Notice of Privacy Practices

Northwest Dakota Surgery Center LLC (“Dakota Medical” or “we”) is required by law to: maintain the privacy of your protected health information (PHI or “your medical information”); provide you with this notice of our legal duties and privacy practices with respect to your PHI, and notify you following a breach of your unsecured PHI.

This Notice of Privacy Practices (this “Notice”) describes how we may use and disclose your medical information. It also outlines your rights and our legal obligations concerning your medical information. Dakota Medical is required to abide by the terms of the Notice currently in effect.

I. Our Responsibilities

We are committed to protecting the privacy of your PHI. We will only use and disclose your PHI as permitted or required by law.

II. How We May Use and Disclose Your Protected Health Information

We may use and disclose your PHI for the following purposes:

• For Treatment: We use your PHI to provide, coordinate, and manage your medical care and treatment. For example, we may share your PHI with other physicians, nurses, and healthcare providers who are involved in your care, or to make a referral. We may also share this information with a pharmacist to fill a prescription or a lab that performs a test.

• For Payment: We may use and disclose your PHI to obtain payment for the health care services we provide to you and for other payment purposes. This includes billing and collecting payments from your insurance company, you, or other third parties. For example, we may need to provide your insurance plan with information about the services you received to ensure payment.

• For Healthcare Operations: We may use and disclose your PHI for our healthcare operations. “Healthcare operations” are those activities necessary to run our practice and ensure we provide quality care. For example, we may use your PHI to review our treatment and services, evaluate the performance of our staff, or conduct business planning and management activities.

• To Business Associates: Some services and activities of Dakota Medical are provided through contracts with business associates. Examples of business associates include Dakota Medical’s attorneys, accountants, medical record and practice management software vendor, management consultants, quality assurance reviewers, and billing and collection agencies. We may disclose information about you to our business associates so they can perform the job we have contracted with them to do. To protect the disclosed information, each business associate must sign a privacy agreement that requires them to appropriately safeguard the disclosed information.

• Appointment Reminders: We may use and disclose medical information to contact and remind you about appointments. This may include leaving a message on your voicemail or with the person who answers the phone. You may opt out of receiving appointment reminders at any time by contacting us at info@dakotamedical.com.

• Individuals Involved in Your Care: To the extent permitted by law, we may disclose your PHI to a family member, a close friend, or any other person you identify as being involved in your care, or helping you pay for your care. If you can make your own health care decisions, we will ask your permission before disclosing your information to these individuals. If you are unable to make your own health care decisions, we will disclose relevant information to these individuals or other responsible persons if we believe, in our professional judgment, that it is in your best interest to do so. For example, we may disclose limited medical information about you to your family member so that they can pick up a prescription for you, or in an emergency when the disclosure is necessary to help protect your health and well-being.

• As Required by Law: We may use and disclose your PHI when required to do so by federal, state, or local law.

• To Avert a Serious Threat to Health or Safety: We may use and disclose information about you when necessary to prevent or lessen a serious and imminent threat to the health and safety of you, another person, or the public. Any such disclosure may only be made to someone who is able to help prevent the threat and will be made in accordance with applicable state and federal law. These laws include, but are not limited to, the laws imposing a “duty to warn” on certain types of health care providers.

• Public Health Activities: We may disclose your PHI to public health authorities or other authorized persons to help carry out certain activities relating to public health, including to: prevent or control disease, injury, or disability; report births and deaths; report the abuse or neglect of a child or vulnerable adult; report reactions to medications or problems with regulated products or devices, or other activities related to the quality, safety or effectiveness of regulated products or devices; locate and notify persons of recalls of products they may be using; or notify people who may have been exposed to a communicable disease or may be at risk for contracting or spreading a disease or condition.

• Health Oversight Activities: We may disclose PHI to a health oversight agency for health oversight activities that are authorized by law. These activities are necessary for the government to monitor the health care system, government programs, and compliance with certain laws, and may include audits, investigations, inspections, and licensure and disciplinary activities.

• Workers' Compensation: We may use or disclose your PHI to comply with workers' compensation laws or similar programs. For example, we may release information about you to your employer or your employer’s workers’ compensation insurer without your specific consent, so long as the released information is related to a workers’ compensation claim and made in accordance with applicable law.

• Coroners, Medical Examiners, and Funeral Directors: We may disclose PHI to a coroner or medical examiner to identify a deceased person or determine the cause of death. We may also disclose PHI to funeral directors as necessary to carry out their duties.

• Research: Under certain circumstances, we may use and disclose your PHI for research purposes subject to the confidentiality provisions of sate and federal law. When required by law, we will make a good faith effort to obtain your written authorization before using or disclosing your PHI for a research project.

• Law Enforcement: We may release your medical information to a law enforcement official in response to a valid court order or with your written consent. We may also release information to law enforcement that is not a part of the health record (in other words, non-medical information) for the following reasons:

  • To identify or locate a suspect, fugitive, material witness, or missing person.

  • If you are the victim of a crime and we are unable to obtain your agreement, to the extent permitted by law;

  • About a death we believe may be the result of criminal conduct;

  • About a crime or suspected crime committed at our offices or clinics; and

  • In emergency circumstances, to report: a crime, the location of the crime or victims, or the identity, description or location of the person believed to have committed the crime.

We are also required to report certain types of wounds, such as gunshot wounds and some burns. In most cases, such reports will include only the fact of injury, and any additional disclosures would require a valid court order or your written consent.

• National Security and Intelligence Activities; Protective Services for the President and Others: We will disclose information about you to authorized federal officials for intelligence, counterintelligence, and other national security activities only as required by law or with your written consent. We will also disclose information about you to authorized federal officials so they may protect the President, other authorized persons, or foreign heads of state, or conduct special investigations only as required by law or with your written consent.

• Military and Veterans: If you are a member of the armed forces, we will release information about you to military command authorities or foreign military personnel when required to do so by law or with your written consent.

• Organ and Tissue Donation: We may release limited information about you to organizations that help locate, procure, and transplant organs and tissue, as necessary to facilitate organ or tissue donations that you agreed to make, if any.

• Inmates: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we will release information about you to a correctional institution or law enforcement official only as required by law or with your written

  consent.

• Lawsuits and Other Disputes: We may use and disclose information about you when required by a court or administrative tribunal order. We may also use and disclose information about you in response to a subpoena, discovery request, or other legal process, when required by law, or with your written consent.

• Marketing and Sale of Private Medical Information: We will not use, disclose, or sell information about you for marketing purposes without your written consent.

III. Your Rights Regarding Your Protected Health Information

You have the following rights regarding the PHI we maintain about you:

• Right to Access, Inspect and Copy: You have the right to access, inspect and receive a copy of the PHI that is used to make decisions about your care. Typically, this includes medical and billing records maintained by Dakota Medical but does not include psychotherapy notes or information gathered or prepared for a civil, criminal, or administrative proceeding. To access, inspect or receive a copy of your PHI, you must submit a written request to our Privacy Officer. To the extent permitted by state and federal law, we may charge a reasonable fee for the costs of copying, mailing, or other supplies. You may also direct us to provide your PHI directly to an entity or person designated by you in writing.
  
  We may deny your request to access, inspect and copy your PHI in certain very limited circumstances. For example, we may deny you access to this information if your provider believes this access will be harmful to your health or could cause a threat to others. In such cases, we may supply the information to a third party who may release the information to you. If you are denied access to your PHI, you may request a review of this denial, and another licensed health care professional will review your request and the denial. This professional will be chosen by Dakota Medical and will not be the person who denied your request. We will comply with the outcome of the review.

• Request Amendment: If you believe that your PHI is incorrect or incomplete, you may ask us to amend the information. To request an amendment, you must submit a written request to our Privacy Officer, and the request must include a reason supporting the request. We may deny your request if the information: already accurate and complete; was not created by Dakota Medical (unless the person or entity that created the information is no longer available to make the amendment); is not kept by Dakota Medical; or is not part of the information you would otherwise be permitted to inspect and copy If we deny your request, we will provide you with a written explanation, and you may respond with a statement of disagreement.

• Right to an Accounting of Disclosures: You have the right to request a list or an “accounting” of the disclosures of your PHI we have made. The list will not include certain disclosures, including those: made for treatment, payment, or healthcare operations purposes; that you specifically authorized or were authorized on your behalf; or that were made for certain notification purposes (e.g., national security, law enforcement purposes, etc.). To request an accounting, you must submit a written request to our Privacy Officer. In your written request, you must state the time period covered by your request, which may be up to six years from the date of your request. The first accounting that you request in a 12-month period will be free, but we may charge you for the reasonable costs incurred by us when providing an additional accounting(s) within the same 12-month period. We will tell you about the costs in advance, and you may choose to cancel your request at any time before we incur these costs.

• Right to Request Restrictions: You have the right to request a restriction on how we use or disclose your PHI. To request a restriction, you must submit a written request to our Privacy Officer. Each restriction request must specify (1) the information you want to restrict; (2) how you want to restrict the information (for example, restricting use to this office, only restricting disclosure to persons outside this office, or restricting both); and (3) to whom you want the restrictions to apply. We are not required to agree to all requests, but if we do, we will abide by that restriction unless the disclosure is needed to provide you with emergency treatment.
  
  You also have the right to restrict disclosures of your PHI to a health plan for payment or health care operation purposes if you pay for the services or items that are the subject of the restriction in full, out-of-pocket. We are required to agree with such a request. However, we are not required to agree to any other request.

• Right to Request Confidential Communications: You have the right to request that we communicate with you about medical matters in a certain way or at a specific location. For example, you can ask that we only contact you at work or by mail. To request confidential communications, you must make a written request to our Privacy Officer specifying the alternative means or location for communication. We may ask you to provide information about how payment will be handled; however, we will not ask you the reason for your request and will accommodate all reasonable requests.

• Right to a Paper Copy of This Notice: You have the right to a paper copy of this Notice at any time, even if you previously agreed to receive this Notice electronically. To obtain a paper copy of this Notice, please contact our Privacy Officer.

IV. Changes to this Notice

The original effective date of this Notice was Thursday, August 2st, 2025. Dakota Medical reserves the right to change this Notice at any time, and to make the revised or changed Notice effective for all PHI maintained by Dakota Medical. If Dakota Medical changes the terms of this Notice, Dakota Medical will provide you with a copy of the revised Notice upon request, and will post the revised Notice on its website (https://www.dakotamedical.com/notice-of-privacy-practices) and in designated locations at Dakota Medical’s practice locations.

V. Other Uses of Your Medical Information

Except as described above, we will not use or disclose your PHI without a specific written authorization from you. If you provide us with this written authorization to use or disclose medical information about you, you may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose medical information about you for the reasons covered by your written authorization, except to the extent we have already relied on your authorization. We are unable to take back any disclosures we have already made with your permission, and we are required to retain our records of the care that we provided to you.

VI. Compliance with Most Stringent Applicable Law; Potential for Redisclosure

The privacy of your health information and your health information rights are governed by multiple state and federal laws, including the Health Insurance Portability and Accountability Act (“HIPAA”). When multiple laws govern the privacy of your health information, we will comply with the law that most stringently protects this privacy. When multiple laws govern your health information rights, we will comply with the law that gives you the greatest right to access, amend, understand, and control your health information. For example, we will comply with the federal regulations governing the confidentiality of substance use disorder patient records (42 CFR Part 2) when these regulations prohibit uses and disclosures of these records that would otherwise be permitted under other applicable laws. However, these same laws may no longer protect your health information after it is disclosed by us. Therefore, there is a possibility that your health information may be redisclosed and no longer subject to legal protection after it is disclosed by us.

VII. Questions and Complaints

Your privacy and security are our utmost priority. If you have any questions about this Notice or would like to exercise any of your rights, please contact our Privacy Officer.

If you believe your privacy rights have been violated, you may file a complaint with Dakota Medical and/or with the Secretary of the U.S. Department of Health and Human Services. To file a complaint with Dakota Medical, please contact our Privacy Officer.

You will not be retaliated against or penalized for filing a complaint.