Notice of Privacy Practices

Effective Date: October 17, 2026 • Compliant with 45 C.F.R. § 164.520 (February 2026 Update)

1. Our Commitment to Your Privacy

AdaptivMVMT Physical Therapy & Performance, Inc. is required by law to maintain the privacy of your Protected Health Information (PHI) and to provide you with this notice. We are committed to: (1) keeping your PHI private and secure; (2) notifying you promptly if a breach occurs; (3) following the practices described here; and (4) giving you a copy of this notice on request.

This notice complies with HIPAA (45 C.F.R. § 164.520), incorporating the February 2026 updates required by the 2024 HIPAA Privacy Rule Final Rule and the 2024 Part 2 Final Rule. It also reflects California’s Confidentiality of Medical Information Act (CMIA, Cal. Civil Code §§ 56–56.37). Where California law is more protective than HIPAA, California law applies.

2. How We Use and Share Your Health Information

2A. What We Can Share Without Your Authorization

We use and disclose your PHI only for the purposes you’d expect:

• Treatment: To provide, coordinate, and manage your care, including sharing information with other providers involved in your treatment. Example: contacting your orthopedist to coordinate post-operative rehab.
• Payment: To process payment for services, provide documentation for HSA/FSA accounts, and issue Superbills for qualifying PT services upon request.
• Healthcare Operations: To run the practice and ensure quality of care. Our Business Associates who may access your PHI under signed Business Associate Agreements (BAAs): Jane App (scheduling, intake, clinical records, and payments), Quo (phone calls and text messaging), and Rex, CPA (bookkeeping).
• As required by law: Court orders, subpoenas, law enforcement requests, public health reporting.
• Public health & safety: Preventing or controlling disease, reporting abuse or neglect, preventing a serious and imminent threat to health or safety.
• Other permitted uses: Research with appropriate safeguards, organ donation, workers’ compensation, government functions, coroner or medical examiner, legal proceedings.

2B. What Requires Your Written Authorization

The following require your separate written consent. You may revoke authorization in writing at any time, except where we’ve already relied on it:

• Marketing communications
• Sale of your health information
• Most disclosures of psychotherapy notes
• Any use or disclosure not described in this notice

2C. Substance Use Disorder (SUD) Records — 42 C.F.R. Part 2 (Required as of February 16, 2026)

2D. Important: Redisclosure Warning — 45 C.F.R. § 164.520(b)(1)(ii)(H) (Required February 2026)

3. Your Rights

These are your rights regarding your health information. To exercise any of them, contact us at the address or email above.

• Access your records: You can inspect and get a copy of your medical records. Under California’s PAHRA and CMIA, we respond within 5 business days and provide copies within 15 calendar days. Electronic format available if readily producible.
• Correct your record: If you believe something is incorrect, ask us to amend it. If we decline, you can submit an addendum that must be attached to future relevant disclosures.
• Accounting of disclosures: Request a list of disclosures we’ve made for purposes other than treatment, payment, and operations — covering the past 6 years. One free per year; additional requests may incur a reasonable fee.
• Restrict disclosures: Ask us not to share certain PHI. We must honor your request not to share information with your health insurer for services you paid entirely out-of-pocket, unless required by law.
• Confidential communications: Ask us to contact you only a specific way (email only, alternate address, etc.). We’ll accommodate all reasonable requests.
• Copy of this notice: Request a paper or electronic copy any time, even if you originally agreed to receive it electronically.
• Personal representative: Someone with legal authority to act for you (healthcare power of attorney, legal guardian) may exercise these rights on your behalf.
• File a complaint: If you believe your privacy rights have been violated, you can file a complaint. We will never penalize you or affect your care for doing so. See Section 7.

4. Your Choices

For the following, you can tell us your preferences. If you give no instruction, we use our best judgment in your interest.

• Family & friends: We may share relevant information with family, close friends, or others involved in your care or payment, unless you tell us not to.
• Disaster relief: We may share your information with authorized disaster relief organizations in an emergency, unless you instruct otherwise.
• Marketing & fundraising: We will never use or share your PHI for marketing or fundraising without your written authorization. We will never sell your health information.
• Psychotherapy notes: We will not disclose psychotherapy notes without your specific written authorization, separate from any general authorization.

5. California-Specific Protections

5A. Confidentiality of Medical Information Act (CMIA) — Cal. Civil Code §§ 56–56.37

California’s CMIA provides stronger protections than federal HIPAA in several areas. The more protective standard always applies.

• No employer disclosure: We will not share your medical information with your employer without your express written authorization.
• No marketing use: We will not use your medical information for marketing without your explicit written authorization.
• No sale of medical information: We will never sell your medical information. Prohibited under CMIA regardless of authorization.
• Private right of action: Unlike federal HIPAA, the CMIA allows you to take legal action directly for an unauthorized disclosure of your medical information.
• Sensitive services: We will not disclose information related to mental/behavioral health, sexual and reproductive health, STIs, substance use disorder, gender-affirming care, or intimate partner violence to anyone other than you without your express written authorization.

5B. SB 81 — Immigration Status (Effective 2025)

Your place of birth and immigration status are protected medical information under California SB 81. We will not disclose this for immigration enforcement without your written authorization or a lawful court order.

5C. Breach Notification

If your medical information is breached or improperly accessed, we will notify you in the most expedient time possible and without unreasonable delay — as required by HIPAA (45 C.F.R. § 164.400) and California law (Cal. Civil Code § 1798.82). If a breach requires notice to more than 500 California residents, we will also submit a sample copy of the notice to the California Attorney General, as required by Cal. Civil Code § 1798.82.

6. Our Responsibilities

In plain terms, here’s what we commit to:

• Maintain the privacy and security of your PHI under HIPAA and California’s CMIA
• Notify you promptly if a breach occurs that may have compromised your PHI
• Follow the practices described in this notice and give you a copy on request
• Apply whichever standard — HIPAA or CMIA — provides greater protection to your health information
• Not use or share your PHI beyond what is described here without your written permission, which you may revoke at any time
• Keep signed Business Associate Agreements (BAAs) with all vendors who access your PHI: Jane App, Quo, and Rex, CPA
• Post the current version of this notice on our website at www.adaptivmvmt.com and make it available in our office
• Reserve the right to update this notice at any time — changes take effect for all PHI we maintain and will be posted on our website

7. Questions & Complaints

If you have questions about your privacy rights or believe they’ve been violated, please reach out. We want to hear from you first — but you also have every right to go directly to the agencies below. Filing a complaint will never affect your care.