Your information.
Your choices, in writing.

Notice of Privacy Practices

DRAFT — FOR COUNSEL REVIEW — NOT EFFECTIVE

Review instruction: this is for a confirmed HIPAA covered health care provider. Identify the provider before using “we.” Do not label CLR SYNC LLC the provider without an established legal basis. Complete or remove bracketed choices only after review. A Part 2 program needs additional notice content.

Provider: [[REQUIRED: covered entity's full legal name and applicable trade name]]
This notice covers: [[REQUIRED: services, locations, and any legally approved participating entities]]
Effective date and version: [[REQUIRED: actual approved effective date and version]]
Privacy questions and requests: [[REQUIRED: contact name or office/title, telephone, mailing address and secure request method]]
Current notice and paper-copy requests: [[REQUIRED: verified website location and working request method]]

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our responsibility

We must protect the privacy of your protected health information, explain our legal duties and privacy practices, follow the notice currently in effect, and notify affected people following a breach of unsecured protected health information as required by law.

This notice explains information handled in the provider relationship named above. CLEAR SYNC's website/account notice and another organization's notice may apply to other services. [[REQUIRED: explain the actual CLEAR SYNC/provider relationship and where patients obtain the other applicable notices.]]

Uses and sharing permitted by law

We may use and share information for:

• Treatment: for example, a clinician may review laboratory results and share relevant information with another professional involved in your care.
• Payment: for example, supplying the information needed to collect payment for a service. [[REQUIRED: reflect actual self-pay/insurance billing arrangements.]]
• Health care operations: for example, quality review, patient-safety review and administration of our practice. Contractors handling information for us must have the required safeguards and agreements.

Other laws may impose tighter limits, including the special protections below. We may also use or disclose information, when applicable legal conditions are satisfied, for public-health reporting and safety; product recalls and adverse-event reporting; reporting abuse, neglect or domestic violence; health oversight; workers' compensation; organ/tissue donation; coroners, medical examiners and funeral directors; lawful national-security, military and other specialized government functions; and preventing a serious and imminent threat. Research use requires the authorization or other safeguards that the law permits; this notice is not research consent.

We disclose information when legally required, including authorized federal privacy-compliance review. Court orders, subpoenas, law-enforcement requests and other proceedings require legal review and the applicable protections; receiving a request does not by itself permit release of every record.

Family, friends and your choices

We may share information directly relevant to a person's involvement in your care or its payment when you agree, have an opportunity to object and do not, or the law otherwise permits it. Tell us whom to include or exclude. If you cannot express a preference, a professional may use judgment about your best interests within the law, including permitted disaster-relief disclosures. A family relationship alone does not give someone full portal access or all of your records.

[[REQUIRED: state whether a facility directory is used. If used, explain the limited directory information, permitted recipients and the patient's choice to restrict or opt out. If not used, omit this paragraph.]]

[[REQUIRED: select actual fundraising practice. If fundraising communications are used, explain the right and working method to opt out and that treatment/payment are not conditioned on that choice. If Part 2 information is used, provide a clear, conspicuous opportunity in advance to elect not to receive fundraising communications. If no fundraising is done, state the approved practice.]]

Written authorization and special protections

Uses and disclosures requiring authorization include most uses/disclosures of psychotherapy notes, marketing uses requiring authorization, and sales of protected health information. We obtain your specific written authorization when required. Other uses or disclosures not described in this notice will require your written authorization.

You may revoke an authorization in writing through the privacy contact above. Revocation stops future activity under that authorization, except to the extent we have already acted in reliance on it. We will explain any other legally applicable exception in the particular authorization. Optional permissions are separate from notice receipt.

Protected substance use disorder records: to the extent we maintain records protected by 42 CFR Part 2, the following additional rules apply. Records from a Part 2 program, and testimony describing their contents, cannot be used or disclosed in civil, criminal, administrative or legislative investigations or proceedings against you without your specific written consent or a qualifying court order after legally required notice and opportunity to be heard. The order must be accompanied by a subpoena or another legal requirement compelling disclosure. A general treatment/payment/operations consent does not authorize use against you in such proceedings.

[[REQUIRED: explain the entity's actual Part 2 receipt/use model. If it receives records under a Part 2 treatment/payment/operations consent, describe permitted HIPAA redisclosures and the continuing proceedings restriction. If it is itself a Part 2 program, replace/expand this notice with a reviewed Part 2 or combined notice.]]

[[REQUIRED: insert applicable state/other-law limits for the actual services and patient locations, including sensitive records and minors as applicable. Complete a documented review even if no additional paragraph is ultimately needed.]]

Your rights and how to use them

Contact the privacy office above for help or submit a request through the verified method listed there. We verify identity and any representative's authority without imposing unreasonable barriers.

• See or receive records: request inspection or an electronic or paper copy of information in the designated record set used to make decisions about you. We provide the requested form/format if readily producible or agree on an alternative. We explain any permitted fee before charging it. HIPAA generally requires action within 30 calendar days; a single additional 30-day period requires timely written reasons and a completion date. A more protective applicable law may require faster action. We explain any denial and available review rights.
• Ask for an amendment: tell us which information you believe is wrong or incomplete and why. We may deny an amendment for legally permitted reasons, with a written explanation and information about submitting a statement of disagreement. HIPAA generally requires action within 60 calendar days; a single additional 30-day period requires timely written notice. An amendment ordinarily adds or links corrected information; it does not erase the original record.
• Request confidential contact: ask for a different telephone number, address or other reasonable contact arrangement. We accommodate reasonable requests. You need not explain your reason to a covered provider.
• Request limits on sharing: ask us to limit particular uses/disclosures for treatment, payment or operations, or sharing with people involved in care. We generally need not agree. We must agree to a qualifying request to keep information about an item/service paid in full out of pocket from a health plan for payment/operations, unless law requires disclosure. Tell us before the claim or disclosure so the restriction can be applied.
• Obtain an accounting: request a list of disclosures covered by the accounting right for a specified period within the preceding six years. Certain disclosures, including most treatment/payment/operations disclosures and authorized disclosures, are excluded under HIPAA. The first accounting within a 12-month period is free; an additional one may have an advance-disclosed, reasonable cost-based fee that you can avoid by withdrawing/modifying the request. HIPAA generally requires action within 60 days, with one properly noticed extension of up to 30 days.
• Get this notice: request a paper copy even if you chose electronic delivery.
• Use an authorized representative: a person with authority under applicable law may act within that authority. We verify it and consider applicable exceptions, including risks of abuse or endangerment.
• Complain without retaliation: contact our privacy office using the details above. You may also complain to the U.S. Department of Health and Human Services, Office for Civil Rights, through its complaint page (opens in a new tab). You do not need to complain to us first. We will not retaliate.

Changes

We may revise this notice and, when law permits, apply its terms to information we already maintain and future information. We will make the revised notice available at [[REQUIRED: actual notice website and service locations]] and through the privacy contact. Its actual effective date will be shown. We will provide any additional notice required by law.

Review basis: HHS provider model, updated February 13, 2026 (opens in a new tab); 45 CFR 164.520 (opens in a new tab); sources and court-status qualification in document 09. Federal time periods above are legal baselines, not a verified company service-level commitment.

Notice of Privacy Practices — receipt acknowledgment

DRAFT — NOT FOR PATIENT SIGNATURE UNTIL APPROVED

Provider: [[REQUIRED: covered provider legal name]]
Notice version/effective date: [[REQUIRED: exact approved notice]]
Notice supplied by: [[REQUIRED: paper/electronic delivery method and usable copy location]]

Patient name: ____________________ Patient record reference: ____________________

If I select acknowledgment below, I confirm that I received a copy of the Notice of Privacy Practices identified above. I may ask for a paper copy. This acknowledgment records receipt; it does not authorize disclosures, agree to treatment, waive privacy rights, or enroll me in optional programs.

My choice:

• [ ] I acknowledge receipt.
• [ ] I decline to sign an acknowledgment. I understand I can still obtain the notice and receive care.

Patient or authorized representative signature: ____________________ Date: __________

Printed name if representative: ____________________ Authority: ____________________

Staff record — complete when used

Notice actually provided/offered on: __________ Method: __________ Staff: __________

• [ ] Receipt acknowledged; signed copy furnished.
• [ ] Patient declined acknowledgment.
• [ ] Unable to obtain acknowledgment despite good-faith effort.
• [ ] Emergency treatment; notice provided as soon as reasonably practicable after emergency ended.

Effort made and reason acknowledgment was not obtained: ____________________

Copy requested / delivery outcome: ____________________

Implementation: present receipt choice separately from required signatures. A refusal or missing acknowledgment must not be recorded as a signature or block care. Preserve the notice version, delivery evidence and good-faith documentation. For first service delivered electronically, implement the applicable contemporaneous notice delivery requirement. A prechecked box or a link hidden in account terms is insufficient evidence of actual delivery.

Source: HHS notice delivery and acknowledgment guidance (opens in a new tab).

Limited authorization to disclose health information

DRAFT — NOT FOR PATIENT SIGNATURE UNTIL APPROVED

Use this form only after confirming an authorization is the appropriate basis. Do not require it to obtain a patient's own records under the HIPAA right of access or for a disclosure already permitted without authorization when another law does not require consent. Do not combine it with service terms, NPP receipt or marketing choices.

Your instructions

Patient name: ____________________ Date of birth or other approved matching identifier: ____________________

Who may disclose the information? Exact provider/entity or clearly identified class: ____________________

Who may receive it? Exact person/entity or clearly identified class: ____________________
Recipient address/verified delivery destination: ____________________
Contact to verify destination: ____________________

What information? Select and describe only the records needed.

• [ ] Laboratory reports for tests/dates: ____________________
• [ ] Visit or treatment records for service/dates: ____________________
• [ ] Medication/allergy information for dates: ____________________
• [ ] Billing records for service/dates: ____________________
• [ ] Apple Health categories and date range: ____________________
• [ ] Other specifically described records: ____________________

Exclude these records or details: ____________________

Purpose: ____________________
If you initiate this release and prefer not to explain why, “at my request” may be used.

Scope: [ ] One disclosure of the records above. [ ] Repeated disclosures limited to this description: ____________________

Expiration: this authorization ends on this date, or this event relating to me or this disclosure's purpose: ____________________

Both the information description and expiration must be completed before signing. Do not use an indefinite “all records forever” default.

Your rights

• Signing is voluntary. For this optional release, we will not condition treatment, payment, enrollment or eligibility for benefits on signing it. A legally permitted conditioning exception requires a separately reviewed form explaining the consequence; it is not offered by this template.
• You may revoke this authorization in writing at any time by sending a revocation to [[REQUIRED: responsible provider's monitored written/secure submission destination and assistance telephone]]. Identify the authorization and information you want to stop sharing. Revocation does not undo actions already taken in reliance on the authorization.
• Information disclosed under this authorization may be redisclosed by the recipient and may no longer be protected by the HIPAA Privacy Rule. Other laws may still protect it.
• You may receive a copy of the completed, signed authorization.

This form does not authorize marketing, sale of PHI, research, publicity/testimonials, disclosure of psychotherapy notes, or use/disclosure of Part 2 records. Route those requests for a separate applicable authorization/consent and legal review. Other specially protected records require review of applicable state law before release; do not silently include them under a general category.

I authorize only the disclosure described above.

Patient/authorized representative signature: ____________________ Date: __________
Printed name: ____________________
If representative, describe legal authority and supporting document: ____________________

Staff validation and disclosure record

Identity/authority verified by/method/date: ____________________
Form version and authorization ID: ____________________
Required fields complete; no expiration/revocation; applicable sensitive-record rules checked by: ____________________
Recipient/destination verified: ____________________
Actual records/date/method of disclosure: ____________________
Signed copy provided by/date: ____________________

Do not disclose on a blank, expired, materially incomplete or revoked authorization. Any material change to recipient, purpose, information or duration requires appropriate new authorization. Keep authorization evidence in the approved clinical records system.

Revocation of a prior authorization

Patient name/approved record identifier: ____________________
Authorization ID or date/recipient/purpose sufficient to locate it: ____________________

• [ ] Revoke the entire authorization.
• [ ] Revoke only this portion: ____________________

I revoke future uses/disclosures under the authorization to the extent stated above. I understand this does not undo actions already taken in reliance on it.

Signature: ____________________ Date: __________
Representative name/authority, if applicable: ____________________

Submit to [[REQUIRED: same verified written/secure destination]]. Staff receipt time, verified identity, affected systems/recipients, enforcement time and patient confirmation: ____________________

No particular revocation form is required if the written request otherwise identifies the authorization and clearly communicates revocation. Do not delay an otherwise valid revocation simply to obtain this template.

Sources: HHS authorization elements (opens in a new tab), HHS authorizations FAQs (opens in a new tab), HHS consent versus authorization (opens in a new tab). Counsel should verify final text against 45 CFR 164.508 and applicable state law.

Patient communications preferences

DRAFT — NOT ACTIVE — approved channels and contacts must be completed first

Responsible care provider: [[REQUIRED: full legal name]]
Requests/changes: [[REQUIRED: monitored secure method, telephone and mailing address]]

Patient name/approved record identifier: ____________________ Date: __________

Tell us safe ways to contact you. These choices cover care and account communications; they do not authorize advertising, promotional texts or calls, research recruitment or optional commercial programs. Declining an optional channel does not waive care or privacy rights.

Where to contact me

Safe times, sender-name restrictions, address restrictions or other instructions: ____________________

Even a generic message may reveal a relationship with a health service. Email, SMS, voicemail, lock-screen previews, shared devices and shared accounts can expose information to others. A secure portal may offer more protection, but no method eliminates all risk.

Confidential communication request: Please contact me by this alternative method or at this alternative location: ____________________

For covered-provider requests, you do not have to explain why. We accommodate reasonable requests. Staff will work with you on a usable alternative and confirm any necessary payment arrangements without requiring a reason for the request.

Optional request for unencrypted delivery of a particular record

Complete only if you ask for a specific disclosure through ordinary email or another less-protected method and that method can lawfully be supported. This is not permission for all future messages to contain health information.

Requested record/date range: ____________________ Exact destination: ____________________

Staff explained the risk that the information could be read by others, intercepted, misdirected or retained outside our control, and offered this alternative: ____________________

• [ ] After that explanation, I still request this specific delivery by the method/destination above.
• [ ] I prefer the alternative.

Your request does not waive our obligations to use reasonable safeguards or excuse use of an unapproved vendor. A communications preference alone does not make a particular technology permissible for PHI.

Changes and signature

Use the contact method above to change these choices. Changes apply to future communications after processing; they cannot recall a message already sent. Staff should record and implement the request promptly under the applicable policy. No specific company response time is established by this draft.

Patient/authorized representative signature: ____________________ Date: __________
Representative name/authority: ____________________

Staff: identity/destination verified __________; channels approved __________; preference recorded __________; conflicts resolved __________; copy supplied __________.

Operational review: define actual monitoring hours, urgent-result escalation and channel opt-out behavior before activation. Do not promise that email/SMS/portal messages are continuously monitored. Emergency instructions and clinical escalation belong in the specific service's care instructions. Confirm applicable communications laws separately before adding automated calling/texting or marketing consent.

Sources: HHS patient email safeguards (opens in a new tab); HHS provider notice model — confidential communications (opens in a new tab).

Optional Apple Health connection and sharing choices

DRAFT FOR A FUTURE CONNECTION — sharing is not currently available

The existing preparation page says there is no companion app to download or permission to grant. Do not show this as an active enrollment form until the reviewed companion and approved clinical runtime are available. This document creates no Apple permission and imports no information.

Disclosure to complete before launch

Operator: CLR SYNC LLC, using the brand CLEAR SYNC.
Companion app and approved version: [[REQUIRED: actual app identity/version]]
Connection privacy contact: [[REQUIRED: verified monitored contact and secure request method]]
Applicable privacy notices: [[REQUIRED: direct-consumer notice and/or named provider NPP, based on actual role]]
Where information is sent and stored: [[REQUIRED: approved receiving service, operator and jurisdictions]]
Processors and permitted purposes: [[REQUIRED: accurate recipient/purpose disclosure]]
Import period/frequency: [[REQUIRED: supported historical lookback and synchronization behavior]]
Retention/deletion terms: [[REQUIRED: actual periods, backup handling and medical-record/legal limits]]

Use your own account on the iPhone that holds your own Health data. Connecting is optional. Declining does not enroll you, prevent unrelated services, or grant anyone access to another household member's information. Features that depend on imported measurements will not have that data.

What the planned connection reads

The current design is read-only. Choose individual categories; none should be preselected merely because you accepted account terms.

• [ ] Sleep records and recording times
• [ ] Resting heart rate
• [ ] Heart rate variability (SDNN)
• [ ] Respiratory rate
• [ ] Blood oxygen measurements
• [ ] Steps

Measurements are intended to retain their source, date and applicable units. Availability depends on your devices, existing Health data and Apple permissions. Missing measurements do not necessarily mean a medical change or that a permission was denied. The connection does not write to or change Apple Health records.

Purpose of the selected import: [[REQUIRED: exact approved descriptive account feature and any clinical use]]

It is not continuous monitoring or an emergency service. Imported values and software trends do not diagnose a condition or direct a medication or treatment change. Clinical use, if offered, requires an identified provider and appropriate review.

Two separate choices

A. Apple permission: Apple presents native permissions for the categories the app requests. This paper/web document cannot grant those permissions. You may allow some categories and decline others. Apple may limit what the app can learn about read-permission choices.

B. Who may see imported information: show the actual default access before connecting.

Default permitted access: [[REQUIRED: named account holder, authorized operational roles and their limited purpose]]

Optional clinical sharing, if offered:

• [ ] Keep imported information within the disclosed account service; do not enable optional clinician sharing.
• [ ] Share only these categories/date range: ____________________ with this identified clinic/provider: ____________________ for this purpose: ____________________ until this date/event: ____________________.

Counsel must select and document the legal basis for clinical sharing. If a HIPAA authorization is required, collect the separately approved limited authorization with all required elements; this checkbox alone does not replace it. Use a reviewed consumer-health-data consent where applicable. These choices do not authorize marketing, sale, research, commercial aggregate-data participation, or family access. Any proposed new use needs its own legal review and appropriate choice.

Stop future sharing or request deletion

You can change the app's Health permissions in Apple's Health app. Apple's current guide describes profile → Privacy → Apps, then choosing the app and categories. Device versions may differ. Apple's permission guide (opens in a new tab)

Turning off Apple Health access stops future reads of the affected categories; it does not automatically delete data already sent to CLEAR SYNC. Account disconnect, withdrawal of optional clinician sharing and a deletion request are separate actions:

• Disconnect control: [[REQUIRED: verified account path and effect, including queued transfers]]
• Withdraw clinical sharing: [[REQUIRED: verified method and affected recipients/systems]]
• Request deletion/export: [[REQUIRED: verified method and actual retention exceptions]]

Previously shared clinical records may have retention requirements, and a withdrawal cannot undo completed disclosures. Explain what can be deleted, what must be retained and how backup copies are handled before acceptance. Do not promise immediate or universal deletion.

Future enrollment record

Patient/account reference: __________ Version shown: __________ Date/time: __________

• [ ] I choose the selected import categories for the stated purpose after reviewing the completed disclosure.
• [ ] I decline for now.

Record native permission-request evidence separately; do not claim the operating system granted a category merely because this document was accepted. Provide a copy of these choices and a working way to change them.

Review anchors: existing app/lib/apple-health-preparation.ts, app/apple-health/page.tsx and docs/connected-health/PHI-PRODUCTION-READINESS.md; HHS health apps guidance (opens in a new tab). Determine HIPAA applicability from the actual relationship, not from the data being health-related.

Family contact, portal delegate or personal representative request

DRAFT — no access is granted by completing this form

Responsible provider: [[REQUIRED: legal name]]
Secure submission/contact: [[REQUIRED: verified method and telephone]]

Patient name/approved record identifier: ____________________ Date: __________

Person requesting access: ____________________ Relationship: ____________________
Verified contact/account identity: ____________________

Choose the applicable role. Staff must verify its basis before enabling access. An emergency contact, shared address, family relationship, referral, payment or commercial account administrator role does not automatically confer authority over health records.

A. Person involved in my care or payment

• [ ] I want the provider to discuss only the following information relevant to this person's help with my care/payment: ____________________
• [ ] Do not discuss my information with this person: ____________________

Allowed purposes and limits: ____________________
Duration or review date/event of this preference: ____________________

This preference concerns limited discussions. It does not by itself give portal login, unrestricted record access, authority to sign for me or power to make health care decisions. A specific record disclosure may require the limited authorization in document 03 or another legal basis.

B. Optional portal delegate

• [ ] I request a separate delegate account with only these supported permissions:
• [ ] View appointments
• [ ] Help with scheduling
• [ ] View specifically selected records: ____________________
• [ ] Help with messages, with sender clearly identified
• [ ] Other reviewed scope: ____________________

Provider/account covered: ____________________ Information/date limits: ____________________
Access ends on date/event: ____________________

Staff must confirm the selected permissions can actually be separated. If the software cannot enforce the limits, do not grant broader access. Complete document 03 when required for the requested disclosures. Do not share the patient's credentials. Delegated portal access does not appoint a legal health care decision-maker.

C. Personal representative under applicable law

• [ ] I have existing legal authority to act for this patient.

Basis: [ ] Health care power of attorney [ ] Guardianship/court order [ ] Parent of minor [ ] Estate authority [ ] Other: __________

Authority document/date/issuing jurisdiction: ____________________
Scope, conditions for authority to become effective, and expiration: ____________________

Supply supporting documents through the secure method above. This form does not create a power of attorney or guardianship. Applicable law determines whether and to what extent the person may act. Staff must examine minor-consented services, confidentiality arrangements, custody orders and possible abuse/endangerment exceptions. A general parent or household setting must not expose every record by default.

Change or end access

Use [[REQUIRED: verified contact/control]] to revoke optional permissions in A/B or report a change in legal authority under C. Ending an optional delegate grant does not itself terminate legal authority created elsewhere. We will review and enforce the change; previous lawful disclosures cannot be recalled.

Patient signature for optional A/B choices, or representative signature for C: ____________________ Date: __________
Printed name/authority: ____________________

Staff decision and audit

Identity verified: __________ Legal basis/scope verified by: __________ Supporting evidence location: __________
Sensitive/minor-record segmentation reviewed: __________ Related authorization ID, if needed: __________
Approved scope: __________ Account and provider mapping: __________ Expiration/review trigger: __________
Patient and delegate notices/copies supplied: __________ Revocation method tested: __________

Status: [ ] Awaiting review [ ] Approved within verified scope [ ] Additional information needed [ ] Denied/limited with documented legal basis

A discretionary portal feature must not replace or improperly narrow a personal representative's legal access rights. Provide an appropriate alternative if the portal cannot meet them.

Sources: HHS personal representatives (opens in a new tab), HHS authority verification (opens in a new tab), HHS family and friends (opens in a new tab).

Patient privacy rights request

DRAFT — configure the responsible office and process before use

Responsible provider/record custodian: [[REQUIRED: legal name]]
Submit securely or request help: [[REQUIRED: actual monitored submission method, telephone and mailing address]]

Patient name: ____________________ Date of birth or approved matching identifier: ____________________
Safe contact method/destination: ____________________ Date: __________

Representative, if any, and basis of authority: ____________________

Use only the fields relevant to your request. This form is an aid; staff should accept another legally sufficient request and provide accessible assistance. You do not need to authorize the release of your own records to yourself using a separate HIPAA authorization.

What would you like to request?

• [ ] Access or copy. Records/service/date range: ____________________
• [ ] Inspection [ ] Electronic copy in this format: __________ [ ] Paper
• Delivery: [ ] To me [ ] To another person at my written direction, where applicable
• Exact recipient and verified destination: ____________________
• You do not need to state a reason for requesting access. If your requested format is not readily producible, we will work with you on an alternative. Any permitted fee will be explained in advance.
• [ ] Amendment. Identify the record/date, what is incorrect/incomplete, and the change/reason: ____________________
• Relevant supporting information: ____________________
• People who may need an accepted correction: ____________________
• [ ] If accepted, I agree to necessary notification of the people identified above.
• [ ] Restriction on sharing. Information, activity/recipient to restrict and requested duration: ____________________
• [ ] This concerns a specific item/service paid in full out of pocket, and I request no disclosure to my health plan for payment/operations unless required by law.
• Item/service/date and payment reference, if known: ____________________
• [ ] Confidential communications. Use this reasonable alternative method/location: ____________________
• You do not need to explain the reason to a covered provider.
• [ ] Accounting of disclosures. Requested period within the preceding six years: ____________________
• [ ] Paper or electronic copy of the current privacy notice. Format: ____________________
• [ ] Privacy complaint. What happened and the outcome requested: ____________________
• Supply only relevant details through the approved secure channel. Filing a complaint will not result in retaliation. You may also contact HHS OCR (opens in a new tab) directly.
• [ ] Other request, including withdrawal of a permission or deletion inquiry: ____________________
• HIPAA does not create a general right to delete medical records. We will review any applicable deletion right and retention requirement and explain the outcome. Use document 03 for a release-authorization revocation if convenient; another valid written revocation is accepted.

Signature, when required for the requested action: ____________________ Date: __________
Printed name/representative authority: ____________________

What happens next

We verify identity and representative authority as needed, route the request to the responsible organization, and apply the relevant legal requirements. We explain any lawful denial, fees, extension and available review/disagreement rights. The published provider notice explains the federal time periods. Routing between CLEAR SYNC and a provider must not be used to restart or evade an applicable deadline.

Staff processing record

Request ID: __________ Received date/time: __________ Receiving organization: __________
Identity/authority verification method: __________ Responsible decision-maker: __________
Scope clarified, if necessary: __________ Applicable law and due date calculated by: __________
Acknowledgment/help provided: __________ Custodian/BA task handoff and original receipt date: __________

Decision, legal basis and records covered: ____________________
Fee estimate/choice, if allowed: ____________________
Extension permitted? Basis, timely written notice and new date: ____________________
Completed delivery destination/method/date: ____________________
Denial/review/disagreement/complaint information supplied when applicable: ____________________
Request, response and evidence retention location: ____________________

Implementation: provide a way to submit without an active paid membership; preserve access to past records when new services are gated. Verify the current right-of-access rules for third-party delivery, including the scope of the Ciox court decision, instead of treating every third-party request as ordinary patient access or every access request as an optional authorization. Never demand an explanation for access, a waiver, or unrelated signatures.

Sources: HHS patient rights (opens in a new tab); amendment rule (opens in a new tab); accounting rule (opens in a new tab). See document 09 for the operational deadline baseline.