Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: September 1, 2026

Issued by: Matthew Narlesky, DO (“this practice,” “I,” “me,” or “my”)

A NOTE ABOUT HEADWAY

You may also receive a Notice of Privacy Practices from Headway. Headway provides scheduling, billing, insurance processing, technology, and related services and may receive, access, use, or disclose protected health information in performing those services, as described in its notice. This notice describes the privacy practices of my practice. The notices may overlap.

MY RESPONSIBILITIES

I am required by law to maintain the privacy and security of your protected health information (“PHI”), provide you with this notice of my legal duties and privacy practices, notify you following a breach of unsecured PHI, and follow the terms of the notice currently in effect.

State or federal law may provide additional protection for certain health information. When another applicable law is more protective than HIPAA, I will follow the more protective law.

HOW I MAY USE AND DISCLOSE YOUR HEALTH INFORMATION

Treatment. I may use or disclose your information to provide, coordinate, or manage your care, as permitted by applicable law. For example, I may communicate with a pharmacy about a prescription or coordinate care with another treating professional.

Payment. I may use or disclose information to bill for services and obtain payment. For example, I may provide necessary information to Headway, your health plan, or another payer to process a claim.

Health care operations. I may use or disclose information for activities necessary to operate this practice, including scheduling, quality review, credentialing, compliance, licensing, recordkeeping, and practice administration. For example, I may review records to evaluate the quality of care I provide. I may also disclose information to service providers or business associates that perform services on my behalf and are required to protect the information.

Other uses and disclosures permitted or required without written authorization. Subject to applicable legal requirements and limitations, I may use or disclose your information:

When required by federal, state, or local law, including to the U.S. Department of Health and Human Services when it is reviewing compliance with federal privacy law.
For public-health activities, such as preventing disease, reporting adverse medication reactions, or assisting with product recalls.
To report suspected abuse, neglect, or domestic violence when authorized or required by law.
To prevent or lessen a serious and imminent threat to health or safety or to discharge a duty to warn or protect imposed by law.
For lawful health-oversight activities, including audits, investigations, inspections, credentialing, or licensing proceedings.
For workers’ compensation or similar programs, as authorized by law.
For limited law-enforcement purposes authorized by law.
In response to a court or administrative order, subpoena, discovery request, or other lawful process, but only as permitted by applicable law.
To coroners, medical examiners, or funeral directors as necessary to perform their lawful duties.
To organ-procurement organizations for organ, eye, or tissue donation.
For certain research activities when permitted by law and subject to required approval and privacy safeguards.
For special governmental functions authorized by law, such as military, national-security, protective-service, or correctional activities.

YOUR CHOICES

You may tell me whether you want information shared with family members, close friends, or other people involved in your care or payment for your care, or for disaster-relief purposes.

If you cannot state a preference, I may disclose limited information when permitted by law and when, in my professional judgment, the disclosure is in your best interest.

USES AND DISCLOSURES REQUIRING WRITTEN AUTHORIZATION

Most uses and disclosures of psychotherapy notes, if I create and maintain them separately from the medical record, require your written authorization. Uses and disclosures for marketing and any sale of PHI also generally require your written authorization.

Other uses and disclosures not described in this notice will be made only with your written authorization. You may revoke an authorization in writing at any time, except to the extent that action has already been taken in reliance on it.

Substance use disorder records received from other programs. To the extent this practice receives or maintains substance use disorder treatment records protected by 42 CFR Part 2, those records, or testimony describing their contents, will not be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding against you without your written consent or a court order issued after the notice and opportunity to be heard required by law. Any such order must also be accompanied by a subpoena or other legal requirement compelling disclosure.

YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION

Inspect or obtain a copy. You may ask to inspect or obtain an electronic or paper copy of your medical record and other health information maintained by this practice, subject to limited exceptions. I may charge a reasonable, cost-based fee consistent with applicable law.

Request an amendment. You may ask me to amend information you believe is inaccurate or incomplete. I may deny the request in certain circumstances and will provide a written explanation when required.

Receive an accounting of disclosures. You may request an accounting of certain disclosures of your information. The accounting does not include every disclosure, such as many disclosures for treatment, payment, or health care operations.

Request restrictions. You may ask me to restrict how I use or disclose information for treatment, payment, or health care operations. I am generally not required to agree.

If you pay in full out of pocket for a particular service, you may ask me not to disclose information about that service to your health plan for payment or health care operations. I must agree unless the disclosure is required by law.

Request confidential communications. You may ask me to communicate with you in a particular way or at a particular location. I will accommodate reasonable requests.

Obtain a paper copy. You may request a paper copy of this notice at any time, including if you previously agreed to receive it electronically.

Receive breach notification. You will be notified as required by law if a breach of unsecured PHI occurs.

Have a personal representative act for you. A person with legal authority to act as your personal representative may exercise your privacy rights on your behalf. I may require documentation of that authority.

To exercise any of these rights, contact me using the information below. I may ask that certain requests be submitted in writing.

CHANGES TO THIS NOTICE

I reserve the right to change this notice and make the revised terms effective for all PHI that I maintain, including information created or received before the revision. If I revise this notice, the revised notice will be posted on my practice websites and made available upon request.

COMPLAINTS AND QUESTIONS

If you believe your privacy rights have been violated, you may file a complaint with me by calling the practice phone number listed below. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against or penalized for filing a complaint.

Privacy contact
Matthew Narlesky, DO
Phone: 603-722-0409

U.S. Department of Health and Human Services, Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
1-877-696-6775
https://www.hhs.gov/hipaa/filing-a-complaint/index.html