Privacy Policy and HIPAA Notice
of Privacy Practices

NY Best Medical respects your privacy and is committed to protecting your personal information and health information. This Privacy Policy and HIPAA Notice of Privacy Practices ("Policy") describes how we collect, use, disclose, and protect information relating to your use of our website located at nybestmedical.com, our communications, and our services provided in the United States. By using our website or providing us with your information, you agree to the practices described in this Policy.

1. Who We Are

NY Best Medical is a healthcare services provider headquartered at:

NY Best Medical is a HIPAA covered entity. We are required by law to maintain the privacy and security of your protected health information (PHI) and to provide you with this notice of our legal duties and privacy practices.

2. Scope of This Policy

This Policy applies to:

• Information collected through our website at nybestmedical.com
• Information collected through phone, email, and in-person interactions with our staff
• Protected health information (PHI) created, received, maintained, or transmitted in connection with the healthcare services we provide

This Policy does not apply to third-party websites, services, or applications that may be linked from our website. We encourage you to review the privacy policies of any third-party sites you visit.

3. Information We Collect

3.1 Information You Provide Directly

When you use our services, schedule appointments, or submit forms on our website, you may provide us with the following types of information:

• Full name
• Phone number
• Email address
• Referring agency or employer
• Date of birth
• Social Security Number (SSN)
• Residential address
• Insurance information (carrier, policy number, group number)
• Medical information related to the services we provide (e.g., lab orders, test results, medical history)

3.2 Information Collected Automatically

When you visit our website, we may automatically collect certain information, including:

• IP address
• Browser type and version
• Pages viewed and time spent on each page
• Cookies and similar tracking technologies (see Section 11 below)

4. How We Use Your Information

We use the information we collect for the following purposes:

• Treatment: To provide, coordinate, and manage your healthcare, including scheduling appointments, processing lab orders, and communicating test results
• Payment: To bill and collect payment for healthcare services, including submitting claims to your insurance company and processing co-pays
• Healthcare Operations: To support our business activities, including quality assessment, employee training, compliance programs, audits, and customer service
• Respond to Inquiries: To respond to your questions, requests, and feedback submitted through our website or other communication channels
• Legal Compliance: To comply with applicable federal, state, and local laws and regulations, including HIPAA
• Security: To protect the security and integrity of our systems, prevent fraud, and ensure the safety of our patients and staff

5. How We Share Your Information

5.1 Service Providers and Business Associates

We may share your information with third-party service providers and business associates who perform services on our behalf, such as laboratory testing, billing, IT support, and data hosting. These parties are required by contract and by law to protect your information and use it only for the purposes for which it was disclosed.

5.2 Other Healthcare Providers and Insurers

We may share your PHI with other healthcare providers involved in your care, as well as your health insurance company, for purposes of treatment, payment, and healthcare operations.

5.3 Legal, Safety, and Public Health

We may disclose your information when required or permitted by law, including:

• To comply with a court order, subpoena, or other legal process
• To report suspected abuse, neglect, or domestic violence
• To prevent or lessen a serious and imminent threat to health or safety
• To public health authorities for activities such as disease prevention and control
• To health oversight agencies for audits, investigations, and inspections
• To law enforcement officials under limited circumstances
• To coroners, medical examiners, and funeral directors as necessary
• For workers' compensation and similar programs as authorized by law

5.4 No Sale of Protected Health Information

We do not sell your protected health information to any third party for any purpose.

6. HIPAA Notice of Privacy Practices

As a HIPAA covered entity, we are required to inform you of the following:

6.1 Uses and Disclosures That Do Not Require Your Authorization

We may use and disclose your PHI without your written authorization for purposes of:

• Treatment: Providing, coordinating, or managing your healthcare and related services
• Payment: Obtaining payment for your healthcare services, including billing, claims management, and collection activities
• Healthcare Operations: Supporting our internal business operations, including quality improvement, training, compliance, and business planning

6.2 Other Uses and Disclosures That Do Not Require Your Authorization

We may also use or disclose your PHI without your authorization in the following situations:

• Public Health Activities: Reporting to public health authorities for disease prevention, injury, disability, birth and death reporting, and FDA-regulated product monitoring
• Health Oversight: Disclosures to health oversight agencies for audits, civil or criminal investigations, inspections, and licensure activities
• Law Enforcement: Responding to a court order, warrant, subpoena, summons, or similar legal process; identifying or locating a suspect, fugitive, or missing person; or reporting certain types of wounds or injuries
• Judicial and Administrative Proceedings: In response to a court or administrative order, or in response to a subpoena or discovery request with appropriate protections
• Abuse, Neglect, or Domestic Violence: Reporting suspected abuse, neglect, or domestic violence to appropriate government authorities
• Serious Threats to Health or Safety: To prevent or lessen a serious and imminent threat to the health or safety of a person or the public
• Workers' Compensation: As authorized by and to comply with workers' compensation and similar programs
• Coroners, Medical Examiners, Funeral Directors: To assist in identification, cause of death determination, and other duties authorized by law
• Organ and Tissue Donation: To organizations involved in procurement, banking, or transplantation of organs, eyes, or tissue
• Research: Under certain conditions with institutional review board or privacy board approval
• Military and Veterans: As required by military command authorities for members of the armed forces
• National Security: To authorized federal officials for intelligence, counterintelligence, and national security activities
• Correctional Institutions: To correctional institutions or law enforcement officials having lawful custody of an inmate
• Required by Law: When required by federal, state, or local law

6.3 Uses and Disclosures Requiring Your Written Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes other than those described above, including:

• Psychotherapy Notes: Uses and disclosures of psychotherapy notes (except for certain treatment, payment, or healthcare operations purposes permitted by law)
• Marketing: Using your PHI for marketing purposes, except for face-to-face communications and promotional gifts of nominal value
• Sale of PHI: Disclosures that constitute a sale of your PHI

You may revoke an authorization at any time by submitting a written request to our Privacy Officer. Revocation will not affect any uses or disclosures made in reliance on the authorization before it was revoked.

7. Your Rights Under HIPAA

You have the following rights regarding your protected health information:

7.1 Right to Access

You have the right to inspect and obtain a copy of your PHI maintained in our records, including medical and billing records. We may charge a reasonable, cost-based fee for copies. In limited circumstances, we may deny your request, and you may request a review of the denial.

7.2 Right to Request Amendment

You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny your request if the information was not created by us, is not part of our records, is accurate and complete, or is not available for inspection. If we deny your request, we will provide a written explanation.

7.3 Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures of your PHI that we have made. This accounting does not include disclosures made for treatment, payment, or healthcare operations, or disclosures made with your authorization. The first accounting in any 12-month period is free; we may charge a reasonable fee for additional requests.

7.4 Right to Request Restrictions

You have the right to request that we restrict certain uses and disclosures of your PHI for treatment, payment, or healthcare operations. We are not required to agree to your request, except that we must agree to restrict disclosures to a health plan if the disclosure is for payment or healthcare operations purposes and the PHI pertains to a service for which you have paid in full out of pocket.

7.5 Right to Confidential Communications

You have the right to request that we communicate with you about your health information in a specific way or at a specific location. For example, you may ask that we contact you only at a certain phone number or address. We will accommodate reasonable requests.

7.6 Right to a Copy of This Policy

You have the right to obtain a paper copy of this Policy upon request, even if you have agreed to receive it electronically.

7.7 How to Exercise Your Rights

To exercise any of the rights described above, please contact our Privacy Officer:

8. Our Legal Duties

We are required by law to:

• Maintain the privacy and security of your protected health information
• Provide you with this notice of our legal duties and privacy practices with respect to your PHI
• Follow the terms of this notice currently in effect
• Notify you if a breach of your unsecured PHI occurs, as required under the HIPAA Breach Notification Rule

We reserve the right to change this Policy and to make the revised Policy effective for PHI we already have about you as well as any information we receive in the future. We will post a copy of the current notice on our website and make it available upon request.

9. Data Security

We take the security of your personal and health information seriously. We implement administrative, technical, and physical safeguards to protect your information against unauthorized access, use, disclosure, alteration, or destruction. These safeguards include, but are not limited to:

• Access Controls: Restricting access to PHI to authorized personnel who need the information to perform their job functions
• Encryption: Using encryption to protect sensitive data in transit and at rest
• Training: Providing regular training to our workforce on privacy and security policies and procedures
• Policies and Procedures: Maintaining written policies and procedures to ensure compliance with HIPAA and other applicable laws

While we strive to protect your information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to maintaining appropriate safeguards.

10. Data Retention

We retain your personal information and PHI for as long as necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Medical records are retained in accordance with applicable federal and state law, including New York State requirements for the retention of medical records.

11. Online Tracking and Cookies

Our website may use cookies and similar tracking technologies to improve your browsing experience and analyze website traffic. Cookies are small text files stored on your device when you visit a website.

We may use the following types of cookies:

• Essential Cookies: Necessary for the website to function properly, such as maintaining your session
• Analytics Cookies: Used to understand how visitors interact with our website, including through Google Analytics. These cookies collect information about pages visited, time spent on the site, and other usage data

You can control cookies through your browser settings. Most browsers allow you to refuse cookies or alert you when cookies are being sent. However, disabling cookies may affect the functionality of certain parts of our website.

We do not use cookies to collect protected health information. Any PHI submitted through our website is collected through secure forms, not through cookies.

12. Children's Privacy

Our website is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 through our website, in compliance with the Children's Online Privacy Protection Act (COPPA). If we become aware that we have inadvertently collected personal information from a child under 13 without verified parental consent, we will take steps to delete such information from our records.

Healthcare services provided to minors are subject to applicable state and federal laws regarding consent and privacy. A parent or legal guardian may exercise the minor's rights with respect to PHI as permitted by law.

13. International Visitors

Our services are provided in the United States, and our website is intended for users located in the United States. If you are accessing our website from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country of residence. By using our website or providing us with your information, you consent to such transfer, storage, and processing.

14. Changes to This Policy

We reserve the right to update or modify this Policy at any time. When we make changes, we will update the "Effective Date" at the top of this page and post the revised Policy on our website. If we make material changes to how we use or disclose your PHI, we will provide a revised notice. We encourage you to review this Policy periodically to stay informed about how we are protecting your information.

15. Contact Us and Complaints

If you have questions about this Policy, wish to exercise your rights, or want to file a complaint about our privacy practices, please contact our Privacy Officer:

You also have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR), if you believe your privacy rights have been violated. You may file a complaint online, by mail, or by phone:

We will not retaliate against you for filing a complaint with us or with the Office for Civil Rights.

© 2026 NY Best Medical. All rights reserved.