Skip to content

Notice of Privacy Practices

Sunstone Clinical, PC

Effective date: October 6, 2026 Version 0.1

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who we are

Sunstone Clinical, PC (“Sunstone Clinical,” “we,” “us”) is a physician-owned medical practice providing pediatric neurology, genetic medicine, and specialty co-management services, primarily through telehealth. We are a covered entity under the Health Insurance Portability and Accountability Act (HIPAA).

Sunstone Clinical works with Sunstone Health, Inc., a separate company that provides technology, care coordination, and administrative services to our practice. Sunstone Health, Inc. is our business associate and may only use your health information as permitted by our written agreement with them and by law.

This Notice applies to all records of your care created or received by Sunstone Clinical, including information shared with us by other providers, laboratories, and diagnostic partners.

Our responsibilities

We are required by law to:

  1. Keep your health information private and secure.
  2. Give you this Notice of our legal duties and privacy practices.
  3. Follow the terms of the Notice currently in effect.
  4. Tell you promptly if a breach occurs that may have compromised the privacy or security of your information.

How we may use and share your health information

For treatment

We use your health information to provide care and we share it with others involved in your care. Because our model is specialty co-management, this routinely includes:

  1. Your child’s primary care physician and other treating clinicians.
  2. The applied behavior analysis (ABA) provider treating your child, including the treating BCBA and behavior technicians, so that care plans stay aligned.
  3. Laboratories and diagnostic partners we use, such as clinical genomic laboratories and at-home EEG services.
  4. Sunstone Clinical’s own clinicians, care coordinators, and clinical liaisons.

For payment

We may use and share your information to bill and collect payment for services, including sharing with your health plan, your employer’s plan administrator, or a payment processor for cash-pay services. If you pay for a service in full out of pocket, you may ask us not to share information about that service with your health plan, and we will agree unless the law requires us to share it.

For health care operations

We may use and share your information to run our practice, improve quality, train staff, and comply with the law. Examples include quality review of care plans, measuring outcomes, credentialing clinicians, and responding to audits.

De-identified information

We may create information that cannot reasonably identify you, in accordance with HIPAA’s de-identification standard, and use it to study outcomes, improve care, and advance understanding of the conditions we treat. Information that has been de-identified under HIPAA is no longer protected health information.

Other ways we may use or share your information without your authorization

The law permits or requires us to share your information in certain situations, including:

  1. When required by federal, state, or local law.
  2. For public health activities, such as reporting disease, reporting reactions to medications, or supporting product recalls.
  3. To report suspected abuse, neglect, or domestic violence.
  4. For health oversight activities, such as audits, inspections, and licensure.
  5. In response to a court or administrative order, subpoena, or other lawful process.
  6. To law enforcement, in the limited circumstances the law allows.
  7. To coroners, medical examiners, and funeral directors.
  8. For organ and tissue donation.
  9. For research that has been approved by an Institutional Review Board or privacy board, or where the information is otherwise prepared for research in a way the law permits.
  10. To prevent a serious and imminent threat to the health or safety of a person or the public.
  11. For specialized government functions, including military, national security, and protective services.
  12. For workers’ compensation claims.
  13. To a correctional institution or law enforcement official if you are in custody.

Family, friends, and others involved in care

We may share information with a parent, guardian, or other person involved in your child’s care or payment for care, if you agree, if you are given the opportunity to object and do not, or if we reasonably infer from the circumstances that you would not object. For minors, we follow the laws of the state where the patient is located regarding who may access a minor’s records.

Appointment reminders and care information

We may contact you about appointments, test results, and treatment options related to your care.

Uses and disclosures that require your written authorization

We will not do the following without your written authorization:

  1. Use or share psychotherapy notes, if any exist.
  2. Use or share your information for marketing purposes.
  3. Sell your information.
  4. Share genetic test results with an employer or health insurer for underwriting or employment purposes. Federal law (the Genetic Information Nondiscrimination Act) and many state laws prohibit this regardless of authorization.
  5. Any other use or disclosure not described in this Notice.

You may revoke an authorization in writing at any time. The revocation will not affect uses or disclosures already made in reliance on it.

Special protections

Some information receives extra protection under federal or state law, including genetic information, mental health information, substance use disorder treatment records, HIV status, and certain information about minors. Where the law requires stricter protection than HIPAA, we follow the stricter rule. In particular, we will not disclose the results of genetic testing to third parties without your specific written consent, except as the law requires.

Your rights

Inspect and get a copy of your records

You may ask to see or get a copy of your health information, including an electronic copy. We will provide it within 30 days, or tell you why we cannot and when you can expect it. We may charge a reasonable, cost-based fee.

Ask us to correct your records

If you believe information in your record is wrong or incomplete, you may ask us to amend it. We may say no, but we will tell you why in writing within 60 days and explain how to disagree.

Get a list of those with whom we have shared your information

You may ask for an accounting of the times we have shared your health information in the six years before your request, other than for treatment, payment, health care operations, and certain other disclosures. One accounting per year is free.

Ask us to limit what we use or share

You may ask us to restrict how we use or share your information. We are not required to agree, except where you pay for a service in full out of pocket and ask us not to share information about that service with your health plan.

Ask for confidential communications

You may ask us to contact you in a specific way or at a specific address, for example by secure message rather than phone. We will accommodate reasonable requests.

Choose someone to act for you

If you have given someone medical power of attorney, or if someone is your child’s legal guardian, that person can exercise these rights and make choices about the information. We will confirm the person’s authority before acting.

Get a paper copy of this Notice

You may ask for a paper copy at any time, even if you agreed to receive it electronically.

File a complaint

If you believe your privacy rights have been violated, you may file a complaint with us using the contact information below. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue SW, Washington, DC 20201, by calling 1-877-696-6775, or online at www.hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.

Changes to this Notice

We may change this Notice. Changes will apply to all information we hold, including information we already have. The current Notice will be posted at sunstonehealth.com and in the Sunstone patient application, and you may request a copy at any time.

Contact

Privacy Officer Sunstone Clinical, PC [Mailing address] [Phone] privacy@sunstoneclinical.com

Acknowledgment of receipt

By signing below (or by electronic acknowledgment in the Sunstone patient application), you acknowledge that you received a copy of this Notice of Privacy Practices.

Patient name: ______________________

Parent or guardian name: ______________________

Signature: ______________________ Date: __________