Notice of Privacy Practices

OnPoint Healthcare Services LLC
NOTICE OF PRIVACY PRACTICES
Effective Date: September 13, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, HOW YOU CAN ACCESS THIS
INFORMATION, AND YOUR PRIVACY RIGHTS. PLEASE REVIEW IT CAREFULLY.
About This Notice
OnPoint Healthcare Services LLC (“OnPoint,” “we,” “our,” or “us”) is committed to protecting the privacy and security of your health information.
Federal and Maryland laws require us to maintain the privacy and security of protected health information (“PHI”), provide you with this Notice
explaining our legal duties and privacy practices, and follow the privacy practices described in the Notice currently in effect.
PHI includes information that identifies you and relates to your physical or mental health, healthcare you receive, or payment for your
healthcare.
Maryland law also requires healthcare providers to keep patient medical records confidential and disclose them only as permitted or required
by applicable law.

YOUR RIGHTS
You have important rights regarding your health information.
Obtain a Copy of Your Health Record
You may ask to inspect or obtain an electronic or paper copy of your medical record and other health information maintained by OnPoint.
We will generally provide access or a copy within the timeframe required by law. In limited circumstances, access may be denied as permitted by
law.
We may charge a reasonable, cost-based fee when permitted by law.
Ask Us to Correct Your Health Information
If you believe information in your medical record is incorrect or incomplete, you may ask us to amend or correct it.
We may deny certain requests, but if we do, we will provide an explanation in writing as required by law.
Request Confidential Communications
You may ask us to contact you in a particular way or at a particular location.
For example, you may ask us to contact you only through your patient portal, at a particular telephone number, or at a different mailing address.
We will accommodate reasonable requests when required by law.
Ask Us to Limit What We Use or Share
You may ask us not to use or disclose certain health information for treatment, payment, or healthcare operations.
We generally are not required to agree to every requested restriction unless the law requires us to do so.
If we agree to a restriction, we will follow it except when disclosure is necessary for emergency treatment or otherwise permitted or required by
law.
Information About Services Paid in Full
If you pay for a healthcare service or item completely out of pocket, you may request that information about that service not be disclosed to
your health plan for payment or healthcare operations.
When the applicable legal requirements are met, we will honor that request unless disclosure is otherwise required by law.
OnPoint Healthcare Services LLC is currently a self-pay practice and does not bill Medicare, Medicaid, or commercial insurance for patient
services at this time.
Receive an Accounting of Certain Disclosures
You may request a list of certain disclosures OnPoint has made of your health information during the period permitted by law.
The accounting does not include every type of disclosure. For example, certain disclosures made for treatment, payment, healthcare
operations, or disclosures you specifically authorized may not be included.
We will provide the first accounting within the applicable period without charge and may charge a reasonable cost-based fee for additional
requests when permitted by law.
Receive a Copy of This Notice
You may ask for a paper or electronic copy of this Notice at any time, even if you previously agreed to receive it electronically.
Choose Someone to Act for You

If you have given another person legal authority to act on your behalf, such as through a healthcare power of attorney or guardianship, that
person may exercise certain privacy rights for you.
OnPoint may verify that person's authority before acting on the request.
File a Privacy Complaint
You may file a complaint with OnPoint if you believe your privacy rights have been violated.
You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR).
OnPoint will not retaliate against you for filing a privacy complaint or exercising your privacy rights.

YOUR CHOICES
For certain uses and disclosures of health information, you may tell us your preferences.
Family, Friends, and Others Involved in Your Care
You may tell us whether we may share relevant health information with a family member, friend, caregiver, or another person involved in your
care or payment for your care.
If you cannot communicate your preference—for example, because of a medical emergency—we may share information when permitted by law
and when we believe doing so is in your best interest.
We may also disclose appropriate information when necessary to prevent or lessen a serious and imminent threat to health or safety, as
permitted by law.
Marketing and Sale of Health Information
OnPoint will obtain your written authorization before using or disclosing your health information for purposes that require authorization
under HIPAA.
OnPoint does not sell patient health information.
When HIPAA requires written authorization for marketing activities, we will obtain your authorization before using your information for that
purpose.
Psychotherapy Notes
Most uses and disclosures of psychotherapy notes require written authorization, subject to limited exceptions under applicable law.
Fundraising
If OnPoint engages in fundraising activities permitted under HIPAA, you have the right to tell us not to contact you again for fundraising
purposes.

HOW WE MAY USE OR DISCLOSE YOUR HEALTH INFORMATION
HIPAA and other applicable laws allow or require us to use or disclose health information for certain purposes without obtaining a separate
authorization each time.
Treatment
We may use and disclose your health information to provide, coordinate, or manage your healthcare.
For example, we may share relevant information with another physician, nurse practitioner, specialist, pharmacy, laboratory, imaging facility,
hospital, or other healthcare professional involved in your treatment.
Healthcare Operations
We may use and disclose your information to operate OnPoint and improve the quality and safety of our services.
Examples include:
• quality improvement;
• care coordination;
• clinical review;
• compliance activities;
• staff training;
• business planning;
• credentialing;
• auditing; and
• communicating with you about your care.
Payment
We may use or disclose information as reasonably necessary to obtain payment for healthcare services.
Because OnPoint currently operates as a self-pay practice, this may include processing patient payments, documenting balances, issuing
receipts, or working with vendors that assist us with payment processing.
This statement does not mean that OnPoint currently submits claims to Medicare, Medicaid, or commercial health insurance.
Appointment and Care Communications
We may use your contact information to communicate with you about:
• appointment requests;
• appointment confirmations or reminders;
• telehealth visits;

• follow-up care;
• laboratory or diagnostic results;
• prescription matters;
• referrals;
• patient portal messages; and
• other matters related to your healthcare.
We will use reasonable safeguards when communicating electronically.
Business Associates
OnPoint may use third-party companies or individuals to perform services that involve PHI, such as electronic health record services, secure
communications, payment processing, information technology, or other administrative functions.
When required by HIPAA, these business associates must appropriately safeguard PHI.
Public Health and Safety
We may disclose health information when permitted or required by law for public-health or safety purposes, including certain activities
involving:
• prevention or control of disease;
• reporting certain diseases or conditions;
• medication or medical-product safety;
• product recalls;
• suspected abuse, neglect, or domestic violence; or
• prevention or reduction of a serious threat to health or safety.
Health Oversight
We may disclose health information to authorized health oversight agencies for activities permitted by law, such as audits, investigations,
inspections, licensing, and regulatory compliance.
Required by Law
We may disclose health information when federal or Maryland law requires us to do so.
This may include reporting obligations applicable to healthcare professionals.
Research
Health information may be used or disclosed for research only when the requirements of applicable law have been satisfied.
Organ and Tissue Donation
When applicable, information may be disclosed to organizations involved in organ, eye, or tissue donation or transplantation as permitted by
law.
Coroners, Medical Examiners, and Funeral Directors
We may disclose appropriate health information to a coroner, medical examiner, or funeral director when authorized or required by law.
Workers' Compensation
We may disclose health information as authorized by and necessary to comply with workers' compensation or similar programs established by
law.
Law Enforcement and Government Functions
Under circumstances specifically permitted or required by law, we may disclose information for law-enforcement purposes, health-oversight
activities, judicial or administrative proceedings, national-security activities, or other governmental functions.
Lawsuits, Court Orders, and Legal Proceedings
We may disclose health information in response to a valid court or administrative order or other lawful legal process when the applicable
requirements for disclosure are satisfied.

SUBSTANCE USE DISORDER RECORDS
Federal privacy requirements concerning substance-use-disorder records changed effective February 16, 2026, and HHS revised its HIPAA
provider NPP model accordingly. HIPAA-covered providers must now address applicable Part 2 records in their NPPs.
Accordingly:
To the extent OnPoint creates, receives, or maintains substance-use-disorder patient records that are protected by 42 CFR Part 2, those
records will receive the additional protections required by federal law.
Part 2-protected records generally may not be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding
against a patient unless the applicable federal requirements are satisfied, such as obtaining the patient's written consent or the legally required
court authorization and process.
Nothing in this Notice means that OnPoint Healthcare Services LLC is currently operating as a federally assisted 42 CFR Part 2 substance-use-
disorder treatment program.
If OnPoint establishes a Part 2 program in the future, additional Part 2 policies, notices, consents, and safeguards will be implemented as
applicable.
This approach is consistent with HHS's current provider model, which addresses Part 2 records using conditional language when a HIPAA
provider possesses such records.

MARYLAND PRIVACY PROTECTIONS
OnPoint will comply with applicable Maryland laws that provide privacy protections in addition to HIPAA.
Maryland law generally requires a healthcare provider to maintain the confidentiality of patient medical records and disclose those records
only as authorized by Maryland law or other applicable law.
Certain categories of health information may receive additional protection under federal or Maryland law. When another law gives your
information greater privacy protection than HIPAA, OnPoint will follow the more protective requirement when applicable.

TELEHEALTH, PATIENT PORTAL & ELECTRONIC COMMUNICATIONS
OnPoint provides healthcare through telehealth and may use electronic health record systems, a patient portal, secure messaging, electronic
prescribing, laboratory interfaces, video technology, telephone communications, and other electronic tools.
We use reasonable safeguards designed to protect PHI transmitted or stored electronically.
Patients are also encouraged to protect their patient-portal credentials, passwords, devices, email accounts, and physical privacy when
participating in telehealth or accessing health information electronically.
This Notice of Privacy Practices is separate from OnPoint's Telehealth Informed Consent.

OUR RESPONSIBILITIES
OnPoint Healthcare Services LLC is required to:
• maintain the privacy and security of PHI as required by law;
• provide you with this Notice describing our privacy practices and legal duties;
• follow the terms of the Notice currently in effect;
• provide notification as required by law if a breach of unsecured PHI occurs; and
• obtain written authorization before using or disclosing PHI when authorization is required by law.
If you give us written authorization to use or disclose information, you may generally revoke that authorization in writing at any time, except to
the extent that we have already acted in reliance on it or another legal exception applies.
These responsibilities are consistent with the current HHS provider model NPP.

CHANGES TO THIS NOTICE
OnPoint may change the terms of this Notice and our privacy practices as permitted by law.
A revised Notice may apply to health information we already maintain as well as information created or received after the revision.
When the Notice is materially revised, the current version will be made available as required by law, including through OnPoint's website and
practice.
HHS requires covered entities to make their current NPP available to anyone who requests it and prominently make it available on a website that
provides information about their healthcare services.

CONTACT ONPOINT REGARDING PRIVACY
Privacy Official:
Marlene Margerum, DNP, AGPCNP-C, CRNP
OnPoint Healthcare Services LLC
Phone: 443-561-3657
Email: info@myonpointhealth.com
Website: myonpointhealth.com
Questions regarding this Notice, requests to exercise privacy rights, or complaints concerning OnPoint's privacy practices may be directed to
the Privacy Official using the information above.
You may also submit a privacy complaint directly to:
U.S. Department of Health and Human Services
Office for Civil Rights
HHS provides complaint instructions through its Office for Civil Rights.
OnPoint Healthcare Services LLC will not retaliate against you for filing a complaint or exercising a privacy right.
Effective Date: September 13, 2026

OnPoint Healthcare Services LLC
Marlene Margerum, DNP, AGPCNP-C, CRNP
443-561-3657 · info@myonpointhealth.com