MIDWEST CONCUSSION CLINIC

HIPAA NOTICE OF PRIVACY PRACTICES

Effective Date: November 2026

This notice describes how medical information about you may be used or disclosed and how you can get access to this information. Please review it carefully.

COVERED ENTITY DUTIES

Midwest Concussion Clinic (MCC) is a Covered Entity as defined and regulated under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). MCC is required by law to maintain the privacy of your protected health information (PHI), provide you with notice of its legal duties and privacy practices, abide by the terms of the Notice currently in effect, and notify affected individuals following a breach of unsecured PHI.

This Notice describes how MCC may use and disclose your PHI. It also describes your rights to access, amend, and manage your PHI and how to exercise those rights. Uses and disclosures not otherwise permitted by law or described in this Notice will require your written authorization. You may revoke an authorization in writing, subject to applicable legal limitations.

MCC reserves the right to change this Notice and make revised provisions effective for PHI already maintained by MCC and information received in the future, as permitted by law.

MCC will promptly revise this Notice when a material change occurs to its uses or disclosures, your rights, its legal duties, or other privacy practices described in the Notice.

Revised Notices will be available upon request and electronically through MCC’s website. Patients may also request a paper copy.

INTERNAL PROTECTIONS OF ORAL, WRITTEN AND ELECTRONIC PHI

MCC strives to protect your PHI. We are also committed to keeping race, ethnicity, language preferences, sexual orientation and gender identity (SOGI) information confidential.

  • MCC trains the staff to follow privacy and security processes
  • MCC requires any associates to follow privacy and security processes
  • MCC keeps our offices and all PHI secure
  • Your PHI is only referred to for clinical/business purposes with appropriate individuals
  • MCC keeps your PHI secure when sending, receiving and storing information electronically
  • MCC uses technology to ensure only members of the Midwest Concussion Clinic access your information

PERMISSIBLE USES AND DISCLOSURES OF YOUR PHI

The following are ways we may use or disclose your PHI without your permission or authorization:

  • Treatment – MCC may use and disclose your PHI to any physician or other healthcare provider providing treatment to you in an effort to coordinate your treatment among providers.
  • Payment – MCC may use and disclose your PHI to ensure payment on your behalf or provide a receipt of treatments rendered to appropriate healthcare providers or payers subject to the federal Privacy Rules for their payment purposes.
  • Healthcare Operations – MCC may use and disclose your PHI to perform certain healthcare operations. These activities may include providing customer service, responding to complaints or appeals and providing care management/coordination.

Your race, ethnicity, preferred language, sexual orientation and gender identity are protected by the
federal laws. This information remains private and MCC will only share this information with other
healthcare providers. In order to share this information, MCC will require your written authorization. This information will only be shared to help improve the quality of care you receive.

This information may be useful in the following situations:

  • Better understanding of your healthcare needs
  • Knowing your language preferences when seeing healthcare providers
  • Providing healthcare information to ensure appropriate care

This information will not be used to determine whether you are eligible for treatment with the Midwest
Concussion Clinic.

SUBSTANCE USE DISORDER TREATMENT RECORDS

Certain substance use disorder treatment records may receive additional confidentiality protections
under federal law, including 42 CFR Part 2.

When MCC receives or maintains records subject to these protections, MCC will use and disclose those records only as permitted by applicable law and any required patient consent.

Records protected under 42 CFR Part 2 may be subject to additional restrictions on their use or
disclosure in civil, criminal, administrative, or legislative proceedings against the patient. Where required by law, MCC will obtain the patient’s specific consent or ensure that another applicable legal
authorization exists before such records are used or disclosed for these purposes.

Additional restrictions may apply to redisclosure of these records.

OTHER PERMITTED OR REQUIRED DISCLOSURES OF YOUR PHI

  • Appointment Reminders/Treatment Alternatives – MCC may use and disclose your PHI to remind you of an appointment for treatment and medical care with us or to provide you with information regarding treatment alternatives or other health-related benefits and services, such as information on how to stop smoking or lose weight.
  • As Required by Law – If federal, state, and/or local law requires a use or disclosure of your PHI, MCC may use or disclose your PHI information to the extent that the use or disclosure complies with such law and is limited to the requirements of such law. If two or more laws or regulations governing the same use or disclosure conflict, MCC will comply with the more restrictive laws or regulations.
  • Public Health Activities – MCC may disclose your PHI to a public health authority for the purpose of preventing or controlling disease, injury, or disability. MCC may disclose your PHI to the Food and Drug Administration (FDA) to ensure the quality, safety or effectiveness of products or services under the jurisdiction of the FDA.
  • Victims of Abuse and Neglect – MCC may disclose your PHI to a local, state or federal government authority, including social services or a protective services agency authorized by law to receive such reports if MCC have a reasonable belief of abuse, neglect or domestic violence.
  • Judicial and Administrative Proceedings – MCC may disclose your PHI in response to an administrative or court order. MCC may also be required to disclose your PHI to respond to a subpoena, discovery request or other similar requests.
  • Law Enforcement – MCC may disclose your relevant PHI to law enforcement when required to do so for the purposes of responding to a crime.
  • Workers’ Compensation – MCC may disclose your PHI to comply with laws relating to workers’ compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault.
  • Emergency Situations – MCC may disclose your PHI in an emergency situation, or if you are incapacitated or not present, to a family member, close personal friend, authorized disaster relief agency, or any other person previously identified by you. MCC will use professional judgment and experience to determine if the disclosure is in your best interest. If the disclosure is in your best interest, MCC will only disclose the PHI that is directly relevant to the person’s involvement in your care.
  • Research – Under certain circumstances, MCC may disclose your PHI to researchers when their clinical research study has been approved and where certain safeguards are in place to ensure the privacy and protection of your PHI.

INDIVIDUAL’S RIGHTS

The following are your rights concerning your PHI. If you would like to use any of the following rights, please contact us using the information at the end of this Notice.

  • Right to Request Restrictions – You have the right to request restrictions on the use and disclosure of your PHI for treatment, payment or healthcare operations, as well as disclosures to persons involved in your care or payment of your care, such as family members or close friends. Your request should state the restrictions you are requesting and state to whom the restriction applies. MCC is not required to agree to this request. If MCC agrees, MCC will comply with your restriction request unless the information is needed to provide you with emergency treatment. However, MCC will restrict the use or disclosure of PHI for payment or health care operations to a health plan when you have paid for the service or item out of pocket in full.
  • Right to Request Confidential Communications – You have the right to request that Midwest Concussion Clinic (MCC) communicate with you about your protected health information (PHI) by alternative means or at alternative locations. For example, you may request that MCC contact you at a different telephone number, email address, or mailing address. MCC will accommodate reasonable requests for confidential communications. MCC may require that your request be made in writing and that you specify an alternative means of communication or location. You are not required to explain the reason for your request. MCC may ask you to provide information about how payment, if applicable, will be handled.
  • Right to Access and Receive a Copy of your PHI – You have the right, with limited exceptions, to look at or get copies of your PHI contained in a designated record set. You may request that MCC provides copies in a format other than photocopies. MCC will use the format you request unless MCC cannot practically do so. You must make a request in writing to obtain access to your PHI. If MCC denies your request, MCC will provide you with a written explanation and will tell you if the reasons for the denial can be reviewed. MCC will also tell you how to ask for such a review or if the denial cannot be reviewed.
  • Right to Amend your PHI – You have the right to request that MCC amends, or changes, your PHI if you believe it contains incorrect information. Your request must be in writing, and it must explain why the information should be amended. MCC may deny your request for certain reasons, for example if MCC did not create the information you want amended and the creator of the PHI is able to perform the amendment. If MCC denies your request, MCC will provide you with a written explanation. You may respond with a statement that you disagree with our decision and MCC will attach your statement to the PHI you request that MCC amend. If MCC accepts your request to amend the information, MCC will make reasonable efforts to inform others, including people you name, of the amendment and to include the changes in any future disclosures of that information.
  • Right to Receive an Accounting of Disclosures – You have the right to request an accounting of certain disclosures of your protected health information made by Midwest Concussion Clinic or its business associates during the six years preceding your request, subject to applicable exceptions and requirements under federal law. An accounting generally does not include disclosures for treatment, payment, or healthcare operations, disclosures made pursuant to your authorization, or certain other disclosures excluded by law. Additional accounting requirements may apply to certain records or electronic health information as required by applicable law. If you request an accounting more than once during a 12-month period, MCC may charge a reasonable, cost-based fee for additional requests, as permitted by law. MCC will inform you of any applicable fee before processing the request.
  • Right to File a Complaint – If you feel your privacy rights have been violated or that MCC has violated It’s own privacy practices, you can file a complaint with us in writing or by phone using the contact information at the end of this Notice.

You can also file a complaint with the Secretary of the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201 or calling 1-800-368-1019, (TTY: 1-800-537-7697 or visiting hhs.gov/ocr/privacy/hipaa/complaints/

MCC WILL NOT TAKE ANY ACTION AGAINST YOU FOR FILING A COMPLAINT

Right to Receive a Copy of this Notice – You may request a copy of our Notice at any time by
using the contact information listed at the end of the Notice. If you receive this Notice on our
website or by electronic mail (email), you are also entitled to request a paper copy of the
Notice.

PRIVACY OFFICER AND CONTACT INFORMATION

If you have questions about this Notice, wish to exercise your privacy rights, request a copy of your
medical records, or file a privacy complaint, please contact:

Matt Campbell, HIPAA Privacy Officer
Midwest Concussion Clinic, LLC
1204 Clark Ave.
Bluffton, IN 46714
Phone: (260) 200-3735
Email: Matt@MWConcussion.com

Midwest Concussion Clinic will not retaliate against any individual for exercising their privacy rights or
filing a complaint.