Notice of Privacy Practices and Website Privacy Statement

Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

Effective Date: September 15, 2025

 

This joint Notice of Privacy Practices (“Notice”) applies to the following organizations:

Avance Care P.A. (“Avance Care”), FastMed P.C., and FastMed Primary Care P.C. along with their respective affiliated practices and individual providers, participate in an Organized Health Care Arrangement (OHCA) to provide coordinated, high-quality care across our respective networks. An OHCA is a clinically integrated setting in which individuals may receive care from more than one health care provider or an organized system of healthcare in which more than one healthcare provider participates.

These providers include their employees, staff, trainees, personnel, volunteers, students, and other healthcare professionals. Both of these entities, their sites, and locations follow the terms of this Notice. In addition, these entities, sites, and locations may share your health information with each other for treatment, payment, and/or healthcare operations as described by this Notice.

Collectively, these entities will be referred to as “we” or “us” in this Notice. We may share medical information with each other for treatment, payment, and operational purposes. The law allows us to do so to provide efficient healthcare services. Moreover, certain healthcare providers within this arrangement may participate in clinically integrated networks for purposes of joint utilization review, quality assessment and improvement, or payment activities, and those providers may share medical information with the network participants as necessary to carry out the joint activities of the network.

Important Disclaimer

The above providers are giving you this joint Notice. Each provider in this joint Notice is its own healthcare provider. Each provider is individually responsible for its own activities. This includes complying with privacy laws and all the healthcare services it provides. We do not provide healthcare services mutually or on each other’s behalf. We may share health information as allowed by law.

WE HAVE A LEGAL DUTY TO PROTECT HEALTH INFORMATION ABOUT YOU.

We are required by law to protect the privacy and confidentiality of PHI. We are required to explain how we may use PHI about you and when we may give out PHI to others. You have rights regarding PHI about you as described in this Notice. We are required to follow the procedures in this Notice. We have the right to change our privacy practices and to make new Notice provisions effective for all PHI that we maintain by posting the revised notice at our location, making copies of the revised notice available upon request, and posting the revised notice on our website.

You may have additional rights under other applicable state or federal law. Applicable state or federal laws that provide greater privacy protection or broader privacy rights will continue to apply and we will comply with such laws to the extent they are applicable.

HOW WE USE OR DISCLOSE PROTECTED HEALTH INFORMATION.

We access, use, and disclose PHI for a variety of reasons, as permitted or required by federal or state law, including the Health Insurance Portability and Accountability Act (HIPAA). These purposes include treatment, payment, and health care operations; with your written permission; pursuant to a court order; or as otherwise permitted by law.

In addition to federal protections, North Carolina law provides enhanced privacy safeguards, including protections for your relationship with your health care provider and if applicable, your mental health provider. Other applicable laws governing sensitive information (including behavioral health information, drug and alcohol treatment information, and HIV status) may further limit these uses and disclosures.

The following includes descriptions and examples of our potential uses and disclosures of your PHI as allowed under State and Federal law. Please note that not every potential use and disclosure will be listed in this Notice, but all the ways we may use or disclose your PHI will fall within one of the categories below.

Health Information Exchange. We participate in several electronic Health Information Exchanges (HIEs), including NC HealthConnex, Epic’s Care Everywhere, and Carequality. These exchanges allow your treatment providers to securely access your medical information when needed, especially in emergencies or when you see a new provider. Unless you direct otherwise, your health information is shared and accessible to other participating providers through these exchanges. You have the right to opt out of these exchanges, to the extent permitted by law and payer or network requirements. Opting out of any HIE will not affect your ability to receive care from us or our affiliated providers. However, it may limit the ability of other providers to access your medical history quickly, especially in urgent situations.

NC HealthConnex 

NC HealthConnex is North Carolina’s statewide HIE that links your medical records from different providers into a single electronic health record. It helps providers make informed decisions, especially in emergencies or when coordinating care across multiple settings.

You may opt-out of NC HealthConnex by submitting a sign “Opt-Out Form” to the NC Health Information Exchange Authority (NC HIEA).

Important: We cannot submit this form on your behalf. This is because NC HIEA requires opt-out requests to come directly from the patient to ensure proper identity verification and consent.

Opting out prevents providers from viewing your data in NC HealthConnex but does not stop providers from submitting data if they are required to do so by law (e.g. Medicaid-funded services).

You may opt back in at any time by submitting a new form to NC HealthConnex.

Form(s) and instructions can be found here: NC HIEA Opt-Out Info.

Epic’s Care Everywhere

Care Everywhere is Epic’s built-in HIE that allows providers using Epic’s electronic health record (EHR) system to securely share your health information across organizations. This includes hospitals, specialists, and other providers in your care.

You may opt out of sharing and/or receiving your health information through Care Everywhere by sending an email request to:  [email protected] or [email protected]. Please include your full legal name and contact information in the email message.

Please note:

  • By opting out of the Care Everywhere exchange for one participating organization, you are opting out for all organizations within this OHCA. Opting out may delay access to your records in emergencies or when seeing new providers.
  • You may opt back in at any time by submitting a request to the medical records email listed above.

Carequality – Carequality is a national interoperability framework that connects multiple HIEs and EHR networks. It allows providers across different systems to securely exchange patient data.

You may opt out of sharing and/or receiving your health information through Care Everywhere by sending an email request to: [email protected] or [email protected]. Please include your full legal name and contact information in the email message.

Please note:

  • By opting out of the Care Everywhere exchange for one participating organization, you are opting out for all organizations within this OHCA.
  • Opting out may delay access to your records in emergencies or when seeing new providers.
  • You may opt back in at any time by submitting a request to the medical records email listed above.

Treatment. We may use or disclose your PHI to provide medical treatment or services to you to manage and coordinate your medical care. For example, we may use and disclose PHI about you when you need a prescription, lab work, an x-ray, or other health care services. In addition, we may use and disclose PHI about you when referring you to another health care provider.

Payment. We may use or disclose your PHI to obtain payment for your health care services. For example, we may provide your health plan with PHI that it needs before it can pay us for services we provided to you. Your health plan may also require us to share information with them to determine whether you are eligible for benefits.

Health Care Operations. We may use and disclose your PHI to manage, operate, and support the business activities of our practice. This includes, but is not limited to, licensing, quality assessment, business planning, and administrative activities. For example, we may combine outcome data from many patients to evaluate the need for new products, services or treatments. We may disclose information to health care professionals, students and other personnel for review and training purposes. We may also combine the health information we have with other sources to see where we can make improvements. We may remove information that identifies you from this set of health information to protect your privacy and to allow others to use the information to study health care without learning the identity of specific residents. We may also use and disclose medical information to evaluate the performance of our staff and your satisfaction with our services.

Minors. Under North Carolina law, minors – whether or not their parent or guardian consents – may receive confidential treatment for certain conditions, including venereal diseases and other reportable communicable diseases, pregnancy-related care, substance or alcohol abuse, and emotional disturbances. Minors under 18 who are unmarried, not legally emancipated, and not enlisted in the military may consent to such treatment without adult involvement. Information about these services will remain confidential unless:

  • Disclosure is required by law (e.g. suspected child abuse or neglect).
  • A provider determines that informing a parent or guardian is necessary to prevent serious harm.
  • A parent or guardian explicitly requests access to information and disclosure is legally permissible.

PHI about minors will generally be available to parents or legal guardians acting as personal representatives, unless doing so violates confidentiality protections granted under state or federal law.

As Required by Law and Legal Proceedings. We will use or disclose your PHI when required to do so by applicable law. For example, we may share your PHI when required to report suspected child abuse. We may use and disclose your PHI in response to court or administrative orders, subpoena, discovery request or other lawful process.

Abuse, Neglect, or Domestic Violence. We may disclose your health information to appropriate authorities if we reasonably believe that you are a possible victim of abuse, neglect, or domestic violence. For example, if we believe that a patient has been or is currently the victim of abuse, neglect, or domestic violence and the patient agrees to the disclosure, or we are otherwise permitted or required by law to do so.

Law Enforcement. We may use and disclose PHI about you as required by federal, state and local laws. For example, we may disclose certain PHI if asked to do so by a law enforcement official in circumstances such as:

  • In response to a court order, subpoena, warrant, summons or similar process.
  • To identify or locate a suspect, fugitive, material witness or missing person.
  • About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement.
  • About a death we believe may be the result of criminal conduct.
  • About criminal conduct in the facility; and
  • In emergency circumstances to report a crime; the location of a crime or victims; or the identity, description or location of the person who committed the crime.

To Avert a Serious and Imminent Threat of Harm. Consistent with applicable law and our ethical standards, we may disclose PHI to law enforcement or other persons who can reasonably prevent or lessen the threat of harm in order to avoid a serious and imminent threat to the health or safety of an individual or the public. For example, the law may require such disclosure when an individual or group has been specifically identified as the target or potential victim of a threat.

Public Health. We may share PHI about you for certain public health activities, such as:

  • Preventing disease.
  • For the purpose of activities related to the quality, safety or effectiveness of such FDA-regulated product or activity.
  • Helping with product recalls.
  • Reporting adverse reactions to medications
  • Reporting a person who may have been exposed to a disease or may be at risk of contracting and/or spreading a disease or condition; and
  • Releasing proof of immunization for students without an authorization if you have agreed to the disclosure on behalf of yourself or your dependent.

Coroners, Medical Examiners, or Funeral Directors. We may disclose PHI to a coroner, medical examiner, or funeral director as necessary for them to carry out their duties, in accordance with applicable laws. For example, we may disclose PHI to a coroner for purposes of identifying a deceased person.

Organ and Tissue Donation Requests. We may share PHI about you with organ procurement organizations or other similar entities. If you are an organ or tissue donor, we may use or disclose health information about you to organizations that help with organ, eye and tissue donation and transplantation.

Health Oversight Activities. We may disclose your PHI to a health oversight agency for audits, investigations, inspections, licensures, and other activities authorized by law. For example, we may share your PHI with governmental units that oversee or monitor the health care system, government benefit and regulatory programs, and compliance with civil rights laws.

Research. We may use or share your PHI under certain circumstances. For example, we may disclose PHI to a research organization if an institutional review board or privacy board has reviewed and approved the research proposal, after establishing protocols to ensure the privacy of your health information.

Military, National Security, and other Specialized Government Functions and Activities. We may disclose PHI to military authorities under certain circumstances. For example, we may disclose your PHI, if you are in the Armed Forces, for activities deemed necessary by appropriate military command authorities for determination of benefit eligibility by the Department of Veterans Affairs or to foreign military authorities if you are a member of that foreign military service. We may disclose your PHI to authorized federal officials for conducting national security and intelligence activities or special investigations (including for the provision of protective services to the President of the United States, other authorized persons, or foreign heads of state) or to the Department of State to make medical suitability determinations.

Business Associates. On some occasions we may share your PHI with a business associate, such as a consultant, cloud service provider, or other vendor. For example, while we are providing you with health care services, we may share your PHI with business associates to help us perform services related to billing, administrative support or data analysis. These business associates are required by HIPAA to protect your PHI. We may also share your PHI with a Business Associate who will remove information that identifies you so that the remaining information can be used or disclosed for purposes outside of this Notice.

Appointment Reminders. We may use your PHI to provide appointment reminders. We may contact you by mail, e-mail, or telephone. We may use the telephone number(s) you provide to leave voice messages or send text messages.

YOU HAVE THE RIGHT TO OBJECT TO CERTAIN USES AND DISCLOSURES OF PHI AND, UNLESS YOU OBJECT, WE MAY USE OR DISCLOSE PHI IN THE FOLLOWING CIRCUMSTANCES.

To families, friends or others involved in your care. We may share with a family member, relative, friend or other person identified by you, PHI directly related to that person’s involvement in your care or payment for your care. We may share with a family member, personal representative or other person responsible for your care PHI necessary to notify such individuals of your location, general condition or death. We may share your PHI with these persons if you are present or available before we share your PHI with them and you do not object to our sharing your PHI with them, or we reasonably believe that you would not object to such sharing. If you are not present, and certain circumstances indicate to us that it would be in your best interest to do so, we will share information with a friend or family member or someone else identified by you, to the extent necessary. This could include sharing information with your family or friend so that they could pick up a prescription for you. If you wish to object to this use or update the persons you have identified for this use or disclosure of your PHI, please use the information under the “Contacting Us” section of this Notice.
Disaster relief. In the event of a disaster, we may release your PHI to a public or private relief agency, for purposes of notifying your family and friends of your location, condition or death. Whenever possible, we will provide you with an opportunity to agree or object.
Fundraising. We may use certain information (name, address, telephone number or e-mail information, age, date of birth, gender, health insurance status, dates of service, department of service information, treating physician information or outcome information) to contact you for the purpose of raising money and you will have the right to opt out of receiving such communications with each solicitation. For example, you may receive a letter from us asking for a donation to support enhanced patient care, treatment, education or research. If you have opted out, HIPAA prohibits us from making fundraising communication.
ANY OTHER USE OR DISCLOSURE OF PHI ABOUT YOU REQUIRES YOUR WRITTEN AUTHORIZATION.

We are only permitted to use and/or disclose your PHI as listed below if we obtain your written authorization. In addition, other uses and disclosures that are not described in this Notice may only be made with your authorization. If you provide us with an authorization, you may revoke your authorization at any time by submitting a request in writing. Revocation does not apply to PHI that has already been used or disclosed with your permission. You understand that we are required to retain your health records of the care that we provide to you. You can obtain an authorization form from us upon request.

Psychotherapy Notes. Unless we obtain your written authorization, in most circumstances we will not disclose your psychotherapy notes. Some circumstances in which we will disclose your psychotherapy notes include the following: for your continued treatment; training of medical students and staff; to defend ourselves during litigation; if the law requires; health oversight activities regarding your psychotherapist; to avert a serious or imminent threat to yourself or others; and to the coroner or medical examiner upon your death.
Substance Use Disorder Treatment Records. We will not share any substance use disorder treatment records without your written authorization unless permitted or otherwise required by law. For more information, please see SPECIAL CONFIDENTIALITY PROTECTIONS FOR TREATMENT RECORDS FROM SUBSTANCE ABUSE DISORDER PROGRAMS described below.
Marketing Health-Related Services. We will not use your health information for marketing purposes unless we have your written authorization to do so. We are required to obtain an authorization for marketing purposes if communication about a product or service is provided and we receive financial remuneration (getting paid in exchange for making the communication). No authorization is required if communication is made face-to-face or for promotional gifts.
Sale of PHI. We are not allowed to disclose PHI without authorization if it constitutes remuneration (getting paid in exchange for the PHI). Any activity constituting a sale of your Protected Health Information will require your prior written authorization. “Sale of PHI” does not include disclosures for public health, certain research purposes, treatment and payment, and for any other purpose permitted by HIPAA, where the only remuneration received is “a reasonable cost-based fee” to cover the cost to prepare and transmit the PHI for such purpose or a fee otherwise expressly permitted by law. Corporate transactions (i.e., sale, transfer, merger, consolidation) are also excluded from the definition of “sale.”

YOU HAVE SEVERAL RIGHTS REGARDING YOUR PHI.

You have the following rights regarding the health information we maintain about you:

Right to Request Restrictions. You have the right to request a restriction or limitation on the PHI about you that we use or disclose. Your request must be in writing to the Privacy Officer at the address listed below. If you have paid in full for a service and have requested that we not share PHI related to that service with a health plan, we must agree to the request. For any other request to limit how we use or disclose your PHI, we will consider your request, but are not required to agree to the restriction. If we agree to your request for a restriction, we will comply with it unless the information is needed for emergency treatment.

  • Right to Request Alternative Method of Contact. You have the right to request that we communicate with you about confidential medical matters in a certain way or at a certain location. Your request must be in writing to the Privacy Officer at the address listed below. We will agree to the request to the extent that it is reasonable for us to do so. For example, you may request an alternative address for billing purposes.
  • Right to an Accounting of Disclosures. You have the right to request an “accounting of disclosures” of your PHI of certain disclosures of your health information during the past six years. We will provide one accounting of disclosures a year at no charge, but will charge a reasonable, cost-based fee if another accounting of disclosures is requested within 12 months. To request this list or accounting of disclosures, you must submit your request in writing to our Privacy Officer at the address listed below.
  • Right to Access, Inspect, and Copy. You have the right to inspect and/or obtain a copy of PHI that may be used to make decisions about your care. This includes medical and billing records but does not include psychotherapy or Substance Use Disorder (SUD) counseling notes.. To request access to your records, you must complete a written authorization for the release of your PHI and submit it to the Medical Records Department of the provider who maintains your records. Please note that this request should not be sent to the Privacy Office, as the Privacy Office does not process medical record requests. If you request a copy of your PHI, we may charge you a reasonable fee to cover the costs associated with copying and mailing the information. If you request an electronic copy of your PHI that we maintain electronically, we will provide an electronic copy, and will do so in the electronic form or format you requested if the PHI is readily producible in that form or format. In certain very limited circumstances, we may deny your request to inspect and copy your health information. If you are denied access to your medical information, we will document our reasons in writing and explain any right to have the denial reviewed.
  • Right to Amend. If you feel that certain PHI we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for our practice. To request an amendment, your request must be made in writing and submitted to the Privacy Officer at the address listed below. You must provide a reason that supports your request. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:Was not created by us, unless the person or entity that created the information is no longer available to make the amendment.
    Is not part of the medical information kept by or for our practice.
    Is not part of the information which you would be permitted to inspect and copy; or
    Is accurate and complete.
    Examples of amendment requests we will not approve include:

    • Requests to change a diagnosis made by a licensed provider if the diagnosis was clinically supported at the time.
    • Requests to remove documentation of symptoms, behaviors, or test results that were observed or recorded during your visit.
    • Requests to alter provider notes or clinical impressions that reflect professional judgment.
    • Requests to revise billing codes or insurance documentation that were submitted based on services rendered.If your request for an amendment is denied, we will explain our reasons in writing. You have the right to submit a statement explaining why you disagree with our decision to deny your amendment request. We will include your statement whenever we disclose the relevant PHI.
  • Paper or Electronic Copy. If you agreed to receive this Notice electronically, you have the right to obtain a paper copy of this Notice from us upon request.
    Breach Notification Requirements. We are required by law to notify you following a breach of your unsecured PHI. We will give you written notice in the event we learn of any unauthorized use of your PHI that has not otherwise been properly secured as required by HIPAA. You will be notified of the situation and any steps you should take to protect yourself against harm due to the breach.
    CHANGES TO THIS NOTICE.

We reserve the right to make any changes in our Notice, and the new terms of our Notice are effective for all PHI maintained, created and/or received by us before the date changes were made. Before we make a significant change, this Notice will be amended to reflect the changes, and we will make the new Notice available in our office and on our website.

COMPLAINTS.

If at any time you believe your privacy rights have been violated and you would like to register a complaint, you may do so with us or with the Secretary of the United States Department of Health and Human Services. If you file a complaint, we will not take action against you or change our treatment of you in any way.

If you wish to file a complaint with us, please submit it in writing to the Privacy Officer of your treating organization as listed below:

AVANCE CARE: [email protected]; or Avance Care, Attn: Privacy Officer | 4705 University Dr, Bldg 700, Durham, NC 27707

FASTMED and FASTMED PRIMARY CARE: [email protected]; or FastMed, Attn: Privacy Officer | P.O. Box 271, Durham, NC 27702

If you wish to file a complaint with the Secretary of the United States Department of Health and Human Services, please go to the website of the Office for Civil Rights (www.hhs.gov/ocr/hipaa/), call 202-619-0257 (toll free 877-696-6775), or mail to:

Secretary of the US – Department of Health and Human Services
200 Independence Ave S.W.
Washington, D.C. 20201

To file a complaint with the Secretary, you must 1). name the clinic location or person that you believe violated your privacy rights and describe how that place or person violated your privacy rights; and 2). file the complaint within 180 days of when you knew or should have known that the violation occurred.

NOTICE OF NON-DISCRIMINATION.

We comply with applicable Federal civil rights laws and do not discriminate on the basis of race, color, national origin, age, disability, or sex.

SPECIAL CONFIDENTIALITY PROTECTIONS FOR TREATMENT RECORDS FROM SUBSTANCE ABUSE DISORDER PROGRAMS

Records related to your treatment for substance use disorders are protected under federal law, specifically 42 CFR Part 2, which provides enhanced confidentiality safeguards. Under this regulation, we may not disclose any information that identifies you as receiving substance use disorder treatment – including diagnosis, referral, or attendance – without your written consent, except in limited circumstances as permitted by law, described further below. These protections apply even more strictly than HIPAA and are designed to encourage individuals to seek treatment without fear of stigma or discrimination. You have the right to revoke your consent at any time, and any unauthorized redisclosure of this information is strictly prohibited under federal law.

You should also know:

1. A violation of the federal law and regulations governing drug or alcohol use may be a crime. Suspected violations may be reported to the United States Attorney at 617-748-3100.

2. As mentioned above, there are certain limited circumstances under which substance use disorder disclosures can be made without patient consent, by law. The circumstances include but are not limited to:

  •  Medical Emergencies. Patient identifying information is permitted to be disclosed to medical personnel who have a need for information about a patient for the purpose of treating a condition which poses an immediate threat to the health of any individual and which required immediate medical intervention.
  • Subpoena and court—ordered disclosures. Programs are permitted to release patient identifying information in response to a subpoena ONLY IF the patient signs a consent permitting release of the information requested in the subpoena. If the patient does not consent, programs are prohibited from releasing information in response to a subpoena unless a court has issued an order that complies with the law.
  •  Child or elder person abuse or neglect reporting. Programs are permitted to release patient identifying information in order to comply with state laws that require the reporting of child or elder person abuse and neglect.
  •  Crimes on program premises or against program personnel. Programs are permitted to disclose limited patient identifying information to law enforcement officers.
  • Qualified Service Organization. Programs are permitted to disclose patient identifying information to a QSO.
  • Research activities. Programs are permitted to allow a researcher to have access to its patients’ records, provided certain safeguards are met.
  • Audit or evaluation activities. Programs are permitted to disclose patient identifying information to qualified persons who are conducting an audit or evaluation of the program, without patient consent, provided certain safeguards are met.
    Patient’s intent to harm self or others, patient does not have the capacity to care for self, or patient is considered by a court to be “incompetent” to manage himself or herself. Programs are permitted to disclose limited patient identifying information to law enforcement officers or emergency medical systems.

CONTACTING US.

We are required by law to provide individuals with this Notice of our legal responsibilities and privacy practices with respect to Protected Health Information. We are also required to maintain and implement safeguards to maintain the privacy of PHI, and abide by, the terms of the Notice currently in effect. If you have questions about your privacy rights, wish to exercise any of the rights as described in this Notice, or need assistance with opting out of a Health Information Exchange, please contact the organization that directly provides your care. Each organization is responsible for its own privacy practices and cannot act on behalf of the other. For example, if your provider is with Avance Care, please reach out to Avance Care directly. If your provider is with FastMed, please contact FastMed. This ensures your request is handled appropriately and in accordance with applicable laws.

AVANCE CARE: [email protected]; or Avance Care Attn: Privacy Officer, 4705 University Dr, Bldg 700, Durham, NC 27707

FASTMED and FASTMED PRIMARY CARE: [email protected]; or FastMed Attn: Privacy Officer, P.O. Box 271,Durham, NC 27702

 

 

 

Don't delay the care you need.

Most practices open 7-days a week with same-day appointments.