NOTICE OF PRIVACY PRACTICES (HIPAA) — LYXARA BIOLOGICS INSTITUTE

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: February 11, 2025
Last Updated: February 11, 2026

This Notice of Privacy Practices (“Notice”) applies to LYXARA Biologics Institute and its workforce (“Lyxara,” “we,” “us,” or “our”) to the extent we are a HIPAA Covered Entity or otherwise required to provide this Notice, or when we handle Protected Health Information (“PHI”) on behalf of providers.

PHI is information about your health or payment for healthcare that can reasonably identify you.

A) Our Duties

We are required by law to:

• Maintain the privacy and security of your PHI
   
• Provide you with this Notice of our legal duties and privacy practices
   
• Notify you if a breach occurs that may have compromised your PHI
   
• Follow the terms of the Notice currently in effect
   

B) How We May Use and Disclose Your PHI (Without Your Written Authorization)

1) Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services.
Example: sharing information with a lab, pharmacy, or another provider involved in your care.

2) Payment

We may use and disclose your PHI to bill and receive payment for services.
Example: submitting claims or verifying benefits.

3) Healthcare Operations

We may use and disclose your PHI for operational purposes, such as quality improvement, training, audits, compliance, licensing, and business management.

4) Appointment Reminders and Service Communications

We may contact you about appointments, follow-ups, and service-related messages by phone, email, or text (based on your preferences).

5) Individuals Involved in Your Care

We may share PHI with a family member, friend, or caregiver involved in your care or payment, unless you object and we are able to honor your objection.

6) Business Associates

We may disclose PHI to third parties (“Business Associates”) who perform services for us (billing, IT, secure storage), provided they agree to safeguard your PHI.

7) Required by Law

We may disclose PHI when required by federal or state law.

8) Public Health and Safety

We may disclose PHI for public health activities (such as reporting certain diseases), preventing serious threats to health/safety, or reporting abuse/neglect as required.

9) Health Oversight, Audits, and Licensure

We may disclose PHI to health oversight agencies for audits, investigations, inspections, and licensure actions.

10) Legal Proceedings and Law Enforcement

We may disclose PHI in response to a court order, subpoena, or other lawful process, or to law enforcement as permitted by law.

11) Coroners, Medical Examiners, and Funeral Directors

We may disclose PHI as permitted by law.

12) Workers’ Compensation

We may disclose PHI for workers’ compensation or similar programs as authorized by law.

C) Uses and Disclosures That Require Your Written Authorization

We will obtain your written authorization for:

• Most uses/disclosures of psychotherapy notes
   
• Marketing communications that involve disclosure of PHI (with limited exceptions)
   
• Sale of PHI
   
• Any other use/disclosure not described in this Notice
   

You may revoke an authorization in writing at any time, except to the extent we’ve already acted on it.

D) Your Rights Regarding Your PHI

You have the right to:

1) Get a Copy of Your Records

You may request access to inspect or obtain a copy of your PHI, usually within 30 days (or as required by law). We may charge a reasonable, cost-based fee.

2) Request a Correction

If you believe your PHI is incorrect or incomplete, you may request an amendment. We may deny the request under certain circumstances, but will provide a written explanation.

3) Request Confidential Communications

You may ask us to contact you in a specific way (e.g., only at a certain phone number, or via mail).

4) Ask Us to Limit What We Use or Share

You may request restrictions on certain uses/disclosures. We are not required to agree in all cases.

We must agree to a request to restrict disclosure to a health plan for services you paid for in full out-of-pocket, if the disclosure is for payment or operations and not otherwise required by law.

5) Get a List of Disclosures

You may request an accounting (list) of certain disclosures of your PHI for up to the last 6 years, as permitted by law.

6) Get a Paper Copy of This Notice

You can request a paper copy at any time, even if you agreed to receive it electronically.

7) Choose Someone to Act for You

If you have a legal guardian or someone with medical power of attorney, that person may exercise your rights after providing documentation.

E) Complaints

You may complain if you feel your privacy rights were violated. You will not be retaliated against for filing a complaint.

Privacy Officer (LYXARA Biologics Institute):

Phone:  352–385–0970  
Email: info@LYXARA.md

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR).

F) Changes to This Notice

We may change this Notice, and the changes will apply to all PHI we maintain. The current Notice will be available on our website and upon request.