Notice of Privacy Practices

1. Our Legal Duty

We are required by law to maintain the privacy of your protected health information (PHI), to provide you with this Notice of our legal duties and privacy practices with respect to your health information, and to notify you following a breach of your unsecured PHI.

We are required to abide by the terms of this Notice currently in effect. We reserve the right to change the terms of this Notice and to make new provisions effective for all PHI we maintain. If we make a material change to this Notice, we will post the revised Notice prominently in our office and on our website.

This Notice applies to RDC Special Needs Pros and all workforce members, including Dr. Oscar Suarez-Sanchez, clinical staff, administrative personnel, students, and volunteers.

2. How We May Use and Disclose Your Health Information

We use and disclose your PHI for the following purposes without your written authorization:

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your dental and prosthodontic care. For example, we may share your diagnostic records, radiographs, or laboratory work orders with external oral surgeons, dental laboratories, or specialists involved in fabricating your prosthetic restorations (crowns, bridges, implants, dentures).

Payment

We may use and disclose your PHI to obtain payment for services, including verifying insurance eligibility, submitting claims, and billing activities. We may disclose information to your health plan about treatment you received or are scheduled to receive.

Healthcare Operations

We may use and disclose your PHI for administrative, financial, legal, and quality improvement activities necessary to operate this practice, including workforce training, compliance audits, and accreditation activities.

Patient Restriction Right

If you have paid for a service out-of-pocket in full, you have the right to request that we restrict disclosure of PHI related to that service to your health plan. We are required to honor such a request.

3. Uses and Disclosures Requiring Your Written Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes other than Treatment, Payment, or Healthcare Operations, including:

• Most disclosures of psychotherapy notes
• Marketing communications
• Sale of your PHI
• Any other use or disclosure not described in this Notice

You may revoke any authorization you have given us at any time in writing. Your revocation will not affect uses or disclosures already made in reliance on your prior authorization.

4. Permitted Disclosures Under Federal and North Carolina Law

We may be required or permitted to disclose your PHI without your authorization in the following circumstances:

• Required by Law: Disclosures required by federal, state, or local law, including court orders and subpoenas.
• Public Health Activities: Reporting communicable diseases or conditions to the North Carolina Division of Public Health.
• Mandatory State Reporting: Under North Carolina law (N.C.G.S. § 130A et seq.), certain conditions must be reported to local health directors, including animal bite incidents within 24 hours and vision impairment within 30 days.
• Abuse, Neglect, or Domestic Violence: Reporting to appropriate government authorities as required by law.
• Workers' Compensation: Disclosures to comply with workers' compensation laws.
• Law Enforcement: Disclosures to law enforcement officials in specific circumstances permitted by law.
• Judicial and Administrative Proceedings: In response to a lawful court order or subpoena.
• Health Oversight: Disclosures to the North Carolina State Board of Dental Examiners (NCBDE) or other agencies for legally authorized oversight activities.
• Serious Threats to Health or Safety: To prevent or lessen a serious and imminent threat.

Special Note: Substance use treatment records, HIV-related information, and mental health records receive additional confidentiality protections under applicable state and federal law. Such records will not be shared for civil or criminal proceedings without your written consent or a court order.

5. Your Rights Regarding Your Health Information

Right to Access

You have the right to inspect and obtain a copy of your PHI maintained in a designated record set. Requests must be submitted in writing. Under North Carolina law (G.S. § 90-411), copying fees are limited to $0.75/page for the first 25 pages, $0.50/page for pages 26–100, and $0.25/page thereafter (minimum fee up to $10.00 may apply). We are required to fulfill your request within 30 days regardless of any outstanding balance for dental services.

Right to Request Amendment

You have the right to request an amendment to your PHI if you believe it is inaccurate or incomplete. We may deny your request under certain circumstances.

Right to an Accounting of Disclosures

You have the right to receive a list of certain disclosures of your PHI made by us in the prior six years, other than disclosures for Treatment, Payment, Healthcare Operations, or disclosures you authorized.

Right to Request Restrictions

You have the right to request restrictions on how we use or disclose your PHI for Treatment, Payment, or Healthcare Operations. We are not required to agree to all restrictions, except as noted in Section 2 (out-of-pocket payments).

Right to Request Confidential Communications

You have the right to request that we communicate with you about your health information by alternative means or at alternative locations (e.g., only by mail to a P.O. box).

Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time, even if you have agreed to receive it electronically. Please contact us to request a copy.

Right to Notification of Breach

You have the right to receive notification in the event of a breach of your unsecured PHI, as required by the HITECH Act and North Carolina law. We will notify you without unreasonable delay and no later than 60 days after discovery of the breach.

6. North Carolina Identity Theft Protection Act

In addition to HIPAA, this practice complies with the North Carolina Identity Theft Protection Act (N.C.G.S. § 75-60 et seq.). This state law governs the collection, use, and disposal of personal information — including your name in combination with financial account data, Social Security numbers, or government identification numbers — that we collect in connection with high-value restorative procedures and insurance billing.

We maintain a written identity theft prevention program and implement reasonable security measures to protect your personal and financial information from unauthorized access. In the event of a security breach involving your unencrypted personal information, we will notify you in accordance with North Carolina state law in addition to our federal HIPAA obligations.

7. Teledentistry and Virtual Consultations

This practice may provide dental consultations using electronic or digital means as authorized under N.C.G.S. § 90-30.2. Records of teledentistry services are held to the same record retention standards as in-person encounters. Your informed consent will be obtained before any teledentistry services are provided. All virtual consultations are conducted using HIPAA-compliant platforms with appropriate Business Associate Agreements in place.

8. Record Retention

We retain your health information in accordance with applicable law:

9. How to Exercise Your Rights or File a Complaint

To exercise any of your rights or to obtain more information about our privacy practices, please contact:

You also have the right to file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights:

For state-level concerns, you may also contact:

We will not retaliate against you for filing a complaint.