Notice of Privacy Practices.

Carolyn's Family Clinic policy. Questions: call (469) 795-3311.

Carolyn’s Family Clinic — Notice of Privacy Practices

Effective date: September 01, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice applies to Carolyn’s Family Clinic and all of its locations, physicians, clinicians, staff, and volunteers. If you have questions, contact our Privacy Officer: Carolyn Ortiz, FNP-C (Owner) · 469-795-3311 · office@carolynsfamilyclinic.com · 3213 I 30 Frontage Rd, Ste 110, Mesquite, TX 75150.

We protect your health information under the federal Health Insurance Portability and Accountability Act (HIPAA), federal rules for substance use disorder records (42 CFR Part 2), and Texas law, including the Texas Medical Records Privacy Act (Health & Safety Code Chapter 181) and Texas Health & Safety Code Chapter 183. When Texas law gives you more protection than HIPAA, we follow Texas law.

Our responsibilities

We are required by law to maintain the privacy and security of your protected health information (PHI).
We must give you this notice of our legal duties and privacy practices, and follow the terms of the notice currently in effect.
We will notify you promptly if a breach occurs that may have compromised the privacy or security of your information.
We will not use or share your information other than as described here unless you tell us we can in writing. You may change your mind at any time by telling us in writing.
We store electronic health records in the United States and limit access to workforce members with a legitimate clinical or business need, as Texas law requires.

How we may use and share your health information

We typically use or share your information for treatment, payment, and health care operations without your written authorization.

Treatment. We share information with doctors, nurses, specialists, labs, pharmacies, and others involved in your care. Example: a physician treating you for an injury consults another doctor about your overall health.
Payment. We use and share information to bill and get paid by health plans or other payers. Example: we give information about you to your health insurer so it will pay for your services.
Health care operations. We use and share information to run our practice, improve care, train staff, and contact you when necessary. Example: we review charts to evaluate the quality of care our clinicians provide.
Business associates. We share information with vendors who perform services for us (such as billing, IT, or transcription) under written contracts that require them to protect it.
Appointment reminders and health-related services. We may contact you about appointments, treatment alternatives, or health-related benefits and services.

Other uses and disclosures allowed or required by law

We may also share your information, when permitted or required by law, for these purposes:

Public health and safety: preventing disease, reporting adverse reactions to medications, product recalls, reporting suspected abuse, neglect, or domestic violence, and preventing a serious threat to anyone's health or safety.
As required by law: including to the U.S. Department of Health and Human Services when it checks our HIPAA compliance, and reports required by Texas law.
Organ and tissue donation requests.
Medical examiners, coroners, and funeral directors when an individual dies.
Workers' compensation claims, as Texas workers' compensation law allows.
Law enforcement purposes, or with a law enforcement official, as the law permits.
Health oversight agencies for audits, investigations, inspections, and licensure.
Special government functions such as military, national security, and presidential protective services.
Correctional institutions, if you are an inmate or in custody.
Lawsuits and legal actions: in response to a court or administrative order, or a subpoena, as the law permits.
Disaster relief: to organizations assisting in a disaster so your family can be notified of your location and condition.

Your choices, and uses that need your permission

You can tell us your preferences for sharing information with family, close friends, or others involved in your care or payment, and in a disaster relief situation. If you can't tell us (for example, if you are unconscious), we may share information if we believe it is in your best interest, or to lessen a serious and imminent threat to health or safety.

We will never share your information in these cases unless you give us written permission:

Marketing purposes, unless you give us written permission
Sale of your information — Texas law also prohibits selling protected health information except in narrow circumstances the law allows. We do not sell your information.
Most sharing of psychotherapy notes

Any other use or disclosure not described in this notice requires your written authorization, which you may revoke in writing at any time (except to the extent we have already acted on it).

Additional protections under Texas law

Notice of electronic disclosure (Tex. Health & Safety Code §181.154). Your protected health information is subject to electronic disclosure. We will not disclose it electronically to anyone without your separate authorization for each disclosure, except to another covered entity for treatment, payment, health care operations, or insurance or HMO functions, or as otherwise authorized or required by state or federal law. You may give this authorization in writing, electronically, or orally if we document it in writing.

No sale of your information. Texas law prohibits us from selling your protected health information, except in the limited cases the law permits.

Faster access to electronic records. If you ask for a copy of your electronic health record, we will provide it in electronic form within 15 business days of receiving your written request, unless you agree to another format.

Parents and minors. A parent, managing conservator, or guardian of a patient under 18 may obtain complete access to the minor's electronic health record, unless access to all or part of the record is restricted by state or federal law or a court order. Under Texas law, a minor may consent to certain services on their own — for example, some care related to pregnancy, sexually transmitted infections, or substance use — and those records may have additional protections.

Confidential categories. Certain information has extra protection under Texas law, such as mental health records, HIV/AIDS test results, and communications with your physician. We share this information only as those laws allow.

Your rights

To exercise any of these rights, contact our Privacy Officer using the information above.

Get a copy of your health and billing records. You may see or get a paper or electronic copy. We will respond within 30 days (15 business days for electronic records, as Texas requires) and may charge a reasonable, cost-based fee.
Ask us to correct your records. You may ask us to amend information you think is incorrect or incomplete. We may say no, but we will explain why in writing within 60 days.
Request confidential communications. You may ask us to contact you a specific way (for example, a cell phone) or at a different address. We will agree to all reasonable requests.
Ask us to limit what we use or share. You may ask us not to use or share certain information for treatment, payment, or operations. We are not required to agree, and may say no if it would affect your care.
Restrict disclosures to your health plan. If you pay for a service or item out-of-pocket in full, you may ask us not to share that information with your health insurer. We will say yes unless the law requires us to share it.
Get a list of those we've shared information with. You may ask for an accounting of disclosures for up to six years before the request, excluding those for treatment, payment, operations, and certain others. One list per year is free; we may charge a reasonable fee for additional requests within 12 months.
Get a copy of this notice. You may ask for a paper copy at any time, even if you agreed to receive it electronically.
Choose someone to act for you. If you have a medical power of attorney or a legal guardian, that person can exercise your rights. We will confirm their authority first.
Get notice of a breach. We will notify you if a breach of your unsecured information occurs.

Changes to this notice

We may change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available on request, in our office, and on our website.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the government. We will not retaliate against you for filing a complaint.

Our Privacy Officer: Carolyn Ortiz · 469-795-3311 · office@carolynsfamilyclinic.com · 3213 I 30 Frontage Rd, Ste 110, Mesquite, TX 75150.
U.S. Department of Health and Human Services, Office for Civil Rights: 200 Independence Avenue S.W., Washington, D.C. 20201 · 1-877-696-6775 · hhs.gov/ocr/complaints
Texas Attorney General, Consumer Protection Division: texasattorneygeneral.gov · 1-800-621-0508
Texas Board of Nursing (for complaints about a physician): https://www.bon.texas.gov/ · 1-512-305-7400

Acknowledgment of receipt

I acknowledge that I received Carolyn’s Family Clinic's Notice of Privacy Practices.

Patient name: ______________________ · Date: ____________

Signature (patient or legal representative): ______________________

If representative, relationship to patient: ______________________

For office use: If acknowledgment could not be obtained, describe the good-faith effort made and why: ______________________