Notice of Privacy Practices

High Country Oxygen is required by HIPAA, the HITECH Act, and applicable Colorado state laws to maintain the privacy of your Protected Health Information (“PHI”), provide you with this Notice of our legal duties and privacy practices, and abide by the terms of this Notice as currently in effect. PHI is any individually identifiable information that relates to your past, present, or future physical or mental health condition, the provision of health care to you, or the payment for such health care, maintained in any form — electronic, paper, or verbal.

We may use or disclose your PHI to provide, coordinate, or manage your health care and related services. For example, we may share your PHI with your prescribing physician, other health care providers involved in your care, or equipment manufacturers to ensure you receive the correct equipment and services. Payment We may use or disclose your PHI to obtain payment for the equipment and services we provide. For example, we may share information with your health insurance plan, Medicare, Medicaid, or other third-party payors to verify coverage, obtain prior authorization, determine benefits eligibility, or submit claims.

We may use or disclose your PHI to support our business operations, including quality assessment and improvement, performance evaluations, staff training, accreditation activities (including ACHC accreditation surveys), compliance programs, auditing, and business planning.

We may disclose your PHI to business associates who perform functions on our behalf, such as billing companies, software vendors, and delivery contractors. All business associates are required to protect your PHI under a written Business Associate Agreement as required by HIPAA.

We may also use or disclose your PHI without your authorization as permitted or required by law, including:

• As required by federal, state, or local law

• For public health activities, such as reporting disease or adverse events

• To report suspected abuse, neglect, or domestic violence

• For health oversight activities, including government audits and investigations

• In response to a court order, subpoena, or other lawful process

• To law enforcement officials for certain law enforcement purposes

• To coroners, medical examiners, and funeral directors as necessary

• For research purposes approved by an appropriate review board

• To avert a serious and imminent threat to health or safety

• For specialized government functions (military, national security)

• For workers’ compensation purposes as authorized by law

• To remind you of scheduled deliveries, appointments, or equipment maintenance

• To provide information about treatment alternatives or health-related benefits

• For FDA purposes, including product recalls, tracking, and post-market surveillance

We will obtain your written authorization before using or disclosing your PHI for purposes not described above, including marketing communications (except face-to-face communications and promotional gifts of nominal value), sale of your PHI, and any other use not permitted or required by HIPAA. You may revoke any authorization at any time in writing, except to the extent we have already acted in reliance on it.

• Right to Access: You may inspect and obtain a copy of your PHI. Submit your request in writing. We will respond within 30 days. A reasonable, cost-based fee may apply.

• Right to Request Amendment: You may request an amendment to your PHI if you believe it is incorrect or incomplete. Submit your request in writing with the reason for the amendment.

• Right to an Accounting of Disclosures: You may request a list of certain disclosures we have made of your PHI (excluding treatment, payment, and operations disclosures). Your request must specify the time period, not to exceed six years.

• Right to Request Restrictions: You may request that we restrict how we use or disclose your PHI. We are not required to agree, except that we must agree to restrict disclosure to a health plan if you paid for the service in full out of pocket.

• Right to Request Confidential Communications: You may request that we communicate with you about your PHI in a specific way or at a specific location. We will accommodate all reasonable requests.

• Right to a Paper Copy of This Notice: You may receive a paper copy of this Notice at any time by contacting our Privacy Officer.

• Right to Be Notified of a Breach: You will be notified if a breach of your unsecured PHI occurs, as required by the HITECH Act.