MyAshHealth

HIPAA Notice of Privacy Practices

Effective Date: September 4, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, HOW YOU CAN GET ACCESS TO THIS INFORMATION, AND YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice applies to protected health information (“PHI”) maintained by AshHEALTH, LLC d/b/a MyAshHealth (“MyAshHealth,” “we,” “us,” or “our”) in its capacity as a covered entity under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Independent healthcare professionals, pharmacies, laboratories, and other healthcare entities may have their own privacy notices and are not covered by this Notice unless expressly stated in a legally valid arrangement.

Your Rights

You have the right to:

  • Get an electronic or paper copy of health and billing information we maintain about you, subject to limited legal exceptions.
  • Ask us to correct health and billing information you believe is incorrect or incomplete.
  • Request confidential communications, including asking us to contact you in a specific way or at a specific location.
  • Ask us to limit certain uses or disclosures of your PHI. We are not required to agree to every request, but we will comply where the law requires us to do so.
  • Ask us not to disclose information to a health plan for payment or healthcare operations when the disclosure concerns an item or service for which you, or someone on your behalf other than the health plan, paid in full out of pocket, when HIPAA requires us to honor that restriction.
  • Receive an accounting of certain disclosures of your PHI as provided by law.
  • Get a paper copy of this Notice at any time, even if you agreed to receive it electronically.
  • Choose someone to act for you, such as a personal representative who has legal authority to make healthcare or privacy decisions for you.
  • File a complaint if you believe your privacy rights have been violated.

Your Choices

For certain health information, you may tell us your preferences about what we share. Where the law gives you a choice, you may tell us whether we may share relevant information with family, friends, or others involved in your care or payment for your care. If you cannot tell us your preference, we may use professional judgment and applicable law to determine whether a limited disclosure is in your best interest or needed to lessen a serious and imminent threat to health or safety.

We will obtain your written authorization before using or disclosing PHI for purposes that require authorization under HIPAA, including most uses of psychotherapy notes, most marketing uses, and a sale of PHI. If you authorize a use or disclosure, you may revoke that authorization in writing at any time, except to the extent we have already relied on it.

How We May Use and Disclose Your PHI

Treatment

We may use or disclose PHI to support treatment and coordination of care, including facilitating information exchange with licensed healthcare professionals, pharmacies, laboratories, and other healthcare providers involved in your care, as permitted by law.

Payment

We may use or disclose PHI for payment activities, including processing charges, administering refunds, determining or supporting eligibility or reimbursement where applicable, coordinating payment information with service providers, and performing other lawful payment functions.

Healthcare Operations

We may use or disclose PHI for healthcare operations, including quality assessment, compliance, auditing, credentialing support where applicable, customer service, care coordination support, business management, legal services, security, fraud prevention, and other activities permitted by HIPAA.

Business Associates

We may disclose PHI to business associates that perform services for us involving PHI, such as technology, hosting, communications, support, security, analytics permitted by HIPAA, professional services, and administrative functions. We require business associates to safeguard PHI as required by HIPAA and applicable agreements.

Other Uses and Disclosures Permitted or Required by Law

We may use or disclose PHI without your written authorization when HIPAA and other applicable law permit or require it, including for:

  • Public health and safety activities, including certain disease, adverse-event, product, abuse, neglect, or safety reporting.
  • Health oversight activities such as lawful audits, inspections, licensing, and investigations.
  • Judicial and administrative proceedings when legal requirements are satisfied.
  • Law-enforcement purposes in circumstances permitted by law.
  • Coroners, medical examiners, funeral directors, and organ or tissue donation organizations as permitted by law.
  • Research when applicable legal safeguards and approvals are satisfied.
  • Preventing or lessening a serious and imminent threat to health or safety as permitted by law.
  • Workers’ compensation and other programs authorized by law.
  • National security, protective services, military, correctional, or custodial circumstances as permitted by law.
  • Any use or disclosure required by federal, state, or local law.

Substance Use Disorder Records and Other Specially Protected Information

Certain records, including records of substance use disorder treatment protected by 42 CFR Part 2, may be subject to additional federal protections. When MyAshHealth creates, receives, or maintains information subject to Part 2, we will use and disclose that information only as permitted by applicable law and any required consent. Part 2 records, testimony, and certain counseling notes may be subject to protections beyond ordinary HIPAA requirements.

Other federal or state laws may provide greater protection for particular categories of information. When such a law applies, we will follow the more protective requirement.

Our Responsibilities

We are required by law to maintain the privacy and security of your PHI, provide you with this Notice describing our legal duties and privacy practices, and follow the terms of the Notice currently in effect. We will notify affected individuals as required by law if a breach occurs that may have compromised the privacy or security of unsecured PHI.

We will not use or disclose PHI other than as described in this Notice or as otherwise permitted or required by law unless you provide a valid written authorization. If you provide an authorization, you may revoke it in writing as permitted by law.

Exercising Your Rights

To exercise a HIPAA right, request a copy of your information, request an amendment, request restrictions or confidential communications, obtain an accounting of disclosures, or ask questions about this Notice, contact the MyAshHealth Privacy Officer using the information below. We may require a written request and reasonable identity verification where permitted by law.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with the MyAshHealth Privacy Officer and/or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint or exercising a privacy right.

U.S. Department of Health and Human Services, Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201

You may also use the complaint process available through HHS.gov.

Changes to This Notice

We may change the terms of this Notice, and the changes may apply to PHI we already maintain as well as information we receive in the future. If we make a material change, we will post the revised Notice on our website and make copies available as required by law. The revised Notice will state its effective date.

Privacy Contact

Privacy Officer

AshHEALTH, LLC d/b/a MyAshHealth

1160 Pittsford Victor Road, Building M, Suite 12, Pittsford, NY 14534

Telephone: (585) 540-1353

Email: Supportteam@AshHealth.fit

Website: https://myashhealth.com