Rosett Plastic Surgery

Notice of Privacy Practices

Effective date: January 1, 2026

Rosett Plastic Surgery 2461 N Clybourn Ave, Chicago, IL 60614 Phone: 312-535-2200

Your Information. Your Rights. Our Responsibilities.

This notice describes how medical information about you may be used and disclosed and how you can access this information. Please review it carefully.

Rosett Plastic Surgery is committed to protecting the privacy and security of your health information. This Notice of Privacy Practices explains how we may use and disclose your protected health information (“PHI”), describes your rights regarding that information, and explains our responsibilities under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and other applicable laws.

1. Your Rights

You have certain rights regarding your health information. The following explains those rights and how you may exercise them.

Get an Electronic or Paper Copy of Your Medical Record

You may ask to inspect or obtain an electronic or paper copy of your medical record and other health information that we maintain about you.

We will generally provide the requested information within the timeframe required by applicable law.

We may charge a reasonable, cost-based fee when permitted by law. Certain information may be withheld in limited circumstances permitted by law.

Ask Us to Correct or Amend Your Medical Record

If you believe health information in your medical record is inaccurate or incomplete, you may ask us to correct or amend it.

We may deny your request in certain circumstances permitted by law. If we deny your request, we will provide you with a written explanation and information about any additional rights you may have.

Request Confidential Communications

You may ask us to communicate with you about your health information in a specific manner or at a particular location. For example, you may ask us to:

  • Call you only at a particular telephone number;
  • Contact you through a specific email address;
  • Send correspondence to a different mailing address; or
  • Avoid leaving detailed voicemail messages.
  • We will accommodate reasonable requests.

Ask Us to Limit What We Use or Disclose

You may ask us not to use or disclose certain health information for treatment, payment, or healthcare operations.

We are generally not required to agree to every request. However, if we agree to a restriction, we will follow it except when disclosure is necessary for emergency treatment or otherwise permitted or required by law.

Services Paid in Full

If you pay for a healthcare service or item entirely out of pocket, you may ask us not to disclose information about that service to your health plan for payment or healthcare operations purposes. When required by HIPAA, we will honor that request unless another law requires us to disclose the information.

Receive an Accounting of Certain Disclosures

You may request a list of certain disclosures we have made of your health information during the six years before the date of your request.

The accounting generally does not include disclosures made for treatment, payment, healthcare operations, disclosures you specifically authorized, and certain other disclosures excluded by law.

You may receive one accounting during a 12-month period without charge. We may charge a reasonable, cost-based fee for additional requests during the same period where permitted by law.

Receive a Copy of This Notice

You may request a paper copy of this Notice at any time, even if you have previously agreed to receive the Notice electronically. The current Notice is also available on our website at rosettmd.com.

Choose Someone to Act on Your Behalf

If you have authorized another person to act as your personal representative, such as through a valid healthcare power of attorney or legal guardianship, that person may exercise applicable privacy rights on your behalf. We may require documentation confirming that person’s legal authority before acting on a request.

File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with Rosett Plastic Surgery. You may also file a complaint with the:

U.S. Department of Health and Human Services Office for Civil Rights 200 Independence Avenue, S.W. Washington, D.C. 20201 Phone: 1-877-696-6775

Additional information about filing a HIPAA complaint is available through the U.S. Department of Health and Human Services Office for Civil Rights.

Rosett Plastic Surgery will not retaliate against you for filing a complaint or exercising your privacy rights.

2. Your Choices

For certain types of health information, you may tell us how you would like that information to be used or disclosed.

Family Members and Others Involved in Your Care

Unless you object or applicable law requires otherwise, we may disclose relevant health information to a family member, close friend, caregiver, or another person involved in your care or payment for your care. We generally limit the information disclosed to what is relevant to that person’s involvement.

If you are unable to express your preference, such as during an emergency or while unconscious, we may disclose information when we reasonably believe doing so is in your best interest and is permitted by law.

Disaster Relief

We may disclose relevant health information to an organization assisting with disaster-relief efforts so that your family or others responsible for your care can be informed about your condition, status, or location when permitted by law.

Marketing

We generally will not use or disclose your PHI for marketing purposes when HIPAA requires your written authorization.

In particular, identifiable patient photographs, videos, testimonials, medical information, or treatment results will not be used for marketing or promotional purposes when a HIPAA authorization is required unless you have provided a valid written authorization.

Providing or refusing a marketing authorization will not affect your ability to receive treatment from Rosett Plastic Surgery.

If you provide authorization, you may revoke it in writing as permitted by law. A revocation will not affect actions already taken in reliance on your previous authorization.

Sale of Health Information

We will not sell your PHI when HIPAA requires your written authorization unless you provide the authorization required by law.

Psychotherapy Notes

Most uses and disclosures of psychotherapy notes, if we maintain such information, require your written authorization except where otherwise permitted by law.

Fundraising

If we contact you as part of a fundraising activity permitted under HIPAA, you have the right to tell us that you do not wish to receive future fundraising communications.

3. How We Typically Use and Disclose Your Health Information

We may use and disclose your health information without written authorization for certain purposes permitted by law.

Treatment

We may use and disclose your health information to provide, coordinate, or manage your healthcare. For example, we may share information with:

  • Surgeons; Physicians; Nurses;
  • Anesthesia professionals;
  • Hospitals; Surgery centers;
  • Laboratories; Pharmacies;
  • Imaging providers; Pathology providers;
  • Other healthcare professionals involved in your care.
  • We may also use medical photographs, imaging, measurements, and other clinical information when reasonably necessary for diagnosis, treatment planning, documentation, postoperative care, or other legitimate treatment purposes.

Payment

We may use and disclose your health information to bill and obtain payment for healthcare services provided to you. For example, we may provide information to:

  • Your health insurance company;
  • Health plans;
  • Claims processors;
  • Billing companies; or
  • Other entities responsible for payment.
  • This information may be used for eligibility verification, claims submission, prior authorization, medical-necessity review, payment processing, and related activities.

Healthcare Operations

We may use and disclose health information to operate our medical practice and improve the quality of care we provide. Healthcare operations may include:

  • Quality assessment and improvement;
  • Patient-safety activities;
  • Reviewing provider performance;
  • Staff training;
  • Credentialing;
  • Compliance activities;
  • Auditing;
  • Business planning;
  • Legal and professional services;
  • Practice administration; and
  • Contacting you regarding your care.
  • We may work with outside companies that perform services for our practice and require access to PHI. When required by HIPAA, these organizations are considered business associates and must agree to appropriately safeguard your information.

4. Other Uses and Disclosures Permitted or Required by Law

HIPAA and other laws permit or require us to use or disclose health information in certain additional circumstances.

Public Health and Safety

We may disclose health information for authorized public-health and safety purposes, including:

  • Preventing or controlling disease;
  • Reporting certain diseases or conditions;
  • Reporting adverse reactions to medications;
  • Assisting with product recalls;
  • Reporting suspected abuse, neglect, or domestic violence where permitted or required by law; and
  • Preventing or reducing a serious and imminent threat to health or safety.

Research

We may use or disclose health information for research when the research satisfies applicable legal requirements, including authorization, institutional review, waiver, or other requirements where applicable.

Required by Law

We may disclose health information when federal, state, or local law requires us to do so. We may also disclose information to the U.S. Department of Health and Human Services when necessary to demonstrate our compliance with federal health-information privacy laws.

Organ and Tissue Donation

When applicable, we may disclose health information to organizations involved in organ, eye, or tissue donation and transplantation as permitted by law.

Coroners, Medical Examiners, and Funeral Directors

We may disclose health information to a coroner, medical examiner, or funeral director when permitted or required by law.

Workers’ Compensation

We may disclose health information as authorized or required for workers’ compensation or similar programs.

Health Oversight Activities

We may disclose health information to government agencies for legally authorized health-oversight activities, including audits, inspections, investigations, licensing, and disciplinary proceedings.

Law Enforcement

We may disclose health information for certain law-enforcement purposes when the disclosure meets applicable legal requirements.

Judicial and Administrative Proceedings

We may disclose health information in response to certain court orders, administrative orders, subpoenas, discovery requests, or other lawful processes when permitted or required by applicable law.

Special Government Functions

We may disclose health information for certain authorized government functions, including military, national-security, intelligence, correctional-institution, or protective-service activities where permitted by law.

5. Substance Use Disorder Records

Certain substance use disorder treatment records may receive additional protection under 42 CFR Part 2.

To the extent Rosett Plastic Surgery receives or maintains records that are subject to 42 CFR Part 2, those records are subject to additional restrictions.

We will not use or disclose Part 2 records in civil, criminal, administrative, or legislative investigations or proceedings against you unless the disclosure is permitted under applicable federal law, including where appropriate through your written consent or the legally required court process.

If Part 2 information is used for fundraising communications, we will provide any notice and choice required by applicable law.

6. Information Subject to Additional Illinois Privacy Protections

Some categories of health information may receive greater protection under Illinois law than under HIPAA.

When Illinois or another applicable law provides greater privacy protection than HIPAA, Rosett Plastic Surgery will follow the more protective legal requirement. This may apply to certain information concerning:

  • Mental-health or developmental-disability services;
  • HIV-related information;
  • Genetic testing or genetic information;
  • Substance-use-disorder treatment;
  • Records concerning minors; and
  • Other categories of specially protected medical information.
  • Where additional authorization, consent, court process, or other legal requirements apply to these records, we will comply with those requirements before using or disclosing the information.

7. Other Uses of Your Health Information

Uses and disclosures of your PHI not described in this Notice will generally be made only with your written authorization when authorization is required by law.

If you give us written authorization, you may generally revoke that authorization at any time by notifying us in writing. Your revocation will apply to future uses and disclosures and will not affect actions already taken based on your authorization.

8. Our Responsibilities

Rosett Plastic Surgery is required by law to protect the privacy and security of your PHI. We are also required to:

  • Follow the privacy practices described in the Notice currently in effect;
  • Provide you with a copy of this Notice;
  • Maintain appropriate safeguards for PHI;
  • Limit uses and disclosures of PHI as required by law; and
  • Notify affected individuals as required by law if a breach of unsecured PHI occurs.
  • We will not use or disclose your PHI in a manner that requires your authorization unless we first obtain that authorization.

9. Electronic Communications and Patient Portal

Rosett Plastic Surgery may communicate with patients using electronic systems, including patient portals, telephone, text messaging, and email where appropriate.

You may request reasonable alternative methods of communication.

Because ordinary email and text messaging may present privacy and security risks, sensitive medical information should be transmitted through secure patient communication systems when available.

Your use of third-party portals or communication services may also be subject to the terms and privacy practices of those services.

10. Changes to This Notice

We reserve the right to change the terms of this Notice and our privacy practices as permitted by law.

Any revised Notice may apply to PHI we already maintain as well as information we receive in the future.

When we materially revise this Notice, the updated version will be made available:

  • At our office;
  • Upon request; and
  • On our website at rosettmd.com.
  • The effective date appearing at the beginning of the Notice will indicate when the current version became effective.

11. Privacy Questions, Requests, and Complaints

To exercise any of the rights described in this Notice, request additional information, or submit a privacy complaint, please contact:

Contact

Privacy Officer Brian E Rosett, MD 2461 N Clybourn Ave Chicago, IL 60614 Phone: 312-535-2200 Email: DrBrian@RosettMD.com

Please identify your communication as a Privacy Request or HIPAA Privacy Matter when appropriate.

We may require reasonable identity verification before fulfilling a request involving protected health information.

You will not be retaliated against for exercising your privacy rights or filing a complaint.