GROTH PAIN & SPINE

PHI POLICY

NOTICE OF PRIVACY PRACTICES
Your Information. Your Rights. Our Responsibilities.
Effective date: July 21, 2026

Applies to: Timothy Groth MD PC, doing business as Groth Pain & Spine, and all practice locations, workforce members, and health care professionals covered by this notice. This notice explains how medical information about you may be used and shared and how you can get access to it. Please review it carefully.

1. Your Rights

You have the right to:

Get an electronic or paper copy of your medical record.
Ask us to correct information you believe is wrong or incomplete.
Ask us to contact you in a specific way or at a different address.
Ask us to limit certain uses or disclosures of your information.
Get a list of certain disclosures we have made.
Get a paper copy of this notice.
Choose someone to act for you.
File a complaint if you believe your privacy rights were violated.

Get a copy of your medical record: You may ask to see or receive an electronic or paper copy of your medical record and other health information we maintain about you. Ask us how to make the request. We will usually provide a copy or summary within 30 days. We may charge a reasonable, cost-based fee as permitted by law.

Ask us to correct your medical record: You may ask us to correct health information that you believe is incorrect or incomplete. We may deny the request in some circumstances, but we will explain the reason in writing, generally within 60 days.

Request confidential communications: You may ask us to contact you in a particular way—for example, only by cell phone—or to send mail to a different address. We will agree to reasonable requests.

Ask us to limit what we use or share: You may ask us not to use or share certain information for treatment, payment, or our health care operations. We generally do not have to agree, including when a restriction could affect your care. If we agree, we may still share the information if you need emergency treatment.

If you pay the full cost of a service or item yourself, you may ask us not to share information about it with your health insurer for payment or health care operations. We will agree unless a law requires us to share it.

Get a list of certain disclosures: You may ask for an accounting of certain disclosures made during the six years before your request. The list does not include disclosures for treatment, payment, or health care operations and certain other disclosures, including disclosures you authorized. One accounting in a 12-month period is free. We may charge a reasonable, cost-based fee for another accounting during the same period.

Get a copy of this notice: You may ask for a paper copy at any time, even if you agreed to receive it electronically. We will provide one promptly.

Choose someone to act for you: If someone has legal authority to act for you, such as a health care agent or legal guardian, that person may exercise your rights. We will verify the person’s authority before taking action.

File a complaint without retaliation: You may complain to us using the contact information at the end of this notice. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by visiting https://www.hhs.gov/hipaa/filing-a-complaint/, calling 1-877-696-6775, or writing to 200 Independence Avenue SW, Washington, DC 20201. We will not retaliate against you for filing a complaint.

2. Your Choices

In the situations below, you may tell us what you want us to do. We will follow your instructions when the law requires us to do so.

Share relevant information with family members, close friends, or others involved in your care or payment for your care.
Share information in a disaster-relief situation.

If you cannot tell us your preference—for example, if you are unconscious—we may share relevant information when we believe it is in your best interest. We may also share information when needed to reduce a serious and imminent threat to health or safety.
We will not use or share your information for marketing, sell your information, or share most psychotherapy notes unless you give us written authorization, except where the law permits otherwise. If we contact you for fundraising, you may tell us not to contact you again.

3. How We Typically Use and Share Your Information

Treat you
We may use your health information and share it with other professionals who are treating you. Example: A clinician treating your back injury may ask another clinician about your overall health or medications.

Run our practice
We may use and share your information to operate the practice, improve care, train staff, review quality, manage services, and contact you when necessary. Example: We may use health information to coordinate your treatment and appointments.

Bill for your services
We may use and share your information to bill and receive payment from health plans or other responsible parties. Example: We may send information to your insurer so it can process a claim.

4. Other Uses and Disclosures Allowed or Required by Law

We may use or share your information in other ways allowed or required by law. These uses and disclosures have legal conditions that we must meet.

Public health and safety. We may report disease, help with product recalls, report adverse medication reactions, report suspected abuse or neglect, or help prevent or reduce a serious threat to health or safety.
Research. We may use or share information for health research when an institutional review board or privacy board approves the research or another legal permission applies.
Compliance with law. We will share information when federal or state law requires it, including with HHS when it reviews our compliance with federal privacy law.
Organ and tissue donation. We may share information with organ-procurement organizations.
Medical examiners and funeral directors. We may share information with a coroner, medical examiner, or funeral director when a person dies.
Workers’ compensation and government requests. We may use or share information for workers’ compensation claims, health oversight, certain law-enforcement purposes, or special government functions when permitted by law.
Lawsuits and legal proceedings. We may share information in response to a court or administrative order or, when legal requirements are met, a subpoena.

5. Information Requiring Additional Protection

Federal and New York law may provide greater protection for certain information, including substance-use-disorder treatment records, HIV-related information, genetic information, and some mental-health information. When a law provides greater protection than HIPAA, we will follow the stricter law.

Substance-use-disorder records
To the extent we receive or maintain substance-use-disorder patient records protected by 42 CFR Part 2, we will not use or disclose those records in a civil, criminal, administrative, or legislative investigation or proceeding against you unless you give written consent or the disclosure is authorized by a court order and subpoena that meet applicable law. If Part 2 information would be used for fundraising, we will give you clear advance notice and a choice not to receive those communications.

6. Uses Requiring Written Authorization

Uses or disclosures not described in this notice will be made only with your written authorization unless another law permits or requires them. You may revoke an authorization in writing at any time. Revocation will not affect actions already taken in reliance on the authorization.

7. Our Responsibilities

We are required by law to protect the privacy and security of your protected health information.
We must follow the duties and privacy practices described in the notice currently in effect.
We will notify you without unreasonable delay if a breach occurs that may have compromised the privacy or security of your unsecured information, as required by law.
We will not use or share your information other than as described here unless you give us written authorization or the law permits or requires it.

8. Safeguards

We use reasonable administrative, physical, and technical safeguards designed to protect health information. These include workforce training, access controls, secure recordkeeping, risk management, and safeguards for electronic systems. No system can be guaranteed completely secure, but we regularly review our protections and respond to suspected privacy or security incidents.

9. Changes to This Notice

We may change this notice and apply the revised terms to all information we maintain, including information created or received before the change. The current notice will be available upon request, at our offices, and on our website at https://www.grothpainandspine.com/. The effective date appears at the top of the notice.

10. Service Providers and Business Associates

We may use outside companies or professionals—called business associates—to help us provide services such as billing, technology support, records storage, legal services, and practice management. When a business associate needs protected health information to perform work for us, HIPAA generally requires a written agreement that limits how the information may be used or disclosed and requires appropriate safeguards. Business associates and their subcontractors must report certain privacy or security incidents to us and help us meet applicable patient-rights and breach-notification duties. We share only the information reasonably necessary for the service, except where a different HIPAA rule applies.

11. Contact Us

Privacy contact: Privacy Officer / Director of Operations
Organization: Timothy Groth MD PC, doing business as Groth Pain & Spine
Mailing address: 1500 Middle Country Road, Centereach, NY 11720
Phone: 631-543-1440
Website: https://www.grothpainandspine.com/

PHI POLICY

Get an electronic or paper copy of your medical record.

Ask us to correct information you believe is wrong or incomplete.

Ask us to contact you in a specific way or at a different address.

Ask us to limit certain uses or disclosures of your information.

Get a list of certain disclosures we have made.

Get a paper copy of this notice.

Choose someone to act for you.

File a complaint if you believe your privacy rights were violated.

Share relevant information with family members, close friends, or others involved in your care or payment for your care.

Share information in a disaster-relief situation.

Public health and safety. We may report disease, help with product recalls, report adverse medication reactions, report suspected abuse or neglect, or help prevent or reduce a serious threat to health or safety.

Research. We may use or share information for health research when an institutional review board or privacy board approves the research or another legal permission applies.

Compliance with law. We will share information when federal or state law requires it, including with HHS when it reviews our compliance with federal privacy law.

Organ and tissue donation. We may share information with organ-procurement organizations.

Medical examiners and funeral directors. We may share information with a coroner, medical examiner, or funeral director when a person dies.

We are required by law to protect the privacy and security of your protected health information.

We must follow the duties and privacy practices described in the notice currently in effect.

We will notify you without unreasonable delay if a breach occurs that may have compromised the privacy or security of your unsecured information, as required by law.

We will not use or share your information other than as described here unless you give us written authorization or the law permits or requires it.