Notice of Privacy Practices

This Notice of Privacy Practices describes how BlackPoint Diagnostics may use and disclose your Protected Health Information to carry out treatment, payment, or healthcare operations, and for other purposes that are permitted or required by law. It also describes your rights to access and control your Protected Health Information.

Effective Date: March 1, 2025

Protected Health Information (PHI) is information about you, including demographic data, that relates to your past, present, or future physical or mental health condition, the provision of health care to you, or the past, present, or future payment for the provision of health care to you, and that identifies you or for which there is a reasonable basis to believe it can be used to identify you.

For Treatment: We may use or disclose your PHI to provide, coordinate, or manage your healthcare and any related services. This includes sharing information with other healthcare providers who may be involved in your care, such as the board-certified cardiologist who reviews and interprets your imaging studies.

For Payment: We may use and disclose your PHI so that the services you receive are properly billed and payment is collected. This includes processing transactions through our HIPAA-compliant payment processor.

For Healthcare Operations: We may use and disclose your PHI in connection with our healthcare operations, including quality assessment, improving services, training, and ensuring proper credentialing and compliance.

Other Permitted Uses and Disclosures: We may also use or disclose your PHI without your authorization in the following circumstances:

• As required by law, including reporting to public health authorities
• To avert a serious threat to your health or safety or the health or safety of others
• To comply with workers' compensation or similar programs
• In response to a court order, subpoena, or other lawful process
• To authorized federal officials for lawful intelligence and national security activities

Uses Requiring Your Authorization: Other uses and disclosures of your PHI not described in this Notice will be made only with your written authorization. You may revoke such authorization in writing at any time, except to the extent that we have already taken action in reliance upon it.

You have the following rights regarding the PHI we maintain about you:

Right to Inspect and Copy: You have the right to inspect and receive a copy of your PHI that is contained in a designated record set. To request access, submit a written request to us at the contact information below. We may charge a reasonable fee for copying.

Right to Amend: If you believe the PHI we have about you is incorrect or incomplete, you may request that we amend your information. Your request must be made in writing and include a reason supporting the request. We may deny your request under certain circumstances.

Right to an Accounting of Disclosures: You have the right to request an accounting of certain disclosures we have made of your PHI. This right does not apply to disclosures made for treatment, payment, or healthcare operations purposes.

Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures of your PHI. We are not required to agree to a restriction, except when you request that we restrict disclosure of PHI to a health plan for a service you paid for entirely out of pocket.

Right to Request Confidential Communications: You have the right to request that we communicate with you in a certain way or at a certain location. We will accommodate reasonable requests.

Right to a Paper Copy of This Notice: You have the right to a paper copy of this Notice at any time, even if you have agreed to receive it electronically. Contact us at the information below to request a copy.

Right to Be Notified of a Breach: You have the right to be notified if there is a breach of your unsecured PHI as required by applicable law.

BlackPoint Diagnostics maintains appropriate administrative, technical, and physical safeguards to protect the privacy and security of your PHI. All scheduling and payment processing is handled through HIPAA-compliant platforms under signed Business Associate Agreements. Imaging data and reports are transmitted and stored using secure, encrypted systems.

We have executed a Business Associate Agreement with Acuity Scheduling (Squarespace) for scheduling and billing services, and with our cardiologist partner for interpretation services.

We reserve the right to change this Notice at any time. We reserve the right to make the revised or changed Notice effective for PHI we already have about you as well as any information we receive in the future. The effective date will be listed on the Notice. You are entitled to a copy of the Notice currently in effect.

The current version of this Notice will be posted on our website at blackpointdiagnostics.com.

If you believe your privacy rights have been violated, you may file a complaint with BlackPoint Diagnostics or with the Secretary of the U.S. Department of Health and Human Services. To file a complaint with us, contact us using the information below. All complaints must be submitted in writing.

You will not be retaliated against for filing a complaint.

To file a complaint with the U.S. Department of Health and Human Services, visit hhs.gov/ocr/privacy/hipaa/complaints.

For questions about this Notice, to exercise any of your rights described above, or to file a privacy complaint, please contact our Privacy Officer:

BlackPoint Diagnostics
Privacy Officer: Emanuel Papadakis, RDCS, RVT
Email: emanuel@blackpointdiagnostics.com
Phone: (207) 409-7797
Southern Maine

This Notice is effective as of March 1, 2025.