NOTICE OF PRIVACY PRACTICES

Precision Specialty Care, PLLC  |  doing business as Vanpoint Health

Effective Date: July 15, 2026  •  Last Updated: August 6, 2026

YOUR INFORMATION. YOUR RIGHTS. OUR RESPONSIBILITIES.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

You have a right to a paper or electronic copy of this Notice and to discuss it with PSC’s Privacy Officer at (972) 910-2682 or [email protected].

1. Who This Notice Applies To

This Notice applies to Precision Specialty Care, PLLC, a Texas professional limited liability company doing business as Vanpoint Health (“PSC,” “Vanpoint Health,” “we,” “our,” or “us”), its physicians, workforce members, and other persons or organizations acting for PSC as permitted by law. Vanpoint Health is PSC’s trade name and is not a separate legal entity.

This Notice applies to protected health information (“PHI”) created or maintained by PSC in any form, including electronic, paper, photographic, and oral information. It applies to care provided through PSC’s asynchronous digital model and to related portal, scheduling, messaging, prescription-management, payment, and administrative activities.

This Notice is different from PSC’s website Privacy Policy. The website policy describes broader data practices; this Notice governs PHI under HIPAA and other applicable health-information privacy laws.

2. Your Rights

When it comes to your health information, you have certain rights. This section explains those rights and PSC’s responsibilities to help you exercise them.

Get an electronic or paper copy of your medical record

• You may ask to inspect or receive an electronic or paper copy of your medical record and other PHI in a designated record set. Ask us how to submit your request.

• We will provide access, a copy, or, if you agree, a summary within the time required by applicable law. HIPAA generally requires action within 30 days. Texas law may require electronic records to be provided sooner—often within 15 business days after a proper written request when the provider has an electronic health records system capable of fulfilling it.

• We may charge a reasonable, cost-based fee permitted by law. We will not charge a retrieval fee when prohibited.

• We may deny access in limited circumstances permitted by law. If review of a denial is available, we will explain how to request it.

Ask us to correct or amend your medical record

• You may ask us to amend PHI that you believe is incorrect or incomplete. Your request should be in writing and explain why the information should be changed.

• We may deny the request in circumstances permitted by law—for example, if PSC did not create the information, the information is not part of the designated record set, the information is not available for inspection, or the record is accurate and complete.

• If we deny the request, we will explain the decision in writing within the time required by law and tell you about any right to submit a statement of disagreement.

Request confidential communications

• You may ask us to contact you in a specific way—for example, through the portal, at a particular telephone number, or by mail at a different address.

• We will accommodate reasonable requests. We may ask you to specify how or where you wish to be contacted but will not require you to explain why.

Ask us to limit what we use or disclose

• You may ask us not to use or disclose certain PHI for treatment, payment, or health care operations. We generally are not required to agree, and we may decline if the restriction could affect care or operations. If we agree, we will follow the restriction except as permitted by law, including in certain emergencies.

• If you pay in full out of pocket for a specific item or service, you may ask us not to disclose information about that item or service to your health plan for payment or health care operations. We will agree unless disclosure is required by law.

Receive an accounting of certain disclosures

• You may request an accounting of certain disclosures of your PHI made during the six years before your request, identifying who received the information and why.

• The accounting generally will not include disclosures for treatment, payment, or health care operations; disclosures to you; disclosures made pursuant to your authorization; and certain other disclosures excluded by law.

• We will provide one accounting in any 12-month period without charge. We may charge a reasonable, cost-based fee for an additional accounting during the same period after notifying you of the cost and allowing you to modify or withdraw the request.

Get a copy of this Notice

You may obtain a paper or electronic copy of this Notice at any time, including if you previously agreed to receive it electronically. The current Notice is also available at www.vanpointhealth.com.

Choose someone to act for you

If a person has legal authority to act as your personal representative—for example, through a medical power of attorney, guardianship, or applicable law—that person may exercise your rights and make choices about your PHI. We will verify the person’s identity and authority before taking action. A parent’s or guardian’s access to a minor’s PHI depends on applicable law and the circumstances of the minor’s care.

Receive notice of a breach

You have the right to receive notice following a breach of unsecured PHI when notification is required by law. We will provide required notice without unreasonable delay and within the applicable legal deadline.

File a complaint without retaliation

• You may complain to PSC if you believe we violated your privacy rights. Use the Privacy Officer contact information at the end of this Notice.

• You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (“OCR”), through the OCR Complaint Portal at https://www.hhs.gov/hipaa/filing-a-complaint, by calling (800) 368-1019 (TDD: (800) 537-7697), or by writing to Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F, HHH Building, Washington, DC 20201.

• You may also submit an appropriate complaint to the Texas Attorney General or another agency with jurisdiction.

• PSC will not retaliate against you for filing a good-faith complaint or exercising a privacy right.

3. Your Choices

For certain PHI, you may tell us your preferences about what we disclose. If you have a clear preference in the situations below, tell us what you want us to do. We will follow your instructions when required by law.

Family, friends, and others involved in your care

You may tell us whether to disclose relevant PHI to a family member, close friend, caregiver, or another person involved in your care or payment for care. If you are unable to state a preference—for example, because you are unconscious—we may disclose relevant information if we determine that doing so is in your best interest and is permitted by law.

Disaster relief and serious threats

We may disclose relevant PHI to an authorized disaster-relief organization so your family can be notified about your location, condition, or death, unless you object when given the opportunity. We may also use or disclose PHI when necessary and permitted by law to prevent or lessen a serious and imminent threat to health or safety.

Marketing, sale of PHI, and psychotherapy notes

• We will obtain your written authorization before using or disclosing PHI for marketing when HIPAA requires authorization.

• We will not sell PHI without your written authorization unless an exception under law applies.

• We will obtain your written authorization for most uses and disclosures of psychotherapy notes if PSC maintains them.

• PSC does not currently use PHI for fundraising. If that practice changes, any fundraising communication will explain how to opt out, and we will honor your choice.

Authorization and revocation

Other uses and disclosures of PHI not described in this Notice will be made only with your written authorization unless otherwise permitted or required by law. You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it or the authorization was obtained as a condition of insurance coverage and other law permits the insurer to contest the policy or claim.

4. How We Typically Use or Disclose PHI

We may use or disclose PHI without a separate written authorization for the following purposes, subject to applicable law.

Treatment

We may use and disclose PHI to provide, coordinate, or manage your care and related services. For example, we may share information with another treating clinician, pharmacy, laboratory, imaging facility, or other health care provider involved in your treatment.

Payment

We may use and disclose PHI to obtain payment or support access to treatment. For example, we may disclose information to a health plan, pharmacy benefit manager, payment processor, or manufacturer assistance program for eligibility, coverage, prior authorization, billing, claims, or payment activities. PSC’s professional services may be self-pay even when medications, testing, or other services involve third-party coverage.

Health care operations

We may use and disclose PHI to run the practice, improve care, train our workforce, conduct quality assessment, perform compliance and auditing, manage risk, credential clinicians, evaluate performance, communicate with you, and conduct other health care operations permitted by law.

Business associates

We may disclose PHI to vendors that perform services for PSC—such as electronic health record, portal, hosting, secure communications, payment, analytics, cybersecurity, records management, administrative support, or professional services. When required, these business associates must sign agreements requiring them to appropriately safeguard PHI and use it only as permitted.

Electronic, portal, and technology-assisted care

We may create, receive, maintain, or transmit PHI through electronic systems used for intake, photographs, structured reviews, clinical documentation, messaging, prescriptions, monitoring, payment, and support. PSC may use automation or artificial intelligence tools to assist with organization, summarization, documentation, routing, and workflow. These tools do not independently diagnose or prescribe. When a vendor handles PHI for PSC, we address HIPAA obligations and contractual protections as required.

5. Other Uses and Disclosures Permitted or Required by Law

We may use or disclose PHI in the following circumstances, but only after satisfying applicable legal conditions and limitations.

Public health and safety

• To prevent or control disease, injury, or disability and for public-health surveillance or intervention.

• To report suspected child abuse or neglect and, when permitted or required, abuse, neglect, exploitation, or domestic violence involving another person.

• To report adverse events, product defects, medication reactions, or support product recalls.

• To notify a person who may have been exposed to a communicable disease when authorized by law.

• To prevent or lessen a serious and imminent threat to health or safety.

Health oversight

We may disclose PHI to health oversight agencies for audits, investigations, inspections, licensure or disciplinary matters, civil rights oversight, and other activities authorized by law.

Research

We may use or disclose PHI for research when an institutional review board or privacy board approves a waiver, when the information is used for preparatory or decedent research as permitted by law, when the information is a limited data set subject to an appropriate agreement, or when you provide written authorization. PSC may also use or disclose properly de-identified information, which is not PHI under HIPAA.

Required by law and HHS compliance review

We will disclose PHI when federal, state, or local law requires it and will limit the disclosure to the relevant legal requirements. We must disclose PHI to the U.S. Department of Health and Human Services when requested to determine our compliance with HIPAA.

Law enforcement, judicial, and administrative proceedings

We may disclose PHI for certain law-enforcement purposes or in response to a court or administrative order, subpoena, discovery request, or other lawful process, but only when applicable HIPAA and state-law requirements are satisfied. A subpoena by itself may not always be sufficient. We will apply any more protective Texas or federal confidentiality law.

Workers’ compensation and special government functions

We may disclose PHI as authorized by workers’ compensation laws and for certain military, veterans, national-security, intelligence, correctional-institution, and protective-service functions permitted by law.

Organ donation, coroners, medical examiners, and funeral directors

We may disclose PHI to organ-procurement organizations to facilitate organ, eye, or tissue donation and transplantation. We may disclose PHI to coroners, medical examiners, or funeral directors as permitted by law after an individual’s death.

6. Specially Protected Information

Some categories of information receive additional protection under federal or Texas law. When a law is more protective than HIPAA, PSC will follow the more protective law.

Texas medical and sensitive records

Texas law generally treats physician medical records as confidential and may impose requirements beyond HIPAA under the Texas Medical Records Privacy Act and other statutes. Special rules may apply to mental-health records, HIV or other communicable-disease information, genetic information, records involving minors, and other sensitive information. PSC will obtain consent or authorization when required and will disclose such information without authorization only when a specific law permits or requires it.

Substance use disorder records protected by 42 C.F.R. Part 2

PSC is not represented to be a federally assisted substance use disorder treatment program subject to 42 C.F.R. Part 2. However, to the extent PSC receives or maintains records that remain protected by Part 2, we will not use or disclose those records in a civil, criminal, administrative, or legislative investigation or proceeding against you without your written consent or a court order accompanied by a subpoena or other legal mandate meeting Part 2 requirements. Other uses, disclosures, consent, redisclosure, and fundraising rules for Part 2 records will be handled as required by law.

Reproductive-health information

PSC protects reproductive-health information under the HIPAA Privacy Rule and applicable state and federal law as currently in effect. Because portions of the 2024 HIPAA reproductive-health rule were vacated by a federal court in 2025, PSC will apply the requirements that remain legally effective and will revise this Notice if controlling law changes.

7. Our Responsibilities

• We are required by law to maintain the privacy and security of PHI.

• We must provide you with this Notice describing our legal duties and privacy practices and must follow the Notice currently in effect.

• We will notify affected individuals following a breach of unsecured PHI when required by law.

• We will use reasonable and appropriate administrative, physical, and technical safeguards to protect PHI.

• We will apply the minimum-necessary standard when required. This standard generally does not apply to disclosures for treatment, disclosures to you, uses or disclosures made pursuant to your authorization, uses or disclosures required by law, and certain other exceptions.

• We will not use or disclose PHI other than as described in this Notice unless you authorize us in writing or applicable law permits or requires the use or disclosure.

8. Changes to This Notice

PSC may change the terms of this Notice and make the revised Notice effective for all PHI we maintain, including PHI created or received before the revision. If we materially change our privacy practices, we will promptly revise the Notice as required by law. The current Notice will be available on our website, through the patient portal or upon request, and at any physical service location where posting is required.

9. Questions, Requests, and Complaints

Contact the PSC Privacy Officer for questions, requests to exercise your rights, suspected privacy or security incidents, or complaints:

Privacy Officer: Sarah Fink
Precision Specialty Care, PLLC
doing business as Vanpoint Health
Email: [email protected]
Phone: (972) 910-2682
Website: www.vanpointhealth.com
Mailing address: 3541 cedar cottage circle, Frisco Texas 75033

Requests may require written documentation and verification of identity and authority. Do not send urgent medical concerns or emergency information to the Privacy Officer contact.