Notice of Privacy Practices

---

Effective Date: March 6, 2026

Smart Spine and Rehab
www.smartspineandrehab.com

This Notice of Privacy Practices describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Smart Spine and Rehab is committed to protecting your health information. We are required by law to:

• Maintain the privacy of your Protected Health Information (PHI)
• Provide you with this notice of our legal duties and privacy practices
• Follow the terms of the notice currently in effect
• Notify you if we are unable to accommodate a requested restriction or confidential communication

We may use or disclose your PHI for the following purposes without obtaining your written authorization:

Treatment: We may use your health information to provide you with chiropractic care, physical therapy, and therapeutic exercise services. We may disclose your information to other healthcare providers involved in your care, including physicians, specialists, or other therapists who need the information to treat you.

Payment: We may use and disclose your health information to bill and collect payment for services provided. This may include submitting claims to your health insurance company, verifying coverage, and responding to payment-related inquiries.

Healthcare Operations: We may use your information to improve the quality of care we provide, train staff, conduct business planning, and perform other necessary business functions.

Appointment Reminders: We may contact you to remind you of scheduled appointments via phone, text message, or email.

Treatment Alternatives: We may contact you to provide information about treatment alternatives or other health-related services that may be of interest to you.

Health Information Exchange: With your consent where required by law, we may share your health information through secure electronic health information exchanges to coordinate your care with other providers.

As Required by Law: We will disclose your health information when required to do so by federal, state, or local law, including reporting to state and federal agencies that regulate our profession.

Public Health Activities: We may disclose your health information to public health authorities for purposes such as preventing or controlling disease, injury, or disability, and reporting adverse events related to products or services.

Victims of Abuse, Neglect, or Domestic Violence: We may disclose your health information to appropriate authorities if we reasonably believe you are a victim of abuse, neglect, or domestic violence, to the extent required or authorized by law.

Health Oversight Activities: We may disclose your health information to health oversight agencies for activities such as audits, investigations, inspections, and licensure actions.

Judicial and Administrative Proceedings: We may disclose your health information in response to a court order, subpoena, discovery request, or other lawful process.

Law Enforcement: We may disclose limited health information to law enforcement officials in response to a warrant, summons, court order, or in certain emergency situations.

Coroners, Medical Examiners, and Funeral Directors: We may disclose health information to coroners, medical examiners, or funeral directors as necessary to carry out their duties.

Serious Threat to Health or Safety: We may use or disclose your health information if we believe in good faith that disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of the public or another person.

Workers' Compensation: We may disclose your health information as authorized by and to comply with workers' compensation laws or similar programs.

Military and Veterans: If you are a member of the armed forces, we may release your health information as required by military command authorities.

National Security and Intelligence Activities: We may disclose your health information to authorized federal officials for intelligence, counterintelligence, protection of the President, and other national security activities authorized by law.

Inmates: If you are an inmate of a correctional institution or under the custody of law enforcement, we may release your health information to the institution or law enforcement official as necessary for your health, the health and safety of others, or the safety and security of the correctional institution.

Reproductive Health (2026 Update): In accordance with 2024-2026 updates to the HIPAA Privacy Rule, we will not disclose PHI for the purpose of investigating or prosecuting the seeking, providing, or receiving of legal reproductive health care.

Substance Use Disorder (SUD) Records: We follow strict alignment with 42 CFR Part 2 regarding the confidentiality of any SUD records.

Psychotherapy Notes: We will obtain your written authorization before using or disclosing psychotherapy notes, except for certain treatment, payment, or healthcare operations purposes or as otherwise required by law.

Marketing: We will obtain your written authorization before using your health information for marketing purposes, except for face-to-face communications or promotional gifts of nominal value.

Sale of PHI: We will obtain your written authorization before selling your health information, with limited exceptions as permitted by law.

Other Uses: Other uses and disclosures not described in this notice will be made only with your written authorization. You may revoke your authorization in writing at any time, except to the extent we have already taken action in reliance on your authorization.

You have the following rights regarding your Protected Health Information:

Right to Inspect and Copy: You have the right to inspect and obtain a copy of your health information that we maintain in a designated record set (such as medical and billing records) for as long as we maintain the information. To inspect or copy your health information, you must submit a written request. We may charge a reasonable fee for copying, mailing, and supplies. In limited circumstances, we may deny your request, and you may request a review of the denial by another licensed healthcare professional chosen by us.

Right to Amend: If you believe your health information is incorrect or incomplete, you may request that we amend it. Your request must be in writing and include a reason supporting your request. We may deny your request if the information was not created by us, is not part of the records we maintain, is not part of the information you would be permitted to inspect and copy, or is accurate and complete.

Right to an Accounting of Disclosures: You have the right to request an accounting of certain disclosures of your health information made by us during the six years prior to your request (or a shorter period if you request). The accounting will not include disclosures made for treatment, payment, healthcare operations, disclosures made to you, disclosures authorized by you, disclosures for national security purposes, or disclosures to correctional institutions or law enforcement. Your request must be in writing. The first accounting within a 12-month period is free; we may charge a reasonable fee for additional requests.

Right to Request Restrictions: You have the right to request restrictions on how we use or disclose your health information for treatment, payment, or healthcare operations, or to restrict disclosures to persons involved in your care. We are not required to agree to your request except in one situation: if you pay for a service or healthcare item out-of-pocket in full and request that we not disclose information about that service or item to your health plan for payment or healthcare operations purposes, we must honor that request unless disclosure is required by law.

Right to Request Confidential Communications: You have the right to request that we communicate with you about your health information in a specific manner or at a specific location. For example, you may request that we contact you only by mail or at a different address. Your request must be in writing and must specify how or where you wish to be contacted. We will accommodate reasonable requests.

Right to a Paper Copy of This Notice: You have the right to obtain a paper copy of this Notice of Privacy Practices at any time, even if you have agreed to receive it electronically. You may request a copy by contacting us at the information provided below.

Right to Be Notified of a Breach: You have the right to be notified in the event that we (or one of our Business Associates) discover a breach of your unsecured Protected Health Information.

In addition to HIPAA, Smart Spine and Rehab complies with applicable Illinois privacy and security requirements related to billing and patient information.

• Illinois Personal Information Protection Act (PIPA): We maintain safeguards consistent with the Illinois Personal Information Protection Act (PIPA). Under PIPA, certain data elements (including health insurance information and medical records) are treated as sensitive personal information and are protected accordingly.
• Illinois Medical Patient Rights Act: We adhere to the Illinois Medical Patient Rights Act and will maintain patient confidentiality throughout the billing and insurance claim process, consistent with applicable law.
• Billing and insurance uses of PHI: We may use and disclose Protected Health Information (PHI) as needed to verify insurance eligibility, process and manage claims, obtain payment, and to facilitate billing-related communications such as Explanations of Benefits (EOBs) issued by your health plan.
• Right to request Confidential Communications (Illinois residents): Illinois residents may request Confidential Communications to help maintain privacy, including directing billing statements, claim-related communications, or EOB-related correspondence to an alternative address or by an alternative method (for example, mailing to a different address). Requests must be made in writing and must specify how or where you wish to be contacted. We will accommodate reasonable requests, consistent with law.
• Third-party billing vendors: If we use a third-party billing company or other billing-related vendor, that vendor is required by contract to protect PHI and to maintain privacy and security standards consistent with HIPAA and applicable Illinois-specific requirements, including PIPA-related safeguards.

If you choose to use a Health Savings Account (HSA) or Flexible Spending Account (FSA), we may use or disclose certain Protected Health Information (PHI) as needed to support payment and reimbursement.

• Sharing PHI with HSA/FSA administrators: PHI may be shared with your HSA or FSA administrator (or its payment processor/administrator) to facilitate payment, verify eligible medical expenses, substantiate claims, or process reimbursements.
• Minimum Necessary: When we disclose PHI for HSA/FSA payment or substantiation, we follow HIPAA’s Minimum Necessary standard and share only the essential information required (for example, dates of service, billing codes, amounts, and provider/practice information), unless a broader disclosure is required by law or authorized by you.
• Patient responsibility for documents provided to you: If we provide an itemized statement and/or “superbill” directly to you for HSA/FSA reimbursement, please understand that once the document leaves our office (including if sent to you by email, mail, patient portal download, or physical pickup), you are responsible for safeguarding it and for how you share or store it.
• Secure electronic transfers: Any electronic transfers of billing or payment-related data to third-party administrators are made through secure, encrypted channels consistent with HIPAA standards.
• HSA/FSA privacy obligations: HSA/FSA providers and administrators are typically HIPAA Covered Entities or Business Associates (or work with such entities) and are legally required to maintain their own privacy and security protocols for the information they receive.

Smart Spine and Rehab offers telehealth services, including virtual consultations and therapeutic exercise instruction via secure video platforms. When receiving telehealth services:

• We use platforms that are encrypted and HIPAA-compliant with signed Business Associate Agreements in place
• You should ensure you are in a private location where others cannot overhear your consultation
• We recommend using a secure, password-protected internet connection rather than public Wi-Fi
• Recording of telehealth sessions by either party is prohibited without prior written consent
• The same privacy protections apply to telehealth visits as apply to in-person visits
• 
  

We are required by law to:

• Maintain the privacy and security of your Protected Health Information
• Provide you with this notice of our privacy practices and legal duties
• Follow the terms of the notice currently in effect
• Notify you if we are unable to accommodate a requested restriction or confidential communication
• Notify affected individuals following a breach of unsecured Protected Health Information

We reserve the right to change our privacy practices and the terms of this notice. If we make a material change to our privacy practices, we will revise this notice and post the new notice on our website at www.smartspineandrehab.com. The new notice will apply to all Protected Health Information we maintain, including information created or received before the changes were made. We will also make the new notice available upon request.

If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services. You will not be retaliated against or penalized for filing a complaint.

To file a complaint with Smart Spine and Rehab:

Dr. Julia Cherner, DC
Privacy Officer
Smart Spine and Rehab
www.smartspineandrehab.com

To file a complaint with the U.S. Department of Health and Human Services:

Office for Civil Rights
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
Phone: 1-877-696-6775
Website: www.hhs.gov/ocr/privacy/hipaa/complaints/

If you have questions about this Notice of Privacy Practices or wish to exercise any of your rights described herein, please contact:

Julia Cherner, DC
Smart Spine and Rehab
(847) 416-6173
Info@SmartSpineAndRehab.com

ACKNOWLEDGMENT OF RECEIPT

By proceeding with services, you acknowledge that you have been provided with a copy of this Notice of Privacy Practices and have been given an opportunity to review it.

This Notice of Privacy Practices is effective as of February 22, 2026, and complies with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Parts 160 and 164) as amended, including updates effective March 26, 2026.