HIPAA Notice of Privacy Practices
bio/synergy Health + Wellness
Effective Date: October 1, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
bio/synergy Health + Wellness is committed to protecting the privacy and security of your health information. This Notice describes how we may use and disclose your Protected Health Information ("PHI"), your rights regarding that information, and our responsibilities under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), applicable federal regulations, and Maryland law.
Federal law requires covered health care providers to provide patients with a Notice of Privacy Practices explaining permitted uses and disclosures, patient rights, the provider's legal responsibilities, and how patients may make privacy complaints.
Protected Health Information
Protected Health Information is individually identifiable information relating to your past, present, or future physical or mental health, health care services, or payment for health care.
Information maintained by bio/synergy may include:
- Medical and health history
- Medications, allergies, and health conditions
- Consultation and screening information
- Treatment and service records
- Clinical notes and care plans
- Laboratory or diagnostic information, when applicable
- Photographs or images associated with your care
- Billing and payment information
- Insurance information, when applicable
- Contact information associated with health services
- Electronic communications regarding your care
Maryland law also protects medical records maintained by health care providers and generally requires those records to remain confidential unless disclosure is permitted or required by law.
How We May Use and Disclose Your Health Information
Treatment
We may use and disclose your health information to provide, coordinate, or manage your care. For example, information may be shared among physicians, nurse practitioners, physician assistants, registered nurses, or other authorized health care professionals involved in your care.
Payment
We may use or disclose health information as necessary to obtain payment for services provided to you. This may include billing, payment processing, insurance verification, claims administration, or collection activities, when applicable.
Health Care Operations
We may use and disclose PHI for activities necessary to operate bio/synergy Health + Wellness, including:
- Quality assessment and improvement
- Staff training
- Credentialing and licensing
- Compliance activities
- Auditing
- Risk management
- Business planning
- Legal and regulatory compliance
- Patient safety activities
These types of uses are specifically contemplated by HIPAA as treatment, payment, and health care operations.
Other Uses and Disclosures Permitted or Required by Law
We may use or disclose your health information without your written authorization when permitted or required by federal or Maryland law. These circumstances may include:
Public Health Activities: We may disclose information to authorized public health agencies for legally authorized disease reporting, adverse-event reporting, product recalls, or other public health activities.
Health Oversight: Information may be disclosed to governmental or regulatory authorities for audits, inspections, licensing, disciplinary proceedings, or other legally authorized oversight activities.
Abuse or Neglect: We may disclose medical information when required or authorized by law to report suspected child abuse, vulnerable-adult abuse, neglect, or other reportable circumstances.
Judicial and Administrative Proceedings: We may disclose health information in response to a valid court order, subpoena, warrant, summons, or other lawful compulsory process when the requirements of applicable law have been satisfied.
Law Enforcement: Information may be provided to law-enforcement authorities when authorized or required by law.
Serious Threats to Health or Safety: Information may be disclosed when permitted by law and reasonably necessary to prevent or reduce a serious and imminent threat to the health or safety of an individual or the public.
Workers' Compensation: We may disclose information as authorized by laws governing workers' compensation or similar programs.
Maryland Health–General §4-306 identifies circumstances in which medical records must be disclosed without patient authorization, including certain governmental investigations and lawful compulsory processes.
Uses and Disclosures Requiring Your Authorization
Except as permitted or required by law, we will obtain your written authorization before using or disclosing your PHI for purposes not described in this Notice.
Written authorization generally will be required for:
- Certain marketing activities
- Sale of PHI
- Use of identifiable photographs or videos for advertising
- Testimonials containing identifiable health information
- Social-media use of identifiable patient information
- Other disclosures not otherwise permitted by law
Under Maryland law, an authorization for disclosure of medical records generally must be written, dated, signed, identify the provider and recipient, and state the period for which the authorization is valid. In most circumstances, a Maryland medical-record authorization may not remain valid for more than one year.
You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on that authorization.
Your Rights Regarding Your Health Information
Right to Inspect and Obtain Copies
You have the right to inspect and obtain a copy of health information maintained about you, subject to limited exceptions permitted by law.
You may request an electronic copy when your information is maintained electronically and an electronic copy can reasonably be provided.
Maryland law also gives a "person in interest" the right, upon written request, to inspect or obtain copies of medical records, subject to specified limitations.
Reasonable, legally permitted fees may apply for copies of records.
Right to Request a Correction or Amendment
If you believe information in your medical record is inaccurate or incomplete, you may request that it be corrected or amended.
Maryland law requires health care providers to establish procedures for patients or other persons in interest to request an addition or correction to a medical record. Information generally may not simply be deleted from an existing medical record.
We may deny a request in certain circumstances, but you may have the right to submit a written statement of disagreement.
Right to Request Restrictions
You may ask us to limit certain uses or disclosures of your health information.
We generally are not required to agree to every requested restriction. However, if you pay for a health care item or service in full out of pocket, you may request that we not disclose information regarding that item or service to your health plan for payment or health care operations purposes. When HIPAA requires us to honor such a request, we will do so.
Right to Request Confidential Communications
You may request that we communicate with you about your health information in a specific manner or at a particular location.
For example, you may ask that we contact you at a particular telephone number, mailing address, or email address.
We will accommodate reasonable requests as required by law.
Right to an Accounting of Disclosures
You may request a list of certain disclosures we have made of your health information during the six years preceding your request.
The accounting generally does not include disclosures made for treatment, payment, health care operations, disclosures authorized by you, or certain other disclosures excluded by law.
Right to a Copy of This Notice
You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.
Right to Designate a Personal Representative
If another person has lawful authority to act on your behalf, such as a legal guardian, health care agent, or other authorized personal representative, that person may exercise certain privacy rights on your behalf after we verify the person's authority.
Our Responsibilities
bio/synergy Health + Wellness is required to:
- Maintain the privacy and security of your PHI.
- Follow the privacy practices described in the Notice currently in effect.
- Provide you with a copy of this Notice upon request.
- Limit uses and disclosures of PHI as required by applicable law.
- Apply reasonable administrative, physical, and technical safeguards to protect health information.
- Notify affected individuals when required following a breach of unsecured PHI.
The HIPAA Breach Notification Rule generally requires covered entities to notify affected individuals following a breach of unsecured PHI, subject to applicable exceptions and risk-assessment requirements.
Safeguarding Your Information
We maintain reasonable safeguards intended to protect health information against unauthorized access, use, alteration, disclosure, or destruction.
These safeguards may include:
Administrative safeguards, such as privacy policies, workforce training, access authorization, risk assessments, and incident-response procedures.
Physical safeguards, such as restricted areas, secured records, controlled access to workspaces, and secure document disposal.
Technical safeguards, such as user authentication, access controls, encryption where appropriate, system security controls, audit capabilities, and secure electronic communications.
Photographs, Testimonials, and Marketing
Clinical photographs or other images created for treatment or documentation purposes may form part of your medical record.
bio/synergy will not use identifiable clinical photographs, videos, testimonials, treatment information, or other PHI for public advertising, websites, social media, or promotional purposes unless permitted by law or appropriate written authorization has been obtained.
Authorization for marketing use is separate from your consent to receive care and may be revoked in accordance with applicable law.
Communications by Email, Text, and Electronic Systems
At your request or with appropriate consent, we may communicate with you by telephone, email, text message, patient portal, or other electronic means.
Electronic communications may involve privacy risks depending on the communication method. We will use reasonable safeguards and will comply with applicable HIPAA and Maryland requirements when transmitting PHI.
Complaints
If you believe your privacy rights have been violated, you may file a complaint with bio/synergy Health + Wellness.
bio/synergy Health + Wellness
7161 Woodmont Avenue
Bethesda, MD 20814
Phone: (301) 664-4365
Email: info@biosynergyhw.com
You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights.
bio/synergy Health + Wellness will not retaliate against you for filing a privacy complaint or exercising your privacy rights. HIPAA specifically requires covered entities to provide patients with information about their right to complain and prohibits retaliation for exercising HIPAA rights.
Changes to This Notice
We reserve the right to change this Notice and our privacy practices as permitted by law. Any revised Notice may apply to health information we already maintain as well as information we receive in the future.
When material changes are made, the revised Notice will be made available upon request, posted at our facility, and posted on our website as required by applicable law. HIPAA requires covered providers with websites describing their services to prominently post their current Notice of Privacy Practices online.
Maryland Privacy Protections
In addition to HIPAA, bio/synergy Health + Wellness follows applicable provisions of the Maryland Confidentiality of Medical Records Act, Maryland Health–General Article, Title 4, Subtitle 3.
Where Maryland law provides greater privacy protection than federal law, we will follow the more protective requirement to the extent required by law.
Maryland law generally requires health care providers to maintain medical records confidentially, specifies requirements for patient authorizations, establishes rights to inspect and correct records, and identifies circumstances under which records may or must be disclosed without authorization.