Receiving care outside New York? View the version of this notice for all other WellBe patients.

View General Notice

New York notice of privacy practices

Effective date: 05/02/2020 | Revised date: 09/29/2026

Questions? Contact our Compliance Department at complyline@wellbe.com.

Download PDF

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

This Notice of Privacy Practices (“Notice”) described the privacy practices of WellBe Senior Medical (“WellBe,” “we,” “us,” or “our”).

A. Our commitment to your privacy

Our practice is dedicated to maintaining the privacy of your individually identifiable health information (also called protected health information, health information, or “PHI”). In conducting our business, we will create records regarding you and the treatment and services we provide to you. We are required by law to maintain the privacy of your health information, to provide you with notice of our legal duties and privacy practices with respect to health information, and to notify affected individuals following a breach of unsecured protected health information, including breaches involving records protected under 42 CFR Part 2, as required by applicable law.

We are required to abide by the terms of the Notice of Privacy Practices that we have in effect at the time.

Additional protections for substance use disorder records

Certain records relating to substance use disorder (“SUD”) diagnosis, treatment, or referral for treatment may be protected under federal law, including 42 U.S.C. § 290dd-2 and 42 CFR Part 2 (“Part 2”). Where applicable, WellBe will use and disclose Part 2 records only as permitted or required by law. These records receive additional protections beyond those generally applicable to protected health information under HIPAA.

Accordingly, we are providing you with the following important information:

  • How we may use and disclose your health information,
  • Your privacy rights in your health information, and
  • Our legal duties concerning the use and disclosure of your health information.

The terms of this notice apply to all records containing your health information that are created or retained by our practice. We reserve the right to change the terms of this notice and to make the new notice provisions effective for all health information that we maintain. The new Notice of Privacy Practices will be available on our website and upon request.

B. Questions about this notice

If you have questions about this notice or would like to contact us in writing regarding your rights and the options explained in this notice, please reach out to:

Joshua Aubey, Chief Compliance & Privacy Officer
WellBe New York Medical PC
100 S Clinton Ave 24th Floor
Rochester, NY 14604
complyline@wellbe.com

C. We routinely use and share your personal information in the following ways

1. Treatment

  • Many of the people who work for our practice – including, but not limited to, our doctors and nurses – may use or disclose your health information in order to treat you or to assist others in your treatment.
    • For example, we may ask you to have laboratory tests (such as blood or urine tests), and we may use the results to help us reach a diagnosis.
    • We may use your health information in order to write a prescription for you, or we might disclose your health information to a pharmacy when we order a prescription for you.
    • Our practice may use and disclose your health information to contact you and remind you of an appointment. We may send appointment reminders to you on mailed postcards, in text messages, and electronic mail. Postcards, texts and emails indicate your name and time and date of the appointment. You have the right to request that we do not send you appointment reminder postcards, text messages or emails. (see “Request confidential communications” below)
  • We may use and disclose your health information so that we may contact you to communicate health-related benefits or services that may be of interest to you.
    • We may use your health information to inform you of potential treatment options or alternatives.
  • We may also disclose your health information to other health care providers for purposes related to your treatment.

2. Payment

  • Our practice may use and disclose your health information in order to bill and collect payment for the services and items you may receive from us.
    • For example, we may contact your health insurer to certify that you are eligible for benefits (and for what range of benefits), and we may provide your insurer with details regarding your treatment to determine if your insurer will cover, or pay for, your treatment.
  • We may disclose your health information to other health care providers and entities to assist in their billing and collection efforts.
    • We will limit such disclosures to the minimum information necessary to that person or entity’s involvement payment for healthcare services.

3. Health care operations

  • Our practice may use and disclose your health information to operate our business and improve your care.
    • For example, our practice may use your health information to evaluate the quality of care you received from us, or to conduct regulatory compliance, cost management and business planning activities.
  • We may disclose your health information to other health care providers and entities to assist in their health care operations activities.
    • We will limit such disclosures to the minimum information necessary to enable that person or entity to complete its healthcare operations activities.

D. You have the right to object to WellBe using or disclosing in certain situations

You can reach out and let us know if you do not want us to use or disclose your health information in the following instances:

  1. Sharing information with your family, other relative, or a close personal friend, or others involved in your care.
    1. If you are unable to tell us your preference (for example, if you are unconscious), we may share your information if we believe it is in your best interest.
    2. If there is someone you do not want us to disclose your health information to, please contact us in writing.
  2. Sharing information to notify your family members or another person responsible for your care of your location, general condition, or death.
  3. Sharing information in a disaster relief situation.
  4. Patient experience surveys.
    1. We may contact you to conduct patient satisfaction surveys designed to monitor quality of care. You have the right to opt-out of these communications by contacting us in writing.
  5. Sharing proof of immunization with a school.
    1. If you are a student or prospective student of a school that is required by State or other law to have proof of immunization, we will first obtain your agreement to disclose this information.

E. Other permitted and required disclosures

We are permitted or required to share your information for public health and oversight activities or certain legal purposes. We are required to meet specific conditions before we can share your information for the following purposes:

1. Public health and safety

  1. To a public health authority for the purpose of preventing or controlling disease, injury, or disability.
  2. To notify an individual regarding potential exposure to a communicable disease.
  3. To notify an individual regarding a potential risk for spreading or contracting a disease.
  4. To a public health authority to report vital events such as birth or death.
  5. Reporting suspected abuse, neglect, or domestic violence.
  6. Preventing or reducing a serious threat to health or safety.
  7. Reporting adverse reactions to medications.
  8. To enable product recalls, repairs, or replacement.
  9. To an employer for work-related illness or injury disclosure or medical surveillance, if we provide you with written notice.

2. Health oversight activities

  1. We may disclose your information to a health oversight agency for oversight activities authorized by law, including audits, civil, administrative, or criminal investigations, inspections, licensure or disciplinary action, or other activities necessary for oversight of the health care system, government benefit programs, or civil rights laws.

3. Judicial and administrative proceedings

  1. We may disclose your information in response to a court or administrative order or in response to a subpoena, discovery request, or other lawful process.

4. Law enforcement

  1. For the purpose of identifying or locating a suspect, fugitive, material witness, or missing person.
  2. Information about an individual who is suspected to be a victim of a crime.
  3. Information about an individual who has died, if we have a suspicion that such death may have resulted from criminal conduct.
  4. Health information about an inmate in lawful custody of a law enforcement official.
  5. For special government functions such as military, national security, and presential protective services.

5. Coroners, medical examiners, and funeral directors

  1. We can share your information with a coroner, medical examiner, or funeral director to allow them to carry out their duties.

6. Facilitating organ, eye, or tissue donation and transplantation

  1. We can share your health information with organ procurement organizations or other entities engaged in the procurement, banking, or transplantations of cadaveric organs, eyes, or tissue.

7. Substance Use Disorder Records Protected Under 42 CFR Part 2

  1. With your written consent, Part 2 records may be used and disclosed for treatment, payment, and health care operations.
  2. A single written consent may authorize future uses and disclosures for treatment, payment, and health care operations, as permitted by law.
  3. HIPAA covered entities and business associates receiving Part 2 records pursuant to a valid consent may further use and disclose those records as permitted by HIPAA, except where otherwise prohibited by law.
  4. Part 2 records may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless you provide specific authorization or another legal exception applies.
  5. We may disclose de-identified Part 2 information to public health authorities without patient authorization when permitted by law and when the information has been de-identified in accordance with HIPAA requirements.
  6. Unauthorized use or disclosure of Part 2 records may result in penalties under applicable federal law.

8. Workers’ compensation

  1. We may disclose your health information as authorized by laws relating to workers’ compensation that provide benefits for work-related injuries or illness.

F. State law limitations on what we can disclose

1. Sensitive health information – A court order is required

  1. Certain states have regulations that prohibit or restrict releasing specific health information about you. The most common regulations protect mental health information, alcohol and drug abuse treatment information, information related to sexually transmitted diseases, and genetic information (“sensitive health information”).
    1. For example, a court orders may be required to obtain medical records that include your sensitive health information. A subpoena will not suffice. This aspect of HIPAA law NY aims to protect patient privacy by requiring that a court review a request for medical records before ordering production of the records.
    2. Some states require that the subject of an HIV test, or the subject’s legally authorized representative, is first notified in person of a confirmed positive HIV test result.

G. In these cases, we will never share your information without your written authorization

We must obtain your written authorization before using or disclosing your health information in the following situations. Other uses and disclosures not described in this notice will be made only with your written authorization. You may revoke an authorization at any time, provided that the revocation is in writing and except to the extent that we have already acted on your authorization.

1. Psychotherapy notes

  1. We will obtain your written authorization before disclosing psychotherapy notes, except in certain limited circumstances:
    1. For the legal and clinical oversight of the psychotherapist who created the note;
    2. Supervised mental health training programs for students, trainees, or practitioners;
    3. Used in our defense in legal proceedings brought by the patient;
    4. To the Department of Health and Human Services to investigate or determine our compliance with HIPAA;
    5. To avert a serious and imminent threat to public health or safety;
    6. To a health oversight agency for lawful oversight of the note’s originator;
    7. For the lawful activities or a coroner or medical examiner; or
    8. As otherwise required by law.

2. Substance Use Disorder Counseling Notes

  1. Substance Use Disorder (“SUD”) Counseling Notes are notes maintained separately from the rest of a patient’s medical and SUD treatment record by a treating provider that document or analyze the contents of a counseling conversation
  2. We will not use or disclose SUD Counseling Notes without your specific written authorization except as otherwise permitted or required by law. SUD Counseling Notes receive protections similar to psychotherapy notes and may not be disclosed pursuant to a general treatment, payment, or health care operations consent.

3. Marketing/Promotions

  1. We will obtain your written authorization before using or disclosing your health information for unsubsidized and subsidized marketing or promotions, unless the communication is face-to-face or the communication is in the form of a promotional gift of nominal value.

4. Research

  1. We will obtain your written authorization before reaching out to you about clinical research opportunities or trials.

5. Sale of your health information

  1. We will not sell any of your health information.

6. Use of Substance Use Disorder Records in Legal Proceedings

  1. If you have records protected by 42 CFR Part 2, we will not use or disclose those records in any civil, criminal, administrative, or legislative proceeding against you unless:
    1. You provide separate written consent specifically authorizing the disclosure for that proceeding; or
    2. Disclosure is otherwise authorized by a court order or other legal authority permitted under applicable law.
  2. Any consent authorizing use or disclosure of Part 2 records in legal proceedings must be separate and distinct from any consent authorizing treatment, payment, or health care operations disclosures.

7. Disclosure to a Health Information Exchange (HIE)

  1. We participate in one or more Health Information Exchanges (“HIE”s). Your healthcare providers can use this electronic network to securely provide access to your health records for a better picture of your health needs. We, and other healthcare providers, may allow access to your health information through the HIE for treatment, payment, or other healthcare operations. We will not access or disclose your information through a state-run Health Information Exchange without a completed “Authorization for Access to Patient Information Through a Health Information Exchange Organization” form. This is a voluntary form.
  2. You may opt-in to allow WellBe access to your information at any time by completing the Authorization for Access to Patient Information Through a Health Information Exchange Organization form.

H. Protections against discrimination

  1. Federal law prohibits the use or disclosure of records protected under 42 CFR Part 2 to investigate or prosecute a patient solely on the basis of information contained in those records except as expressly authorized by law.

I. Your rights with respect to protected health information & how to exercise them

1. Receive an electronic or paper copy of your medical record, upon written request

  1. You can ask to view or receive an electronic or paper copy of your designated record set, which is the portion of your record used to make healthcare and treatment decisions about you.
  2. Such requests must be made in writing.
  3. We may charge a reasonable, cost-based fee for copies of your medical record.
  4. Our practice may deny your request to inspect or receive a copy of your medical records in limited circumstances. In such cases, and within ten (10) business days after receiving your request, we will provide in writing the reasons why your request is infeasible under the circumstances.

2. Amend your medical record

  1. You may ask us to amend your medical record if you believe it is incorrect or incomplete, and you may request an amendment for as long as the information is kept by or for our practice.
  2. We may deny your request, but we will explain why in writing within sixty (60) days after receiving your request. You have the right to appeal our decision.

3. Request restrictions

  1. You have the right to request a restriction in our use or disclosure of your health information for treatment, payment, or heath care operations purposes. We are not required to agree to your request (except in situations described in Section D of this notice), however if we do agree, we are bound by our agreement except when otherwise required by law, in emergencies, or when the information is necessary to treat you.
  2. You may request restrictions on certain uses and disclosures of your Part 2 records. We will review requests and respond in accordance with applicable federal and state law.
  3. Your written request must describe in a clear and concise fashion:
    1. The health information you wish restricted;
    2. Whether you are requesting to limit our practice’s use, disclosure, or both; and
    3. To whom you want the limits to apply.

4. Request confidential communications

  1. You have the right to request that our practice communicate with you about your health and related issues in a particular manner or at a certain location. For example, you may ask that we contact you at home, rather than work. We will say “yes” to all reasonable requests.
  2. Your written request must describe in a clear and concise fashion:
    1. Requested method of contact; and
    2. Location where you wish to be contacted.

5. Request a list of those with whom we have shared your health information

  1. All of our patients have the right to request an “accounting of disclosures”. An accounting is a list of certain non-routine disclosures that our practice has made of your health information for purposes not related to treatment, payment, or health care operations.
  2. Requests for an accounting of disclosures must state a time period, which may not be longer than six (6) years from the date of disclosure. You may request this list once per year at no cost, but any additional requests within the same 12-month period may incur a reasonable, cost-based fee.
  3. If you have records protected under 42 CFR Part 2, you may request an accounting of certain disclosures of those records as permitted by applicable law. Requests must be submitted in writing and will be processed in accordance with HIPAA and Part 2 requirements.

6. Request a copy of this Notice of Privacy Practices

  1. You are entitled to receive a paper copy of this notice, even if you agreed to receive the notice electronically. You may ask us to give you a copy at any time.

7. File a complaint

If you believe your privacy rights have been violated, you may file a complaint with our practice or with the Secretary of the Department of Health and Human Services. To file a complaint with our practice, contact:

Joshua Aubey, Chief Compliance & Privacy Officer
WellBe New York Medical PC
100 S Clinton Ave 24th Floor
Rochester, NY 14604
complyline@wellbe.com

All complaints must be submitted in writing. You will not be retaliated against for filing a complaint.

U.S. Department of Health and Human Services
200 Independence Avenue, SW
Room 509F, HHH Building
Washington, D.C. 20201
(800) 368-1019, (800) 537-7697 (TDD)

Complaint forms are available at: www.hhs.gov/ocr/office/file/index.html.

Want a copy to save or print?

Download PDF