HIPAA Notice of Privacy Practices

1. Who We Are

Blue Spine, located at 600 Cleveland St, Suite 300, Clearwater, FL 33755, is a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations. This means we are required by law to maintain the privacy of your health information, to provide you with this Notice of our legal duties and privacy practices with respect to your health information, and to notify you following a breach of your unsecured protected health information.

This Notice is effective as of June 23, 2026, and applies to all protected health information we create or receive about you in connection with your care at Blue Spine.

2. What Is Protected Health Information (PHI)?

Protected Health Information (PHI) is any information we hold that:

• Relates to your past, present, or future physical or mental health condition
• Relates to the provision of health care to you
• Relates to past, present, or future payment for the provision of health care to you
• Identifies you or could reasonably be used to identify you

PHI includes information in your medical records, imaging and diagnostic results, treatment notes, billing records, and any other information in identifiable form that we create or receive about your health.

3. Permitted Uses and Disclosures of PHI

Federal law permits us to use and disclose your PHI without your written authorization for the following purposes:

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your health care and related services. For example, we may share your medical records with referring physicians, specialists, anesthesiologists, physical therapists, or other providers involved in your care. We may also share your PHI with outside facilities such as hospitals, surgical centers, or imaging centers to which we refer you.

Payment

We may use and disclose your PHI to obtain payment for health care services provided to you. For example, we may submit claims to your health insurance company, Medicare, Medicaid, or other payers, and provide them with information about your diagnoses and treatments to justify the services billed.

Health Care Operations

We may use and disclose your PHI to support our business operations, including:

• Quality assessment and improvement activities
• Medical education and training of staff
• Peer review and performance evaluation
• Audits, compliance programs, and legal services
• Business planning and management

As Required by Law

We will disclose your PHI when required by federal, state, or local law, including to comply with court orders, administrative orders, or subpoenas.

Public Health and Safety Activities

We may disclose your PHI to public health authorities for activities including preventing or controlling disease, injury, or disability; reporting births and deaths; and reporting reactions to medications or product problems to the FDA.

Health Oversight Activities

We may disclose your PHI to a health oversight agency (such as the Florida Agency for Health Care Administration or the U.S. Department of Health and Human Services) for authorized oversight activities including audits, investigations, and inspections.

Research

Under certain circumstances and with appropriate safeguards, we may use or disclose your PHI for research purposes, including when a Research Authorization Board has approved the waiver of written authorization.

Business Associates

We share PHI with our business associates — companies and individuals that perform services on our behalf that require access to your PHI (such as billing services, medical transcription, or IT support). We require all business associates to sign written agreements obligating them to protect the privacy and security of your PHI in accordance with HIPAA.

Appointment Reminders and Health-Related Communications

We may use your PHI to contact you with reminders about upcoming appointments. We may also contact you to provide information about treatment alternatives or other health-related benefits or services that may be of interest to you.

4. Uses and Disclosures Requiring Your Written Authorization

For uses and disclosures of PHI not described in this Notice, we will ask for your written authorization. You have the right to revoke an authorization at any time, in writing. The revocation will not apply to uses or disclosures already made in reliance on your authorization.

We will not use or disclose the following without your written authorization:

• Marketing — use of your PHI for most marketing purposes
• Sale of PHI — we do not sell your PHI
• Psychotherapy notes — if applicable
• Most other uses and disclosures not described in this Notice

5. Your Rights Regarding Your Protected Health Information

You have the following rights with respect to your PHI. To exercise any of these rights, submit a written request to our Privacy Officer at the contact information in Section 9.

Right to Inspect and Copy

You have the right to inspect and obtain a copy of your PHI in our designated record set, including your medical records and billing records. We may charge a reasonable, cost-based fee for copies. We must respond to your request within 30 days. In certain limited circumstances, we may deny your request, and if so, we will explain the reason for the denial and describe your right to have the denial reviewed.

Right to Amend

If you believe that PHI in your record is incorrect or incomplete, you have the right to request that we amend the information. We may deny your request if we did not create the information, if the information is accurate and complete, or if the information is not part of the designated record set. If we deny your request, you may submit a written statement of disagreement that will be kept with your record.

Right to an Accounting of Disclosures

You have the right to request an accounting of certain disclosures of your PHI made by us during the six years prior to your request. This accounting does not include disclosures for treatment, payment, health care operations, or certain other disclosures. We will provide the first accounting in any 12-month period at no charge; subsequent requests may incur a reasonable fee.

Right to Request Restrictions

You have the right to request restrictions on certain uses and disclosures of your PHI. We are not required to agree to your requested restriction, except that we must agree to your request not to disclose PHI to your health plan for payment or health care operations purposes when you have paid for the service in full and out-of-pocket. If we agree to a restriction, we will honor it unless the disclosure is necessary to provide emergency treatment.

Right to Request Confidential Communications

You have the right to request that we communicate with you about your PHI in a certain way or at a certain location. For example, you may ask us to contact you only at your work phone number or to send correspondence only to a post office box. We will accommodate reasonable requests.

Right to a Copy of This Notice

You have the right to a paper copy of this Notice at any time, even if you have agreed to receive this Notice electronically. To obtain a paper copy, contact our Privacy Officer at the information in Section 9, or ask any staff member at our office.

6. Our Legal Duties

We are required by law to:

• Maintain the privacy of your PHI
• Provide you with this Notice of our legal duties and privacy practices
• Abide by the terms of the Notice currently in effect
• Notify you if there is a breach of your unsecured PHI

7. Changes to This Notice

We reserve the right to change this Notice and to make the revised or changed Notice effective for PHI we already have as well as PHI we receive in the future. We will post the revised Notice on our website at https://www.bluespine.com/hipaa and will have paper copies available at our office. The effective date of the current version is shown at the top of this Notice.

8. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Secretary of Health and Human Services. To file a complaint with us, contact our Privacy Officer at the information in Section 9. To file a complaint with the federal government:

We will not retaliate against you for filing a complaint.

9. Contact Our Privacy Officer

For questions about this Notice, to request access to your records, or to exercise any of your rights described herein, please contact our Privacy Officer: