THRIVE CHIROPRACTIC AND WELLNESS

Notice of Privacy Practices

Updates Effective May 28, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THAT INFORMATION. PLEASE REVIEW THIS NOTICE CAREFULLY.

Thrive Chiropractic and Wellness (the “Practice”), in accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, (the “Privacy Rule”) and applicable state law, is committed to protecting the privacy of your protected health information (“PHI”). PHI includes information about your health condition and the care and treatment you receive from the Practice. The Practice understands that information about your health is personal.
This Notice explains how your PHI may be used and disclosed to third parties. This Notice also details your rights regarding your PHI. The Practice is required by law to maintain the privacy of your PHI and to provide you with this Privacy Notice detailing the Practice’s legal duties and practices with respect to your PHI. The Practice is required by law to notify affected individuals following a breach of unsecured protected health information as required by applicable federal and state law. The Practice is also required by law to abide by the terms of this Notice.
The Practice reserves the right to change the terms of this Notice at any time. Any changes will apply to all protected health information maintained by the Practice. Updated versions of this Notice will be available in our office and on our website.

HOW THE PRACTICE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION

The Practice, in accordance with this Notice and without asking for your express consent or authorization, may use and disclose your PHI for the purposes of:

For Treatment – We may use your PHI to provide you with treatment. We may disclose your PHI to doctors, nurses, technicians, clinicians, medical students, hospitals and other health facilities involved in or consulting in your care. We may also disclose information about you to people outside the practice, such as other health care providers involved in providing treatment to you, and to people who may be involved in your care, such as family members, or others we use to provide services that are part of your care. If we refer you to another health care provider, we would, as part of the referral process, share PHI information about you. For example, if you were referred to a specialist, we would contact the doctor’s office and provide such information about you to them so that they could provide services to you.

For Payment – We may use and disclose your PHI so we can be paid for the services we provide to you. For example, we may need to give your insurance company information about the health care services we provided to you so your insurance company will pay us for those services or reimburse you for amounts you have paid. We also may need to provide your insurance company or a government program, such as Medicare or Medicaid, with information about your condition and the health care you need to receive prior approval or to determine whether your plan will cover the services.

For Health Care Operations – We may use and disclose your PHI for our own health care operations and the operations of other individuals or organizations involved in providing your care. This is necessary for us to operate and to make sure that our patients receive quality health care. For example, we may use information about you to review the services we provide and the performance of our employees in caring for you.

OTHER USES & DISCLOSURES THAT ARE REQUIRED OR PERMITTED BY LAW

The Practice may also use and disclose your PHI without your consent or authorization in the following instances:

Appointment Reminders and Electronic Communications – We may contact you by phone call, voicemail, text message, email, patient portal, or mail regarding appointments, treatment information, health-related reminders and information about treatment alternatives as permitted by law, billing matters, or other healthcare operations. These communications may be sent using the contact information you provide to us.
While we take reasonable safeguards to protect your information, electronic communications such as email and text messaging may not always be fully secure. By providing your contact information, you acknowledge and accept these risks unless you request alternative communication methods in writing.

Website and Online Services – If you use our website, patient portal, online scheduling system, or other digital services, certain technical information may be collected through cookies, analytics tools, or similar technologies used to operate and improve our online services. We take reasonable steps to protect this information in accordance with applicable privacy laws.

Individuals Involved in Your Care or Payment for Your Care – We may disclose to a family member, other relative, a close friend, or any other person identified by you certain limited PHI that is directly related to that person’s involvement with your care or payment for your care. We may use or disclose your PHI to notify those persons of your location or general condition. This includes in the event of your death unless you have specifically instructed us otherwise. If you are unable to specifically agree or object, we may use our best judgment when communicating with your family and others.

Disaster Relief – We also may use or disclose your PHI to an authorized public or private entity to assist in disaster relief efforts. This will be done to coordinate information with those organizations in notifying a family member, other relative, close friend or other individual of your location and general condition.

De-identified Information – The Practice may use and disclose health information that may be related to your care but does not identify you and cannot be used to identify you.

Business Associates – The Practice may use and disclose PHI to one or more of its business associates if the Practice obtains satisfactory written assurance, in accordance with applicable law, that the business associate will appropriately safeguard your PHI. A business associate is an entity that assists the Practice in undertaking some essential function, such as a billing company that assists the office in submitting claims for payment to insurance companies.

Personal Representatives and Minors – The Practice may use and disclose PHI to a person who, under applicable law, has authority to act on your behalf in making healthcare decisions. In most cases, parents and legal guardians may exercise privacy rights for minor children. However, Colorado law allows minors to consent to certain healthcare services in limited circumstances, and in those situations the minor may control related health information as permitted by law.

Emergency Situations – The Practice may use and disclose PHI for the purpose of obtaining or rendering emergency treatment to you provided that the Practice attempts to obtain your Consent as soon as possible. The Practice may also use and disclose PHI to a public or private entity authorized by law or by its charter to assist in disaster relief efforts, for the purpose of coordinating your care with such entities in an emergency situation.

Public Health and Safety Activities – The Practice may disclose your PHI about you for public health activities and purposes. This includes reporting information to a public health authority that is authorized by law to collect or receive this information. These activities generally include:

• To prevent or control disease, injury or disability
• To report births or deaths
• To report child, elder, or dependent adult abuse or neglect
• To report reactions to medications or problems with products
• To notify people of recalls of products they may be using
• To notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.

Victims of Abuse, Neglect, or Domestic Violence – We may disclose your PHI to a government authority authorized by law to receive reports of abuse, neglect, or domestic violence, if we believe an adult or child is a victim of abuse, neglect, or domestic violence. This will occur to the extent the disclosure is (a) required by law, (b) agreed to by you, (c) authorized by law and we believe the disclosure is necessary to prevent serious harm, or, (d) if you are incapacitated and certain other conditions are met, a law enforcement or other public official represents that immediate enforcement activity depends on the disclosure.

Health Oversight Activities – We may disclose your PHI to a health oversight agency for activities authorized by law, including audits, investigations, inspections, licensure, or disciplinary actions. These activities and similar activities are necessary for appropriate oversight agencies to monitor the health care system, government benefit programs, and compliance with civil rights laws.

Judicial and Administrative Proceedings – We may disclose your PHI in response to a court or administrative order. We also may disclose information about you in response to a subpoena, discovery request, or other legal process, but only if efforts have been made to notify you of the request or to obtain an order protecting the information to be disclosed.

Disclosures for Law Enforcement Purposes – We may disclose your PHI to law enforcement officials for the following purposes:

• As required by law
• In response to a court order, grand jury or administrative order, warrant, subpoena, summons, or similar process
• To identify or locate a suspect, fugitive, material witness, or missing person
• About an actual or suspected victim of a crime if, under certain limited circumstances, we are unable to obtain the person's agreement
• To alert a potential victim or victims or intending harm (“duty to warn”)
• To alert law enforcement officials to a death if we suspect the death may have resulted from criminal conduct
• About crimes that occur at our facilities
• To report a crime, a victim or a crime, or a person who committed a crime in emergency circumstances

To Avert a Serious Threat to Health or Safety – We may use and disclose your PHI when we believe disclosure is necessary to prevent or lessen a serious and imminent threat to your health and safety, the health and safety of another person, or the public, as permitted or required by law. Any disclosure would be made only to someone reasonably able to help prevent or lessen the threat.

Coroners, Medical Examiners, and Funeral Directors – We may disclose your PHI to a coroner or medical examiner for purposes such as identifying a deceased person or determining the cause of death. We may also disclose information to funeral directors as necessary to carry out their duties.

Organ, Eye, or Tissue Donation – To facilitate organ, eye, or tissue donation and transplantation, we may disclose your PHI to organizations involved in organ procurement, banking, or transplantation.

Workers' Compensation – We may disclose your PHI as authorized by and to the extent necessary to comply with workers' compensation and similar laws that provide benefits for work-related injuries or illnesses without regard to fault.

Special Government Functions – If you are a member of the armed forces, we may release your PHI as required by military command authorities. We may also release information about you to authorized federal officials for intelligence, counter-intelligence and other national security activities authorized by law.

Research – We may use and/or disclose your PHI for research projects that are subject to a special review process. If researchers are allowed access to information that identifies who you are, we will ask for your permission.

AUTHORIZATION

The following uses and/or disclosures specifically require your express written permission:

Marketing Purposes – We will not use or disclose your PHI for marketing purposes for which we have accepted payment without your express written permission. We may communicate with you about treatment alternatives, health-related products, wellness services, or other services offered by our Practice that may be of interest to you. We will obtain authorization when required by law for marketing communications involving third-party compensation.

Sale of Health Information – We will not sell your PHI without your written authorization. If you do authorize such a sale, the authorization will disclose that we will receive compensation for the information that you have authorized us to sell. You have the right to revoke the authorization at any time, which will halt any future sale.

Uses and/or disclosures other than those described in this Notice will be made only with your written authorization. If you do authorize a use and/or disclosure, you have the right to revoke that authorization at any time by submitting a revocation in writing to our Privacy Officer. However, revocation cannot be retroactive and will only impact uses and/or disclosures after the date of revocation.

YOUR RIGHTS

Right to Revoke Authorization – You have the right to revoke any Authorization or consent you have given to the Practice, at any time. To request a revocation, you must submit a written request to the Practice’s Privacy Officer

Right to Request Restrictions – You have the right to request that we restrict the uses or disclosures of your information for treatment, payment or healthcare operations. You may also request that we limit the information we share about you with a relative or friend of yours. You also have the right to restrict disclosure of information to your commercial health insurance plan regarding services or products that you paid for in full, out-of-pocket, and we will abide by that request unless we are legally obligated not to do so.
We are not required to agree to any other requested restriction. If we agree, we will follow your request unless the information is needed to a) give you emergency treatment, b) report to the Department of Health and Human Services, or c) the disclosure is described in the “Uses and Disclosures That Are Required or Permitted by Law” section. To request a restriction, you must submit your request in writing to the Practice’s Privacy Officer. You must tell us a) what information you want to limit, b) whether you want to limit use or disclosure or both, and c) to whom you want the limits to apply. Either you or we can terminate restrictions at a later date.

Right to Receive Confidential Communications – You have the right to request that we communicate your PHI in a certain way or at a certain place. For example, you can ask that we only contact you by mail or at work.
If you want to request confidential communications, you must do so in writing to our Practice’s Privacy Officer and explain how or where you can be contacted. You do not need to give us a reason for your request. We will accommodate all reasonable requests.

Right to Inspect and Copy – You have the right to inspect and request copies of your information.
To inspect or copy your information, you may either complete an Authorization to Release/Obtain Information form or write a letter of request, stating the type of information to be released, the date(s) of service being requested, the purpose of the request, and whether you wish to review the record or receive copies of the requested information in your preferred format. You may request an electronic copy of your records if the information is maintained electronically. We will provide records in the form and format requested when readily producible, or in another agreed-upon electronic format. You may also request that your records be sent to another person that you have designated in writing. Direct this request to the Practice’s Privacy Officer. You may be charged a fee for the cost of copying, mailing or other expenses related with your request.
We may deny your request to inspect and copy information in a few limited situations. If your request is denied, you may ask for our decision to be reviewed. The Practice will choose a licensed health care professional to review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of that review.

Right to Amend – If you feel that your PHI is incorrect, you have the right to ask us to amend it, for as long as the information is maintained by us. To request an amendment, you must submit your request in writing to the Practice’s Privacy Officer. You must provide a reason for the amendment.
We may deny your request for an amendment if it is not in writing or does not include a reason for wanting the amendment. We also may deny your request if the information a) was not created by us, unless the person or entity that created the information is no longer available to amend the information, b) is not part of the information maintained by the Practice, c) is not information that you would be permitted to inspect and copy, or d) is accurate and complete.
If your request is granted, the Practice will make the appropriate changes and inform you and others, as needed or required. If we deny your request, we will explain the denial in writing to you and explain any further steps you may wish to take.

Right to an Accounting of Disclosures – You have the right to request an accounting of disclosures. This is a list of certain disclosures we have made regarding your PHI. To request an accounting of disclosures, you must write to the Practice’s Privacy Officer. Your request must state a time period for the disclosures. The time period may be for up to six years prior to the date on which you request the list, but may not include disclosures made before April 14, 2003.
There is no charge for the first list we provide to you in any 12-month period. For additional lists, we may charge you for the cost of providing the list. If there will be a charge, we will notify you of the cost in advance. You may withdraw or change your request to avoid or reduce the fee.
Certain types of disclosures are not included in such an accounting. These include disclosures made for treatment, payment or healthcare operations; disclosures made to you or for our facility directory; disclosures made with your authorization; disclosures for national security or intelligence purposes or to correctional institutions or law enforcement officials in some circumstances.

Right to a Paper Copy of this Notice – You have the right to receive a paper copy of this Notice of Privacy Practices, even if you have agreed to receive this Notice electronically. You may request a paper copy of this Notice at any time.

Right to File a Complaint – You have the right to complain to the Practice or to the United States Secretary of Health and Human Services (as provided by the Privacy Rule) if you believe your privacy rights have been violated. To file a complaint with the Practice, contact the Practice’s Privacy Officer:

Privacy Officer
Thrive Chiropractic and Wellness
1190 E. Bridge Street
Brighton, CO 80601
Phone: 303-827-4236
Email: drk@thrivebrighton.com

You can file a complaint with the U.S. Department of Health and Human Services’ Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting https://www.hhs.gov/hipaa/filing-a-complaint/index.html.

We will not retaliate against you for filing a privacy complaint or exercising your rights under HIPAA.