Notice of Privacy Practices

Munish Lal MD PC / Interventional Spine Institute
Effective date: October 27, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice applies to protected health information maintained by Munish Lal MD PC / Interventional Spine Institute. It explains your privacy rights, our responsibilities, and how information about your care may be used or disclosed. Separate healthcare facilities and other providers may have their own privacy notices.

Questions and privacy requests

Contact our Practice Privacy Contact at (424) 254-3592 or admin@munishlalmd.com to ask about this notice, exercise a right described below, or make a privacy complaint. We may need to verify your identity. Please do not send medical records or sensitive health details through a general website inquiry form; ask us how to provide them securely.

Your rights

• Inspect or obtain your records. You may request access to, or an electronic or paper copy of, medical records and other information in the records used to make decisions about you. We will respond within the time required by applicable law. A lawful, reasonable cost-based fee may apply. If access is denied, we will explain the reason and any review rights.
• Request a correction. You may ask us to amend information you believe is inaccurate or incomplete. We may require a written request and explanation. If we deny it, we will explain why in writing and explain how you may submit a statement of disagreement.
• Request confidential communications. You may ask us to contact you in a particular way or at a different location. We will accommodate reasonable requests.
• Request limits on use or disclosure. You may ask us to restrict information used or shared for treatment, payment, or healthcare operations. We generally do not have to agree. However, if you pay for a healthcare item or service out of pocket in full, we must honor your request not to disclose the related information to your health plan for payment or healthcare operations, unless disclosure is required by law. Agreed restrictions may have an emergency-treatment exception.
• Request an accounting of disclosures. You may request a list of certain disclosures made during the preceding six years. The list generally excludes disclosures for treatment, payment, healthcare operations, and certain other legally excluded disclosures. One accounting in a 12-month period is free; a permitted fee may apply to additional requests.
• Receive a paper copy of this notice. You may request one at any time, including if you previously agreed to receive the notice electronically.
• Use a personal representative. A person legally authorized to act for you may exercise your rights, subject to applicable law. We will verify that authority.
• Make a complaint. You may complain to us or to the U.S. Department of Health and Human Services. We will not retaliate against you.

How we may use and disclose your information

The following permissions are subject to applicable federal and California law, including laws that provide greater confidentiality protections. We meet the legal conditions for a disclosure before making it.

• Treatment. We may use information to provide or coordinate your care and share it with professionals treating you. For example, we may discuss your condition with a referring physician or a clinician involved in your procedure.
• Payment. We may use or disclose information to bill for services and obtain payment. For example, we may provide your insurer with information needed to process a claim.
• Healthcare operations. We may use or disclose information to operate the practice, review care quality, and coordinate services. For example, we may review records to evaluate our care processes. Service providers working on our behalf must satisfy applicable privacy requirements.
• Communications about care. We may contact you about appointments, treatment, or related healthcare services, subject to applicable law and any agreed communication restrictions.
• People involved in your care and disaster relief. We may share relevant information with family, friends, or others involved in your care or payment when you agree or have an opportunity to object. If you cannot communicate your preference, we may use professional judgment when the law permits sharing in your best interests. Tell us your preferences.
• Public health and safety. Where authorized or required, disclosures may support disease prevention, product recalls, reporting of adverse reactions, reports of abuse or neglect, or efforts to prevent a serious and imminent threat.
• Research. Information may be used or disclosed for research only when applicable privacy requirements are met, such as an appropriate authorization or an authorized waiver.
• Legal and government purposes. Disclosures may be required or permitted for workers’ compensation, health oversight, specified law-enforcement activities, court or administrative proceedings, and certain military, national-security, or other government functions. A request alone does not automatically authorize disclosure.
• Other legally permitted purposes. Information may be disclosed to organ-procurement organizations, coroners, medical examiners, or funeral directors when the law permits. We also disclose information when required by law, including to HHS for a privacy-compliance review.

Uses requiring your written permission

Uses or disclosures not described in this notice require your written authorization unless otherwise permitted or required by law. Most uses and disclosures of psychotherapy notes, marketing uses, and sales of protected health information require authorization. You may revoke an authorization in writing, except to the extent we have already acted in reliance on it or another legal exception applies.

If we contact you for fundraising, you may opt out of further fundraising communications. If information protected by 42 CFR part 2 is involved, we will first provide a clear opportunity to choose not to receive those communications, as required by law.

Additional California protections

California law provides additional confidentiality protections for some information, including identifiable HIV test results, certain mental health records, and records of substance use disorder services. For information covered by these protections, we obtain the authorization required by California law unless a specific legal exception permits or requires disclosure. For example, a general permission under HIPAA does not by itself override a stricter California consent requirement.

California law also gives minors confidentiality rights for certain services they may legally consent to themselves. When those protections apply, a parent or guardian does not automatically have access to the related information. We follow the applicable limits and exceptions when responding to an access or disclosure request.

Additional protection for substance use disorder records

If we receive or maintain substance use disorder treatment records protected by 42 CFR part 2, additional federal restrictions apply. Those records, or testimony describing their contents, may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your written consent or a qualifying court order issued after the required notice and opportunity to be heard. An order authorizing disclosure must also be accompanied by a subpoena or other legal requirement compelling disclosure.

We obtain any additional consent required by Part 2 and follow its limits when using or disclosing protected records. This section describes privacy protections; it does not describe services offered by the practice.

Information disclosed to others

Information lawfully disclosed under HIPAA may be disclosed again by the recipient and may no longer be protected by HIPAA. Other laws, including Part 2 and applicable California confidentiality laws, may continue to protect particular information.

Our responsibilities

• We are required by law to maintain the privacy of protected health information, provide this notice, and follow the notice currently in effect.
• We must notify affected individuals following a breach of unsecured protected health information as required by law.
• We apply any additional protections required by applicable law.

Complaints

You may make a complaint to our Practice Privacy Contact using the phone number or email above. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/hipaa/filing-a-complaint, by calling 1-877-696-6775, or by writing to 200 Independence Avenue SW, Washington, DC 20201. You do not have to complain to us first. We will not retaliate against you for filing a complaint.

Changes to this notice

We may revise this notice as permitted by law and make a revised notice apply to information we already maintain as well as information received later. The current notice will be posted on this website and will be available from the practice upon request. A revised notice will show its effective date.