Alderon Medical · HIPAA Privacy
Notice of Privacy Practices
This Notice of Privacy Practices explains how medical information about you may be used and disclosed, the rights you have regarding your health information, and the responsibilities Alderon Medical has for protecting that information. Please review it carefully.
This Notice of Privacy Practices describes Alderon Medical’s privacy practices concerning protected health information. It is different from the website Privacy Policy , which primarily addresses information associated with use of Alderon’s public website and its nonclinical patient-interest and professional-interest workflows. Do not submit PHI through those public forms. When clinical enrollment opens, Alderon plans to use its designated secure Elation patient-care workflow for clinical onboarding and the medical record.
When Alderon begins providing care, the practice will ask patients to acknowledge receipt of this Notice as required by HIPAA. Signing an acknowledgement confirms receipt of the Notice; it does not authorize special uses or disclosures of health information. If a patient declines to sign, Alderon may document that the acknowledgement was not obtained.
Who This Notice Covers
This Notice applies to protected health information created, received, maintained, or transmitted in connection with healthcare services provided by SMPA Medical One, LLC, doing business as Alderon Medical, when the information is subject to the HIPAA Privacy Rule.
Alderon may use workforce members, contractors, technology vendors, laboratories, pharmacies, healthcare professionals, business associates, and other organizations in connection with your care and practice operations. Their handling of health information is governed by applicable law and, when required, appropriate contractual safeguards.
Electronic systems and business associates
Alderon may use electronic health record, patient portal, telehealth, clinical-intake, payment, laboratory, pharmacy, imaging, referral, and other service providers to support patient care and practice operations. Alderon plans to use Elation Health for its electronic health record, patient-facing portal, and secure clinical onboarding workflow.
When a service provider creates, receives, maintains, or transmits protected health information on Alderon’s behalf as a HIPAA business associate, Alderon will require the written contractual safeguards required by applicable law before using that service for PHI.
This Notice may be supplemented by state-specific or service-specific privacy notices when another law provides additional protections or requirements.
Your Rights
You have important rights regarding health information that Alderon maintains about you. Some rights are subject to conditions, exceptions, and verification requirements established by law.
Get a copy of your health information
You may request access to or a paper or electronic copy of health information in a designated record set that you are entitled to access. When available, certain information may also be accessible through Alderon’s designated patient portal. Portal access does not limit your HIPAA right to request access. We generally respond within the timeframe required by law and may charge a lawful, reasonable cost-based fee.
Ask us to correct information
You may ask us to amend health information you believe is inaccurate or incomplete. We may deny certain requests as permitted by law, but if we do, we will explain the decision in writing within the required timeframe.
Request confidential communications
You may ask us to contact you in a particular way or at an alternative location. Alderon will accommodate reasonable requests as required by law.
Ask us to limit certain uses or disclosures
You may request restrictions on certain uses or disclosures for treatment, payment, or healthcare operations. We are not always required to agree.
Restrict disclosure to a health plan
If you pay out-of-pocket in full for a healthcare item or service, you may ask us not to disclose information about that item or service to your health plan for payment or healthcare operations. We will honor a qualifying request unless disclosure is required by law.
Ask for certain disclosure information
You may request an accounting of certain disclosures of your health information made during the period allowed by law, generally up to six years before your request.
Get a copy of this Notice
You may request a paper copy of this Notice even if you previously agreed to receive it electronically.
Choose someone to act for you
A legally authorized personal representative may exercise privacy rights on your behalf when the person’s authority is established and applicable law permits the action.
Your Choices
In certain circumstances, you may tell us how you want health information shared.
Family, friends, and people involved in your care
When permitted by law, we may share relevant information with family members, close friends, or others involved in your care or payment for your care based on your preference, authorization, or the circumstances.
If you cannot express your preference, we may make a professional judgment about whether a limited disclosure is in your best interest when permitted by law.
Disaster relief
We may share information with an organization assisting in disaster-relief efforts when permitted by law and appropriate to the circumstances.
Marketing and sale of health information
Alderon will obtain your written authorization for uses or disclosures requiring authorization under HIPAA, including most uses of PHI for marketing and any sale of PHI that is subject to HIPAA’s authorization requirement.
Psychotherapy notes
Most uses and disclosures of psychotherapy notes, when Alderon maintains such notes and HIPAA’s special rules apply, require your written authorization unless an exception permits the use or disclosure.
Fundraising
If Alderon engages in fundraising communications involving information that HIPAA permits to be used for that purpose, you will have the right to opt out of receiving future fundraising communications.
Treatment, Payment, and Healthcare Operations
HIPAA generally permits Alderon to use and disclose protected health information for treatment, payment, and healthcare operations without obtaining a separate authorization.
Treatment
We may use your health information to evaluate and treat you and may share relevant information with other healthcare professionals or organizations involved in your care.
For example, Alderon may share relevant clinical information with a specialist, laboratory, imaging facility, pharmacy, hospital, or another clinician involved in your treatment.
Payment
We may use or disclose health information as necessary to obtain payment for healthcare services, determine coverage, submit claims, coordinate benefits, conduct utilization review, or perform other lawful payment activities.
Healthcare operations
We may use and disclose health information for activities necessary to operate the practice and support the quality and safety of care.
Healthcare operations may include quality assessment, patient-safety activities, clinical review, training, credentialing, compliance, auditing, business planning, technology operations, customer service, legal services, and other functions permitted by law.
Other Permitted or Required Uses and Disclosures
HIPAA and other laws permit or require certain uses and disclosures outside routine treatment, payment, and healthcare operations. Additional conditions may apply before information may be disclosed.
Public health and safety
When permitted or required by law, we may disclose information for public-health activities such as:
- disease prevention and control;
- reporting certain illnesses or conditions;
- reporting adverse events or product problems;
- product recalls;
- reporting suspected abuse, neglect, or domestic violence; or
- preventing or reducing a serious threat to health or safety.
Health oversight
We may disclose information to authorized health oversight agencies for lawful activities such as audits, inspections, investigations, licensing, accreditation, and regulatory oversight.
Research
Health information may be used or disclosed for research only when applicable legal requirements and safeguards are satisfied.
Required by law
We may use or disclose health information when a federal, state, or other applicable law requires us to do so.
Organ and tissue donation
When applicable, health information may be shared with organ procurement organizations or similar entities for purposes permitted by law.
Coroners, medical examiners, and funeral directors
We may disclose appropriate health information following a person’s death when permitted or required by law.
Workers’ compensation
We may disclose health information as authorized by laws governing workers’ compensation or similar programs.
Law enforcement and government functions
We may disclose health information for certain law enforcement, national-security, military, correctional, or other governmental purposes when the disclosure satisfies applicable legal requirements.
Judicial and administrative proceedings
We may disclose health information in response to certain court or administrative orders, subpoenas, discovery requests, or other lawful processes when the requirements for disclosure are satisfied.
Substance Use Disorder Patient Records
Some substance use disorder (“SUD”) treatment records may receive additional protection under federal law, including 42 CFR Part 2.
To the extent Alderon creates, receives, or maintains records that are protected by Part 2, additional limitations may apply to their use and disclosure.
Special protection for Part 2 records. Part 2-protected records generally may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you unless applicable Part 2 requirements are satisfied, such as valid patient consent or an appropriate court order and legal process.
Additional rules may also apply to consent, redisclosure, fundraising, complaints, and breach notification involving Part 2 records.
Beginning February 16, 2026, individuals may also file complaints with the U.S. Department of Health and Human Services Office for Civil Rights concerning alleged violations of Part 2.
State and Other More-Protective Privacy Laws
HIPAA establishes federal privacy requirements, but some states and other federal laws provide additional or more protective rules for particular categories of information or particular healthcare services.
Depending on the jurisdiction and circumstances, additional protections may apply to information involving areas such as behavioral health, substance use treatment, genetic information, communicable diseases, reproductive health, minors, or other specially protected information.
When another applicable law provides greater privacy protection or imposes a more restrictive disclosure rule than HIPAA, Alderon will follow the requirements that apply to the information and circumstances involved.
State-specific privacy notices or addenda may supplement this Notice for patients receiving care in particular jurisdictions.
Alderon’s Responsibilities
Alderon has legal duties concerning the privacy and security of protected health information.
- We are required by law to maintain the privacy and security of PHI.
- We must provide you with a notice describing our privacy practices and legal duties.
- We must follow the privacy practices described in the Notice currently in effect.
- We must notify affected individuals following a breach of unsecured PHI when notification is required by law.
- We may not use or disclose PHI in a manner not permitted by this Notice or applicable law unless you provide a valid written authorization or another lawful basis applies.
- If you give us a written authorization, you generally may revoke it in writing for future uses or disclosures, subject to applicable limitations.
- We will not retaliate against you for exercising a privacy right or filing a complaint.
Changes to This Notice
Alderon may change the terms of this Notice and its privacy practices when permitted by law.
A revised Notice may apply to health information we already maintain as well as information received or created after the change.
When a material revision is made, the current Notice will be made available as required by law, including on Alderon’s website and through other required distribution methods.
Privacy Complaints
If you believe your privacy rights have been violated, you may file a complaint directly with Alderon Medical using the Privacy Contact information in this Notice.
You may also file a HIPAA privacy or security complaint—and, where applicable, a Part 2 complaint—with the U.S. Department of Health and Human Services, Office for Civil Rights .
Complaints to HHS may be submitted to:
U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
Telephone: 1-877-696-6775
Alderon will not retaliate against you for filing a privacy complaint with Alderon, HHS, or another appropriate authority.
Our Responsibilities
Privacy is a legal duty—not simply a website promise.
Alderon’s responsibilities extend across the systems, people, vendors, and workflows involved in handling protected health information.
Protect health information
Maintain appropriate privacy protections for PHI in accordance with applicable law.
Safeguard electronic information
Use administrative, technical, and physical safeguards appropriate to electronic protected health information and the systems involved.
Explain our practices
Give patients notice of privacy practices and provide information about how privacy rights can be exercised.
Respond when something goes wrong
Investigate privacy and security concerns and provide legally required notifications when a qualifying breach occurs.
Keep clinical systems separate
Use designated secure clinical systems for PHI and keep public website lead capture and advertising technology outside authenticated patient-care and medical-record workflows.
Privacy Officer
Questions About Your Privacy?
You have the right to ask questions and exercise your privacy rights.
Contact Alderon’s Privacy Officer if you have questions about this Notice of Privacy Practices, want additional information about our privacy practices, wish to exercise a privacy right, request information involving your protected health information, or want to file a privacy complaint.
Related Policies