Notice of Privacy Practices

Effective October 12, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice applies to Sultan Allergy & Immunology, A Medical Corporation, doing business as Sultan Allergy & Immunology Medical Clinic (the clinic, we, or us), and the health information we maintain about your care. It explains your choices, rights, and how to contact us.

Privacy contact

Sultan Majid, Privacy Officer | (760) 650-1969 81709 Dr Carreon Blvd Ste C4, Indio, CA 92201 Website sultanallergy.com

Treatment

We may use and share information to provide and coordinate your care. For example, we may share allergy testing results or medication information with another clinician treating you. We may contact you about appointments, treatment options, or services relevant to your care.

Payment

We may use and share information to obtain payment for your care, check benefits, and process claims. For example, we may send your health plan the information needed to review a claim, subject to applicable restrictions.

Health care operations and service providers

We may use information to manage the clinic, assess quality, train staff, and meet legal and administrative obligations. Vendors that handle protected health information on our behalf must meet applicable privacy requirements, including business associate safeguards when required.

Optional AI assistance with clinical notes

With separate consent, our EMR’s built-in AI documentation feature may capture visit audio to help prepare clinical notes. It does not record video, and audio files are not retained. The clinician reviews the draft before using it as the clinical note. Clinical documentation is retained in your medical record. You may decline recording or ask that it stop without losing access to care.

Your Privacy Rights

Contact the Privacy Officer to exercise these rights or obtain a request form. We may verify your identity or a representative’s authority without creating unreasonable barriers.

Inspect or obtain your records

You may request access to or a paper or electronic copy of records we maintain about you, subject to limited legal exceptions. For requests covered by California law, inspection is generally available within five working days and copies within 15 days of a written request. We follow applicable federal and California deadlines and any permitted exceptions. Fees, if any, are limited by law; some requests qualify for free copies. A denial will explain applicable review rights.

Request a correction

You may ask in writing to amend information you believe is incorrect or incomplete and explain why. We may deny a request when legally permitted, for example if the record is accurate and complete. We generally respond within 60 days; one extension of up to 30 days requires written notice. A denial explains the reason, your right to submit a statement of disagreement, and how to complain.

Request confidential communications

You may ask us to contact you at a different address or in a particular way. We accommodate reasonable requests. You do not have to explain why you want an alternative method.

Request limits on use or disclosure

You may ask us to limit information used or shared for treatment, payment, or operations. We are not required to accept every request. However, if you pay for an item or service in full out of pocket, we must honor a request not to disclose the related information to your health plan for payment or operations, unless disclosure is required by law. Agreed restrictions remain subject to lawful exceptions, including emergency treatment.

Receive an accounting of disclosures

You may request an accounting of covered disclosures for up to six years before your request. It excludes treatment, payment, operations, and other categories excluded by law. The first accounting in 12 months is free. For additional requests, we will explain any reasonable fee and let you withdraw or narrow your request. We generally respond within 60 days; one extension of up to 30 days requires written notice.

Receive this notice or use a representative

You may obtain a paper copy at any time, including after agreeing to electronic delivery. A legally authorized personal representative may exercise your rights, subject to applicable law and verification of authority. Special rules protect minors’ confidential care.

Other Permitted Uses and Disclosures

The following disclosures are allowed or required only when the applicable legal conditions are met. More protective federal or California law takes priority; this notice does not create permission to disregard those protections.

Public health and safety

We may share information with authorized agencies to prevent or control disease, report adverse drug reactions or product issues, report abuse or neglect when required or permitted, or reduce a serious and imminent threat to health or safety.

Oversight and compliance

We may share information for authorized inspections, audits, licensing, and other health oversight activities. We must provide information to HHS when required to investigate compliance with federal privacy requirements.

Legal requests and required reports

We may disclose information required by law or in response to qualifying court orders, subpoenas, or law enforcement requests when legal safeguards are satisfied. Not every request, subpoena, or officer inquiry authorizes disclosure.

Other specific purposes

When the law permits, we may share information for workers’ compensation, organ or tissue donation, a coroner or medical examiner, funeral services, military or national security functions, and correctional health or safety purposes. Research uses require the applicable authorization, waiver, or other lawful basis.

Additional protections for sensitive records

California and federal laws may impose additional restrictions on HIV information, mental health information, psychotherapy notes, minors’ confidential care, and substance use disorder records. We disclose HIV test results only with authorization or as a specific law permits. Psychotherapy notes generally require separate authorization. Information about a minor’s confidential care is disclosed to parents or guardians only as law allows. We obtain additional permission when required and apply the more protective rule.

Substance use disorder records protected by Part 2

If we receive or maintain records protected by 42 CFR Part 2, we apply those protections. Such records may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you without your specific written consent or a qualifying court order and subpoena or similar legal mandate. A general treatment or payment consent does not itself authorize that use. A qualifying treatment, payment, and operations consent may permit certain redisclosures under HIPAA, subject to Part 2 restrictions.

Information disclosed to another recipient may be shared again and may no longer be protected by HIPAA. Part 2 and other laws may continue to restrict its use and disclosure.

Your Choices and Our Responsibilities

Family and others involved in care

You may tell us whom we may involve in your care or payment and what relevant information we may share. We will give you an opportunity to agree or object when appropriate. If you cannot express a preference, we may share information when permitted and consistent with professional judgment and your best interests, including permitted disaster-relief notifications.

Written authorization and withdrawal

Uses or disclosures not described in this notice require your written authorization unless otherwise permitted or required by law. Most uses of psychotherapy notes, marketing uses that require authorization, and sale of protected health information require specific written permission. You may revoke an authorization in writing to the Privacy Officer, except to the extent we already relied on it or another legal exception applies.

Our duties

We must protect the privacy of your health information, provide this notice, and follow the notice currently in effect. We must notify you when a breach requires notice under applicable law. We will not retaliate against you for exercising privacy rights or filing a complaint.

Changes to this notice

We may revise our privacy practices and this notice as permitted by law. A revised notice may apply to information we already have as well as new information. The current notice will be available at the clinic, upon request, and on our website.

Questions and complaints

Contact Sultan Majid, Privacy Officer, at (760) 650-1969 or write to the clinic at 81709 Dr Carreon Blvd Ste C4, Indio, CA 92201. You may also complain to the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/hipaa/filing-a-complaint, call 1-800-368-1019, or write to 200 Independence Avenue SW, Washington, DC 20201. You will not be penalized for filing a complaint.