HIPAA Notice of Privacy Practices

Ellen A. Mahony, MD, Inc. 131 Kings Highway North, Westport, Connecticut 06880 Phone: (203) 221-0102 Website: www.drellenmahony.com

Effective Date: 3 Feb 2026

---

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

---

Who Will Follow This Notice

This notice describes the privacy practices of Ellen A. Mahony, MD, Inc. and all workforce members who handle your medical information, including physicians, nurses, medical assistants, office staff, and any other personnel involved in your care.

---

Our Commitment to Your Privacy

We understand that your medical information is personal and private. We are committed to protecting your health information while providing you with excellent medical care. This notice explains:

• How we may use and share your health information
• Your rights regarding your health information
• Our legal duties to protect your privacy

We are required by law to:

• Keep your protected health information (PHI) private
• Give you this notice of our privacy practices
• Follow the terms of this notice
• Notify you if there is a breach of your unsecured health information

---

What is Protected Health Information (PHI)?

Protected health information includes any information about you that:

• Identifies who you are (such as your name, address, or Social Security number)
• Relates to your past, present, or future health condition
• Relates to healthcare services you receive
• Relates to payment for your healthcare

---

How We May Use and Share Your Health Information

Uses and Disclosures That Do Not Require Your Authorization

We may use and share your health information without your written permission for the following purposes:

Treatment

We use your health information to provide and coordinate your medical care. For example:

• Reviewing your medical history to plan your treatment
• Sharing information with other doctors involved in your care
• Providing information to laboratories, surgical facilities, or pharmacies
• Coordinating follow-up care and recovery

Payment

We use your health information to obtain payment for services. For example:

• Sending bills to you or your insurance company
• Providing information to your health plan for coverage decisions
• Collecting payment from third parties responsible for your care

Healthcare Operations

We use your health information to run our practice and ensure quality care. For example:

• Evaluating and improving the quality of care we provide
• Training staff and medical students
• Conducting audits and compliance reviews
• Business planning and management
• Obtaining accreditation and licensing

Appointment Reminders and Health Information

We may contact you to:

• Remind you of upcoming appointments
• Provide information about treatment options
• Tell you about health-related services that may interest you

Individuals Involved in Your Care

We may share your health information with family members, friends, or others you identify who are involved in your care or payment for your care. If you are unable to agree or object, we may share information as necessary if we believe it is in your best interest.

As Required by Law

We will use and share your health information when required by federal, state, or local law.

Public Health Activities

We may share your information for public health purposes, such as:

• Preventing or controlling disease
• Reporting births and deaths
• Reporting reactions to medications or medical devices
• Notifying people of product recalls

Health Oversight Activities

We may share information with health oversight agencies for activities authorized by law, including audits, investigations, inspections, and licensing.

Lawsuits and Legal Proceedings

We may share your information in response to a court order or subpoena, or in connection with legal proceedings.

Law Enforcement

We may share information with law enforcement officials as required or permitted by law, such as reporting certain types of wounds or injuries.

Coroners, Medical Examiners, and Funeral Directors

We may share information with coroners, medical examiners, or funeral directors as necessary for them to carry out their duties.

Organ and Tissue Donation

We may share information with organizations involved in organ, eye, or tissue donation and transplantation.

Research

We may share your information for research purposes when approved by an institutional review board that has established protocols to protect your privacy.

Serious Threats to Health or Safety

We may share information when necessary to prevent a serious threat to your health and safety or the health and safety of others.

Military and Veterans

If you are a member of the armed forces, we may share information as required by military authorities.

Workers' Compensation

We may share information for workers' compensation or similar programs.

Inmates

If you are an inmate of a correctional facility, we may share information necessary for your health and safety or the health and safety of others.

Uses and Disclosures That Require Your Authorization

For uses and disclosures not described above, we will ask for your written authorization before using or sharing your health information. This includes:

• Marketing purposes (with limited exceptions)
• Sale of your health information
• Most uses of psychotherapy notes
• Other purposes not covered by this notice

You may revoke your authorization at any time by submitting a written request to our office. However, we cannot take back any disclosures already made with your permission.

---

Your Rights Regarding Your Health Information

Right to Inspect and Copy

You have the right to inspect and obtain copies of your health information, including medical and billing records. To request access:

• Submit a written request to our office
• We may charge a reasonable fee for copying costs
• We will respond within 30 days (or 60 days if the information is stored offsite)

In limited circumstances, we may deny your request. If we do, you have the right to request a review of the denial.

Right to Amend

If you believe your health information is incorrect or incomplete, you may request an amendment. To request an amendment:

• Submit a written request to our office
• Explain why you believe the information should be changed
• We will respond within 60 days

We may deny your request if the information:

• Was not created by us
• Is not part of the records we maintain
• Is accurate and complete

If we deny your request, you may submit a written statement of disagreement to be included in your record.

Right to an Accounting of Disclosures

You have the right to receive a list of certain disclosures we have made of your health information. This accounting does not include disclosures for:

• Treatment, payment, or healthcare operations
• Disclosures made with your authorization
• Disclosures made directly to you

To request an accounting:

• Submit a written request to our office
• Specify a time period (not longer than six years)
• The first accounting in any 12-month period is free; we may charge for additional requests

Right to Request Restrictions

You have the right to request restrictions on how we use or share your health information for treatment, payment, or healthcare operations. You may also request limits on information shared with family members or others involved in your care.

• Submit a written request to our office
• We are not required to agree to your request (except as noted below)
• If we agree, we will comply unless the information is needed for emergency treatment

Note: We must agree to your request to restrict disclosure to a health plan if:

• The disclosure is for payment or healthcare operations (not treatment)
• You have paid for the service in full out of pocket

Right to Confidential Communications

You have the right to request that we communicate with you in a specific way or at a specific location. For example, you may ask us to contact you only at work or by mail.

• Submit a written request to our office
• We will accommodate all reasonable requests
• You do not need to explain the reason for your request

Right to a Paper Copy of This Notice

You have the right to a paper copy of this notice at any time, even if you have agreed to receive it electronically.

• Request a copy at our office
• Download a copy from our website: www.drellenmahony.com

Right to Be Notified of a Breach

You have the right to be notified if there is a breach of your unsecured protected health information.

---

Our Responsibilities

We are required to:

• Maintain the privacy of your protected health information
• Provide you with this notice of our privacy practices
• Follow the terms of this notice currently in effect
• Notify you if we cannot accommodate a requested restriction or confidential communication

We will not use or share your information in ways not described in this notice without your written authorization.

---

Changes to This Notice

We reserve the right to change this notice and make the new provisions effective for all health information we maintain. If we make significant changes, we will:

• Post the revised notice in our office
• Make the revised notice available on our website
• Provide a copy upon request

The effective date of the current notice is shown at the top of this page.

---

Filing a Complaint

If you believe your privacy rights have been violated, you may file a complaint:

With Our Practice: Ellen A. Mahony, MD, Inc. Attn: Privacy Officer 131 Kings Highway North Westport, Connecticut 06880 Phone: (203) 221-0102

With the U.S. Department of Health and Human Services: Office for Civil Rights 200 Independence Avenue, S.W. Washington, D.C. 20201 Phone: 1-877-696-6775 Website: www.hhs.gov/ocr/privacy/hipaa/complaints/

You will not be penalized or retaliated against for filing a complaint.

---

Questions

If you have questions about this notice or our privacy practices, please contact:

Privacy Officer Ellen A. Mahony, MD, Inc. 131 Kings Highway North Westport, Connecticut 06880 Phone: (203) 221-0102

---

Acknowledgment

You will be asked to sign an acknowledgment that you have received this Notice of Privacy Practices. Your signature confirms receipt only; it does not authorize any specific use or disclosure of your health information.

---

This Notice of Privacy Practices is effective as of 3 Feb 2026.