Privacy Policy | MFM Health

Notice of Privacy Practices

This Notice is effective September 15, 2026

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Contents of Our Notice of Privacy Practices

This Notice explains:

Your rights with respect to medical information about you.
How we may use and disclose medical information about you.
How and where you may file a privacy-related complaint.
Our legal responsibilities as a health care practice.

Questions or complaints:

MFM HIPAA Privacy Officer | (978) 774-2555 | HIPAA@mfmhealth.com

MFM Health, 99 Conifer Hill Dr., Danvers, MA 01923

Your Rights

Get an electronic or paper copy of your medical record

You may ask to inspect or receive an electronic or paper copy of your medical record and other health information we maintain about you. Ask us how to submit your request.
We will provide a copy or a summary, usually within 30 days. If we need additional time, we will notify you in writing as permitted by law. We may charge a reasonable, cost-based fee allowed by federal and Massachusetts law.
Medical record requests may be submitted through our partner, HealthMark Group, at requestmanager.healthmark-group.com, or by contacting MFM Health for assistance.

Ask us to amend your medical record

You may ask us to correct health information about you that you believe is incorrect or incomplete. Ask us how to do this. We may say “no” to your request, but we’ll tell you why in writing within 60 days.

Request confidential communications

You may ask us to contact you in a specific way, such as at a particular phone number, through the patient portal, or at a different mailing address. We will accommodate reasonable requests. Please understand that changing communication methods may affect how quickly we can reach you.

Ask us to limit what we use or share

You may ask us not to use or disclose certain information for treatment, payment, or health care operations. We are not required to agree unless the law requires us to do so.
If you pay for a service or item out-of-pocket in full, you may ask us not to disclose information about that service or item to your health plan for payment or health care operations. We will agree unless disclosure is required by law.
You may ask about available options to limit participation in an electronic health information exchange. Any available opt-out applies only as described in the applicable exchange and does not prevent disclosures otherwise permitted or required by law.

Receive an accounting of certain disclosures

You may request a list of certain disclosures of your health information made during the six years before your request, including who received the information and why.
The accounting will not include disclosures for treatment, payment, or health care operations and certain other disclosures excluded by law. One accounting in any 12-month period is free; we may charge a reasonable, cost-based fee for additional requests.

Get a copy of this notice

You may ask for a paper copy of this notice at any time, even if you agreed to receive it electronically. We will provide it promptly and without charge.

Choose someone to act for you

A person with legal authority to act as your personal representative, such as a health care agent, parent in appropriate circumstances, or legal guardian, may exercise your rights. We will verify the person’s authority before acting.

File a complaint

You may complain to MFM Health by contacting the HIPAA Privacy Officer listed above.
You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting hhs.gov/ocr/privacy/hipaa/complaints/.
We will not retaliate against you for filing a complaint or exercising any privacy right.

Your Choices

For certain health information, you may tell us your preferences. Tell us what you want us to do, and we will follow your instructions when the law gives you that choice.

Family, friends, caregivers, and disaster relief

You may tell us whether to share relevant information with family members, close friends, caregivers, or others involved in your care or payment for your care, and whether to share information for disaster relief.
If you cannot tell us your preference, such as during an emergency, we may share information when we determine it is in your best interest and the disclosure is permitted by law. We may also share information when needed to prevent or lessen a serious and imminent threat to health or safety.

Uses that generally require written authorization

Most uses and disclosures for marketing purposes.
A sale of your protected health information.
Most uses and disclosures of psychotherapy notes, if we maintain them.
Other uses and disclosures not described in this notice, unless otherwise permitted or required by law.

You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.

Fundraising

We may contact you about fundraising as permitted by law. You may opt out of future fundraising communications. If we maintain records subject to 42 CFR Part 2, we will provide any additional notice and choice required before using those records for fundraising.

How We Use and Disclose Your Health Information

Treatment

We may use and disclose your health information to provide, coordinate, or manage your care and to consult with other health care professionals involved in your treatment.

Example: A clinician treating you for an injury asks another clinician about your overall health condition.

Payment

We may use and disclose your health information to bill for services, obtain payment, determine coverage, and conduct related activities such as eligibility checks, prior authorization, utilization review, and claims management.

Example: We give information to your health plan so it can process payment for your visit.

Health care operations

We may use and disclose your health information to operate MFM Health, improve quality and patient safety, train staff, conduct audits, credential clinicians, manage population health, evaluate performance, and perform other health care operations permitted by law.

Electronic health information exchange and care coordination

We may obtain, use, and disclose health information through health information exchanges, interoperability networks, electronic health record networks, prescription history services, admission-discharge-transfer notification services, and other health data services for treatment, payment, and health care operations as permitted by law.

Information may include records from other providers, medication history, laboratory and imaging results, and information about hospital admissions, discharges, and transfers. We may use business associates to help retrieve, organize, maintain, and exchange this information. Information received may become part of your medical record. The specific networks and service providers we use may change over time.

Communications with you

We may contact you about appointments, scheduling, test results, treatment, follow-up care, care gaps, care coordination, payment, benefits, services, and other matters related to your care or our operations. You may request reasonable alternative or confidential communications.

Email, text messages, and mobile information

We have a Patient Communications Program that sets out how we will communicate with you by email and/or text outside of the patient portal. For more information about the privacy of your mobile number, message frequency, potential message and data rates, communication preferences, and how to stop receiving email or text messages, see our Patient Communications Program Terms and Conditions.

Other Uses and Disclosures Permitted or Required by Law

We may use or disclose health information without your written authorization in the circumstances below, subject to all applicable conditions and limits under federal and Massachusetts law.

Public health and safety

Preventing or controlling disease, injury, or disability
Reporting births, deaths, adverse events, product problems, or product recalls
Reporting suspected abuse, neglect, or domestic violence
Preventing or lessening a serious and imminent threat to health or safety

Research

We may use or disclose health information for research when an institutional review board or privacy board has approved a waiver, when the information has been appropriately de-identified or limited, or when you have signed an authorization, as required by law.

Required by law and health oversight

We may disclose information when required by federal or state law, including to the U.S. Department of Health and Human Services for HIPAA compliance review, and to health oversight agencies for activities authorized by law.

Organ donation, medical examiners, and funeral directors

We may disclose information to organ procurement organizations and, after death, to a coroner, medical examiner, or funeral director as permitted by law.

Workers’ compensation, law enforcement, and government functions

We may disclose information for workers’ compensation, limited law enforcement purposes, military and veterans activities, national security, protective services, correctional institutions, and other special government functions when permitted or required by law.

Judicial and administrative proceedings

We may disclose health information in response to a valid court or administrative order, subpoena, discovery request, or other lawful process only after applicable legal requirements and safeguards have been satisfied. Massachusetts law may prohibit or limit cooperation with certain out-of-state investigations or proceedings involving legally protected reproductive or gender-affirming health care.

Special Protections for Certain Information

Some information receives additional protection under federal or Massachusetts law. When a more protective law applies, we will follow that law. Depending on the information and the reason for disclosure, we may need your specific written consent, a court order, or another legal basis before disclosing it.

Substance use disorder records subject to 42 CFR Part 2

If we create or maintain substance use disorder patient records protected by 42 CFR Part 2, those records may be used or disclosed in accordance with the attached addendum.
Part 2 records generally may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless you provide separate written consent or a court order meeting Part 2 requirements authorizes the use or disclosure.

Massachusetts specially protected information

Massachusetts law provides heightened confidentiality protections for certain information, including HIV testing and HIV-related information, genetic testing and genetic information, sexually transmitted infection information, certain mental health information and psychotherapy records, and information concerning substance use disorder treatment. These categories may require a specific, separate, or informed written consent before disclosure, subject to limited exceptions.

Minors

A parent or legal guardian generally acts as a minor’s personal representative. However, when Massachusetts or federal law allows a minor to consent to a particular service without parental consent, the minor may control access to and disclosure of information about that service, subject to applicable exceptions. We will apply the law based on the type of care and the circumstances.

Our Responsibilities

We are required by law to maintain the privacy and security of your protected health information.
We will notify you as required by law if a breach occurs that may have compromised the privacy or security of your information.
We must follow the duties and privacy practices described in the notice currently in effect and provide you a copy upon request.
We will not use or disclose your information other than as described in this notice unless you authorize us in writing or the law permits or requires the use or disclosure.
We apply appropriate administrative, physical, and technical safeguards to protect health information, including information exchanged electronically and information handled by our business associates.

Changes to the Terms of this Notice

We may change the terms of this notice, and the revised notice may apply to all health information we maintain, including information created or received before the change. The current notice will be available upon request, at our offices, and on our website at www.mfmhealth.com.

Contact Information

HIPAA Privacy Officer

HIPAA@mfmhealth.com

Phone: (978) 774-2555

Mail: Attn: MFM HIPAA Privacy Officer, MFM Health, 99 Conifer Hill Dr., Danvers, MA 01923

Medical records requests: requestmanager.healthmark-group.com

Website: www.mfmhealth.com

Notice of Additional Protections of Subtance Use Disorder Records

Our HIPAA Notice of Privacy Practice (“HIPAA NPP”) applies to all our patients. If you receive treatment, diagnosis, or referral for treatment in one of our designated Substance Use Disorder Programs (“Part 2 Programs”), the confidentiality of your records in such programs (“Part 2 Records”) are subject to further protections under the federal law and regulations 42 U.S.C. § 290dd-2, 42 U.S.C. 290ee-3, and 42 C.F.R. Part 2 (“Part 2”).

THIS NOTICE SUPPLEMENTS THE HIPAA NPP AND DESCRIBES:

HOW YOUR PART 2 RECORDS MAY BE USED AND DISCLOSED,

YOUR RIGHTS WITH RESPECT TO PART 2 RECORDS, AND

HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR PART 2 RECORDS, OR OF YOUR RIGHTS CONCERNING YOUR PART 2 RECORDS.

YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH MFM HEALTH’S PRIVACY OFFICER AT (978) 774-2555 OR [INSERT EMAIL] IF YOU HAVE ANY QUESTIONS.

Uses and Disclosures

Our Part 2 Programs may use and disclose your Part 2 Records only as described in this section or with your written consent.

Permitted Uses and Disclosure of Part 2 Records Without Consent

To communicate with other staff within the Part 2 Program who have a need for the information in connection with their duties to provide diagnosis, treatment, or referral for treatment or persons/office with direct administrative control over the Part 2 Program.
To qualified service organizations providing services to us or on our behalf.
To law enforcement agencies or officials if you commit, or threaten to commit, a crime in our facilities or against our personnel.
To report suspected child abuse and neglect consistent with state laws.
To medical personnel in a medical emergency under certain conditions.
For research purposes if certain conditions are met.
To qualified personnel for management and financial audit or program evaluation purposes who agree in writing to comply with the limitations on use and redisclosure.
To a public health authority, if the information has been properly de-identified.

Permitted Uses and Disclosures that Require Consent

For treatment, payment, and health care operations purposes. Our Part 2 Program will request that you provide a single written consent for all future uses or disclosures of your information for treatment, payment, and healthcare operations purposes in order to ensure you receive the highest level of coordinated care. If you do not sign this consent, we may not be able to treat you. This consent shall remain in effect until you revoke it in writing.
Records that are disclosed to us or to another Part 2 program, covered entity, or business associate pursuant to your written consent for treatment, payment, and health care operations may be further disclosed by us or that Part 2 program, covered entity, or business associate, without your written consent, to the extent the HIPAA regulations permit such disclosure.
Our Part 2 Program may use or disclose records to fundraise for the benefit of the Part 2 Program only if you are first provided with a clear and conspicuous opportunity to elect not to receive fundraising communications.
Our Part 2 Program may make uses and disclosures not described in this notice only with your written consent.

Right to Revoke or Withdraw a Consent

You may revoke or withdraw your written consent at any time by sending a request for revocation in writing to the address at the end of the HIPAA NPP or submitting a written request to the Part 2 Program. We will no longer use or disclose your Part 2 Records after such time, except to the extent we have already acted in reliance upon it.

If you were mandated to treatment through the criminal legal system (including drug court, probation, or parole) and you sign a consent authorizing disclosures to elements of the criminal legal system such as the court, probation officers, parole officers, prosecutors, or other law enforcement, your right to revoke consent may be more limited and should be clearly explained on the consent you sign.

Uses or Disclosures in Legal Proceedings and Court Orders

We must follow certain procedures before using or sharing your information for investigations and legal proceedings.

We will not use or share your information or provide testimony about your information in any civil, administrative, criminal, or legislative proceedings against you without your written consent or a court order.
We will only respond to a court order to use or share your health information if it is accompanied by a subpoena or other similar legal mandate requiring us to comply.
We will only use or share your information in proceedings against you based on a court order after we have received notice and an opportunity to be heard or you tell us that you have received notice.
We may use or share your information to respond to legal proceedings against our program based on a court order and you may not be notified in advance. You have the right to seek to overturn or change the court order after you learn about it.

Your Rights Related to Your Part 2 Records

As a client in our Part 2 Program, you have all the rights listed in the HIPAA NPP, including the right to request restrictions of disclosures made with prior consent for purposes of treatment, payment, and health care operations. You also have the right to an accounting of disclosures of electronic Part 2 Records made with your consent for the past 3 years, including disclosures for treatment, payment, and health care operations when such disclosures are made through an electronic health record.

Filing a Complaint

See HIPAA NPP for more information regarding filing a complaint.

99\0009\2352370.v3 | 05-PRV-01-ALL-00153-V2.0