Effective Date: November 1, 2025

This Notice describes how medical and dental information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Our Legal Duty

Wauwatosa Dental Arts (“we,” “our,” or “us”) is required by law to maintain the privacy of your protected health information (“PHI”), provide you with this Notice describing our legal duties and privacy practices, and notify you following a breach of unsecured PHI. We must follow the terms of this Notice currently in effect. We reserve the right to change our privacy practices and the terms of this Notice at any time, as permitted by applicable law, and to make new provisions effective for all PHI we maintain. You may request a copy of this Notice at any time.

How We May Use and Disclose Health Information

We may use and disclose your PHI for the following purposes without your written authorization. Certain information—such as HIV-related information, genetic information, alcohol and/or substance use disorder treatment records, and mental health records—may be entitled to special confidentiality protections under applicable state or federal law. We will abide by these special protections as they pertain to applicable cases involving these types of records.

1. Treatment
   We may use and share your information to provide, coordinate, or manage your dental and medical care. Example: sharing information with specialists, laboratories, or pharmacies involved in your treatment.
2. Payment
   We may use and share PHI to obtain payment for the treatment and services you receive from us or another entity involved in your care. Payment activities include billing, collections, claims management, and determinations of eligibility and coverage to obtain payment from you, an insurance company, or another third party. Example: submitting claims to your insurance company or verifying coverage.
3. Health Care Operations
   We may use and share PHI for administrative, quality assurance, training, auditing, accreditation, or licensing purposes. Example: reviewing treatment outcomes or evaluating staff performance.
4. Appointment Reminders and Communications
   We may contact you via phone, voicemail, text, mail, or email regarding appointments, billing, or follow-up care.
5. Individuals Involved in Your Care
   We may disclose information to family members, friends, or others involved in your care or in the payment for your care when appropriate, unless you object. We may also disclose information to a patient representative. If a person has the authority by law to make health care decisions for you, we will treat that representative the same way we would treat you with respect to your PHI.
6. Disaster Relief
   We may use or disclose your PHI to assist in disaster relief efforts.
7. Required by Law
   We may use or disclose your PHI when we are required to do so by federal, state, or local law.
8. Public Health and Safety
   We may disclose PHI to public health authorities, the FDA, or other agencies for public health activities, including to:
   • prevent or control disease, injury, or disability;
   • report child abuse or neglect;
   • report reactions to medications or problems with products or devices;
   • notify a person of a recall, repair, or replacement of products or devices;
   • notify a person who may have been exposed to a disease or condition; or
   • notify the appropriate government authority if we believe a patient has been the victim of abuse, neglect, or domestic violence.
9. National Security
   We may disclose to military authorities the health information of Armed Forces personnel under certain circumstances. We may disclose to authorized federal officials health information required for lawful intelligence, counterintelligence, and other national security activities. We may disclose to a correctional institution or law enforcement official having lawful custody the PHI of an inmate or patient.
10. Secretary of HHS
    We will disclose your PHI to the Secretary of the U.S. Department of Health and Human Services when required to investigate or determine our compliance with HIPAA.
11. Workers’ Compensation
    We may disclose PHI to the extent authorized by and necessary to comply with workers’ compensation or other similar programs established by law.
12. Law Enforcement
    We may disclose PHI for law enforcement purposes as permitted by HIPAA, as required by law, or in response to a subpoena or court order, including to identify or locate a suspect or missing person.
13. Health Oversight Activities
    We may disclose PHI to a government oversight agency for activities authorized by law, including audits, investigations, inspections, and credentialing, as necessary for licensure and for the government to monitor the health care system, government programs, and compliance with civil rights laws.
14. Judicial and Administrative Proceedings
    If you are involved in a lawsuit or a dispute, we may disclose PHI in response to a court or administrative order. We may also disclose PHI in response to a subpoena, discovery request, or other lawful process instituted by someone else involved in the dispute, but only if efforts have been made, either by the requesting party or us, to tell you about the request or to obtain an order protecting the information requested.
15. Research
    We may use or disclose limited PHI for research projects that have been approved by an institutional review board or privacy board, which has reviewed the research proposal and established protocols to ensure the privacy of your information.
16. Coroners, Medical Examiners, and Funeral Directors
    We may release PHI to a coroner or medical examiner—for example, to identify a deceased person or determine the cause of death—and to funeral directors consistent with applicable law to enable them to perform their duties.
17. Fundraising
    We may contact you with information about our sponsored activities, including fundraising programs, as permitted by applicable law. If you do not wish to receive such information, you may opt out of receiving these communications.
18. Substance Use Disorder (SUD) Treatment Information
    If we receive or maintain any information about you from a substance use disorder treatment program covered by 42 CFR Part 2 (a “Part 2 Program”) through a general consent you provide to the Part 2 Program to use and disclose the record for treatment, payment, or health care operations, we may use and disclose that record for treatment, payment, and health care operations purposes as described in this Notice. If we receive or maintain your Part 2 Program record through specific consent you provide to us or another third party, we will use and disclose it only as expressly permitted by you in your consent as provided to us.
    
    In no event will we use or disclose your Part 2 Program record, or testimony describing the information contained in it, in any civil, criminal, administrative, or legislative proceeding by any federal, state, or local authority, against you, unless authorized by your consent or the order of a court after it provides you notice of the court order.
19. Other Uses and Disclosures with Your Authorization
    Your written authorization is required, with a few exceptions, for the disclosure of psychotherapy notes, the use or disclosure of PHI for marketing, and the sale of PHI. Any other use or disclosure of your PHI not described above will be made only with your written authorization. You may revoke an authorization in writing at any time, except to the extent that we have already relied on it.

Your Rights Regarding Your Health Information

You have the following rights concerning your PHI:

1. Right to Access
   You may request in writing to inspect or obtain a copy of your health and billing records, with limited exceptions. If we maintain the information electronically, you have the right to an electronic copy in the form and format you request if it is readily producible. We may charge a reasonable, cost-based fee for copying, supplies, and postage. If you are denied access, you have the right to have the denial reviewed in accordance with applicable law.
2. Right to Request Amendment
   If you believe your record is incorrect or incomplete, you may request an amendment in writing, explaining why the information should be amended. We may deny the request—for example, if the record was not created by us or is already accurate and complete. If we deny your request, we will provide a written explanation and explain your rights.
3. Right to an Accounting of Disclosures
   You may request in writing a list of certain disclosures of your PHI, generally covering up to the past six years, except those made for treatment, payment, or health care operations. If you request an accounting more than once in a 12-month period, we may charge a reasonable, cost-based fee for the additional requests.
4. Right to Request Restrictions
   You may request in writing that we limit how your PHI is used or disclosed, stating (1) what information you want to limit, (2) whether you want to limit our use, disclosure, or both, and (3) to whom the limits apply. We are not required to agree, except where the disclosure is to a health plan for payment or health care operations and the information pertains solely to a health care item or service you (or someone on your behalf, other than the health plan) have paid for in full. If we agree, we will comply unless the information is needed for emergency treatment or the disclosure is required by law.
5. Right to Request Confidential Communications
   You may request in writing that we contact you at a specific phone number, address, or by a specific method. Your request must specify the alternative means or location and explain how payments will be handled. We will accommodate all reasonable requests, but if we are unable to reach you by the means or at the location you requested, we may contact you using the information we have.
6. Right to a Paper Copy of This Notice
   You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically on our website or by email.
7. Right to Notification of a Breach
   You have the right to be notified if your unsecured PHI is accessed, acquired, used, or disclosed in a manner not permitted by law.

Our Responsibilities

We are required by law to protect the privacy and security of your PHI.

• We will notify you promptly if a breach occurs that may have compromised your PHI.
• We will follow the duties and privacy practices described in this Notice.
• We will not use or share PHI other than as described here unless you authorize us in writing.
• We will never sell your information or use it for marketing without your written permission.

Changes to This Notice

We may revise this Notice at any time. The updated version will apply to all PHI we maintain and will be available in our office and on our website.

Complaints

If you believe your privacy rights have been violated, you may file a complaint:

With Us:
Privacy Officer
Wauwatosa Dental Arts
11600 W North Ave
Wauwatosa, WI 53226
Phone: (414) 462-3160
Email: [email protected]
Website: drrichardrosen.com

With the U.S. Department of Health and Human Services:
Office for Civil Rights (OCR)
200 Independence Avenue SW
Washington, DC 20201
Phone: 1-877-696-6775
Website: https://www.hhs.gov/ocr/privacy/hipaa/complaints/

You will not be penalized or retaliated against for filing a complaint.

Acknowledgment of Receipt

You may be asked to sign a form acknowledging receipt of this Notice. Your signature does not indicate agreement with its terms—only that you received it.