NOTICE OF PRIVACY PRACTICES UNDER HIPAA

CHAND Medical, P.C. d/b/a Ascent Wellness
State of New York

Effective Date: August 1, 2026
Last Updated: August 1, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, HOW YOU CAN ACCESS YOUR MEDICAL INFORMATION, AND YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION.

PLEASE REVIEW THIS NOTICE CAREFULLY.

Our Commitment to Your Privacy

CHAND Medical, P.C. d/b/a Ascent Wellness (“Ascent Wellness,” “we,” “our,” or “us”) is committed to protecting the privacy and confidentiality of your Protected Health Information (“PHI”).

This Notice of Privacy Practices describes:

• Our legal duties regarding your PHI
• How we may use and disclose your PHI
• Circumstances in which your written authorization may be required
• Your rights regarding your PHI
• How you may exercise those rights
• How to contact us with questions or complaints

This Notice is provided in accordance with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), its implementing regulations, and applicable New York State privacy laws.

Medical services are provided through CHAND Medical, P.C. d/b/a Ascent Wellness by licensed healthcare providers, including Carol Smith and Alina Hasan, who practice under the medical oversight of 1977 MESK PLLC. 1977 MESK PLLC provides clinical oversight services.

For purposes of this Notice, references to “Ascent Wellness” include CHAND Medical, P.C. and applicable workforce members and healthcare providers acting on its behalf.

1. What Is Protected Health Information?

Protected Health Information, or PHI, is individually identifiable health information that is created, received, maintained, or transmitted by a healthcare provider or other covered entity and relates to your:

• Physical or mental health condition
• Healthcare services received
• Treatment or proposed treatment
• Payment for healthcare services
• Medical history
• Laboratory results
• Medications
• Diagnoses
• Treatment plans
• Healthcare provider communications

PHI may exist in paper, electronic, photographic, verbal, or other forms.

We are required to protect PHI and use or disclose it only as permitted or required by applicable law.

2. How We May Use and Disclose Your Health Information

We may use or disclose your PHI without obtaining your written authorization for certain purposes permitted or required by HIPAA and applicable law.

Treatment

We may use or disclose your PHI to provide, coordinate, and manage your healthcare.

This may include sharing relevant information with:

• Physicians
• Nurses
• Medical providers
• Clinical staff
• Laboratories
• Pharmacies
• Other healthcare professionals involved in your care

For example, we may share relevant medical information with another healthcare provider when necessary to coordinate your treatment.

Payment

We may use or disclose your PHI to obtain payment for healthcare services.

This may include:

• Processing payments
• Billing
• Claims processing
• Payment verification
• Collection activities
• Determining eligibility or coverage
• Communicating with payment-related service providers

Healthcare Operations

We may use or disclose PHI for healthcare operations necessary to operate and manage our medical practice.

Healthcare operations may include:

• Quality assessment and improvement
• Medical review
• Clinical oversight
• Credentialing
• Licensing
• Staff education and training
• Compliance activities
• Auditing
• Risk management
• Business planning
• Administrative activities
• Patient safety activities
• Reviewing and improving healthcare services

As Required by Law

We may use or disclose your PHI when required to do so by federal, New York State, or applicable local law.

Public Health Activities

We may disclose PHI for public health activities when permitted or required by law, including activities related to:

• Preventing or controlling disease
• Reporting certain conditions
• Public health investigations
• Food, medication, or product safety
• Reporting adverse events
• Public health authorities

Abuse, Neglect, or Domestic Violence

We may disclose PHI when permitted or required by law to report suspected abuse, neglect, or domestic violence to the appropriate government authority.

Health and Safety

We may use or disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, when permitted by law.

Judicial and Administrative Proceedings

We may disclose PHI in response to a court order, administrative proceeding, subpoena, discovery request, or other lawful process when the disclosure is permitted by applicable law.

Law Enforcement

We may disclose PHI to law enforcement when permitted or required by HIPAA and applicable law.

Specialized Government Functions

We may disclose PHI for certain specialized government functions when authorized by law, including activities related to national security, military functions, protective services, or correctional institutions where applicable.

Workers’ Compensation

We may disclose PHI as necessary to comply with workers’ compensation laws and other similar programs established by law.

Business Associates

We may share PHI with trusted vendors, contractors, and service providers that perform services on our behalf.

Examples may include:

• Electronic medical record providers
• Patient portal providers
• Appointment scheduling platforms
• Telehealth platforms
• Billing and payment providers
• Information technology providers
• Cloud storage providers
• Data security providers
• Legal and accounting professionals
• Other vendors supporting healthcare operations

When required by HIPAA, these organizations are required to enter into Business Associate Agreements and appropriately safeguard PHI.

3. Uses and Disclosures Requiring Your Authorization

Certain uses and disclosures of PHI require your written authorization unless otherwise permitted by law.

We will generally obtain your written authorization before using or disclosing PHI for purposes that require authorization under HIPAA.

Examples may include certain:

• Marketing activities
• Disclosures of psychotherapy notes
• Uses or disclosures that constitute a sale of PHI
• Other uses or disclosures for which HIPAA requires authorization

If you provide an authorization, you generally have the right to revoke it in writing at any time.

A revocation will not affect actions already taken in reliance on the authorization before we received your revocation.

4. Your Choices Regarding Certain Disclosures

In certain circumstances, you may have the opportunity to agree or object before we disclose your PHI.

Depending on applicable law and circumstances, we may disclose limited information to:

• A family member
• A close friend
• Another person identified by you
• Individuals involved in your care

We may use professional judgment to determine whether a disclosure is appropriate when you are present and do not object, or when circumstances indicate that disclosure is appropriate.

You may request that we not share information with a particular individual when applicable.

5. Your Rights Regarding Your Protected Health Information

You have important rights concerning your PHI.

Right to Inspect and Obtain a Copy

You generally have the right to inspect and obtain a copy of PHI contained in designated record sets maintained by or for Ascent Wellness, subject to applicable legal exceptions.

You may request your records in paper or electronic form where available and legally required.

We may charge a reasonable, cost-based fee where permitted by law.

Right to Request an Amendment

You may request that we amend PHI that you believe is incorrect or incomplete.

Your request should identify the information you believe is inaccurate or incomplete and explain why you believe an amendment is appropriate.

We may deny an amendment request when permitted by law. If we deny your request, we will provide you with information regarding your right to submit a written statement of disagreement where applicable.

Right to Request Restrictions

You may request restrictions on certain uses or disclosures of your PHI.

We are not required to agree to every restriction request.

However, where applicable under HIPAA, you may request that PHI not be disclosed to a health plan for payment or healthcare operations purposes when the PHI relates solely to a healthcare item or service that has been paid for completely out of pocket.

Right to Request Confidential Communications

You may request that we communicate with you about your healthcare in a particular way or at a particular location.

For example, you may request:

• Communication by telephone rather than mail
• Communication at a different mailing address
• Communication through another reasonable method

We will accommodate reasonable requests when required by law.

Right to an Accounting of Disclosures

You generally have the right to request an accounting of certain disclosures of your PHI made by us during a specified period, subject to exceptions established by law.

Certain disclosures are not required to be included in an accounting, including many disclosures made for treatment, payment, and healthcare operations.

Right to Receive a Copy of This Notice

You have the right to request a paper copy of this Notice at any time.

You may also request an electronic copy where available.

Right to Revoke Authorization

If you provide a written authorization for a use or disclosure of your PHI, you may generally revoke that authorization in writing.

Revocation does not affect disclosures already made in reliance on the authorization before the revocation was received.

Right to Receive Notice of a Breach

You have the right to receive notice when a breach of your unsecured PHI occurs and notification is required by applicable law.

6. Our Responsibilities

Ascent Wellness is required by law to:

• Maintain the privacy of your PHI
• Provide you with this Notice describing our legal duties and privacy practices
• Follow the terms of the Notice currently in effect
• Provide access to your PHI as required by law
• Allow you to exercise your applicable privacy rights
• Maintain reasonable administrative, technical, and physical safeguards designed to protect PHI
• Notify affected individuals following a breach of unsecured PHI when required by law

We reserve the right to change our privacy practices and this Notice.

Any revised Notice will apply to PHI we maintain, as permitted by law.

7. Electronic Communications

If you choose to communicate with Ascent Wellness through:

• Our website
• Patient portal
• Email
• Text messaging
• Telehealth platform
• Other electronic communication methods

we will use reasonable safeguards designed to protect your information.

However, no electronic transmission, email system, text message, website, patient portal, or electronic storage system can be guaranteed to be completely secure.

For your protection, do not send highly sensitive medical information through ordinary email or text messaging unless you have been instructed to use that method.

Electronic communications may also be subject to the privacy and security practices of the technology provider used to transmit or store the communication.

8. Marketing and Sale of Protected Health Information

Ascent Wellness will not use or disclose your PHI for marketing purposes when HIPAA requires your written authorization unless you provide that authorization.

We will not sell your PHI without your written authorization when HIPAA requires authorization.

You have the right to understand when your PHI is being used for purposes that require authorization.

9. Psychotherapy Notes

If Ascent Wellness maintains psychotherapy notes, certain uses and disclosures of those notes may require your written authorization under HIPAA.

Psychotherapy notes are treated differently from other medical records under federal privacy law.

This section does not apply to ordinary clinical documentation that is not considered psychotherapy notes under HIPAA.

10. Special Protections for Certain Information

Certain categories of health information may be subject to additional federal or New York State protections.

Depending on the circumstances, additional protections may apply to information involving:

• Mental health services
• Substance use disorder treatment
• HIV-related information
• Genetic information
• Reproductive or sexual health information
• Other specially protected categories of health information

Ascent Wellness will comply with applicable federal and New York State requirements governing such information.

11. Complaints and Privacy Concerns

If you believe your privacy rights have been violated, you may submit a complaint to Ascent Wellness.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights.

You will not be retaliated against for filing a privacy complaint or exercising your rights under HIPAA.

You do not need to waive any legal rights or agree to receive less favorable treatment in order to file a complaint.

12. Changes to This Notice

We reserve the right to revise this Notice of Privacy Practices at any time.

If we make material changes to our privacy practices, we will update the effective date and make the revised Notice available as required by law.

The revised Notice will apply to PHI maintained by Ascent Wellness, subject to applicable legal requirements.

The current version of this Notice will be available through our website and may also be provided to you upon request.

13. Questions or Complaints

If you have questions about this Notice, wish to exercise your HIPAA rights, or believe your privacy rights have been violated, please contact:

CHAND Medical, P.C. d/b/a Ascent Wellness

60 Queen Street
Syosset, NY 11791

Phone: (516) 744-2778
Email: legal@ascentwellness.com

For medical emergencies, do not use the contact information above. Call 911 or seek immediate emergency medical assistance.

14. Filing a Complaint With the U.S. Department of Health and Human Services

You may also file a complaint with the:

U.S. Department of Health and Human Services
Office for Civil Rights

You may submit a complaint without fear of retaliation.

Filing a complaint will not affect the quality of care or services you receive from Ascent Wellness.

15. Acknowledgment of Receipt

You may be asked to acknowledge that you received this Notice of Privacy Practices.

Your acknowledgment confirms receipt of the Notice. It does not constitute an authorization for uses or disclosures of PHI beyond those permitted by law.

If you decline to sign an acknowledgment, Ascent Wellness may still provide services when otherwise permitted or required by law, and we may document our efforts to obtain your acknowledgment.

Contact Information

CHAND Medical, P.C. d/b/a Ascent Wellness

Address:
60 Queen Street
Syosset, NY 11791

Phone: (516) 744-2778

Email: legal@ascentwellness.com

Effective Date: August 1, 2026
Last Updated: August 1, 2026