required by law to protect the privacy and confidentiality of PHI. We are required to  explain how we may use PHI about you and when we may give out PHI to others. You have  rights regarding PHI about you as described in this Notice. We are required to follow the  procedures in this Notice. We have the right to change our privacy practices and to make  new Notice provisions effective for all PHI that we maintain by posting the revised notice at  our location, making copies of the revised notice available upon request, and posting the  revised notice on our website. 

You may have additional rights under other applicable state or federal law. Applicable state  or federal laws that provide greater privacy protection or broader privacy rights will  continue to apply and we will comply with such laws to the extent they are applicable. 

HOW WE USE OR DISCLOSE PROTECTED HEALTH INFORMATION. 

We access, use, and disclose PHI for a variety of reasons, as permitted or required by  federal or state law, including the Health Insurance Portability and Accountability Act  (HIPAA). These purposes include treatment, payment, and health care operations; with  your written permission; pursuant to a court order; or as otherwise permitted by law. 

In addition to federal protections, North Carolina law provides enhanced privacy  safeguards, including protections for your relationship with your health care provider and if applicable, your mental health provider. Other applicable laws governing sensitive  information (including behavioral health information, drug and alcohol treatment  information, and HIV status) may further limit these uses and disclosures.  

The following includes descriptions and examples of our potential uses and disclosures of  your PHI as allowed under State and Federal law. Please note that not every potential use  and disclosure will be listed in this Notice, but all the ways we may use or disclose your PHI  will fall within one of the categories below. 

• Health Information Exchange. We participate in several electronic Health  Information Exchanges (HIEs), including NC HealthConnex, Epic’s Care Everywhere,  and Carequality. These exchanges allow your treatment providers to securely  access your medical information when needed, especially in emergencies or when  you see a new provider. Unless you direct otherwise, your health information is  shared and accessible to other participating providers through these exchanges.  You have the right to opt out of these exchanges, to the extent permitted by law and  payer requirements. Opting out of any HIE will not affect your ability to receive care  from us or our affiliated providers. However, it may limit the ability of other providers  to access your medical history quickly, especially in urgent situations.NC HealthConnexNC HealthConnex is North Carolina’s statewide HIE that links your medical records from different providers into a single electronic health record. It  helps providers make informed decisions, especially in emergencies or when  coordinating care across multiple settings.
  • You may opt-out of NC HealthConnex by submitting a sign “Opt-Out Form” to  the NC Health Information Exchange Authority (NC HIEA).
  • Important: We cannot submit this form on your behalf. This is because NC  HIEA requires opt-out requests to come directly from the patient to ensure  proper identity verification and consent.
  • Opting out prevents providers from viewing your data in NC HealthConnex  but does not stop providers from submitting data if they are required to do so  by law (e.g. Medicaid-funded services).
  • You may opt back in at any time by submitting a new form to NC  HealthConnex.
  • Form(s) and instructions can be found here: NC HIEA Opt-Out Info.
• Epic’s Care Everywhere
  • Care Everywhere is Epic’s built-in HIE that allows providers using Epic’s  electronic health record (EHR) system to securely share your health  information across organizations. This includes hospitals, specialists, and  other providers in your care.
  • You may opt out of sharing and/or receiving your health information through  Care Everywhere by sending an email request to: MedicalRecords@AvanceCare.com or MedicalRecords@FastMed.com
  • Please include your full legal name and contact information in the email  message.
  • Please note:
    • By opting out of the Care Everywhere exchange for one participating  organization, you are opting out for all organizations within this OHCA. • Opting out may delay access to your records in emergencies or when  seeing new providers.
    • You may opt back in at any time by submitting a request to the  medical records email listed above.Carequality
• Carequality is a national interoperability framework that connects multiple  HIEs and EHR networks. It allows providers across different systems to  securely exchange patient data.You may opt out of sharing and/or receiving your health information through  Care Everywhere by sending an email request to: MedicalRecords@AvanceCare.com or MedicalRecords@FastMed.com
  • Please include your full legal name and contact information in the email  message.
  • Please note:
    • By opting out of the Care Everywhere exchange for one participating  organization, you are opting out for all organizations within this OHCA. • Opting out may delay access to your records in emergencies or when  seeing new providers.  
    • You may opt back in at any time by submitting a request to the medical records email listed above.

• Treatment. We may use or disclose your PHI to provide medical treatment or  services to you to manage and coordinate your medical care. For example, we may  use and disclose PHI about you when you need a prescription, lab work, an x-ray, or  other health care services. In addition, we may use and disclose PHI about you  when referring you to another health care provider. 
• Payment. We may use or disclose your PHI to obtain payment for your health care  services. For example, we may provide your health plan with PHI that it needs before  it can pay us for services we provided to you. Your health plan may also require us to  share information with them to determine whether you are eligible for benefits. 
• Health Care Operations. We may use and disclose your PHI to manage, operate,  and support the business activities of our practice. This includes, but is not limited  to, licensing, quality assessment, business planning, and administrative activities.  For example, we may combine outcome data from many patients to evaluate the  need for new products, services or treatments. We may disclose information to  health care professionals, students and other personnel for review and training  purposes. We may also combine the health information we have with other sources  to see where we can make improvements. We may remove information that identifies you from this set of health information to protect your privacy and to allow  others to use the information to study health care without learning the identity of  specific residents. We may also use and disclose medical information to evaluate  the performance of our staff and your satisfaction with our services.

• Minors. Under North Carolina law, minors – whether or not their parent or guardian  consents – may receive confidential treatment for certain conditions, including venereal diseases and other reportable communicable diseases, pregnancy-related  care, substance or alcohol abuse, and emotional disturbances. Minors under 18  who are unmarried, not legally emancipated, and not enlisted in the military may  consent to such treatment without adult involvement. Information about these  services will remain confidential unless:
  • Disclosure is required by law (e.g. suspected child abuse or neglect). o A provider determines that informing a parent or guardian is necessary to  prevent serious harm.
  • A parent or guardian explicitly requests access to information and disclosure  is legally permissible.
  • PHI about minors will generally be available to parents or legal guardians acting as  personal representatives, unless doing so violates confidentiality protections  granted under state or federal law.

• As Required by Law and Legal Proceedings. We will use or disclose your PHI when  required to do so by applicable law. For example, we may share your PHI when  required to report suspected child abuse. We may use and disclose your PHI in  response to court or administrative orders, subpoena, discovery request or other  lawful process. 
• Abuse, Neglect, or Domestic Violence. We may disclose your health information  to appropriate authorities if we reasonably believe that you are a possible victim of  abuse, neglect, or domestic violence. For example, if we believe that a patient has  been or is currently the victim of abuse, neglect, or domestic violence and the patient agrees to the disclosure, or we are otherwise permitted or required by law to  do so.

• Law Enforcement. We may use and disclose PHI about you as required by federal,  state and local laws. For example, we may disclose certain PHI if asked to do so by a  law enforcement official in circumstances such as:
  • In response to a court order, subpoena, warrant, summons or similar  process.
  • To identify or locate a suspect, fugitive, material witness or missing person. o About the victim of a crime if, under certain limited circumstances, we are  unable to obtain the person’s agreement.
  • About a death we believe may be the result of criminal conduct. o About criminal conduct in the facility; and
  • In emergency circumstances to report a crime; the location of a crime or  victims; or the identity, description or location of the person who committed  the crime.

• To Avert a Serious and Imminent Threat of Harm. Consistent with applicable law  and our ethical standards, we may disclose PHI to law enforcement or other  persons who can reasonably prevent or lessen the threat of harm in order to avoid a  serious and imminent threat to the health or safety of an individual or the public. For  example, the law may require such disclosure when an individual or group has been  specifically identified as the target or potential victim of a threat. 
• Public Health. We may share PHI about you for certain public health activities,  such as:
  • Preventing disease.
  • For the purpose of activities related to the quality, safety or effectiveness of  such FDA-regulated product or activity.
  • Helping with product recalls.
  • Reporting adverse reactions to medications
  • Reporting a person who may have been exposed to a disease or may be at  risk of contracting and/or spreading a disease or condition; and
  • Releasing proof of immunization for students without an authorization if you  have agreed to the disclosure on behalf of yourself or your dependent.

• Coroners, Medical Examiners, or Funeral Directors. We may disclose PHI to a  coroner, medical examiner, or funeral director as necessary for them to carry out  their duties, in accordance with applicable laws. For example, we may disclose PHI  to a coroner for purposes of identifying a deceased person. 
• Organ and Tissue Donation Requests. We may share PHI about you with organ  procurement organizations or other similar entities. If you are an organ or tissue  donor, we may use or disclose health information about you to organizations that  help with organ, eye and tissue donation and transplantation. 
• Health Oversight Activities. We may disclose your PHI to a health oversight agency  for audits, investigations, inspections, licensures, and other activities authorized by law. For example, we may share your PHI with governmental units that oversee or  monitor the health care system, government benefit and regulatory programs, and  compliance with civil rights laws.

• Research. We may use or share your PHI under certain circumstances. For  example, we may disclose PHI to a research organization if an institutional review  board or privacy board has reviewed and approved the research proposal, after  establishing protocols to ensure the privacy of your health information. 
• Military, National Security, and other Specialized Government Functions and Activities. We may disclose PHI to military authorities under certain circumstances.  For example, we may disclose your PHI, if you are in the Armed Forces, for activities  deemed necessary by appropriate military command authorities for determination  of benefit eligibility by the Department of Veterans Affairs or to foreign military  authorities if you are a member of that foreign military service. We may disclose  your PHI to authorized federal officials for conducting national security and  intelligence activities or special investigations (including for the provision of  protective services to the President of the United States, other authorized persons,  or foreign heads of state) or to the Department of State to make medical suitability  determinations. 
• Business Associates. On some occasions we may share your PHI with a business  associate, such as a consultant, cloud service provider, or other vendor. For  example, while we are providing you with health care services, we may share your  PHI with business associates to help us perform services related to billing,  administrative support or data analysis. These business associates are required by  HIPAA to protect your PHI. We may also share your PHI with a Business Associate  who will remove information that identifies you so that the remaining information  can be used or disclosed for purposes outside of this Notice. 
• Appointment Reminders. We may use your PHI to provide appointment reminders.  We may contact you by mail, e-mail, or telephone. We may use the telephone  number(s) you provide to leave voice messages or send text messages. 

YOU HAVE THE RIGHT TO OBJECT TO CERTAIN USES AND DISCLOSURES OF PHI AND,  UNLESS YOU OBJECT, WE MAY USE OR DISCLOSE PHI IN THE FOLLOWING  CIRCUMSTANCES. 

• To families, friends or others involved in your care. We may share with a family  member, relative, friend or other person identified by you, PHI directly related to that  person’s involvement in your care or payment for your care. We may share with a family member, personal representative or other person responsible for your care  PHI necessary to notify such individuals of your location, general condition or death.  We may share your PHI with these persons if you are present or available before we  share your PHI with them and you do not object to our sharing your PHI with them,  or we reasonably believe that you would not object to such sharing. If you are not  present, and certain circumstances indicate to us that it would be in your best  interest to do so, we will share information with a friend or family member or  someone else identified by you, to the extent necessary. This could include sharing  information with your family or friend so that they could pick up a prescription for  you. If you wish to object to this use or update the persons you have identified for  this use or disclosure of your PHI, please use the information under the “Contacting Us” section of this Notice.

• Disaster relief. In the event of a disaster, we may release your PHI to a public or  private relief agency, for purposes of notifying your family and friends of your  location, condition or death. Whenever possible, we will provide you with an  opportunity to agree or object. 
• Fundraising. We may use certain information (name, address, telephone number or  e-mail information, age, date of birth, gender, health insurance status, dates of  service, department of service information, treating physician information or  outcome information) to contact you for the purpose of raising money and you will  have the right to opt out of receiving such communications with each solicitation.  For example, you may receive a letter from us asking for a donation to support  enhanced patient care, treatment, education or research. If you have opted out,  HIPAA prohibits us from making fundraising communication. 

ANY OTHER USE OR DISCLOSURE OF PHI ABOUT YOU REQUIRES YOUR WRITTEN  AUTHORIZATION. 

We are only permitted to use and/or disclose your PHI as listed below if we obtain your  written authorization. In addition, other uses and disclosures that are not described in this  Notice may only be made with your authorization. If you provide us with an authorization,  you may revoke your authorization at any time by submitting a request in writing.  Revocation does not apply to PHI that has already been used or disclosed with your  permission. You understand that we are required to retain your health records of the care  that we provide to you. You can obtain an authorization form from us upon request. 

• Psychotherapy Notes. Unless we obtain your written authorization, in most  circumstances we will not disclose your psychotherapy notes. Some circumstances in which we will disclose your psychotherapy notes include the following: for your  continued treatment; training of medical students and staff; to defend ourselves  during litigation; if the law requires; health oversight activities regarding your  psychotherapist; to avert a serious or imminent threat to yourself or others; and to  the coroner or medical examiner upon your death.

• Substance Use Disorder Treatment Records. We will not share any substance use  disorder treatment records without your written authorization unless permitted or  otherwise required by law. For more information, please see SPECIAL  CONFIDENTIALITY PROTECTIONS FOR TREATMENT RECORDS FROM SUBSTANCE  ABUSE DISORDER PROGRAMS described below. 
• Marketing Health-Related Services. We will not use your health information for  marketing purposes unless we have your written authorization to do so. We are  required to obtain an authorization for marketing purposes if communication about  a product or service is provided and we receive financial remuneration (getting paid  in exchange for making the communication). No authorization is required if  communication is made face-to-face or for promotional gifts. 
• Sale of PHI. We are not allowed to disclose PHI without authorization if it  constitutes remuneration (getting paid in exchange for the PHI). Any activity  constituting a sale of your Protected Health Information will require your prior  written authorization. “Sale of PHI” does not include disclosures for public health,  certain research purposes, treatment and payment, and for any other purpose  permitted by HIPAA, where the only remuneration received is “a reasonable cost based fee” to cover the cost to prepare and transmit the PHI for such purpose or a  fee otherwise expressly permitted by law. Corporate transactions (i.e., sale, transfer,  merger, consolidation) are also excluded from the definition of “sale.” 

YOU HAVE SEVERAL RIGHTS REGARDING YOUR PHI. 

You have the following rights regarding the health information we maintain about you: 

Right to Request Restrictions. You have the right to request a restriction or limitation on  the PHI about you that we use or disclose. Your request must be in writing to the Privacy  Officer at the address listed below. If you have paid in full for a service and have requested  that we not share PHI related to that service with a health plan, we must agree to the  request. For any other request to limit how we use or disclose your PHI, we will consider  your request, but are not required to agree to the restriction. If we agree to your request for  a restriction, we will comply with it unless the information is needed for emergency  treatment.

• Right to Request Alternative Method of Contact. You have the right to request that  we communicate with you about confidential medical matters in a certain way or at  a certain location. Your request must be in writing to the Privacy Officer at the  address listed below. We will agree to the request to the extent that it is reasonable  for us to do so. For example, you may request an alternative address for billing  purposes. 
• Right to an Accounting of Disclosures. You have the right to request an  “accounting of disclosures” of your PHI of certain disclosures of your health  information during the past six years. We will provide one accounting of disclosures  a year at no charge, but will charge a reasonable, cost-based fee if another  accounting of disclosures is requested within 12 months. To request this list or  accounting of disclosures, you must submit your request in writing to our Privacy  Officer at the address listed below. 
• Right to Access, Inspect, and Copy. You have the right to inspect and/or obtain a  copy of PHI that may be used to make decisions about your care. This includes  medical and billing records but does not include psychotherapy or Substance Use  Disorder (SUD) counseling notes.. To request access to your records, you must  complete a written authorization for the release of your PHI and submit it to the  Medical Records Department of the provider who maintains your records. Please  note that this request should not be sent to the Privacy Office, as the Privacy Office  does not process medical record requests. If you request a copy of your PHI, we  may charge you a reasonable fee to cover the costs associated with copying and  mailing the information. If you request an electronic copy of your PHI that we  maintain electronically, we will provide an electronic copy, and will do so in the  electronic form or format you requested if the PHI is readily producible in that form  or format. In certain very limited circumstances, we may deny your request to  inspect and copy your health information. If you are denied access to your medical  information, we will document our reasons in writing and explain any right to have  the denial reviewed. 
• Right to Amend. If you feel that certain PHI we have about you is incorrect or  incomplete, you may ask us to amend the information. You have the right to request  an amendment for as long as the information is kept by or for our practice. To  request an amendment, your request must be made in writing and submitted to the  Privacy Officer at the address listed below. You must provide a reason that supports  your request. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your  request if you ask us to amend information that:
  • Was not created by us, unless the person or entity that created the  information is no longer available to make the amendment.
  • Is not part of the medical information kept by or for our practice.
  • Is not part of the information which you would be permitted to inspect and  copy; or
  • Is accurate and complete.
• Examples of amendment requests we will not approve include:
  • Requests to change a diagnosis made by a licensed provider if the diagnosis  was clinically supported at the time.
  • Requests to remove documentation of symptoms, behaviors, or test results  that were observed or recorded during your visit.
  • Requests to alter provider notes or clinical impressions that reflect  professional judgment.
  • Requests to revise billing codes or insurance documentation that were  submitted based on services rendered.
• If your request for an amendment is denied, we will explain our reasons in writing.  You have the right to submit a statement explaining why you disagree with our  decision to deny your amendment request. We will include your statement  whenever we disclose the relevant PHI.

• Paper or Electronic Copy. If you agreed to receive this Notice electronically, you  have the right to obtain a paper copy of this Notice from us upon request. 
• Breach Notification Requirements. We are required by law to notify you following a  breach of your unsecured PHI. We will give you written notice in the event we learn  of any unauthorized use of your PHI that has not otherwise been properly secured  as required by HIPAA. You will be notified of the situation and any steps you should  take to protect yourself against harm due to the breach. 

CHANGES TO THIS NOTICE. 

We reserve the right to make any changes in our Notice, and the new terms of our Notice  are effective for all PHI maintained, created and/or received by us before the date changes  were made. Before we make a significant change, this Notice will be amended to reflect the  changes, and we will make the new Notice available in our office and on our website. 

COMPLAINTS.

If at any time you believe your privacy rights have been violated and you would like to  register a complaint, you may do so with us or with the Secretary of the United States  Department of Health and Human Services. If you file a complaint, we will not take action  against you or change our treatment of you in any way. 

If you wish to file a complaint with us, please submit it in writing to the Privacy Officer of your treating organization as listed below: 

AVANCE CARE 

PrivacyOfficer@AvanceCare.com; or
Avance Care
Attn: Privacy Officer
4705 University Dr, Bldg 700
Durham, NC 27707 

FASTMED and FASTMED PRIMARY CARE 

Compliance@FastMed.com; or
FastMed
Attn: Privacy Officer
P.O. Box 271
Durham, NC 27702 

If you wish to file a complaint with the Secretary of the United States Department of Health  and Human Services, please go to the website of the Office for Civil Rights  (www.hhs.gov/ocr/hipaa/), call 202-619-0257 (toll free 877-696-6775), or mail to: 

Secretary of the US – Department of Health and Human Services
200 Independence Ave S.W.
Washington, D.C. 20201 

To file a complaint with the Secretary, you must 1) name the clinic location or person that  you believe violated your privacy rights and describe how that place or person violated your  privacy rights; and 2) file the complaint within 180 days of when you knew or should have  known that the violation occurred. 

NOTICE OF NON-DISCRIMINATION.  

We comply with applicable Federal civil rights laws and do not discriminate on the basis of  race, color, national origin, age, disability, or sex.

SPECIAL CONFIDENTIALITY PROTECTIONS FOR TREATMENT RECORDS FROM  SUBSTANCE ABUSE DISORDER PROGRAMS 

Records related to your treatment for substance use disorders are protected under federal  law, specifically 42 CFR Part 2, which provides enhanced confidentiality safeguards. Under  this regulation, we may not disclose any information that identifies you as receiving  substance use disorder treatment – including diagnosis, referral, or attendance – without your written consent, except in limited circumstances as permitted by law, described  further below. These protections apply even more strictly than HIPAA and are designed to  encourage individuals to seek treatment without fear of stigma or discrimination. You have  the right to revoke your consent at any time, and any unauthorized redisclosure of this  information is strictly prohibited under federal law. 

You should also know:  

1. A violation of the federal law and regulations governing drug or alcohol use may  be a crime. Suspected violations may be reported to the United States Attorney at  617-748-3100.  
2. As mentioned above, there are certain limited circumstances under which  substance use disorder disclosures can be made without patient consent, by law.  The circumstances include but are not limited to:  

• Medical Emergencies. Patient identifying information is permitted to be  disclosed to medical personnel who have a need for information about a patient  for the purpose of treating a condition which poses an immediate threat to the  health of any individual and which required immediate medical intervention.  
• Subpoena and court—ordered disclosures. Programs are permitted to release  patient identifying information in response to a subpoena ONLY IF the patient  signs a consent permitting release of the information requested in the  subpoena. If the patient does not consent, programs are prohibited from  releasing information in response to a subpoena unless a court has issued an  order that complies with the law.  
• Child or elder person abuse or neglect reporting. Programs are permitted to  release patient identifying information in order to comply with state laws that  require the reporting of child or elder person abuse and neglect.  
• Crimes on program premises or against program personnel. Programs are  permitted to disclose limited patient identifying information to law enforcement  officers. 
• Qualified Service Organization. Programs are permitted to disclose patient  identifying information to a QSO.  
• Research activities. Programs are permitted to allow a researcher to have access  to its patients’ records, provided certain safeguards are met.  
• Audit or evaluation activities. Programs are permitted to disclose patient  identifying information to qualified persons who are conducting an audit or  evaluation of the program, without patient consent, provided certain safeguards  are met.  
• Patient’s intent to harm self or others, patient does not have the capacity to care  for self, or patient is considered by a court to be “incompetent” to manage  himself or herself. Programs are permitted to disclose limited patient identifying  information to law enforcement officers or emergency medical systems.  

CONTACTING US. 

We are required by law to provide individuals with this Notice of our legal responsibilities  and privacy practices with respect to Protected Health Information. We are also required to  maintain and implement safeguards to maintain the privacy of PHI, and abide by, the terms  of the Notice currently in effect. If you have questions about your privacy rights, wish to  exercise any of the rights as described in this Notice, or need assistance with opting out of  a Health Information Exchange, please contact the organization that directly provides your  care. Each organization is responsible for its own privacy practices and cannot act on  behalf of the other. For example, if your provider is with Avance Care, please reach out to  Avance Care directly. If your provider is with FastMed, please contact FastMed. This  ensures your request is handled appropriately and in accordance with applicable laws. 

Download copies of this policy below: