Practice policies

HIPAA Notice of Privacy Practices

Effective Date: May 25, 2026 · Last Updated: July 15, 2026

This Notice of Privacy Practices (“Notice”) describes how Dr. Rayna Dvorak, ND, LAc (“Practice,” “we,” “us,” or “our”) may use and disclose your protected health information (PHI) and informs you of your rights regarding your health information. We are required by law to maintain the privacy of your PHI, to provide you with this Notice of our legal duties and privacy practices, and to abide by the terms of the Notice currently in effect.

I. Uses and Disclosures of Your Health Information

A. Uses and Disclosures for Treatment, Payment, and Healthcare Operations (TPO)

The law permits us to use and disclose your PHI without your written authorization for the following purposes:

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and any related services. Example: Dr. Rayna Dvorak may consult with another licensed healthcare provider about your treatment plan. If you are referred to a specialist or laboratory, we may send your relevant health information to that provider.

Payment

We may use and disclose your PHI to obtain payment for services rendered. Example: We may include information about your visit when submitting a superbill or claim so that you or your insurer can process reimbursement. We may disclose your PHI to a collections agency if you have an unpaid balance, to the extent permitted by law.

Healthcare Operations

We may use and disclose your PHI for our internal healthcare operations. Examples: quality assessment and improvement activities; training and supervision of practitioners; legal and compliance activities; auditing functions; and business planning and management.

B. Other Uses and Disclosures Permitted Without Your Written Authorization

Federal and Washington State law permit us to use or disclose your PHI without your authorization in the following circumstances:

• Public Health Activities: To public health authorities for the purposes of preventing or controlling disease, injury, or disability; reporting child abuse or neglect; reporting vital statistics; and reporting adverse events related to foods, supplements, or medications to the FDA.
• Abuse, Neglect, or Domestic Violence Reporting: To government authorities authorized to receive such reports when we believe a patient has been the victim of abuse, neglect, or domestic violence, to the extent required or permitted by law and subject to applicable WA mandatory reporting requirements.
• Health Oversight Activities: To government agencies for oversight activities authorized by law, including audits, investigations, inspections, and licensure.
• Judicial and Administrative Proceedings: In response to a court order, subpoena, or other lawful discovery request, subject to applicable legal protections.
• Law Enforcement: To law enforcement officials in limited circumstances, such as reporting certain crimes, providing information to identify or locate a suspect, or reporting a crime that occurred on our premises.
• Coroners, Medical Examiners, and Funeral Directors: To assist in identifying a deceased person or determining the cause of death.
• Organ and Tissue Donation: To organizations that facilitate organ procurement or transplantation.
• Research: Under specific conditions, including with your authorization or through a waiver approved by an Institutional Review Board.
• To Avert a Serious Threat to Health or Safety: When necessary to prevent or lessen a serious and imminent threat to a person or the public.
• Specialized Government Functions: Military command authorities, intelligence and national security activities, and protective services for the President.
• Workers’ Compensation: As authorized by Washington State workers’ compensation laws.
• Correctional Institutions: If you are an inmate, to the correctional institution or law enforcement official for certain purposes.

C. Uses and Disclosures Requiring Your Written Authorization

The following uses and disclosures of your PHI require your written authorization before we may proceed. You may revoke any such authorization in writing at any time, except to the extent that we have already taken action in reliance on it.

• Psychotherapy Notes: We will not use or disclose psychotherapy notes (if any) without your specific written authorization, except in limited circumstances permitted by law (such as our own training, defending ourselves in legal proceedings you initiate, or mandated reporting).
• Marketing Communications: We will not use your PHI for marketing purposes without your written authorization, except for face-to-face communications and promotional gifts of nominal value.
• Sale of PHI: We will not sell your PHI without your written authorization.
• All Other Uses and Disclosures: Any use or disclosure not described in this Notice or otherwise permitted by law requires your written authorization.

II. Your Rights Regarding Your Health Information

You have the following rights regarding the PHI we maintain about you. To exercise any of these rights, submit your request in writing to our Privacy Officer at hello@drraynadvorak.com or by mail to the address above.

1. Right to Access and Inspect Your Records (45 CFR § 164.524)

You have the right to inspect and obtain a copy of the PHI in your designated record set. We will respond within 30 days of receipt of your request (or 60 days if the records are not maintained on-site), with a one-time 30-day extension if we notify you in writing before the deadline. We may provide records electronically if requested. We may charge a reasonable, cost-based fee for copies. We may deny access in limited circumstances; if denied, you have the right to have the denial reviewed by a licensed healthcare professional designated by us.

2. Right to Amend Your Records (45 CFR § 164.526)

If you believe that PHI we maintain about you is incorrect or incomplete, you may request an amendment. We will respond within 60 days (with one 30-day extension if we provide written notice). We may deny your request if the information was not created by us, is not part of the designated record set, or is accurate and complete. If denied, you have the right to submit a statement of disagreement, which we will include in your record.

3. Right to an Accounting of Disclosures (45 CFR § 164.528)

You have the right to request a list of disclosures of your PHI made by us for purposes other than treatment, payment, healthcare operations, and certain other exceptions. We will respond within 60 days (with one 30-day extension). The accounting covers the six years prior to the request date. The first accounting in any 12-month period is free; subsequent requests may be subject to a reasonable fee.

4. Right to Request Restrictions (45 CFR § 164.522(a))

You have the right to request that we restrict the use or disclosure of your PHI for treatment, payment, or healthcare operations, or to restrict disclosures to family members or others involved in your care. We are not required to agree to your request, except that we must agree to a restriction if: (a) you paid out-of-pocket in full for a service; and (b) you request that we not disclose information about that service to a health plan. If we agree to a restriction, we will comply except in emergencies.

5. Right to Request Confidential Communications (45 CFR § 164.522(b))

You have the right to request that we communicate with you about your PHI in a certain way or at a certain location. For example, you may ask that we contact you only at a specific phone number or address. We will accommodate reasonable requests.

6. Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice at any time, even if you have agreed to receive it electronically. To request a paper copy, contact us at (480) 463-4066 or hello@drraynadvorak.com.

7. Right to Breach Notification (45 CFR §§ 164.400–414)

In the event of a breach of unsecured PHI that affects you, we are required to notify you without unreasonable delay and in no case later than 60 days following discovery of the breach. The notification will include: a description of the breach; the types of information involved; steps you should take to protect yourself; what we are doing to investigate, mitigate, and prevent future breaches; and contact information for questions.

III. Our Obligations

We are required by law to: (1) maintain the privacy of your PHI; (2) provide you with this Notice of our legal duties and privacy practices; (3) abide by the terms of the Notice currently in effect; and (4) notify you following a breach of your unsecured PHI.

We reserve the right to change the terms of this Notice and to make the new Notice provisions effective for all PHI we maintain. We will post the revised Notice on our website and make the current Notice available upon request at any time. Material changes to this Notice will be communicated to existing patients in writing or by other appropriate means.

IV. Washington State Addendum — Additional Protections for Sensitive Health Information

Washington State law provides additional privacy protections beyond HIPAA for certain categories of sensitive health information. We comply with all applicable state law protections, including:

• Mental Health Records (RCW 71.05; RCW 70.02): Mental health treatment information is subject to heightened confidentiality protections under Washington law. Disclosure requires your specific written authorization except in limited circumstances, including when disclosure is necessary to prevent imminent danger to you or others, or is required by court order.
• HIV/AIDS Records (RCW 70.02; RCW 70.24): Information related to HIV/AIDS status, testing, and treatment is protected under Washington law and may not be disclosed without your written authorization except in specific, narrowly defined circumstances. Unauthorized disclosure is a misdemeanor under Washington law.
• Sexually Transmitted Infections (RCW 70.24): STI-related health information receives additional confidentiality protections and generally requires your consent for disclosure, subject to mandatory reporting requirements to public health authorities.
• Substance Use Disorder Records (42 CFR Part 2; RCW 70.96A): Records relating to substance use disorder diagnosis, treatment, or referral are subject to federal confidentiality regulations (42 CFR Part 2) and Washington state law, which in many circumstances provide greater protections than HIPAA. These records may not be disclosed without your written consent except in medical emergencies, court orders, or other narrowly specified circumstances.
• Reproductive Health Information (RCW 7.70.065; Engrossed Substitute House Bill 1155): Washington law protects patient privacy regarding reproductive health decisions. We will not disclose information related to your reproductive health care to out-of-state authorities seeking to investigate or penalize lawful reproductive health care received in Washington State.

V. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). We will not retaliate against you for filing a complaint.

To file a complaint with our Practice:
Contact our Privacy Officer, Dr. Rayna Dvorak, ND, LAc
Email: hello@drraynadvorak.com
Phone: (480) 463-4066
Mail: 11656 98th Ave NE, Kirkland, WA 98034

To file a complaint with the U.S. Department of Health and Human Services — Office for Civil Rights (OCR):
Website: hhs.gov/ocr/privacy/hipaa/complaints/
Phone: 1-800-368-1019 | TTY: 1-800-537-7697
U.S. Department of Health and Human Services
200 Independence Avenue, S.W., Washington, D.C. 20201

Complaints must be filed within 180 days of the date you knew or should have known of the alleged violation. This time limit may be waived if good cause is shown.