Notice of Privacy Practices
How We Protect, Use, and Disclose Your Protected Health Information
Our Commitment to Your Privacy
SpringCreek Fertility ("we," "our," or "the Practice") is committed to protecting the privacy and security of your protected health information (PHI). This Notice of Privacy Practices ("Notice") describes how medical information about you may be used and disclosed and how you can access this information. Please review it carefully.
We are required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, 42 CFR Part 2 (as applicable to substance use disorder records), and their implementing regulations to:
- Maintain the privacy of your PHI
- Provide you with this notice of our legal duties and privacy practices
- Abide by the terms of the notice currently in effect
This notice applies to all locations where SpringCreek Fertility provides care:
Protected Health Information
Protected Health Information (PHI) is individually identifiable health information that relates to your past, present, or future physical or mental health; the provision of healthcare to you; or the past, present, or future payment for healthcare. PHI includes information maintained in any form, including electronic (ePHI), paper, and oral communications.
How We May Use and Disclose Your PHI
The following describes the ways we may use and disclose your PHI without your written authorization (except where otherwise noted). For each category, we provide a brief explanation. Not every possible use or disclosure is listed, but all uses and disclosures will fall within one of the categories described.
Treatment
We may use or disclose your PHI to provide, coordinate, or manage your healthcare and related services. This includes consultations between healthcare providers regarding your care, referrals to other providers, and coordination with laboratories, pharmacies, and other facilities involved in your fertility treatment.
Payment
We may use or disclose your PHI to obtain payment for healthcare services we provide, including billing your health plan or insurance company, verifying coverage, collecting payment, and conducting utilization review and pre-authorization activities.
Healthcare Operations
We may use or disclose your PHI for our healthcare operations, which include quality assessment and improvement, reviewing the competence or qualifications of healthcare professionals, conducting training programs, accreditation, licensing, credentialing, and business management activities.
Required by Law
We may use or disclose your PHI when required to do so by federal, state, or local law. This includes reporting to public health authorities, complying with court orders or administrative proceedings, and other legally mandated disclosures.
Public Health Activities
We may disclose your PHI for public health activities and purposes, including reporting to a public health authority authorized to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability.
Health Oversight Activities
We may disclose your PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, licensure, and other proceedings related to the oversight of the healthcare system.
Abuse or Neglect
We may disclose your PHI to appropriate authorities if we reasonably believe you are a victim of abuse, neglect, or domestic violence, as required or authorized by applicable law.
Research
Under certain circumstances, we may use or disclose your PHI for research purposes, provided the research has been approved by an Institutional Review Board (IRB) or a privacy board that has reviewed the research proposal and protocols to ensure the privacy of your information.
Serious Threats to Health or Safety
We may use or disclose your PHI when necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public, consistent with applicable law and professional standards of ethical conduct.
Workers' Compensation
We may disclose your PHI as authorized by and to the extent necessary to comply with workers' compensation or similar programs established by law.
Decedents
We may disclose PHI of a deceased individual to a coroner, medical examiner, or funeral director as necessary, and to a personal representative of the deceased individual's estate as authorized by HIPAA.
Appointment Reminders and Health-Related Communications
We may use your PHI to contact you with appointment reminders, treatment alternatives, or other health-related benefits and services that may be of interest to you.
Reproductive Health Information
As a reproductive medicine practice, we are committed to providing the highest level of privacy protection for your reproductive health information. We apply additional administrative safeguards to protect information related to fertility treatments, diagnoses, medications, genetic testing results (including PGT-A and PGT-M), and donor or gestational carrier arrangements.
We handle all reproductive health information in strict accordance with HIPAA and applicable Ohio state law. This extends to all services offered across our Dayton, Columbus, and Cincinnati locations, including IVF, IUI, egg freezing, egg donation, gestational carrying, and LGBTQIA+ family-building services.
Substance Use Disorder (SUD) Records — 42 CFR Part 2
Effective February 16, 2026
In accordance with the final rule aligning 42 CFR Part 2 with HIPAA, this notice addresses the privacy of substance use disorder (SUD) treatment records. The protections described below apply to any SUD records we create, receive, maintain, or transmit that are subject to 42 CFR Part 2. These records receive additional protections beyond those provided under HIPAA alone.
Consent Required for Treatment, Payment, and Operations
Unlike other protected health information, the use or disclosure of Part 2 SUD records for treatment, payment, and healthcare operations requires your written consent. You may provide a single written consent authorizing all future uses and disclosures of your SUD records for treatment, payment, and healthcare operations purposes. You have the right to revoke this consent at any time in writing; however, revocation will not apply to any uses or disclosures made in reliance on your consent before it was revoked.
Prohibition on Use in Legal Proceedings
SUD treatment records protected under 42 CFR Part 2 may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding conducted by any federal, state, or local authority against you, the patient, unless you have provided specific written consent or a court has issued an authorizing order under Part 2.
Notice of Potential Re-Disclosure
Protected health information that we disclose to authorized recipients may be re-disclosed by those recipients and may no longer be protected by HIPAA or Part 2 regulations. However, recipients of Part 2 records who are subject to HIPAA or Part 2 must continue to protect SUD records in accordance with applicable law.
Fundraising Communications
If we intend to use or disclose SUD records subject to Part 2 for fundraising purposes, you have the right to opt out before receiving any such communications. We will not use Part 2-protected SUD records for fundraising without providing you the opportunity to opt out.
More Stringent Protections Apply
Where Part 2 imposes requirements that are more stringent than HIPAA, we will follow the more protective standard. The descriptions of uses and disclosures in this notice are limited by the requirements of Part 2 and any other law that is more restrictive than HIPAA.
Other Uses and Disclosures — Sensitive Health Information
Certain categories of health information may receive additional protections under state or federal law, including but not limited to:
- HIV/AIDS-related information
- Substance use disorder treatment records (as described in the SUD Records section above)
- Mental health records
- Genetic information (including PGT-A, PGT-M, and other genetic testing results)
Where applicable, we will comply with these additional protections and obtain any additional consent or authorization required by law before disclosing such information.
Your Rights
Under HIPAA and applicable state law, you have the following rights with respect to your protected health information. To exercise any of these rights, contact our Privacy Officer.
Right to Access
You have the right to inspect and obtain a copy of your PHI maintained in your designated record set, including medical and billing records. We will respond within 30 calendar days (15 days for electronic records once final rules take effect). You may also request that we transmit a copy directly to a person or entity of your choice.
Right to Amend
You may request an amendment to your PHI if you believe the information is incorrect or incomplete. We will act on your request within 60 calendar days. We may deny the request if the information was not created by us, is not part of the designated record set, is not available for inspection, or is accurate and complete.
Right to Restrict
You may request restrictions on certain uses and disclosures of your PHI. We are required to agree to a restriction on disclosure to a health plan for payment or healthcare operations purposes if you paid out of pocket in full for the service. For other restrictions, we will consider your request but are not required to agree.
Right to Breach Notification
You have the right to be notified without unreasonable delay, and no later than 60 days following discovery, in the event of a breach of your unsecured PHI. This includes breaches of SUD records subject to 42 CFR Part 2, which are enforced by HHS Office for Civil Rights.
Right to Confidential Communications
You may request that we communicate with you about your health information in a specific way or at a specific location — for example, sending correspondence to a P.O. Box rather than your home address, or contacting you only on your mobile phone. We will accommodate reasonable requests.
Right to an Accounting of Disclosures
You may request a list of certain disclosures of your PHI that we have made during the six years prior to the date of your request, or since March 22, 2026, whichever is shorter. This accounting does not include disclosures for treatment, payment, or healthcare operations, or disclosures you authorized in writing.
Right to a Paper Copy of This Notice
You have the right to obtain a paper copy of this notice upon request at any time, even if you have previously agreed to receive it electronically. Contact our Privacy Officer or request a copy at any of our office locations during your visit.
Right to Direct Electronic Access
You may request that we transmit your electronic PHI maintained in an electronic health record system to a personal health application or other electronic destination of your choice. We will provide electronic copies at no charge to you.
Information Security
We maintain comprehensive administrative, technical, and physical safeguards designed to protect your PHI from unauthorized access, use, or disclosure. Consistent with proposed HIPAA Security Rule updates and current cybersecurity best practices, our safeguards include:
- Workforce training on HIPAA privacy and security requirements conducted upon hire and at least annually
- Role-based access controls limiting PHI access to authorized personnel with a legitimate need
- Encryption of electronic PHI both in transit and at rest across all systems
- Multi-factor authentication (MFA) for all systems that store or transmit ePHI
- Physical security measures at all locations including locked records storage and restricted access areas
- Annual security risk assessments, compliance audits, and vulnerability scanning at least every six months
- Written incident response and disaster recovery procedures including system restoration protocols
- Asset inventories of all systems and devices that create, receive, maintain, or transmit ePHI
- Business associate agreements with all third-party service providers, with annual verification of security measures
- Network segmentation and monitoring to detect and prevent unauthorized access to ePHI
Breach Notification
In the event of a breach of your unsecured PHI, we will notify you in accordance with the HITECH Act and applicable state law. Our breach notification procedures include:
- Individual notification to affected patients without unreasonable delay and no later than 60 calendar days following discovery of the breach
- Notification to the U.S. Department of Health and Human Services (HHS) as required by law
- Notification to prominent media outlets if a breach affects more than 500 residents of a state or jurisdiction
- For breaches of SUD records protected under 42 CFR Part 2, notification in accordance with the Part 2 breach notification requirements enforced by HHS OCR
- Documentation and investigation of all potential breaches, including mitigation steps taken
Additionally, under Ohio law (Ohio Rev. Code § 1349.19), we will notify affected individuals as required by the Ohio data breach notification statute when applicable.
Website and Electronic Communications
Our website may collect certain information through cookies, analytics, and contact forms. Information submitted through our website contact forms or patient portal is transmitted using encryption technology. However, standard email is not a secure method of communication. We recommend using our secure patient portal for transmitting sensitive health information.
We do not use tracking technologies to collect PHI. Any analytics data collected through our website is de-identified and used solely for improving the user experience and website functionality. We do not sell website visitor data or use it for targeted advertising.
Third-Party Services
We may engage third-party service providers (business associates) to perform functions on our behalf that involve access to your PHI. These include electronic health record systems, billing services, laboratory partners, cloud storage providers, and other healthcare technology vendors.
All business associates are contractually required to safeguard your PHI in accordance with HIPAA and, where applicable, 42 CFR Part 2 requirements. We verify business associate compliance with security requirements on an annual basis.
Data Retention
We retain your medical records and PHI in accordance with applicable federal and state record retention requirements. In Ohio, medical records are generally retained in accordance with the standards established by the State Medical Board of Ohio and applicable Ohio Administrative Code provisions, which typically require retention for a period following the last date of treatment. Records of minors are retained until the patient reaches the age of majority (18) plus the applicable retention period.
SUD treatment records subject to 42 CFR Part 2 are retained in accordance with the applicable Part 2 requirements. When records are no longer required to be retained, they are destroyed in a secure manner that prevents unauthorized access.
State-Specific Provisions
Where Ohio state law or other applicable state laws provide greater protection for your health information than HIPAA, we will comply with the more protective standard. This includes but is not limited to additional protections for:
- Reproductive health information
- Genetic testing results (including preimplantation genetic testing)
- HIV/AIDS-related information under Ohio Rev. Code § 3701.243
- Mental health records under Ohio Rev. Code Chapter 5122
Because SpringCreek Fertility serves patients across southwestern Ohio, eastern Indiana, and northern Kentucky, we also comply with applicable privacy protections in those jurisdictions when treating patients who reside there.
Changes to This Notice
We reserve the right to change this notice at any time. Any revised notice will be effective for all PHI we maintain at that time, including PHI created or received before the revision. We will make the revised notice available on our website, post a copy at our Dayton, Columbus, and Cincinnati offices, and provide a copy to you upon request. Material changes will be highlighted in a summary at the top of the revised notice.
Complaints
If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be penalized or retaliated against in any way for filing a complaint. Complaints must be filed in writing within 180 days of the date you knew or should have known of the act or omission complained of.
U.S. Department of Health and Human Services
Office for Civil Rights — Region V, Chicago Regional Office
233 N. Michigan Ave., Suite 240, Chicago, IL 60601
www.hhs.gov/ocr/complaints | 800-368-1019
Contact Our Privacy Officer
For questions about this notice, to exercise any of your rights, to request a copy of this notice, or to file a complaint, please contact:
Attn: Privacy Officer