Legal

HIPAA Notice of Privacy Practices

At TeleTonicMD, protecting the privacy of your health information is fundamental to the care we provide. This Notice explains how your medical information may be used and disclosed, and how you can access that information, under the federal Health Insurance Portability and Accountability Act (HIPAA) and other applicable law.

Who This Notice Applies To

TeleTonicMD — the concierge primary care practice of Dr. Azka Afzal, M.D. ("we," "our," or "us") — is required by law to protect the privacy of your protected health information. This Notice applies to all protected health information we create or receive in the course of providing your care, whether through virtual (telehealth) visits, in-home visits, secure messaging, or our patient portal.

Protected Health Information

"Protected health information" (PHI) is individually identifiable information about your health, your health care, or payment for your health care. It includes information such as your medical history, symptoms, diagnoses, laboratory and diagnostic results, medications, treatment plans, and your demographic, contact, and insurance information. We are committed to keeping this information confidential and secure.

How We May Use and Disclose Your Health Information

The categories below describe the ways we may use and disclose your PHI without your written authorization. Not every use or disclosure is listed, but every use and disclosure we make will fall within one of these categories.

Treatment

We use and disclose your PHI to provide, coordinate, and manage your health care. For example, we may share your information with a specialist, pharmacy, laboratory, imaging center, or another provider involved in your care, or use it to prescribe medication and develop your treatment plan.

Payment

We may use and disclose your PHI to obtain payment for the services we provide — for example, to bill you, to verify Medicare or other coverage, or to process a payment for a Direct Primary Care membership plan.

Health Care Operations

We may use and disclose your PHI for the operations of our practice — for example, quality assessment and improvement, care coordination, reviewing the competence and qualifications of our providers, and general business and administrative activities.

Appointment Reminders and Health-Related Communications

We may contact you to remind you of an appointment, or to tell you about or recommend treatment options, health-related benefits, or services that may be of interest to you.

Individuals Involved in Your Care

With your agreement — or, when you are not present or able to agree, using our professional judgment — we may disclose relevant PHI to a family member, friend, or other person you identify as being involved in your care or in payment for your care.

Other Uses and Disclosures Permitted or Required by Law

We may use or disclose your PHI without your authorization in the following circumstances, to the extent permitted or required by law:

• As required by law — when federal, state, or local law requires the use or disclosure.
• Public health activities — to public health authorities to prevent or control disease, report vital events, or report adverse events and product recalls.
• Health oversight activities — to oversight agencies for audits, investigations, inspections, and licensure.
• Abuse, neglect, or domestic violence — to report as permitted or required by law.
• Judicial and administrative proceedings — in response to a court order, subpoena, or other lawful process.
• Law enforcement — for limited purposes as permitted by law.
• To avert a serious threat — when necessary to prevent a serious and imminent threat to your health or safety or that of the public.
• Workers' compensation — as authorized by and necessary to comply with workers' compensation laws.
• Coroners, medical examiners, funeral directors, and organ or tissue donation — as authorized by law.
• Research — subject to special approvals and privacy protections.
• Specialized government functions — such as military and veterans' activities, national security, and protective services, as authorized by law.

Uses and Disclosures That Require Your Written Authorization

Uses and disclosures of your PHI other than those described in this Notice will be made only with your written authorization. In particular, the following always require your authorization:

• Most uses and disclosures of psychotherapy notes, where applicable;
• Uses and disclosures of your PHI for marketing purposes; and
• Disclosures that would constitute a sale of your PHI.

You may revoke your authorization in writing at any time, except to the extent we have already acted in reliance on it. We will never sell your health information.

More-Protective State and Federal Law

Certain information — such as records relating to mental health and developmental disabilities, substance use, HIV/AIDS, and genetic information — receives special protection under Illinois and other applicable law. Where state or federal law is more protective of your privacy than HIPAA, we follow the more protective standard.

Your Rights Regarding Your Health Information

You have the following rights with respect to your PHI. To exercise any of these rights, please contact our Privacy Officer using the information at the end of this Notice.

Inspect and Copy

You have the right to inspect and obtain a copy of the PHI we maintain about you, including an electronic copy of information we keep electronically. We may charge a reasonable, cost-based fee for copies.

Request an Amendment

If you believe PHI we have about you is incorrect or incomplete, you may ask us to amend it. We may deny your request in certain circumstances, and if we do, we will explain the denial in writing and tell you how to respond.

Accounting of Disclosures

You have the right to request a list of certain disclosures we have made of your PHI, other than disclosures made for treatment, payment, health care operations, and certain other purposes permitted by law.

Request Restrictions

You may request a restriction on how we use or disclose your PHI for treatment, payment, or health care operations. We are not required to agree to every request. However, if you pay in full, out of pocket, for a service, you may request that we not disclose the PHI relating solely to that service to your health plan, and we will honor that request except where the disclosure is otherwise required by law.

Confidential Communications

You may request that we communicate with you about medical matters in a certain way or at a certain location — for example, by a specific phone number or email address. We will accommodate all reasonable requests.

Paper Copy of This Notice

You have the right to receive a paper copy of this Notice upon request, even if you have agreed to receive it electronically.

Breach Notification

You have the right to be notified in the event of a breach of your unsecured PHI.

Our Responsibilities

• We are required by law to maintain the privacy and security of your PHI.
• We are required to provide you with this Notice of our legal duties and privacy practices with respect to your PHI.
• We will notify you promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must abide by the terms of the Notice that is currently in effect.
• We will not use or disclose your PHI other than as described here unless you tell us we may in writing — and you may change your mind at any time by notifying us in writing.

Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have as well as any information we receive in the future. The current Notice will always be posted at www.teletonicmd.com/hipaa-policy.html, with its effective date shown at the top. You may request a paper copy at any time.

How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

Questions and Contact

If you have any questions about this Notice or would like more information about our privacy practices, please contact our Privacy Officer at (312) 771-7729 or admin@teletonicmd.com.

Effective date: July 1, 2025.