Notice of Privacy Practices

Effective date: February 24, 2026

This Notice describes how medical and behavioral health information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.

Our commitment to your privacy

PWP Health is committed to protecting your personal health information. We follow applicable federal and state privacy laws, including:

• HIPAA, the Health Insurance Portability and Accountability Act.
• The Illinois Mental Health and Developmental Disabilities Confidentiality Act (IL Mental Health Code), which provides additional protections for behavioral health information.

We are required to:

• Maintain the privacy and security of your information.
• Provide you with this Notice.
• Notify you if a breach occurs.
• Follow the terms of this Notice.

We may change this Notice at any time, and the updated Notice will apply to all information we maintain. We will post the updated Notice in our offices and on our website. You may request a paper or electronic copy of this Notice at any time. This Notice is also available on our website at www.pwphealth.com.

How we use and disclose your information

PWP Health may use or share your information for the purposes below. We disclose only the minimum necessary information.

Treatment. We use and share information to provide, coordinate, and manage your care, including:

• Communication among PWP Health clinicians.
• Coordination with your primary care provider or specialists.

Payment. We use and share information to obtain payment for services, including:

• Billing Medicaid, MCOs, or other insurers.
• Determining eligibility or coverage.
• Claims processing.

Healthcare operations. We use and share information to support operations such as:

• Quality improvement.
• Staff training and supervision.
• Accreditation and licensing.
• Service coordination.

Public health and safety. We may disclose information for:

• Reporting communicable diseases.
• Reporting suspected abuse or neglect.
• Preventing or reducing a serious and imminent threat.

Research. We may use or share your information for health research only when the law allows it and when your privacy is fully protected. In most cases, this requires your written permission. If limited information is used for internal research or quality improvement, it will not include details that directly identify you.

Required by law. We may disclose information when required by federal or state law, including:

• Court orders and subpoenas.
• Health oversight activities.
• Law enforcement requests that meet legal standards.

Business associates. We may share information with business associates who perform services on our behalf, such as billing or data hosting. Business associates must protect your information under a written agreement.

Other permitted disclosures. We may disclose information:

• To medical examiners or funeral directors.
• To organ or tissue donation organizations.
• For workers’ compensation claims.

Additional protections under the IL Mental Health Code

Illinois law provides stricter protections for behavioral health information. When HIPAA and the IL Mental Health Code differ, we follow the stricter rule.

Stricter rules for disclosure. We generally cannot disclose your mental health records without your written permission. This includes disclosures to:

• Family members
• Schools
• Employers
• Insurance
• Attorneys
• Providers not involved in your treatment

Uses and disclosures requiring your authorization

We will obtain your written authorization before using or disclosing your information for:

• Marketing communications.
• Fundraising communications.
• Any disclosure not described in this Notice.
• Any disclosure restricted by the IL Mental Health Code.

You may revoke your authorization at any time in writing.

Your rights

You have the right to:

Access your records. Request to see or obtain a copy of your health information, including electronic records.

Request corrections. Ask us to correct information you believe is inaccurate or incomplete.

Request confidential communications. Ask us to contact you in a specific way, such as a different phone number or address.

Request restrictions. Ask us to limit how we use or disclose your information. We must agree to restrict disclosures to Medicaid or commercial insurance if:

• The disclosure is for payment or operations, and
• You paid for the service in full, out of pocket.

Receive a list of disclosures. You can ask for a list of certain times we shared your information in the past six years. This list will include most disclosures we made without your written permission, except for those related to treatment, payment, health care operations, or certain other routine activities allowed by law.

Receive a copy of this Notice. Request a paper or electronic copy at any time.

Designate a personal representative. Identify someone who may act on your behalf regarding your health information.

File a complaint. You may file a complaint without fear of retaliation.

• Contact the PWP Privacy Officer to ask questions or file a complaint by email at compliance@pwphealth.com, or by mail to Legal, Risk, and Compliance Department, 2930 W. Grand Ave, Chicago, IL 60622.
• You can also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting hhs.gov/hipaa/filing-a-complaint.
• We will not retaliate against you for filing a complaint.

Your choices

You may tell us your preferences about how we share information with:

• Family members or friends involved in your care.
• Individuals assisting with payment.
• Emergency contacts.

We will follow your preferences unless a law requires otherwise.

Contact

The PWP Health Privacy Officer is available to answer questions.

PWP Health
2930 W. Grand Ave, Chicago, IL 60622
Email: compliance@pwphealth.com
Phone: 872.817.9858

If you or someone you know is in crisis, call or text 988 at any time.