Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.

Effective September 19, 2026

This notice applies to Holistic Medical Services United, LLC and to Shumeka Hill, DNP, PMHNP-BC, FNP-BC, CPNP-AC, LCDC II, who provides care through it. We are required by law to keep your health information private, to give you this notice explaining our legal duties and privacy practices, and to follow the terms of the notice in effect at the time.

In short

• We use your health information to treat you, to run the practice, and to get paid. We are self-pay, so we do not send anything to an insurer.
• Records of substance use treatment carry stricter federal protection than the rest of your record, and generally cannot be shared without your written permission.
• You can see your record, ask us to correct it, ask us to limit what we share, and ask us to contact you a particular way.
• You can complain to us or directly to the federal government, and we will not retaliate.

How We Use and Share Your Information

To treat you

We use your information to provide your care, and we share it with others involved in that care — for example, sending a prescription to your pharmacy, ordering laboratory tests, or coordinating with another provider you have asked us to speak to.

To run the practice

We use your information to schedule appointments, keep records, train and supervise, review the quality of care, and manage the day-to-day business of the practice.

To bill you

We use your information to charge for your care and to process payments. We are a self-pay practice: we do not bill insurance, submit claims, or verify coverage. If you ask us for an itemized receipt to submit to an insurer yourself, we will give you one, and what happens after that is between you and your insurer. See our Billing, Refund & Cancellation Policy.

With our vendors

We use outside companies for our electronic health record, scheduling, video visits and payments. Where a company handles your health information on our behalf, we are required to have a written Business Associate Agreement obliging them to protect it on the same terms we do.

When the law requires or permits it

In specific situations set out in law, we may use or share your information without your permission. These include:

• Public health activities, such as reporting a communicable disease or an adverse reaction to a medication
• Reporting suspected abuse, neglect or domestic violence, where the law requires or permits it
• Health oversight — audits, investigations and licensing activity by government agencies
• Responding to a court order, subpoena or other lawful process
• Certain law enforcement requests permitted by law
• Coroners, medical examiners and funeral directors, in the event of a death
• Preventing a serious and imminent threat to your health or safety, or to someone else's
• Workers' compensation claims, where the law requires
• Specialised government functions, including military and national security activities
• Research, where an ethics board has approved it and privacy protections are in place

Substance Use Treatment Records

If you receive treatment for a substance use disorder with us — including Suboxone treatment or addiction counseling — those records carry additional federal protection under 42 CFR Part 2, which is stricter than HIPAA on its own.

• We generally cannot tell anyone that you are a patient here for substance use treatment, or share those records, without your written consent — including to other healthcare providers, your family, or your employer.
• Your written consent tells us who may receive the information, what may be shared, and for how long. You can withdraw it at any time.
• Anyone who receives these records from us is told they may not pass them on again without your permission.
• These records generally cannot be used against you in a criminal investigation or prosecution without a court order that meets specific legal requirements. A subpoena alone is not enough.
• Limited exceptions exist — for example, a medical emergency, or a report of suspected child abuse or neglect where the law requires it.

Uses That Need Your Written Permission

Some uses always require your written authorization, which you can revoke at any time:

• Most sharing of psychotherapy notes
• Using or sharing your information for marketing
• Any sale of your information — something we do not do
• Most other uses not described in this notice

Your Rights

See and get a copy of your record

You can ask to see or get an electronic or paper copy of your medical and billing records. We will normally provide it within 30 days, and may charge a reasonable, cost-based fee.

Ask us to correct your record

If you think something in your record is wrong or incomplete, you can ask us to correct it. If we decline, we will explain why in writing, and you may submit a statement of disagreement to be kept with the record.

Ask us to limit what we share

You can ask us not to use or share information for treatment, payment or our operations. We are not required to agree, and will say so if we cannot.

Ask us to contact you a particular way

You can ask us to contact you at a specific phone number or address, or only through the patient portal. We will accommodate reasonable requests, and you do not have to give a reason.

Get a list of who we have shared with

You can ask for an accounting of certain disclosures we have made in the six years before your request, excluding disclosures for treatment, payment and operations, and those you authorized.

Get a paper copy of this notice

You can ask for a paper copy at any time, even if you agreed to receive it electronically, and we will give you one promptly.

Choose someone to act for you

If someone holds medical power of attorney or is your legal guardian, they can exercise these rights on your behalf. We will confirm their authority before acting.

Be told if your information is breached

We will notify you if a breach occurs that compromises the privacy or security of your information.

Our Responsibilities

• We are required by law to protect the privacy and security of your health information.
• We will let you know promptly if a breach occurs that may have compromised it.
• We must follow the terms of the notice currently in effect, and give you a copy.
• We will not use or share your information other than as described here, unless you tell us in writing that we may. If you change your mind, you can tell us in writing at any time.
• Care is delivered by telehealth. You should be somewhere private for your appointment — we cannot control who is within earshot at your end. See our Consent to Telehealth Services.

We are licensed in 23 states, and some of them give you stronger privacy protection than federal law does. Where that is the case, the stronger protection applies.

Complaints

If you believe your privacy rights have been violated, you can complain to us at Hello@holisticmedunited.com or by calling 888-391-0272, Monday to Friday, 9:30 AM to 5:30 PM Eastern.

You can also complain directly to the U.S. Department of Health and Human Services, Office for Civil Rights — 200 Independence Avenue SW, Washington, D.C. 20201; 1-877-696-6775; or online at hhs.gov/hipaa/filing-a-complaint.

We will not retaliate against you for making a complaint.

Changes to This Notice

We can change this notice, and the changes will apply to all the information we hold about you. The revised notice will be posted on this page with a new effective date, and will be available on request.