Notice of Privacy Practices

Effective date: 09/01/2026  ·  Revision date: 09/01/2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice explains how the participating health care providers listed in this notice may use and share your protected health information, called “PHI.” It also explains your rights. PHI is information about your health, care, or payment for care that can identify you.

Who This Joint Notice Covers

This is a joint notice for an organized health care arrangement, or OHCA. It applies to the following four legally distinct covered entities when they provide care through the OHCA:

• Digestive Care, P.A. — gastroenterology clinics.
• Arkansas Surgery & Endoscopy Center, LLC (ASEC) — ambulatory surgery center operations serving Pine Bluff and Little Rock.
• Central Arkansas Surgical Center (CASC) — the ambulatory surgery center in Russellville.
• ASC Anesthesia, PLLC — anesthesia services provided at ASEC Pine Bluff, ASEC Little Rock, and CASC Russellville.

These entities are commonly owned but are not parent and subsidiary companies. They have agreed to follow this joint notice for PHI created or received through their OHCA participation. They may share PHI with one another as needed for treatment, payment, and health care operations that relate to the OHCA. Giving this notice through one participant satisfies the notice-delivery obligation of the other participants for care delivered through the OHCA.

The OHCA participants jointly conduct credentialing, utilization review, and peer review across all four entities. Each licensed ambulatory surgery center separately maintains its own quality assessment and performance improvement (QAPI) program as required for its certification. The separate QAPI programs do not change the entities’ separate legal status.

Covered Service-Delivery Sites

Your Rights

You have the rights described below. To use a right, contact the Privacy Officer listed at the end of this notice. We may ask you to put a request in writing and to verify your identity or authority.

Get a copy of your health and billing records

You may ask to see or get a paper or electronic copy of PHI in your designated record set. This usually includes medical and billing records and other records we use to make decisions about you.

If you ask us in writing, sign the request, and clearly identify the person and destination, you may direct us to send a copy to another person. We will provide the copy in the electronic form and format you request if it is readily producible. If it is not, we will work with you on another readable form or format.

We will act on your request within 30 days. If we need one 30-day extension, we will tell you in writing why and give you a completion date. We generally charge up to $30 for a records request, but never more than the reasonable, cost-based fee allowed by HIPAA and other applicable law. Some electronic access may be free or cost less. We will tell you the approximate fee before making the copy. We may deny access only as allowed by law. Some denials may be reviewed by another licensed health care professional.

Ask us to correct your record

You may ask us in writing to amend PHI in your designated record set if you believe it is wrong or incomplete. We may deny the request for a reason allowed by law, such as when we did not create the information and the creator is available, or when the record is accurate and complete. If we deny the request, we will explain why in writing and tell you how to submit a statement of disagreement.

We will act within 60 days. If we need one 30-day extension, we will tell you in writing why and give you a completion date. We will not erase or overwrite the original record.

Ask for confidential communications

You may ask us to contact you in a specific way, such as only at a certain phone number, or to send mail to a different address. We will accommodate reasonable requests. Tell us which methods or locations are safe for appointment reminders, portal notices, bills, and other communications.

Ask us to limit what we use or share

You may ask us not to use or share certain PHI for treatment, payment, or health care operations. We do not have to agree to most requests. If we agree, we will follow the restriction except when the information is needed for emergency treatment or another exception allowed by law applies.

If you pay us in full out of pocket for a health care item or service and ask us not to share PHI about that item or service with your health plan for payment or health care operations, we must agree unless the law requires the disclosure. Make this request before the claim is sent. You may need to pay every related charge in full, including charges from another provider.

Get a list of certain disclosures

You may ask for an accounting, or list, of certain disclosures of your PHI made during the six years before your request. The accounting generally does not include disclosures for treatment, payment, or health care operations; disclosures you authorized; disclosures to you; or other disclosures excluded by law. We will include the date, recipient, information disclosed, and purpose or legal basis when required.

We will provide one accounting in any 12-month period at no charge. We may charge a reasonable, cost-based fee for another accounting during that period after telling you the cost and giving you a chance to withdraw or change the request.

Get a paper copy of this notice

You may ask for a paper copy at any time, even if you agreed to receive it electronically. You may also get the current notice at each covered service site and at DigestiveCareAR.com.

Choose a personal representative

If you give someone medical power of attorney, or if someone is your legal guardian or otherwise authorized by law, that person may exercise your rights. We will verify the person’s authority. Parents and guardians usually act for minors, but exceptions apply when a minor may consent to care or when law limits a representative’s access.

Receive notice after a breach

We will notify you as required by law if a breach may have compromised the privacy or security of your unsecured PHI.

File a complaint without retaliation

You may complain if you believe your privacy rights were violated. Contact our Privacy Officer using the information at the end of this notice. You will not be retaliated against, denied care, or treated differently for filing a complaint.

You may also complain to the U.S. Department of Health and Human Services, Office for Civil Rights:

Online: https://ocrportal.hhs.gov/
Mail: HHS Office for Civil Rights, Centralized Case Management Operations, 200 Independence Avenue, S.W., Suite 515F, HHH Building, Washington, D.C. 20201
Voice: 1-800-368-1019
TDD: 1-800-537-7697

Your Choices

For certain PHI, you may tell us what to share. If you have a clear preference, tell us.

Family, friends, and others involved in your care

You may agree or object to our sharing PHI that is directly relevant to a family member, friend, caregiver, or other person involved in your care or payment for care. If you cannot tell us your preference, such as during an emergency, we may share relevant PHI when, in our professional judgment, it is in your best interest. We may also share limited information for disaster relief and to notify someone about your location, general condition, or death.

Fundraising

We do not use your PHI to contact you for fundraising.

How We May Use and Share Your PHI

We use and share only the PHI reasonably needed for the purpose, except when the law allows or requires otherwise. If Arkansas or another law gives greater privacy protection, we will follow the more protective law.

Treatment

We may use and share PHI to provide, coordinate, or manage your care. For example, a Digestive Care clinician may share your history with an endoscopy nurse and anesthesia professional before a colonoscopy. After a biopsy, we may send the specimen and relevant information to a pathology laboratory and use the result for follow-up care. We may share PHI with another doctor, hospital, pharmacy, laboratory, or facility treating you.

Payment

We may use and share PHI to bill and collect payment. For example, we may ask your health plan about eligibility or prior authorization, submit a claim for a clinic visit, endoscopy, pathology service, or anesthesia service, and respond to a coverage review or appeal. Our contracted billing company may perform these tasks for us under a written agreement that requires it to protect your PHI.

Health care operations

We may use and share PHI to run our health care activities. For example, we may review endoscopy outcomes, infection-control events, patient safety, coding, clinician performance, credentials, compliance, audits, and patient experience. The legally separate OHCA participants may share PHI for health care operations that relate to their joint arrangement.

Business associates

We may give PHI to companies that perform services for us, such as billing, electronic health record hosting, e-prescribing, information technology, document storage, legal or accounting services, and patient communications. These business associates must protect PHI as required by law and contract.

Appointment reminders

We may contact you about appointments by phone, text message, patient portal, or mail. Tell us if you need a different or safer contact method. Standard text messages and email may not be secure.

Treatment alternatives and health-related benefits

We may tell you about treatment options, care-management services, or health-related benefits or services that may interest you when the law allows. We will get your written authorization for marketing when HIPAA requires it.

When the law allows or requires us to share PHI

We may use or share PHI without your written authorization in the circumstances below, but only when legal conditions are met:

• Required by law. We may disclose PHI when federal, state, or local law requires it.
• Public health and safety. We may report diseases, births or deaths, adverse events, product problems or recalls, and other information to authorized public health agencies. We may make lawful workplace-surveillance disclosures.
• Abuse, neglect, or domestic violence. We may report suspected child maltreatment to the Arkansas Child Abuse Hotline, suspected adult maltreatment to the Adult Maltreatment Hotline, and other matters to the agency authorized by law. We may report intentionally inflicted knife or gunshot wounds and qualifying burns to law enforcement when Arkansas law requires.
• Health oversight. We may disclose PHI for authorized audits, inspections, licensure, disciplinary actions, and fraud or compliance investigations.
• Court and administrative proceedings. We may disclose PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process when the legal requirements are met.
• Law enforcement. We may disclose limited PHI for purposes allowed by law, such as locating a suspect or missing person, reporting certain crimes, or responding to legal process.
• Coroners, medical examiners, and funeral directors. We may disclose PHI so they can carry out duties authorized by law.
• Organ and tissue donation. We may disclose PHI to organ-procurement and related organizations to help with donation and transplantation.
• Research. We may use or share PHI for research with your authorization or when an institutional review board, privacy board, or another lawful exception permits it.
• Preventing a serious threat. We may use or disclose PHI in good faith to prevent or lessen a serious and imminent threat to health or safety, as allowed by law.
• Special government functions. We may make limited disclosures for military and veterans’ activities, national security, protective services, correctional institutions or lawful custody, medical-suitability determinations, and certain public-benefit programs when the law allows.
• Workers’ compensation. We may disclose PHI as authorized by and necessary to comply with workers’ compensation or similar laws.

Substance use disorder records protected by 42 C.F.R. Part 2

The participating entities are not Part 2 programs and do not currently receive or maintain records protected by 42 C.F.R. Part 2. If we later receive or maintain such records, we will not use or disclose them, or testimony describing their content, in a civil, criminal, administrative, or legislative proceeding against you unless you give written consent or a court issues an order that meets Part 2 and a subpoena or other legal mandate compels the disclosure.

Uses and Disclosures That Usually Require Written Authorization

We will get your written authorization before:

• using or disclosing psychotherapy notes, except for limited uses allowed by law;
• using or disclosing PHI for marketing when authorization is required;
• selling PHI when authorization is required; or
• using or disclosing PHI for another purpose not described in this notice and not otherwise permitted or required by law.

An authorization must describe the PHI and the permitted use or disclosure. You may revoke it in writing at any time, except to the extent that we already relied on it or another legal exception applies. Send a revocation to the Privacy Officer.

Our Duties

We are required by law to maintain the privacy and security of your PHI, give you this notice of our legal duties and privacy practices, and follow the notice currently in effect. We will notify affected individuals as required by law after a breach of unsecured PHI.

Each participant remains a separate legal entity and is responsible for its own compliance. The joint notice does not merge the participants or create a parent-subsidiary relationship.

Changes to this notice

We may change this notice and make the revised notice effective for PHI we already have and PHI we receive in the future. When we make a material change, we will update the effective or revision date, post the current notice at each covered service site and on our website, and make copies available on request. You may ask for the current notice at any time.

Questions, Requests, or Complaints

Contact:

Privacy Officer: Ahmed Samad, CEO
Mail: 4800 S. Hazel St, Pine Bluff, AR 71603
Email: Info@ASEC.com
Phone: (870) 534-5533

Do not send medical information or other sensitive information by unsecured email. Call the Privacy Officer to ask for a secure way to send PHI.