HIPAA Notice of Privacy Practices

About This Notice

Cypress Pediatrics is required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to maintain the privacy of protected health information (PHI), to give patients and their parents/guardians notice of our legal duties and privacy practices, and to follow the terms of this notice. PHI includes information that identifies your child and relates to his or her past, present, or future health care or payment for that care.

This notice applies to all medical records of your child created or maintained by our practice, including records held in the Patient Portal operated for us by PCC.

How We May Use and Disclose Health Information

We may use and disclose your child's PHI without your separate authorization for the following purposes:

Treatment, Payment, and Health Care Operations

• Treatment — to provide, coordinate, or manage your child's care. For example, sharing records with a specialist we refer your child to.
• Payment — to bill and collect payment from you, your insurance company, or other payers. This may include sharing information with an insurer to verify eligibility or obtain prior authorization.
• Health Care Operations — for our internal operations, including quality assessment, training, accreditation, licensure, and management of the practice.

Other Permitted Uses and Disclosures

• Appointment reminders, care updates — by phone, text, voicemail, or through the Patient Portal.
• Public health activities — such as reporting required immunizations to state registries, reporting communicable diseases, or reporting suspected child abuse as required by law.
• Health oversight, law enforcement, judicial proceedings — when required by law (subpoena, court order, audit, regulatory investigation).
• Workers' compensation, coroners, organ procurement — to the extent required by law.
• To avert a serious threat to health or safety — when disclosure is needed to prevent or lessen a serious and imminent threat.
• Business associates — vendors that perform services for us (such as PCC, which operates the Patient Portal) under a written Business Associate Agreement requiring them to protect your child's information.

Uses That Require Your Written Authorization

Other uses and disclosures — including most uses of psychotherapy notes, marketing communications, and any sale of PHI — will be made only with your written authorization. You may revoke that authorization in writing at any time, except to the extent we have already acted in reliance on it.

Your Rights Regarding Your Child's Health Information

Under HIPAA, you (as the parent or legal guardian, generally) have the following rights regarding your child's PHI:

• Right to inspect and copy — you may request to inspect or obtain a copy of your child's medical record. We will respond within 30 days. We may charge a reasonable, cost-based fee.
• Right to amend — if you believe a record is inaccurate or incomplete, you may request a correction. We may deny the request in limited circumstances.
• Right to an accounting of disclosures — you may request a list of certain disclosures we have made of your child's PHI, other than those for treatment, payment, or operations.
• Right to request restrictions — you may ask us to limit certain uses or disclosures. We are not required to agree, except for disclosures to a health plan for an item or service you paid for in full out-of-pocket.
• Right to request confidential communications — you may ask us to contact you a specific way (for example, by mobile only, not the home phone) or at a specific address. We will accommodate reasonable requests.
• Right to a paper copy of this notice — even if you have agreed to receive it electronically, you may request a paper copy at any time.
• Right to notification of a breach — we will notify you if a breach of your child's unsecured PHI occurs.

A Note About Minors and Adolescents

In most situations, parents and legal guardians have access to their minor child's medical records and exercise these privacy rights on the child's behalf. Louisiana and federal law recognize specific exceptions — for example, certain reproductive, mental-health, or substance-use services that a minor consents to on their own. In those areas, our team will explain how access works at the time of the visit.

Complaints

If you believe your child's privacy rights have been violated, you may file a complaint with our office or with the U.S. Department of Health and Human Services Office for Civil Rights:

• U.S. Department of Health and Human Services, Office for Civil Rights — www.hhs.gov/hipaa/filing-a-complaint

We will not retaliate against you for filing a complaint.

Changes to This Notice

We reserve the right to change this notice and to make the new notice effective for all PHI we maintain. When we change it, we will post the updated version in our office and on this page, with a new "Last Reviewed" date.

Contact Us

To exercise any of these rights, request a paper copy of this notice, or ask a question about our privacy practices, contact our Privacy Officer:

Last reviewed: May 2026.