HIPAA Notice of Privacy Practices

Starfish Health Inc.
Medicaid-certified | Accredited by The Joint Commission

Effective Date	August 17, 2026
Last Updated	August 17, 2026
Address	1647 Benning Road NE, Suite 301, Washington, DC 20002
Privacy Contact	(202) 840-0423 | info@starfishhealth.com

This Notice of Privacy Practices applies to Starfish Health Inc. and describes how we may use and disclose Protected Health Information (PHI) about you, your rights regarding that information, and our responsibilities. This notice applies to Starfish Health workforce members and healthcare operations that use or maintain PHI on behalf of Starfish Health.

Website data practices are covered separately in our Website Privacy Policy.

Your Rights

You have the right to	What this means
Get a copy of your health record	You can ask to see or receive an electronic or paper copy of your medical record and other health information we have about you, subject to applicable law.
Ask us to correct your health record	You can ask us to correct health information that you believe is incorrect or incomplete. We may deny the request in certain circumstances and will explain the reason in writing when required.
Request confidential communications	You can ask us to contact you in a specific way, such as only at a particular phone number or address. We will accommodate reasonable requests as required by law.
Ask us to limit what we use or share	You can ask us not to use or share certain health information for treatment, payment, or healthcare operations. We are not always required to agree, except where applicable law requires us to do so.
Get a list of certain disclosures	You can ask for an accounting of certain disclosures of your health information as permitted by law.
Get a copy of this notice	You may ask for a paper copy of this notice at any time, even if you agreed to receive it electronically.
Choose someone to act for you	If you have given someone medical power of attorney or if someone is your legal guardian or other authorized personal representative, that person may exercise your rights as permitted by law.
File a complaint	You may complain to Starfish Health or to the U.S. Department of Health and Human Services Office for Civil Rights if you believe your privacy rights have been violated. We will not retaliate against you for filing a complaint.

Your Choices

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations below, tell us what you want us to do. We will follow your instructions when required by law.

• Share information with your family, close friends, or others involved in your care or payment for your care
• Share information in a disaster-relief situation
• Contact you for fundraising efforts, where permitted; you may tell us not to contact you again for fundraising

For certain uses and disclosures, including uses requiring a written authorization, we will obtain your written permission when required by law. You may revoke an authorization in writing, subject to actions already taken in reliance on it.

How We May Use and Share Your Health Information

Treatment

We may use and share your health information to provide, coordinate, or manage your healthcare and related services, including sharing information with healthcare professionals involved in your treatment.

Payment

We may use and share your health information to bill and obtain payment from health plans or other responsible parties, determine eligibility or coverage, and obtain prior authorization where applicable.

Healthcare Operations

We may use and share your health information to operate our organization, improve care, conduct quality assessment, train staff, manage services, and perform other healthcare operations permitted by law.

Public Health and Safety

We may share health information for certain public health, health oversight, safety, or reporting purposes when permitted or required by law.

Legal and Regulatory Requirements

We may use or share health information when required by law or for certain judicial, administrative, law-enforcement, workers compensation, government, or regulatory purposes as permitted by law.

Health Oversight

We may disclose health information to health oversight agencies for activities authorized by law, such as audits, investigations, inspections, and licensure or accreditation activities.

Coroners, Medical Examiners, and Funeral Directors

We may disclose information to coroners, medical examiners, or funeral directors as permitted by law.

Organ and Tissue Donation

We may share information with organizations involved in organ, eye, or tissue donation and transplantation where applicable.

Special Protections for Behavioral Health and Substance Use Disorder Records

Behavioral health information may receive additional protections under federal or District of Columbia law. To the extent Starfish Health maintains records protected by 42 CFR Part 2, those records will be used and disclosed in accordance with applicable Part 2 requirements.

Where written consent or authorization is required to disclose protected substance use disorder records, Starfish Health will obtain the required consent or authorization before making the disclosure, unless another legal exception applies. Information protected by Part 2 may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against a patient except as permitted by applicable law.

Uses and Disclosures Requiring Authorization

We will obtain your written authorization before using or disclosing PHI when an authorization is required by law. Examples may include certain uses or disclosures of psychotherapy notes, certain marketing communications, sale of PHI, and other uses not otherwise permitted by law.

Our Responsibilities

• We are required by law to maintain the privacy and security of your protected health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information and notification is required by law.
• We must follow the duties and privacy practices described in the notice currently in effect.
• We will not use or share your information other than as described here unless you authorize us in writing or another law permits or requires the use or disclosure.
• If you revoke an authorization, we will stop future uses or disclosures covered by that authorization, except to the extent we have already acted in reliance on it.

Minors and Personal Representatives

When a patient is a minor, a parent, legal guardian, or other legally authorized personal representative may exercise privacy rights on the minor’s behalf as permitted by applicable law. There are circumstances in which a minor may have independent rights concerning certain health information. Starfish Health will follow applicable federal and District of Columbia law when determining who may access or authorize disclosure of a minor’s health information.

Confidential Communications

You may request that Starfish Health communicate with you about health matters in a particular way or at a particular location. Please tell us your preferred communication method and any privacy concerns. We will accommodate reasonable requests as required by law.

Questions or Complaints

If you have questions about this notice, wish to exercise a privacy right, or believe your privacy rights have been violated, contact Starfish Health using the information below. You will not be retaliated against for filing a complaint.

Organization	Starfish Health Inc.
Address	1647 Benning Road NE, Suite 301, Washington, DC 20002
Phone	(202) 840-0423
Email	info@starfishhealth.com
Website	starfishhealth.com

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. Filing a complaint will not affect the care you receive from Starfish Health.

Changes to This Notice

Starfish Health may change the terms of this Notice of Privacy Practices and make the revised notice effective for all PHI we maintain, including information created or received before the change. If we make a material change, we will make the revised notice available as required by law and post the current notice on our website.