Infinity Spine Center PLLC

Notice of Privacy Practices

Effective date: November 8, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Infinity Spine Center PLLC is committed to protecting the privacy and security of your health information. This Notice of Privacy Practices explains how we may use and disclose your protected health information, your rights regarding that information, and our legal responsibilities under the Health Insurance Portability and Accountability Act (HIPAA) and other applicable laws.

This notice applies to health information created, received, maintained, or transmitted by Infinity Spine Center in connection with your care and related practice activities.

1. How We May Use and Disclose Your Health Information

We may use and disclose protected health information without your separate written authorization for treatment, payment, and healthcare operations, as permitted by applicable law.

Treatment

We may use your information to evaluate your condition, develop and implement your treatment plan, document care, and coordinate with other healthcare professionals.

For example, with appropriate legal authority, we may share relevant clinical findings with a physician or imaging facility involved in your care.

Payment

We may use and disclose information necessary to document services, prepare patient statements, process payments, and obtain payment for healthcare services.

Where applicable, this may include communicating with billing services, third-party payers, or other entities responsible for payment.

Healthcare Operations

We may use and disclose information for activities necessary to operate Infinity Spine Center, including:

• Maintaining and reviewing clinical records.
• Evaluating and improving the quality of care.
• Managing appointments and administrative activities.
• Maintaining billing and accounting records.
• Meeting professional licensing, legal, and regulatory obligations.
• Working with service providers who perform authorized functions on our behalf.

Service providers who handle protected health information on our behalf must meet applicable privacy and security requirements.

Other Uses and Disclosures Permitted or Required by Law

Subject to applicable legal conditions and limitations, we may use or disclose health information for:

• Public health activities, including required disease or injury reporting.
• Reporting suspected abuse, neglect, or domestic violence when authorized or required by law.
• Health oversight activities, audits, inspections, and investigations.
• Workers' compensation and other legally authorized claims.
• Court orders, subpoenas, and judicial or administrative proceedings.
• Law enforcement requests when legally permitted or required.
• Preventing or reducing a serious threat to health or safety.
• Compliance with federal or state laws.
• Certain approved or otherwise legally permitted research activities.
• Authorized activities involving medical examiners, coroners, funeral directors, or organ donation.
• Special government functions when permitted by law.

We evaluate applicable legal requirements before making these disclosures. Information subject to additional confidentiality protections will be handled according to those protections.

2. Uses and Disclosures Requiring Written Authorization

We will obtain your written authorization before using or disclosing protected health information for purposes that require authorization under applicable law.

Examples include:

• Most uses and disclosures of psychotherapy notes, if such records are maintained.
• Marketing activities requiring HIPAA authorization.
• The sale of protected health information.
• Other purposes not permitted or required by applicable law or described in this notice.

You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.

We do not sell patients' protected health information.

3. Your Choices Regarding Certain Disclosures

You may tell us your preferences about sharing information with family members, friends, caregivers, or others involved in your care or payment for your care.

We will respect your decisions as required by law.

If you are unable to communicate your preferences, we may use our professional judgment to determine whether a permitted disclosure is in your best interest.

Information may also be shared for authorized disaster-relief purposes or to address a serious threat to health or safety, subject to applicable law.

Infinity Spine Center does not currently use protected health information for fundraising. If our practices change, we will provide any required notice and opportunity to opt out.

4. Your Rights Regarding Your Health Information

You have the following rights, subject to applicable legal limitations.

Access Your Records

You may request access to or a copy of your medical records and other protected health information maintained in a designated record set.

If we maintain the information electronically, you may request an electronic copy. We will provide it in the electronic form and format you request if it is readily producible, or otherwise in a readable electronic form and format we agree on with you.

We will respond to requests for access to medical and payment records within the time limits required by applicable Arizona and federal law. The applicable deadline may depend on the nature and purpose of your request.

We may charge a reasonable, cost-based fee for copies provided to you.

Send an Electronic Copy to Someone You Choose

You may direct us to send an electronic copy of protected health information we maintain in an electronic health record to a person or entity you designate. Your request must be in writing, signed by you, and clearly identify the recipient and where to send the copy.

Fees for copies sent to a third party may differ from fees for copies provided to you, as permitted by applicable law. Other disclosures to third parties may require your written authorization.

Request Corrections

You may request an amendment to information you believe is inaccurate or incomplete.

We may deny certain requests as permitted by law, but we will explain the reason for a denial in writing, generally within 60 days.

Request Confidential Communications

You may request that we contact you through a particular telephone number, mailing address, or other communication method.

We will accommodate reasonable requests.

Request Restrictions

You may ask us to limit certain uses or disclosures of your health information for treatment, payment, or healthcare operations.

We are not generally required to agree to every requested restriction.

However, when you pay in full out of pocket for a healthcare item or service, you may request that we not disclose information relating solely to that item or service to a health plan for payment or healthcare operations. We must honor qualifying requests unless disclosure is required by law.

Receive an Accounting of Disclosures

You may request an accounting of certain disclosures of your protected health information made during the preceding six years.

Some categories of disclosure, including many disclosures for treatment, payment, and healthcare operations, are excluded from this accounting.

One accounting within a 12-month period is available without charge. Additional requests may be subject to reasonable, cost-based fees.

Obtain a Copy of This Notice

You may request a paper copy of this notice at any time, even if you previously agreed to receive it electronically.

Designate a Personal Representative

A legally authorized personal representative may exercise your privacy rights on your behalf, subject to applicable law.

We may request documentation establishing that person's authority.

File a Privacy Complaint

You may submit a complaint if you believe your privacy rights have been violated.

Infinity Spine Center will not retaliate against you for filing a complaint or exercising your privacy rights.

5. Special Protections for Substance Use Disorder Records

Certain substance use disorder treatment records are protected by additional federal confidentiality requirements under 42 CFR Part 2.

To the extent Infinity Spine Center receives or maintains records protected by Part 2, we will handle those records according to the applicable additional restrictions.

In particular, protected Part 2 records generally may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against the patient unless the applicable consent or judicial process requirements are satisfied. Where required, a court order must be accompanied by a subpoena or other legal process compelling disclosure.

Additional restrictions, consent requirements, and patient rights may apply to these records.

If we use Part 2 records for fundraising, we will provide the required advance notice and opportunity to decline fundraising communications.

6. Additional Protections Under State and Federal Law

Under Arizona law (A.R.S. § 12-2292), your medical records and payment records, and the information in them, are privileged and confidential. Unless another law provides otherwise, we may disclose them only as permitted by state or federal law, or with written authorization signed by you or your health care decision maker.

Certain categories of health information may be subject to additional privacy protections under other Arizona laws or federal laws.

When a law provides greater protection for your information than HIPAA, we will follow the applicable more protective requirement.

7. Our Legal Responsibilities

Infinity Spine Center is required to:

• Maintain the privacy and security of protected health information.
• Provide notice of our legal duties and privacy practices.
• Follow the terms of the Notice of Privacy Practices currently in effect.
• Notify affected individuals following a breach of unsecured protected health information as required by law.
• Respect patients' privacy rights under applicable federal and state laws.

We may revise this notice as our privacy practices or legal obligations change.

Revised terms may apply to protected health information we maintain, including information created or received before the revision, as permitted by law.

The current notice will be available at our office, upon request, and on our website.

8. Questions and Complaints

For questions about this notice, requests concerning your health information, or privacy complaints, contact:

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:

We will not retaliate against you for filing a complaint.

This notice is available electronically at infinityspine.com and in paper form upon request.