Mammograms Save Lives

Schedule Your Screening Mammogram Now at Our Midtown location.

Click here to learn more about our in house mammogram services.

Book Online
BOOK appointment
TEXT US
Book Mammogram

Notice of Privacy Practices

HIPAA Privacy Policy Notice of Privacy Practices version 08/26/2026

THIS NOTICE DESCRIBES HOW YOUR HEALTH INFORMATION MAY BE USED AND DISCLOSED BY Maiden Lane Medical, PLLC and Downtown Medical Office Based Surgery, P.C. AND HOW YOU CAN GAIN ACCESS TO THIS INFORMATION. PLEASE REVIEW CAREFULLY. 

This notice applies to all records of your care generated by us and will be followed by our health care professionals, employees, medical staff, trainees, students, volunteers, and business associates.

UNDERSTANDING YOUR PROTECTED HEALTH INFORMATION (PHI): Understanding what is in your health record and how your health information is used will help you to ensure its accuracy, allow you to better understand who, what, when, where and why others may access your health information, and assist you in making more informed decisions when authorizing disclosure to others. When you visit us, we keep a record of your symptoms, examination, test results, diagnoses, treatment plan and other medical information. We also may obtain health records from other providers. In using and disclosing this protected health information (PHI), it is our objective to follow the Privacy Standards of the federal Health Insurance Portability and Accountability Act, 45 CFR Parts 160 and 164 The law allows us to use and disclose PHI without specific authorization for sharing of information, when necessary and appropriate, with other health care providers, hospitals, pharmacies, therapists and all treating physicians, as necessary for your continued care. It also includes contacting you for appointment reminders and follow-up care. All other uses and disclosures require your specific written authorization, and we will abide by special privacy protections that apply to mental health, substance abuse, sexually transmitted disease, psychotherapy, HIV/AIDS, genetic, and other highly sensitive or specially protected information, including restrictions under state law and limitations applicable to government health benefit program information. 

YOUR HEALTH INFORMATION RIGHTS ALLOW YOU TO:

  • Request a restriction on the uses and disclosures of PHI as described in this notice, although we are not required to always agree to the restriction you request. You also have the right to direct us not to share specific PHI with your insurance company if you plan to pay for a service personally without submitting a claim to your insurer, and it is your responsibility to inform other providers who may receive copies of your record that they may not share this PHI with your insurance company. You should address your request in writing to the Privacy Officer. We will notify you within 30 days if we cannot agree to the restriction. 
  • Obtain a paper copy of this Notice at any time, even if you agreed to receive it electronically, and upon written request, inspect and obtain an electronic or paper copy of your health record in the specific format you request if feasible, or in an alternative readable electronic format if the requested format is not readily producible, for a reasonable fee permitted by law,and direct us to transmit an electronic copy directly to another person or entity you designate. You are not always entitled to access, or to obtain a copy of, psychotherapy notes and information compiled for legal proceedings. If we deny access in whole or in part in circumstances that permit review, you may request review pursuant to a designated process.
  • Get an accounting of disclosures. You can request information as to how we have shared your health information for six years prior to the date of your request, who we shared it with, and why. We will include all disclosures except those for treatment, payment, and health care operations, and certain other disclosures as permitted by law. We will provide one accounting per year for free but may charge a reasonable fee if you request another accounting within 12 months.
  • Amend your health record by submitting a written request with the reasons supporting the request, subject to applicable exceptions, time frames, internal approval, and your right to submit a written statement of disagreement if we deny the request, which we will attach to your records and include with future disclosures of the disputed item if you clearly ask us in writing to do so.
  • Request in writing to the Privacy Officer that we communicate with you by a specific method and at a specific location, and we will agree to all reasonable requests. We will typically communicate with you in person, or by letter, email, fax and/or telephone. 
  • Revoke an authorization to use or disclose PHI at any time by notifying the Privacy Officer in writing, except to the extent we have already relied on the authorization. 
  • If someone has authority to act as your personal representative, such as a medical power of attorney or legal guardian, that person can exercise your rights and make choices about your health information, and we will take reasonable efforts to ensure the person has this authority before we take any action.

OUR RESPONSIBILITIES AS REQUIRED BY LAW:

  • Maintain the privacy and security of PHI and provide you with notice of our legal duties and privacy practices with respect to PHI.
  • We will let you know without unreasonable delay and no later than such period of time required by law if a breach occurs that may have compromised the privacy or security of your information, potentially even if an investigation is ongoing.
  • Abide by the terms of the notice currently in effect. We may change our policies at any time. When significant changes occur, we will change our notice of privacy practices and post the new notice. You may receive a copy of the current notice at any time. Copies of the notice will be available upon request each time you come to our office for treatment and on our website.  
  • Use or disclose your PHI other than for legally permitted purposes not requiring your consent, only with your written authorization except as described in this notice or as otherwise authorized by you, and if you authorize us, you may revoke that authorization in writing at any time except to the extent we have already relied on it, as we cannot take back disclosures already made with your authorization and must retain records of the care we provided to you. 
  • Follow the more stringent law in any circumstance where other state or federal law may further restrict the disclosure of your PHI.
  • In all cases, if we have substance use disorder patient records about you that are subject to 42 CFR Part 2, we will not use or share information in those records in civil, criminal, administrative, or legislative investigations or proceedings against you without (1) your written consent or (2) a court order and subpoena, and we will give you clear and obvious advance notice and a choice before using your Part 2 information for fundraising communications, and we will attach any required notice prohibiting redisclosure to records disclosed at your request.

FOR MORE INFORMATION OR TO REPORT A PROBLEM, CONTACT THE PRIVACY OFFICER AT:

Kenneth A. Levey MD MPH
90 Maiden Lane Suite 301 New York, NY 10038

If you feel your rights have been violated or disagree with a decision we made about access to your records, you may file a complaint in writing with the Privacy Officer or contact the Privacy Officer by telephone. If you are not satisfied with our response, you may send a written complaint to the U.S. Department of Health and Human Services Office for Civil Rights. Under no circumstances will you be penalized or subject to retaliation for filing a complaint. 

Treatment:
We will use and exchange information obtained by a physician, nurse practitioner, nurse or other medical professionals, staff, trainees, and volunteers in our office to determine your best course of treatment. The information obtained from you or from other providers will become part of your medical records, and a doctor treating you may ask another provider about your overall health condition. We may also disclose your PHI to other outside treatment medical professionals and staff as deemed necessary for your care, including through a Health Information Exchange or other electronic network only with your consent or as permitted by law, in an emergency, or as you otherwise direct. We may automatically send certain information about your care to the person who referred you to us. 

PAYMENT:
We may share information about you with an insurance company or third party for billing and payment purposes. We may send a bill to you or your insurance carrier. The information on or accompanying the bill may include information that identifies you, as well as that portion of your PHI necessary to obtain payment. 

HEALTH CARE OPERATIONS:
Members of the medical staff, trainees, medical students, a Risk or Quality improvement team, or similar internal personnel may use your information to run our practice, improve your care, contact you when necessary, assess the care and outcomes of your care, evaluate staff performance, combine information about patients to determine needed services and whether new treatments are effective, provide information to governmental or accreditation entities to maintain licenses and accreditations, in an effort to improve the quality of the healthcare and service we provide or for educational purposes.  There may also be times in which our accountants, auditors, health information specialists or attorneys may review your PHI to meet their responsibilities. 

OTHER USES AND DISCLOSURES NOT REQUIRING AUTHORIZATION:

  • Business Associates, Organized Health Care Arrangements, Incidental Uses, Limited Data Sets, and De-Identified Information: There are some services provided to our organization such as laboratory and radiology services. We may disclose your PHI to our business associates so that they can manage these services for or on behalf of us under agreements requiring them to appropriately safeguard your PHI. We may also share medical information with covered entities participating in any organized health care arrangement in which we participate as necessary for treatment, payment, or health care operations, make incidental uses or disclosures that occur as part of a permitted or required use or disclosure when appropriate safeguards are in place, use or disclose a limited data set for research, public health, or health care operations subject to applicable conditions, and create or use de-identified information that cannot identify you, in accordance with HIPAA. 
  • Notification:  At your direction, we may disclose limited PHI to friends, family members, or others involved in your care or payment for your care.  We may also notify a family member, or another person responsible for your care, about your location and general condition, including in a disaster relief situation, and if you are not able to tell us your preference, we may share information if we believe it is in your best interest or when needed to lessen a serious and imminent threat to health or safety. 
  • Legally Required Disclosures & Public Health:  We may disclose PHI as required by law, including to the Department of Health and Human Services if it wants to see that we are complying with federal privacy law, or in a variety of circumstances authorized by federal or state law, including public health and safety activities such as preventing disease, helping with product recalls, reporting adverse reactions to medications, reporting suspected abuse, neglect, or domestic violence, sharing information with a multidisciplinary personnel team relevant to prevention, identification, management, or treatment of abused children or elder abuse and neglect, and preventing or reducing a serious threat to anyone’s health or safety. 
  • Law Enforcement, Government Requests & Subpoenas: We may disclose PHI for workers’ compensation claims, to law enforcement or a law enforcement official, to health oversight agencies for activities authorized by law, and for special government functions such as military, national security, and presidential protective services, including limited information for identification and location purposes or information regarding suspected criminal activity, including crimes committed on our premises. We may also disclose PHI to others in the course of judicial or administrative proceedings as required by court or administrative order, or in response to a valid summons, subpoena, discovery request, or other lawful process, subject to applicable legal requirements. 
  • Information Regarding Decedents: We may disclose health information regarding a deceased person to: 1) coroners and medical examiners to in identify cause of death or other duties, 2) funeral directors for their required duties and 3) to procurement organizations for the purposes of organ and tissue donation. 
  • Research: We may also disclose PHI where the disclosure is solely for the purpose of designing a study, or where the disclosure concerns decedents, or an institutional review board or privacy board has determined that obtaining authorization is not feasible and protocols are in place to ensure the privacy of your health information. In all other situations, we may only disclose PHI for research purposes with your authorization. 
  • Marketing and Fundraising: We may contact you with information about treatment alternatives or other health-related benefits and services that may be of interest to you, but if we are paid to send you treatment information, we will tell you that and give you the right not to receive those communications, and we will not use or disclose your PHI for marketing purposes, sell your information, or share most psychotherapy notes unless you give us written authorization. We may also contact you as part of a fundraising effort, but you can tell us not to contact you again, and if we have your substance use disorder patient records subject to 42 CFR Part 2, we will give you clear and obvious advance notice and a choice before using your Part 2 information for fundraising communications. 

DISCLOSURES REQUIRING AUTHORIZATION:
We will obtain your written authorization for uses and disclosures not described in this notice, including marketing purposes, the sale of your non-de-identified information, and most sharing of psychotherapy notes, and you may revoke that authorization in writing at any time except to the extent we have already relied on it.