HIPAA Notice of Privacy Practices

Your Information. Your Rights. Our Responsibilities.

This Notice of Privacy Practices (“Notice”) explains how Wismar Med (“Wismar Med,” “we,” “us,” or “our”) may use and disclose your protected health information (“PHI”), your rights regarding your health information, and our responsibilities under applicable federal and state privacy laws, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

Please review this Notice carefully.

This Notice applies to protected health information created, received, or maintained by Wismar Med in connection with healthcare services provided by our practice, including telehealth medical services, medication refill evaluations, and Georgia Low THC Oil/medical cannabis evaluations.

Wismar Med is a cash-pay medical practice and does not bill or submit claims to health insurance. Although we do not bill health insurance, HIPAA still protects the PHI we create, receive, or maintain in connection with providing healthcare services.

Wismar Med uses Elation Health as its electronic health record (EHR) system to maintain and manage clinical records and other health information associated with patient care. Information maintained in the EHR and other systems used to provide healthcare services may constitute PHI and is handled in accordance with applicable privacy and security requirements.

The public Wismar Med website is separate from the clinical medical record. Patients should not submit detailed medical information through general website contact forms or other non-secure website communications unless specifically instructed to do so by Wismar Med.

1. Your Health Information Rights

You have certain rights regarding the protected health information that Wismar Med maintains about you. These rights include:

Right to Inspect and Obtain a Copy of Your Health Information

You generally have the right to inspect and obtain a copy of your medical records and other PHI that Wismar Med maintains about you in a designated record set. You may request your records in electronic or paper format, as permitted by applicable law.

To request access to your records, please contact:

Privacy Officer/Contact: Tramaine WilkinsonPhone: (678) 562-1163Email: support@wismarmed.comMailing Address: 101 Fairview Rd, Ste 103-209, Ellenwood, GA 30294-2722

We may charge a reasonable, cost-based fee where permitted by law. Certain information may be excluded from access as permitted or required by law.

Right to Request Correction or Amendment

If you believe that information in your medical record is incorrect or incomplete, you may request that Wismar Med amend or correct the information.

Requests must generally be submitted in writing and should explain the reason you believe the information should be corrected or amended.

Wismar Med may deny a request in certain circumstances permitted by law. If we deny your request, we will provide you with an explanation and information about your right to submit a written statement of disagreement, when applicable.

Right to Request Confidential Communications

You may request that Wismar Med communicate with you about your health information in a specific way or at a specific location.

For example, you may ask us to:

• Contact you by email rather than telephone;
• Contact you at a specific telephone number;
• Send communications to a particular mailing address; or
• Use another reasonable method of communication.

We will consider reasonable requests and will comply with them when required by applicable law.

Right to Request Restrictions

You may request that Wismar Med limit how we use or disclose your PHI for purposes of treatment, payment, or healthcare operations.

We are not required to agree to every requested restriction.

However, when required by HIPAA, if you pay for a healthcare service or item completely out of pocket and request that information about that service or item not be disclosed to your health plan for payment or healthcare operations purposes, Wismar Med will generally agree to the restriction unless disclosure is required by law.

Because Wismar Med is a cash-pay practice and does not submit claims to health insurance, this particular restriction may have limited practical application.

Right to Request an Accounting of Certain Disclosures

You may request an accounting of certain disclosures of your PHI made by Wismar Med. The accounting generally covers disclosures made during the six years before the date of your request, or a shorter period if you request one.

The accounting does not generally include disclosures made for treatment, payment, healthcare operations, disclosures you authorized, or certain other disclosures excluded by law. You may generally receive one accounting in a 12-month period without charge. We may charge a reasonable, cost-based fee for additional requests during the same 12-month period, as permitted by law.

Right to Receive a Copy of This Notice

You have the right to receive a paper copy of this Notice at any time, even if you have agreed to receive it electronically.

You may request a copy by contacting Wismar Med at:

Phone: (678) 562-1163Email: support@wismarmed.comMailing Address: 101 Fairview Rd, Ste 103-209, Ellenwood, GA 30294-2722

The current version of this Notice will also be made available on the Wismar Med website at:www.Wismarmed.com

Right to Choose Someone to Act for You

If you have legally appointed a personal representative, such as a person with healthcare power of attorney or a legal guardian, that person may exercise certain privacy rights and make certain choices regarding your PHI on your behalf, as permitted by law. Wismar Med will verify the individual’s legal authority before allowing that person to act on your behalf.

Right to File a Privacy Complaint

If you believe your privacy rights have been violated, you may file a complaint with Wismar Med or with the U.S. Department of Health and Human Services Office for Civil Rights.

You will not be retaliated against for filing a complaint.

To file a complaint with Wismar Med, contact:

Privacy Officer/Contact: Tramaine WilkinsonPhone: (678) 562-1163Email: support@wismarmed.comMailing Address: 101 Fairview Rd, Ste 103-209, Ellenwood, GA 30294-2722

You may also contact the U.S. Department of Health and Human Services Office for Civil Rights through its official complaint process.

2. How Wismar Med May Use and Disclose Your Health Information

Wismar Med may use or disclose your PHI without obtaining your separate written authorization when permitted or required by HIPAA and other applicable law.

The following are common examples.

For Treatment

We may use or disclose your PHI to provide, coordinate, or manage your healthcare.

For example, Wismar Med may use information about your health history, current medications, medical conditions, allergies, prior treatment, or other relevant information when evaluating a request for a medication refill.

We may also use information from your medical record when evaluating whether you may qualify for a Georgia Low THC Oil/medical cannabis certification. When permitted by law, we may disclose relevant PHI to another healthcare professional involved in your care.

For Payment

Wismar Med is a cash-pay practice and does not bill health insurance.We may use or disclose PHI as reasonably necessary to obtain payment for healthcare services provided by Wismar Med.

For example, this may include processing patient payments, managing accounts, addressing payment questions, and using payment-processing or other administrative service providers.

Wismar Med does not submit claims to health insurance companies for payment of its services.

For Healthcare Operations

We may use or disclose PHI as necessary for healthcare operations.Healthcare operations may include activities such as:

• Quality assessment and improvement;
• Reviewing and improving clinical services;
• Managing administrative activities;
• Auditing and compliance;
• Legal and regulatory compliance;
• Credentialing;
• Risk management;
• Patient safety activities;
• Business planning;
• Maintaining and supporting healthcare information systems.

For Appointment and Care-Related Communications

We may use your contact information to communicate with you about your healthcare and related services.

Examples may include:

• Appointment scheduling or reminders;
• Telehealth appointment instructions;
• Follow-up communications;
• Medication refill evaluations;
• Requests for additional medical information;
• Clinical or administrative questions;
• Information about your care;
• Payment or billing matters;
• Patient portal or secure communication instructions.

We will use reasonable safeguards appropriate to the circumstances.

With Business Associates and Service Providers

Wismar Med may disclose PHI to third-party service providers that perform services for or on behalf of Wismar Med when permitted by HIPAA.

These organizations may include vendors that support:

• Electronic health records;
• Telehealth technology;
• Secure patient communications;
• Payment processing;
• Information technology;
• Data storage;
• Medical record management;
• Legal services;
• Accounting services;
• Compliance activities;
• Other healthcare operations.

When required by HIPAA, Wismar Med will have appropriate agreements or other safeguards in place with business associates that handle PHI on our behalf.

Wismar Med uses Elation Health as its electronic health record (EHR) platform to support clinical documentation and management of patient health information.

As Required by Law

We may use or disclose PHI when required to do so by federal, state, or local law.

For Public Health Activities

We may disclose PHI for certain public health activities when permitted or required by law.

Examples may include:

• Reporting certain diseases or health conditions;
• Reporting adverse reactions to medications;
• Reporting product or medical device problems;
• Supporting public health investigations;
• Preventing or controlling disease.

For Health Oversight Activities

We may disclose PHI to government agencies for authorized health oversight activities. These activities may include audits, investigations, inspections, licensing activities, disciplinary proceedings, and other oversight activities authorized by law.

For Legal Proceedings

We may disclose PHI in response to a court order, subpoena, discovery request, or other lawful process when the disclosure is permitted or required by applicable law.

For Law Enforcement

We may disclose PHI to law enforcement officials when permitted or required by applicable law.

To Prevent a Serious Threat to Health or Safety

We may use or disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, when permitted by law.

For Workers’ Compensation

We may disclose PHI as authorized or required by laws relating to workers’ compensation and similar programs.

For Coroners and Medical Examiners

We may disclose PHI to coroners or medical examiners when permitted or required by law, including for purposes of identifying a deceased person or determining the cause of death.

For Organ, Eye, and Tissue Donation

We may use or disclose PHI for organ, eye, or tissue donation and transplantation purposes when permitted by law.

For Research

We may use or disclose PHI for research purposes when permitted by applicable law and when appropriate privacy protections are in place.

3. Uses and Disclosures That Require Your Authorization

Certain uses and disclosures of PHI require your written authorization under HIPAA.

These may include, depending on the circumstances:

• Certain uses and disclosures of psychotherapy notes;
• Certain uses and disclosures for marketing;
• The sale of PHI;
• Other uses or disclosures that are not otherwise permitted by HIPAA.

If Wismar Med requests your authorization, you may generally revoke that authorization in writing at any time. Revoking an authorization will not affect actions that Wismar Med has already taken based on your authorization before we received your revocation. Wismar Med does not sell your PHI.

4. Communications and Telehealth Services

Wismar Med provides healthcare services through telehealth.

Telehealth involves the use of electronic communication technologies to provide healthcare services when the patient and healthcare professional are in different locations. Electronic communications may involve privacy and security risks. Wismar Med uses appropriate safeguards and technology consistent with applicable requirements.

Patients are encouraged to take reasonable steps to protect their privacy when participating in telehealth services, including:

• Participating in telehealth visits from a private location when possible;
• Using a private device when possible;
• Protecting passwords and account credentials;
• Using secure internet connections when possible;
• Keeping devices and software updated;
• Not sharing patient portal login information;
• Avoiding the use of public computers for sensitive health information.

Wismar Med may direct patients to use a secure patient portal or other designated clinical communication system for sensitive health information. The public Wismar Med website and general contact forms are not intended to replace secure clinical communication systems.

5. Electronic Health Records and Elation Health

Wismar Med uses Elation Health as its electronic health record system. Patient information associated with healthcare services may be documented, stored, and managed within the EHR and related systems used by Wismar Med.

This may include information such as:

• Patient demographic information;
• Medical history;
• Current and previous medications;
• Allergies;
• Diagnoses;
• Clinical notes;
• Treatment information;
• Prescription and refill information;
• Telehealth visit documentation;
• Information related to medical cannabis or Low THC Oil evaluations;
• Other information necessary to provide and document healthcare services.

Wismar Med may use and disclose information maintained in its EHR as permitted or required by HIPAA and other applicable laws. The EHR is part of Wismar Med’s clinical healthcare operations and should not be confused with the public Wismar Med website. Patients should use the secure patient portal or other secure communication method designated by Wismar Med when submitting sensitive medical information.

Elation Health Patient Portal/Access Information: Patients will receive access instructions through Wismar Med’s designated secure patient communication process after scheduling or initiating care. Patients should not submit medical information through the public Wismar Med website or general contact forms.

6. Medication Refill Evaluations

Wismar Med may provide telehealth evaluations for medication refill requests for medications that fall within the practice’s scope of services. A request for a medication refill is subject to an individualized clinical evaluation.

Wismar Med may review and use relevant PHI, which may include:

• Medical history;
• Current medications;
• Previous prescriptions;
• Allergies;
• Diagnosis and treatment history;
• Relevant medical records;
• Laboratory or monitoring information;
• Information provided by other healthcare professionals;
• Other information necessary for clinical decision-making.

Wismar Med may request additional records, information, laboratory results, or other documentation when clinically appropriate. A medication refill request does not guarantee that a refill or prescription will be issued. The treating healthcare professional makes the final clinical decision based on the patient’s individual circumstances, applicable law, available information, and professional medical judgment.

Wismar Med may decline to prescribe or refill a medication when the medication is outside the practice’s scope, when additional evaluation or monitoring is needed, when prescribing is not clinically appropriate, or when prescribing is restricted or prohibited by applicable law or Wismar Med policy.

7. Georgia Medical Cannabis Patient Registry / Medical Cannabis Evaluations

Wismar Med may provide evaluations related to eligibility for Georgia Medical Cannabis Patient Registry and medical cannabis program, subject to applicable Georgia law and the physician’s clinical judgment.

Information collected and maintained as part of such an evaluation may include:

• Medical history;
• Diagnosis and qualifying medical condition;
• Relevant treatment history;
• Patient identifying information;
• Information required for the Georgia Medical Cannabis Patient Registry;
• Physician certification information;
• Other information required by applicable law.

Wismar Med may use and disclose this information as necessary to evaluate the patient, provide healthcare services, document the patient’s care, and comply with applicable Georgia requirements. Georgia law requires specific conditions to be met for physician certification for the Medical Cannabis Patient Registry. These requirements include, among other things, an appropriate doctor-patient relationship and physician treatment of the qualifying condition.

A physician’s certification decision is based on the physician’s independent medical judgment and does not guarantee that a patient will be certified. A physician’s certification for the Georgia Medical Cannabis Patient Registry is not a prescription.

Patients should understand that the Georgia Medical Cannabis Program does not legalize all forms of marijuana or cannabis, and possession and use remain subject to applicable federal and state law. Wismar Med will handle PHI associated with these services in accordance with applicable privacy laws and this Notice.

8. Substance Use Disorder Records and 42 CFR Part 2

Wismar Med does not provide substance use disorder treatment services and does not maintain records that are subject to the additional confidentiality protections under 42 CFR Part 2.

If Wismar Med’s services or recordkeeping practices change in the future and records become subject to 42 CFR Part 2 requirements, Wismar Med will comply with applicable federal and state privacy requirements.

9. Our Responsibilities

Wismar Med is required by law to:

• Maintain the privacy and security of your PHI;
• Provide you with this Notice describing our legal duties and privacy practices;
• Follow the terms of the Notice currently in effect;
• Provide you with a copy of this Notice upon request;
• Notify affected individuals as required by law if a breach occurs that compromises the privacy or security of their PHI.

Wismar Med will not use or disclose your PHI in a manner not described in this Notice unless the use or disclosure is permitted or required by law or you provide written authorization when authorization is required. If you provide written authorization for a use or disclosure, you may generally revoke that authorization in writing, subject to the limitations described in this Notice.

10. Changes to This Notice

Wismar Med reserves the right to change this Notice. Any revised Notice will apply to PHI that Wismar Med already maintains, as well as PHI received or created in the future, to the extent permitted by law.

When material changes are made, Wismar Med will update the Notice and make the revised version available as required by applicable law.

The current Notice will be:

• Available upon request;
• Posted prominently on the Wismar Med website;
• Made available through other appropriate methods as required by law.

Current Effective Date: August 1, 2026Last Updated: August 1, 2026

11. Questions, Requests, and Privacy Complaints

If you have questions about this Notice, want to exercise your privacy rights, or believe your privacy rights have been violated, please contact:

Wismar MedMailing Address: 101 Fairview Rd, Ste 103-209Ellenwood, GA 30294-2722Phone: 678-562-1163Email: Support@Wismarmed.comWebsite: www.Wismarmed.com

Privacy Contact / Privacy Officer: Tramaine WilkinsonPrivacy Email: DrTramaine@Wismarmed.comPrivacy Phone: 678-562-1163

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. Wismar Med will not retaliate against you for filing a privacy complaint.