Radiology Center at Harding

Notice of Privacy Practices

Your Information. Your Rights. Our Responsibilities.

Effective Date: August 7, 2026

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Radiology Center at Harding (the “Center,” “we,” “us,” or “our”) is a New Jersey licensed outpatient diagnostic imaging facility. This Notice explains our privacy practices for protected health information (“PHI”) that we create, receive, maintain, or transmit in connection with your care.

This Notice Covers

This Notice applies to health information maintained by the Center and its workforce in connection with MRI, CT, mammography and breast imaging, ultrasound, X-ray, DEXA/bone density, and related diagnostic imaging services. It includes, when applicable, physician orders and referrals; medical histories and screening questionnaires; images and imaging reports; contrast-related information; scheduling and registration information; insurance, authorization, billing and collection records; and communications about your care.

• Electronic information may be maintained in radiology information systems (RIS), picture archiving and communication systems (PACS), electronic medical/health record systems, secure portals, billing systems, and other approved electronic systems.
• Independent physicians, interpreting radiology groups, referring providers, laboratories, hospitals, or other organizations may have their own privacy notices when they are separate covered entities.

Privacy Officer / Contact

At a Glance

1.Your Rights

When it comes to your health information, you have certain rights. We will help you exercise these rights as required by federal and New Jersey law.

Get an Electronic or Paper Copy of Your Medical Record

• You may ask to see or obtain an electronic or paper copy of your medical record and other PHI in a designated record set, including imaging reports and images when applicable. Ask us how to submit your request.
• We generally will provide a copy or a summary within 30 days of your request, subject to limited extensions or exceptions permitted by law.
• Fees will be limited to the amount permitted by applicable law. For HIPAA access requests, fees must comply with HIPAA’s reasonable, cost-based limits; New Jersey requirements will also be applied when they provide additional protection.

Ask Us to Correct or Amend Your Medical Record

• You may ask us in writing to correct or amend information you believe is incorrect or incomplete.
• We may deny the request for reasons permitted by law. If we do, we will explain the denial in writing, generally within 60 days, and tell you about any further rights you may have.

Request Confidential Communications

• You may ask us to contact you in a specific way or at a specific location, such as only at a particular telephone number, by mail to another address, or through another reasonable method.
• We will accommodate reasonable requests as required by law. You do not have to tell us why you are making the request.

Ask Us to Limit What We Use or Share

• You may ask us not to use or share certain PHI for treatment, payment, or health care operations. We are not always required to agree. If we agree, we will follow the restriction except when disclosure is needed for emergency treatment or another law permits or requires disclosure.
• If you pay in full out of pocket for a specific service or item, you may ask us not to disclose information about that service to your health plan for payment or health care operations. We will agree unless a law requires us to make the disclosure.

Receive an Accounting of Certain Disclosures

• You may ask for an accounting of certain disclosures of your PHI made during the six years before your request, including who received the information and why.
• The accounting generally does not include disclosures for treatment, payment, or health care operations; disclosures to you; disclosures you authorized; and certain other disclosures excluded by law.
• We will provide one accounting in a 12-month period without charge. A reasonable, cost-based fee may apply to additional requests as permitted by law.

Get a Paper Copy of This Notice

• You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically. We will provide it promptly.

Choose Someone to Act for You

• A person who is legally authorized to act as your personal representative may exercise your privacy rights and make choices about your PHI, subject to applicable law.
• We may verify the person’s authority before acting on a request.

2.Your Choices

For certain health information, you can tell us your preferences about what we share. Tell us what you want us to do, and we will follow your instructions when the law requires us to do so.

Family, Friends, Caregivers, and Others Involved in Your Care

• You may tell us whether we may share relevant information with a family member, close friend, caregiver, or another person involved in your care or payment for your care.
• If you cannot tell us your preference, such as in an emergency or when you are incapacitated, we may share limited information when we reasonably believe it is in your best interest and the law permits it.

Disaster Relief and Serious Threats

• We may share limited information with disaster-relief organizations or others assisting during an emergency when permitted by law.
• We may use or disclose information when necessary and permitted by law to prevent or lessen a serious and imminent threat to health or safety.

Marketing, Sale of PHI, and Psychotherapy Notes

• We will obtain your written authorization before using or disclosing PHI for marketing when HIPAA requires authorization.
• We will not sell your PHI without the written authorization required by law.
• Most uses and disclosures of psychotherapy notes require written authorization. Diagnostic imaging services do not ordinarily create psychotherapy notes, but these protections apply if we ever maintain such notes.

Fundraising

• The Center does not currently use PHI for fundraising. If that practice changes, any fundraising communication will include the opt-out rights required by law. Part 2 records receive additional protections described later in this Notice.

Appointment Reminders, Text Messages, Email, and Other Communications

• We may contact you by telephone, voicemail, text/SMS, email, portal message, or mail for appointment reminders, scheduling, preparation instructions, follow-up, account balance notices, payment matters, or other health care communications, as permitted by law.
• We may leave limited messages when reasonable. You may request a reasonable alternative method or location for communications by contacting the Privacy Officer.
• We use reasonable safeguards for electronic communications, but ordinary text messages and email may have privacy or security risks outside our systems. Ask us about available communication options if you have concerns.

Other Uses Requiring Authorization

Uses and disclosures not described in this Notice will be made only with your written authorization when authorization is required. You may revoke a valid authorization in writing at any time, except to the extent we have already acted in reliance on it or another legal exception applies.

3.How We Typically Use and Disclose Your Health Information

We may use and disclose PHI without your written authorization for treatment, payment, and health care operations, and for other purposes permitted or required by law. We apply the minimum-necessary standard when it is required.

Treatment and Care Coordination

• We may use and share PHI with radiologists, referring physicians, specialists, hospitals, imaging providers, technologists, nurses, advanced practice clinicians, laboratories, and other professionals involved in your care.
• Example: We may receive an imaging order and clinical history from your referring provider, perform an MRI, CT, mammogram, ultrasound, X-ray, DEXA or other imaging exam, and send the images and report to the provider involved in your treatment.
• We may obtain or exchange prior images and reports for comparison, communicate important findings to appropriate clinicians, and coordinate follow-up care when permitted by law.

Payment, Billing, and Collections

• We may use and disclose PHI to verify insurance eligibility and benefits, obtain prior authorization, submit claims, coordinate benefits, respond to payer requests, appeal coverage or payment decisions, collect copayments, deductibles and other patient balances, and perform other payment activities.
• We may share the minimum information permitted by law with health plans, Medicare or Medicaid, billing companies, clearinghouses, payment processors, attorneys, collection agencies, or other entities involved in lawful payment and collection activities.
• If you pay in full out of pocket and request the health-plan restriction described in Section 1, we will honor that restriction unless disclosure is required by law.

Health Care Operations

• We may use and disclose PHI to run the Center, improve quality and patient safety, conduct peer review and quality assurance, train staff, manage scheduling and workflow, audit compliance, investigate complaints, manage risk, and conduct business planning.
• We may use PHI for accreditation, licensing, inspection, equipment quality control, clinical quality programs, and regulatory compliance related to MRI, CT, mammography, ultrasound, X-ray, DEXA and other services.
• We may disclose PHI to business associates that perform services for us, such as billing, IT, RIS/PACS or image storage, electronic record systems, secure image exchange, cloud or data hosting, document storage, shredding, courier, legal, accounting, consulting, and collection services. Business associates must protect PHI as required by law.

Electronic Records and Electronic Exchange

• Your images, reports and related records may be created, stored, accessed, transmitted, or exchanged electronically through approved systems, secure portals, direct electronic exchange, or other health information networks when applicable and permitted by law.
• Electronic exchange may be used to send results to referring providers, obtain prior imaging, support continuity of care, submit claims, and carry out other permitted treatment, payment, or health care operations.

4.Other Uses and Disclosures Permitted or Required by Law

We may use or disclose PHI for the following purposes when the legal requirements for the disclosure are satisfied:

• Public Health and Safety: To prevent or control disease; report certain injuries, conditions, adverse events, product problems, or suspected abuse or neglect; assist with recalls; or reduce a serious threat to health or safety.
• Research: For approved research when an authorization, waiver, limited-data arrangement, or other legal permission applies.
• Required by Law: When federal, state, or local law requires the use or disclosure, including disclosures to the U.S. Department of Health and Human Services for HIPAA compliance review.
• Health Oversight: To health oversight agencies for audits, inspections, licensure, accreditation, investigations, or other activities authorized by law.
• Workers’ Compensation: For workers’ compensation and similar programs as authorized by law.
• Law Enforcement: For law-enforcement purposes when the applicable legal requirements are satisfied.
• Judicial and Administrative Proceedings: In response to a court or administrative order, subpoena, discovery request, or other lawful process when applicable legal requirements are met.
• Coroners, Medical Examiners, and Funeral Directors: To identify a deceased person, determine cause of death, or enable lawful duties.
• Organ and Tissue Donation: To organ procurement or similar organizations for lawful donation and transplantation activities.
• Special Government Functions: For certain military, national security, protective services, correctional institution, or other governmental functions authorized by law.

Incidental Disclosures

• A limited incidental disclosure may occur as a by-product of an otherwise permitted use or disclosure. We use reasonable safeguards to reduce unnecessary exposure of PHI.

Uses and Disclosures More Protective Than HIPAA

• If another federal or New Jersey law gives your information greater privacy protection than HIPAA, we will follow the more protective requirement to the extent it applies.

5.Substance Use Disorder Records Protected by 42 CFR Part 2

Certain records concerning substance use disorder (“SUD”) diagnosis, treatment, or referral for treatment may be protected by the special federal confidentiality rules in 42 CFR Part 2. Radiology Center at Harding is not describing itself in this Notice as a Part 2 treatment program; however, the Center may receive or maintain Part 2-protected information in connection with your imaging care.

• To the extent we create, receive, or maintain SUD patient records that are subject to 42 CFR Part 2, we will use and disclose those records only as permitted by Part 2, HIPAA, and other applicable law.
• We will not use or disclose Part 2-protected SUD records, or testimony relaying the content of those records, in a civil, criminal, administrative, or legislative investigation or proceeding against you unless the use or disclosure is based on your written consent or is authorized by a qualifying court order and accompanied by a subpoena or other legal requirement compelling disclosure, as required by Part 2.
• If Part 2 requires a specific consent, separate consent, notice, opt-out opportunity, breach notification, or other safeguard, we will follow that requirement.
• If we ever use Part 2 records for fundraising, you will first be given the clear and conspicuous opportunity to elect not to receive those fundraising communications, as required by law.

6.New Jersey-Specific Privacy and Medical Record Protections

Because the Center is a New Jersey licensed ambulatory care facility, New Jersey requirements may supplement HIPAA. Among the protections relevant to our operations:

• Confidentiality and privacy. New Jersey ambulatory care patient-rights rules protect confidential treatment of patient information and recognize the patient’s right to privacy, including auditory and visual privacy.
• Medical record safeguards. The Center maintains policies intended to protect medical record information from loss, tampering, alteration, destruction, and unauthorized use.
• Written consent and legally permitted releases. We obtain patient written consent for release of medical record information when New Jersey law requires it, while also making disclosures that are permitted or required by federal or state law, including certain treatment, payment, oversight, transfer, peer review, and other lawful disclosures.
• Access and copies. New Jersey ambulatory care rules generally require a copy of an individual admission record to be provided within 30 days of a proper written request. We will also comply with HIPAA access requirements and any shorter or more protective requirement that applies.
• Fees. We charge only fees permitted by applicable law. When HIPAA’s reasonable, cost-based fee limits apply to an individual access request, we will comply with those limits even if a different state fee schedule might otherwise permit a higher charge.
• Facility complaints. You may contact the New Jersey Department of Health, Division of Health Facility Survey and Field Operations, PO Box 367, Trenton, NJ 08625-0367. The health care facility complaint hotline is 1-800-792-9770.

7.Our Responsibilities

• We are required by law to maintain the privacy and security of your PHI and to provide you with notice of our legal duties and privacy practices.
• We must follow the duties and privacy practices described in the Notice currently in effect.
• We use administrative, physical, and technical safeguards appropriate to our operations to protect PHI, including electronic imaging and medical information.
• If a breach of unsecured PHI occurs and the law requires notice to you, we will notify you without unreasonable delay and in accordance with applicable HIPAA, HITECH, Part 2, and other breach-notification requirements.
• We will not use or disclose your information other than as described in this Notice unless you authorize us in writing or another law permits or requires the use or disclosure. You may revoke an authorization in writing as described in this Notice.

Changes to This Notice

We may change the terms of this Notice and make the revised terms effective for all PHI we maintain, including PHI created or received before the revision. If we materially change our privacy practices, we will revise this Notice. The current Notice will be available upon request, at the Center, and on our website as required by law.

Questions or HIPAA / Part 2 Privacy Complaints

• Contact our Privacy Officer using the information on this page if you have questions, wish to exercise a privacy right, or believe your privacy rights have been violated.
• You may also file a HIPAA or Part 2 complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR), 200 Independence Avenue, S.W., Washington, DC 20201; telephone 1-877-696-6775; or online at https://www.hhs.gov/hipaa/filing-a-complaint/.
• We will not retaliate against you for filing a complaint, exercising a privacy right, or declining to sign the acknowledgment of receipt.

How We Provide This Notice

• We will provide this Notice no later than the date of first service delivery to a patient with whom we have a direct treatment relationship, except in an emergency treatment situation, when it will be provided as soon as reasonably practicable afterward.
• We make a good-faith effort to obtain written acknowledgment that the Notice was received. Your signature acknowledges receipt only; it does not authorize special uses or disclosures of your health information.
• We keep the current Notice available at the facility, post it in a clear and prominent location, and make it available on our website as required by law.

Radiology Center at Harding  |  1201 Mount Kemble Avenue, Morristown, NJ 07960  |  908-221-0603  |  hardingradiology.com