Kolmac Integrated Behavioral Health Privacy Policy

NOTICE OF PRIVACY PRACTICES 

Purpose: THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. This notice also describes privacy practices of Kolmac Clinic, LLC, in connection with the http://kolmac.com website and any other website that we own or control and which post or links to the Privacy Policy (collectively the treatment services we provide in connection with our marketing activities, and as otherwise described in this Privacy Policy. In addition, this Privacy Policy describes your rights and choices with respect to the personal information we collect. 

Policy: During the process of providing services to you, Kolmac Clinic, LLC and the members of the Kolmac Affiliated Covered Entity (KOLMAC or we) will obtain, record, and use information about you that is protected health information. Protected health information means any information that we have which identifies you and relates to your health payment for health care services, and substance use disorder including mental health, treatment that we provide to you. KOLMAC is committed to protecting the privacy and confidentiality of your protected health information (PHI). The following notice outlines our privacy practices, legal duties and your rights concerning your PHI. 

The references to KOLMAC in this notice refer to the entities that are members of the Kolmac Affiliated Covered Entity (ACE). An Affiliated Covered Entity is a group of entities under common ownership that designate themselves as a single covered entity for purposes of compliance with the Health Insurance Portability and Accountability Act (HIPAA). The entities of the ACE will share PHI with each other for the treatment, payment, and health care operations of the ACE and as permitted by HIPAA and this notice. For a complete list of the members of the ACE, please contact KOLMAC Privacy Officer at compliance@Kolmac.com. 

Medical Records consist of your PHI and may include but are not limited to name, demographic information, referral information, admission notes, admission paperwork, assessments, evaluations, progress notes, treatment plan, medical and medication protocols, continuing care plan, discharge summary and financial/payment information. These records are necessary to provide you with the best interdisciplinary care, continuing care and receiving payment for treatment services from third party payers and are required by state licensing mandates. 

Amendments to this notice may be made in writing by KOLMAC as laws and or policies change. 

HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION 

We are permitted under federal law to use and disclose PHI, without your written authorization, for certain routine uses and disclosures, such as those made for treatment, payment, and the operation of our business. The following are examples of the types of routine uses and disclosures of PHI that we are permitted to make. While this list is not exhaustive, it should give you an idea of the routine uses and disclosures we are permitted to make. 

Treatment: Your personal health information (PHI) may be disclosed as needed to provide you with the best possible care, the most comprehensive treatment and to assure your physical health and safety. For example, we may disclose your health information to your primary care physician or another health care provider to be sure they have all the information necessary to diagnose and treat you. 

Payment: There may be instances when payment for treatment services will require disclosure of your PHI. This is most common when payment is made by a third party such as an insurance company, workers compensation, another family member or your personal financial officer. Your PHI will only be disclosed with your express written consent or authorization. It is important to know, however, that your refusal to give such permission may lead to non-payment by that third party as without your written consent or authorization, we will be unable to discuss payment for your treatment services with any third party. 

Healthcare Operations: KOLMAC may use and/or disclose your PHI for healthcare operations such as: staff training and evaluation, auditing, medical reviews, compliance, business planning, licensing, quality assurance, accreditation, certification and credentialing activities. 

OTHER USES AND DISCLOSURES THAT MAY BE MADE WITHOUT YOUR AUTHORIZATION 

Family Members: We may disclose PHI to family members and others involved in your healthcare or payment for care unless you have objected per section 164.510. Under the Omnibus Rule, this exception would also allow disclosures of information about deceased persons to family members and others involved in the deceased persons care prior to their death unless the deceased person objected prior to their death. 

Personal Representatives: We may disclose your PHI to personal representatives. 

Required by the Secretary of Health and Human Services: We may be required to disclose your PHI to the Secretary of Health and Human Services to investigate or determine our compliance with the requirements of the HIPAA Privacy Rule. 

Required By Law: We may use or disclose your PHI to the extent that the use or disclosure is otherwise required by federal, state, or local law. 

Public Health: We may disclose your PHI for public health activities, such as disclosures to a public health authority or other government agency that is permitted by law to collect or receive information (e.g., the Food and Drug Administration). 

Health Oversight: We may disclose PHI to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies include government agencies that oversee the health care system, government benefit programs, other government regulatory programs and civil rights laws. 

Abuse or Neglect: If you have been a victim of abuse, neglect, or domestic violence, we may disclose your PHI to a government agency authorized to receive such information. In addition, we may disclose your PHI to a public health authority that is authorized by law to receive reports of child abuse or neglect. 

Judicial and Administrative Proceedings: We may disclose your PHI in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), and, in certain conditions, in response to a subpoena, discovery request or other lawful process. 

Law Enforcement: We may disclose your PHI, so long as applicable legal requirements are met, for law enforcement purposes, such as providing information to the police about the victim of a crime. 

Coroners and Funeral Directors: We may disclose your PHI to a coroner, medical examiner, or funeral director if it is needed to perform their legally authorized duties. 

Research: Under certain circumstances, we may use and disclose your PHI for Internal and external research purposes to, among other things, develop and improve our services. We may disclose your PHI to organizations that support medical research or that find, investigate, or cure diseases. 

Serious Threat to Health or Safety: We may disclose your PHI if we believe it is necessary to prevent a serious and imminent threat to the public health or safety and it is to someone, we reasonably believe is able to prevent or lessen the threat. 

Specialized Government Functions: When the appropriate conditions apply, we may disclose PHI for purposes related to military or national security concerns, such as for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits. 

Workers Compensation: We may disclose your PHI as necessary to comply with workers’ compensation laws and other similar programs. 

Business Associates: We may disclose your PHI to persons who perform functions, activities or services to us or on our behalf that require the use or disclosure of PHI. To protect your health information, we require the business associate to appropriately safeguard your information. 

De-identified information: We may de-identify your PHI in accordance with the HIPAA standards. PHI that is de-identified in accordance with the HIPAA standards is not considered PHI, and therefore, we may use and disclose your de-identified information for any lawful purpose, including without limitation, for research purposes. 

Inclusion of your information in the electronic medical record/directory: We may disclose PHI to communicate between members of the treatment team at KOLMAC including professionals contracting with KOLMAC involved in your care such as outpatient therapists, psychiatrists or medical doctors. 

Your authorization and consent to release information: Although your medical record is the physical property of KOLMAC, you have the right to review and receive a copy of your medical record. You may consent to KOLMAC to release specific information about you to facilitate your treatment. A written consent or authorization signed by you regarding such medical records must be obtained prior to copying and or delivery of those records to you. 

You may also request that your PHI be disclosed to any person or agency that you choose for any purpose. You must provide a written consent or authorization for that information to be disclosed even when such a request is made by you. Such consent is valid for one year from the date originally signed unless otherwise specified by you. You have the right to revoke your consent or authorization at any time. 

Disclosure to Family and Friends: Only the PHI that you have specified will be disclosed and only to those for which you have provided written consent or authorization. KOLMAC will not confirm or deny your presence at KOLMAC to any individual that you have not signed consent or authorization for except in the case of an emergency or as required by law. In the event of your incapacity or under emergency circumstances, we will disclose your PHI to the person you had previously designated as your Emergency Contact Person(s) 

Other Uses and Disclosures of Your Health Information that Require Written Authorization: 

Other uses and disclosures of your health information not covered by this Notice will be made only with your written authorization. Some examples include: 

– Psychotherapy Notes: We may maintain psychotherapy notes about you. If we do, we will only use and disclose them with your written authorization except in limited situations. 

– Marketing: We may only use and disclose your health information for marketing purposes with your written authorization 

– Appointments, Reminders and Alumni contact: We may use and disclose your PHI to contact you (i.e.: telephone calls, voicemails, e-mails, letters) as a reminder of an appointment at KOLMAC, to check on you and your mental health status and regarding alumni events and associations. You have the right to request not to be contacted for such purposes. 

– Marketing and advertising. We do not sell your personal information or the personal information of your users. We and our service providers and our third-party advertising partners may collect and use your personal information for marketing and advertising purposes. 

– Interest-based advertising. We may engage third-party advertising companies and social media companies to display ads on the treatment services we provide and other online services. These companies may use cookies and similar technologies to collect information about your interaction (including the data described in the “Cookies and Other Information Collected by Automated Means” section below) over time across the Service, our communications and other online services, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. You can learn more about your choices for limiting interest-based advertising in the Advertising choices section below. 

– Cookies and Other Information Collected by Automated Means 

– We, our service providers, and our business partners may automatically log information about you, your computer, and activity occurring on or through the Service. The information that may be collected automatically includes your computer type and version number, manufacturer and model, device identifier (such as the Google Advertising ID or Apple ID for Advertising), browser type, screen resolution, IP address, the website you visited before browsing to our website, general location information such as city, state or geographic area; and information about your use of and actions on the Service, such as pages or screens you viewed, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times, and length of access. Our service providers and business partners may collect this type of information over time and across third-party websites. 

– On our webpages, this information is collected using cookies, browser web storage (also known as locally stored objects, or “LSOs”), web beacons, and similar technologies, and our emails may also contain web beacons. 

– Referrals 

– Users of Kolmac treatment services may have the opportunity to refer to friends or other contacts to us. If you are an existing patient, you may only submit a referral if you have permission to provide the referral’s contact information to us so that we may contact them. 

YOUR RIGHTS UNDER THE FEDERAL PRIVACY STANDARD 

To request that KOLMAC place additional restrictions on certain uses and disclosures of your information: We are not required by law to agree with your request however, except for restrictions regarding disclosure for payment or health care operations, or if the PHI pertains solely to a health care item or service for which the individual, or person other than the health plan on behalf of the individual, has paid KOLMAC in full. However, whenever possible as to not cause undue hardship to the flow of business of KOLMAC, we will honor such requests. 

For example, you may request that your medical record is not made available to state-licensing representatives during standard audits of KOLMAC. However, these audits may require the regulator to have access to any records of individuals who have received services at KOLMAC. We cannot interfere with these audits in any way. Therefore, under these circumstances, your request cannot be honored.  

Text message communications. We use text messaging to communicate with you about your service. Normal messaging rates apply, and the frequency of messages may vary. Mobile Carriers are not liable for delayed or undelivered messages. 

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. 

Opt-out of text message communications. You may opt-out of text messaging at any time by replying to any message with STOP contacting us at compliance@kolmac.com. This will end the communications from that phone number. You may continue to receive service-related and other non-marketing text messages from other phone numbers managed by Kolmac, and you may opt out of those in a similar fashion. 

To obtain a copy of this notice upon request: You have the right to a paper copy of this Notice at any time. 

To request a copy of your medical record: You may request a copy of your medical record. KOLMAC may deny such request if it or its representatives believe that such access would cause harm to other patients, KOLMAC personnel or property or yourself. You also do not have the right to access your medical record from KOLMAC in the following instances: 

1. When information was compiled in reasonable anticipation of or for use in civil,criminalor administrative actions of proceedings. 
2. Wheninformation was obtained from someone other than a healthcare provider under a promise of confidentiality and the accessrequired would be reasonably likely to reveal the source of the information. 
3. Whentherecords were created by a treatment facility or mental health professional that is not a KOLMAC employee or Business Associate. 
4. There are other situations in which KOLMAC may deny you access to your medical record. If so,KOLMACis required to provide you with a review of the decision denying such access. Reviewable grounds for denial include but are not limited to: 

– When a licensed staff member of KOLMAC has determined, in their professional judgment that access is likely to endanger the life or physical safety of the person receiving services or another person. 

– When the medical record refers to another person receiving services at KOLMAC or person other than a provider. and a licensed staff member of KOLMAC has determined that such access is likely to cause substantial harm to the person or another person. 

– When the request is made by the person’s personal representative and a licensed staff member of KOLMAC has determined that such access is likely to cause substantial harm to the person or another person. 

– When the proper written consents/authorization have not be obtained. 

To receive an accounting of disclosures of PHI: You have the right to get a list of certain instances in which we have disclosed your PHI. You may ask for this list for the prior 6 years. We will give the times we have shared your PHI, who we shared it with, and why. The list will not have uses or disclosures that you have specifically authorized in writing, for example, copies of records to your employer, or disclosures for treatment, payment, or health care operations and certain other types of disclosures. Please send your request in writing to compliance@kolmac.com. We will offer one list a year for free but will charge a reasonable cost-based fee if you ask for another list within 12 months. 

To request an amendment or correction to your medical record: If KOLMAC staff denies your request for amendment/ correction, we will notify you of why and how you can attach a statement of disagreement to your record (which we may argue) and how you can register a written complaint to our Privacy Officer or the Office of Behavioral Health or Department of Health and Human Services. 

If we grant the request, we will make the correction and distribute it to those you identify in writing that you want notified. We do not have to grant the request if KOLMAC staff did not create the record. In this case you must seek the amendment/correction from the party who originally created the record. For instance: KOLMAC staff has obtained your written PHI from another treatment facility or professional, and there is information contained in those records that you disagree with, KOLMAC staff may not legally amend those records in any way. 

To request alternative confidential communication: You have the right to request that we communicate with you by alternative means or at alternative locations. Requests need to be made in writing and must specify the alternative means and location. You may ask that we call you at home, on your cell phone or another form of . You may ask that we send mail to a different address. 

KOLMAC responsibilities under federal law: In addition to providing, you with your rights as detailed above, KOLMAC is required to: 

1. 1. Maintainthe privacy of your PHI: KOLMAC will do this by the implementation of reasonable andappropriate physical, administrative, and technical safeguards. 
2. 2. Provide you with this notice concerning our legal duties and privacy practices with respect to the personal and confidential information we obtain about youduring the course ofyour treatment at KOLMAC. 
3. 3. Notify affected individuals following a breach of unsecured PHI.
4. 4. Provide a copy and abide by the terms of this notice.
5. 5. Train KOLMAC employees, staff and personnel on our privacy and confidentiality policies.
6. 6. Implement a disciplinary plan: KOLMAC policy states that any KOLMAC employee who knowingly and/or willfully violates provisions of KOLMAC policies and proceduresregardingprivacy will face administrative disciplinary action that may result in termination of employment. 
7. 7. Except asset forth inthis notice, KOLMAC will not use or disclose your personal and mental health information without your written consent or authorization. 
8. 8. Maintainan account of any non-routine disclosures and uses of your medical records within60 days of such disclosures. The information provided will include the name and address of the person who received your PHI, a description of the information disclosed, and a statement of the purpose of such disclosure. KOLMAC reserves the right to charge a reasonable fee for this service. 

CHANGES TO THIS NOTICE 

We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for PHI we already have as well as any information we receive in the future. The current notice will be posted on our company website, in all physical locations and will be available in the electronic medical records systems. 

CONTACT INFORMATION 

If you have questions, would like further information or believe your privacy rights have been violated you may contact KOLMACs Privacy Officer. 

Grievances should be made in writing and be addressed to KOLMAC Compliance Team at compliance@kolmac.com.  

You also have the right to file a grievance with: 

The U.S. Department of Health and Human Services at Region Ill Office for Civil Rights 

801 Market Street, Suite 8000, Philadelphia, PA 19107 215-861-4633 

Effective Date: February 16, 2026 

 

 

 

 

 

Appendix A 

Notice of Privacy Practices: KOLMAC Part 2 Programs
 

Additional Federal Privacy Protections For Certain Substance Use Disorder (SUD) Treatment Records 

Purpose: This addendum to the Notice of Privacy Practices describes the additional confidentiality protections Kolmac Clinic, LLC and the members of the Kolmac Affiliated Covered Entity (KOLMAC or we) have instituted to protect SUD records, as required by federal regulations under 42 CFR Part 2 (Part 2). This Notice supplements KOLMAC’s Notice of Privacy Practices and the additional protections described herein apply only to Part 2-protected SUD records, generated as part of KOLMAC’s substance use treatment programs (Part 2 programs). We will follow the Notice of Privacy Practices to the extent it is more restrictive or provides you with more rights than this Appendix. If other applicable laws are more stringent than Part 2, we will comply with those laws.  

This notice describes: 

• How health information about you may be used and disclosed; 

• Your rights with respect to your health information; 

• How to file a complaint concerning a violation of the privacy or security of your health information, or of your rights concerning your information; and 

• You have a right to a copy of this notice in paper or electronic form and to discuss it with the KOLMAC Privacy Officer at 240-356-4003 or compliance@kolmac.com if you have any questions. 

USES AND DISCLOSURES OF PART 2-PROTECTED RECORDS THAT MAY BE MADE WITHOUT YOUR CONSENT 

We are permitted to use and disclose your Part 2-protected records, without your written consent, in the following circumstances: 

• KOLMAC Part 2 Program Personnel: Part 2-protected records may be used and disclosed by staff members within KOLMAC’s Part 2 program and between the part 2 program and an entity having direct administrative control over that part 2 program who have a need for the records as part of their duties to diagnose, treat and refer for treatment. 

• Medical Emergencies: Your Part 2-protected records may be disclosed to medical personnel in a medical emergency.  

• Scientific Research: Under certain circumstances, we may use and disclose your Part 2-protected records for research purposes to the extent allowed under HIPAA regulations and HHS and FDA regulations regarding the protection of human subjects.  

• Audits and Program Evaluations: We may disclose your Part 2-protected records to entities performing a management or financial audit or program evaluation, if these activities are performed on behalf of:  

• a federal, state or local governmental agency that provides financial assistance to the KOLMAC Part 2 program or other lawful holder, or is authorized by law to regulate the activities of the KOLMAC Part 2 program or other lawful holder; 

• a third-party payer or health plan covering the services provided to you; 

• a quality improvement organization (QIO) performing a QIO review; or 

• an entity with direct administrative control over the KOLMAC Part 2 program.  

• Public Health: We may disclose your de-identified Part 2-protected records for public health purposes to a public health authority.  

• Crimes: We may disclose information from your Part 2-protected records to law enforcement if the information is related to the commission of a crime on our premises or against our personnel, or a threat to commit such a crime.  

• Qualified Service Organizations: We may disclose your Part 2-protected records to persons who perform functions, activities or services to us or on our behalf that require the use or disclosure of Part 2-protected records. To protect your health information, we require the qualified service organization to enter into a written agreement to comply with the Part 2 protections.  

• Child Abuse or Neglect: We may disclose your Part 2-protected records as part of a report of suspected child abuse or neglect to a governmental authority that is authorized by law to receive such reports.  

 

• Required by the Secretary of Health and Human Services: We may be required to disclose your Part 2-protected records to the Secretary of Health and Human Services to investigate or determine our compliance with the requirements of Part 2.  

 

• Adult Patients Who Lack Capacity and Deceased Patients: We may receive consent to use and disclose Part 2-protected records from a patient’s personal representative if a patient is adjudicated as lacking capacity or is deceased. In the case of deceased patients, we may also disclose Part 2-records relating to the cause of death of a patient under laws requiring the collection of death or other vital statistics or permitting inquiry into the cause of death.  

 

• Substantial Threat to Life or Wellbeing: In the case of minor applicants, we may disclose facts relevant to  reducing a substantial threat to the life or physical well-being of the minor applicant or any other person to the parent, guardian or other person authorized under state law to act on the minor’s behalf if certain conditions are met.  

 

• Fundraising. We may use or disclose your Part 2-protected records to fundraise for the benefit of the KOLMAC Part 2 Program. However, you have the right to opt-out of receiving fundraising communications from us. 

• Other Permissible Purposes Under Part 2. We may use or disclose Part 2-protected records without your consent as otherwise permitted by Part 2. 

 

 

USES AND DISCLOSURES OF PART 2-PROTECTED RECORDS THAT MAY ONLY BE MADE WITH YOUR CONSENT  

We will ask for your written consent to use and disclose your Part 2-protected records in the following circumstances:  

• Treatment, Payment, and Healthcare Operations. We may use and disclose your Part 2-protected records for Treatment, Payment, and Healthcare Operations purposes, as described in the Notice of Privacy Practices, with your written consent.  

• Single Consent. You may provide a single consent for all future uses or disclosures for treatment, payment and health care operations purposes. For example, you may provide a single consent for sharing your Part 2-protected records with your health plan for payment purposes. Except in civil, criminal, administrative and legislative proceedings against you, records that are disclosed to another Part 2 program or HIPAA-covered entity/business associate pursuant to your written consent for treatment, payment and health care operations may be further disclosed by that Part 2 program, or HIPAA-covered entity/business associate, without your written consent, to the extent the HIPAA regulations permit such disclosure. If the Part 2 program is not subject to HIPAA, the records may be further disclosed to the extent allowed by your written consent.  

• Civil, Criminal, Administrative or Legislative Proceedings. You must sign a separate Part 2 consent form in order for us to share your Part 2-protected records as part of a civil, criminal, administrative or legislative proceeding against you. 

• Central Registry or Withdrawal Management/Maintenance Program. We may in some circumstances disclose your Part 2-protected records to a central registry or withdrawal management or treatment program (not more than 200 miles away) to prevent duplicate enrollment or coordinate care, with your written consent. For example, if you are participating in a drug treatment program, we can disclose your information to a central registry to avoid duplicate enrollment or to the program to coordinate care.  

• Mandated Treatment Through Criminal Justice System. If you are receiving Part 2 program services from KOLMAC as mandated by the criminal justice system, we may share your Part 2-protected records with those entities in the criminal justice system who made your participation a condition of the disposition of any criminal proceedings against you or your parole or other release from custody, with your written consent. For example, these entities may include the court, probation officers, parole officers, prosecutors or other law enforcement. The written consent must state that it is revocable upon the passage of a specified amount of time or the occurrence of a specified, ascertainable event. The time or occurrence upon which your consent becomes revocable may be no later than the final disposition of the conditional release or other action in connection with which written permission was given.  

• Prescription Drug Monitoring Program. We may report any SUD medication prescribed or dispensed by the Part 2 program to the applicable state prescription drug monitoring program if required by applicable state law, but must obtain your consent before reporting such information. 

• Uses and Disclosures Not Described in This Notice. Uses and disclosures of Part 2-protected records not described in this Notice will only be made with your written consent.  

You may revoke your consent provided hereunder at any time, except to the extent KOLMAC has acted in reliance upon it. You may revoke the consent by submitting a request in writing to the KOLMAC Privacy Officer with the contact information listed at the end of this Notice.  

PATIENT RIGHTS IN REGARD TO USING OR SHARING PART 2-PROTECTED RECORDS IN LAWSUITS AND LEGAL ACTIONS  

• Records, or testimony relaying the content of such records, shall not be used or disclosed in any civil, administrative, criminal or legislative proceedings against you unless based on specific written consent or a court order. 

• Records shall only be used or disclosed based on a court order after notice and an opportunity to be heard is provided to you or the holder of the record, where required by 42 U.S.C. § 290dd-2 and 42 CFR Part 2. 

• A court order authorizing use or disclosure must be accompanied by a subpoena or other similar legal mandate compelling disclosure before the record is used or disclosed. 

YOUR RIGHTS REGARDING PART 2-PROTECTED RECORDS 

As a patient in KOLMAC’s Part 2 program, you have the following rights pertaining to your Part 2-protected records: 

• Right to Request Restrictions on Disclosures. You have the right to request restrictions on disclosures made with prior consent for purposes of treatment, payment and health care operations (see our Notice of Privacy Practices for additional information regarding such requests).  

• Right to Request and Obtain Restrictions on Disclosures to Health Plan. You have the right to request and obtain restrictions on the disclosure of Part 2-protected records to your health plan for health services which you, or another person on your behalf, has paid KOLMAC in full. 

• Right to List of Disclosures. You have the right to get a list of certain instances in which we have disclosed your Part 2-protected records. You may ask for this list for the prior three years. We will give the times we have shared your Part 2-protected records, who we shared the records with and why. The list will not have uses or disclosures that you have specifically authorized in writing; for example, copies of records to your employer, or disclosures for treatment, payment or health care operations and certain other types of disclosures. Please send your request in writing to compliance@kolmac.com. We will offer one list a year for free but will charge a reasonable cost-based fee if you ask for another list within 12 months. 

• Right to List of Disclosures by an Intermediary. You have the right to request a list of Part 2-protected record disclosures by an intermediary for the prior three years. Such request may include the name(s) of the entity(ies) to which the disclosure was made, the date of the disclosure and a brief description of the information that was disclosed.  

• Right to a Copy of This Notice and to Discuss This Notice. You have the right to obtain a paper or electronic copy of the notice from KOLMAC’s Part 2 program upon request. You also have a right to discuss this notice with the KOLMAC Privacy Officer upon request.  

• Right to Opt Out of Fundraising Communications. You have the right to not receive fundraising emails from KOLMAC.  

To exercise these rights, you may submit a written request to the KOLMAC Privacy Officer listed at the bottom of this Appendix. 

KOLMAC PART 2-PROTECTED RECORD DUTIES 

• Maintaining Privacy of Part 2-Protected Records. KOLMAC’s Part 2 program is required by law to maintain the privacy of records, to provide patients with notice of its legal duties and privacy practices with respect to records and to notify affected patients following a breach of unsecured records.  

• Abiding by This Notice. KOLMAC’s Part 2 program is required to abide by the terms of the notice currently in effect.  

• Changing This Notice. We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for Part 2-protected records we already have as well as any information we receive in the future. The current notice will be posted on our company website, in all physical locations and will be available in the electronic medical records systems. 

COMPLAINTS  

If you believe your privacy rights have been violated, you may submit a complaint to: 

•  The Secretary of the U.S. Department of Health and Human Services; and/or 

• The KOLMAC Compliance Team at compliance@kolmac.com.  

You will not be retaliated against for filing a complaint.  

PART 2 PROGRAM CONTACT INFORMATION  

For further information about this Appendix, you may ask a Part 2 program staff member or contact KOLMAC’s Privacy Officer at 240-356-4003 or compliance@kolmac.com. 

EFFECTIVE DATE: February 16, 2026