HIPAA notice of privacy practices
How the medical groups that care for you through Arcus may use and share your health information, and how you can get access to it.
Draft, last updated November 6, 2026.
On this page
The short version
- The medical groups that care for you through Arcus are required by law to protect your health information.
- They use and share it to treat you, bill for your care and run their practices, and otherwise only as the law allows or with your written permission.
- You can get a copy of your records, ask for corrections, and choose how we contact you.
- If you think your privacy rights were violated, you can complain to us or to HHS, and we won’t retaliate.
About this notice
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
This is a joint notice of the independent medical groups whose licensed clinicians provide care through Arcus (“we” and “us” in this notice). It applies to the health information they create or receive about you. Arcus supports them as a business associate and is required to protect your information in the same way.
Our responsibilities
- We’re required by law to keep your health information private and secure.
- We’ll tell you promptly if a breach happens that may have compromised the privacy or security of your information.
- We must follow the duties and privacy practices described in this notice and give you a copy of it.
- We won’t use or share your information in ways other than those described here unless you tell us we can in writing. You can change your mind at any time by telling us in writing.
How we use and share your information
We typically use and share your health information to:
- Treat you. For example, your clinician uses your information to diagnose you, sends a prescription to your pharmacy, or orders a test from a lab.
- Bill for your care. For example, we share information with your insurance plan to check your coverage, ask for prior authorization and get paid.
- Run our practice. For example, we review the quality of care, train clinicians and work with business associates like Arcus that help us run our services.
Other ways we may share your information
We’re allowed or required to share your information in other ways, usually ones that contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can share it for these purposes.
- When the law requires it, including to the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.
- For public health and safety, such as preventing disease, helping with product recalls, reporting reactions to medications, reporting suspected abuse, neglect or domestic violence, and preventing or reducing a serious threat to anyone’s health or safety.
- For health oversight, to agencies for activities the law authorizes, like audits, investigations and licensing.
- For lawsuits and legal actions, in response to a court or administrative order, or a subpoena.
- For law enforcement, when the law allows or requires it.
- To coroners, medical examiners and funeral directors, when someone dies.
- For organ and tissue donation requests.
- For research that meets the law’s privacy protections.
- For workers’ compensation claims.
- For special government functions, such as military, national security and presidential protective services.
- With people involved in your care, like a family member or friend, unless you tell us not to. If you can’t tell us, for example if you’re unconscious, we may share information if we believe it’s in your best interest.
Some state laws give extra protection to certain information, like HIV status, mental health, substance use, genetic and reproductive health information. Where a state law is more protective than HIPAA, we follow it.
When we need your written permission
- Most sharing of psychotherapy notes.
- Marketing.
- Selling your information.
- Any other use or sharing not described in this notice.
If you give us permission, you can take it back in writing at any time, except for anything we’ve already done because of it. We won’t contact you for fundraising.
Your rights
- Get a copy of your medical record. Ask for an electronic or paper copy of your record and other health information we have about you. We’ll usually provide it within 30 days and may charge a reasonable, cost-based fee.
- Ask us to correct your record. If you think information is wrong or incomplete, ask us to correct it. We may say no, but we’ll tell you why in writing within 60 days.
- Ask for confidential communications. Ask us to contact you in a specific way, like a different phone number or email. We’ll say yes to all reasonable requests.
- Ask us to limit what we use or share. We aren’t required to agree, and may say no if it would affect your care. If you pay for a service in full yourself, you can ask us not to share information about it with your insurance plan, and we’ll say yes unless the law requires us to share it.
- Get a list of who we’ve shared it with. Ask for a list of the times we’ve shared your information in the six years before your request, who we shared it with and why. It covers sharing other than for treatment, payment and running our practice, and a few other cases. We’ll provide one list a year for free, and may charge a reasonable, cost-based fee for more.
- Get a copy of this notice. Ask for a paper copy at any time, even if you agreed to get it electronically.
- Choose someone to act for you. If someone is your medical power of attorney or legal guardian, they can use your rights and make choices about your health information.
- File a complaint if you feel your rights have been violated, as described below.
To use any of these rights, email privacy@arcus.healthcare.
How to file a complaint
If you believe your privacy rights have been violated, you can complain to us at privacy@arcus.healthcare. You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by writing to 200 Independence Avenue SW, Washington, DC 20201, calling 1-877-696-6775, or visiting hhs.gov/ocr/complaints.
We won’t retaliate against you for filing a complaint.
Changes to this notice
We can change the terms of this notice, and the changes will apply to all the information we have about you. The new notice will be posted on this page, available in your account, and sent to you on request.
Contact
Privacy officer: privacy@arcus.healthcare.