Effective Date: July 13, 2026
Notice of HIPAA Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USEDAND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.PLEASE REVIEW IT CAREFULLY.
Entities and Individuals Covered by this Notice
This Notice describes the privacy practices of the following covered entities that providehealth care services under the Abby Care name (each an "Abby Care Provider Entity" andtogether the “Abby Care Provider Entities”):- Elite Staffing Services Inc.- First Choice Home Health Care Services LLC- Innovative Care LLC- Pinnacle Homecare Services LLC- Artemis Home Care LLC- Just CNA LLC- High Priority Inc.- Abby Care Tennessee LLC- Abby Care Georgia LLC- Elderly Care Companion Services LLCThe Abby Care Provider Entities listed above participate in an Organized Health CareArrangement (“OHCA”). This means that we work together as an integrated healthcaredelivery system to coordinate your care and manage our joint operations. As a part of thisOHCA, the Abby Care Provider Entities may share your protected health information witheach other as necessary to carry out treatment, billing and payment, or healthcareoperations relating to the OHCA. This joint arrangement allows us to provide you withcoordinated, high-quality health care services across our system.Throughout this Notice, when we say "Abby Care," "we," "our," or "us," we are referring tothe Abby Care Provider Entities listed above. Wellspring Care Inc. (doing business as AbbyCare) provides services to support the Abby Care Provider Entities. These services includeadministrative support, information technology, compliance, billing, and other operationalfunctions. Wellspring Care Inc. is a Business Associate of the Abby Care Provider Entitiesand is required by contract and federal law to protect your information in accordance withHIPAA regulations.
Information Covered by This Notice
This Notice describes the information privacy practices that each of the following willfollow:• Any health care professional who provides services to you through the Abby CareProvider Entities;• All departments and units of the Abby Care Provider Entities;• All employees, contractors, and volunteers of the Abby Care Provider Entities,including those at regional offices and service locations.These individuals and entities may share your health information with each other fortreatment, payment, or health care operations purposes as described in this Notice. Wealso use and disclose your health information for other reasons as permitted or required bylaw.IMPORTANT: Your personal physician and other health care providers outside of the AbbyCare Provider Entities have their own privacy practices and notices. This Notice does notapply to them.If you have any questions about this Notice, you may contact us in any of the mannersdescribed at the end of this Notice. We are happy to explain this Notice to you or yourfamily members. A copy is always available at www.abbycare.org/hipaa or by request atany Abby Care service location.When we receive information in connection with the health care services we provide thatrelates to your past, present, or future physical or mental health or condition, to theprovision of health care to you, or to your past, present, or future payment for health care,that information is considered “protected health information” or “PHI” under HIPAA, andthis Notice applies to that information. In other circumstances, the information that wereceive from you may not relate to your health or health care. In those circumstances, wekeep any personal information that we collect from you safe, private, and confidentialunder the terms of our Privacy Policy. In either situation, as further described in ourPrivacy Policy, we will not rent or sell your personal information or Protected HealthInformation, and we will not permit our business partners to rent or sell your personalinformation or Protected Health Information either.
Our Commitment to Your Privacy
We understand that health information about you is private and personal. We arededicated to maintaining the privacy and integrity of the PHI that we receive from you aspart of your application for or participation in our health care services.We are required by law to maintain the privacy of your PHI and to provide you with noticeof our legal duties and privacy practices related to that information. When we use ordisclose your PHI, we are required to abide by the terms of this Notice (or any other Noticein effect at the time of the use or disclosure). We will let you know promptly in the eventthat a breach occurs that may have compromised the privacy or security of your PHI.
How We May Use and Disclose Protected Health Information About You
Below, we describe different ways that we may use your PHI amongst ourselves and wayswe may disclose your PHI to other persons and entities. We have not listed every possibleuse or disclosure in the list below, but all of the ways that we may use and disclose PHI fallwithin one of the categories below. As we describe below, some uses and disclosures willrequire your specific authorization.The list below includes examples of ways that we may disclose PHI about you without awritten authorization from you.• Treatment. We may use your PHI and disclose it to a physician or otherhealth care provider to provide treatment and other services to you. Forexample, we may disclose your health information to your physician sothat he or she may monitor your health information while receivinghealth care services through the Abby Care program.• Payment. We may use and disclose your PHI to obtain payment for theservices that we provide to you. For example, we may disclose certainPHI to claim and obtain payment from your health insurer, your HMO,or any other company that arranges for or pays the cost of your healthcare (“Your Payor”) or to verify that Your Payor will pay for that healthcare.• Our Health Care Operations. We may use and disclose your PHI forour health care operations. Examples of our health care operationsinclude training clinical personnel, improving the operation of the AbbyCare Services, and other internal management functions such as legaland audit processes.• Health Care Operations of Other Covered Entities. We are alsopermitted to share PHI about you with other covered entities that havea relationship with you (including, in some circumstances, youremployer’s health plan, your health insurer, or other health careproviders) for their health care operations and to certain companies thatprovide those covered entities with services as their businessassociates. For example, we might share PHI about you with yourphysician’s office to enable the physician to demonstrate to thegovernment that the physician referred you to a particular program andhow that program is working for you. Other examples of anothercovered entity’s health care operations may include using PHI aboutyou for quality assessment activities, for disease managementprograms, or to improve quality of care.• Disclosure at Your Request. If you ask us to send PHI about you to athird party, such as a friend, family member, or health care provider, wewill do so if we believe that your request is authentic. We may ask youto prove your identity before we honor this request. We may need up to60 days to honor a request like this, depending on the data that youwould like us to disclose, but in most cases, we can honor this requestin 30 or fewer days.• Business Associates. We provide some aspects of our health careservices through contracts with business associates for whom we arelegally responsible. Examples of our business associates includecompanies for secure cloud hosting, management consultants, qualityassurance reviewers, accreditation agencies, and billing and collectionservices. We may disclose your PHI to our business associates so thatthey can perform the jobs that we have asked them to perform. Toprotect your PHI, we require our business associates to sign writtenagreements requiring that they appropriately safeguard your PHI anduse it only as we permit.For certain health information, you can tell us your choices about what we share. Ifyou have a clear preference for how we share your information in the situationsdescribed below, talk to us. Tell us what you want us to do, and we will follow yourinstructions.• Share information with your family, close friends, or others involved inyour care• Share information in a disaster relief situationIf you are not able to tell us your preference, for example if you areunconscious, we may go ahead and share your information if we believe it isin your best interest. We may also share your information when needed tolessen a serious and imminent threat to health or safety.• Health Information Exchange. We may use and disclose your PHI as part of aHealth Information Exchange (HIE) so that we can exchange additional PHIabout you with other healthcare organizations for treatment, payment, and/orhealth care operations purposes.
Additional Special Situations That Do Not Require YourAuthorization
The following categories describe some additional circumstances in which we may use ordisclose your PHI without your authorization. For disclosures such as these, theinformation, once disclosed, may be used and redisclosed by the recipient and,accordingly, no longer protected by HIPAA.• Public Health Activities. We can share health information about you for certainsituations such as:• Preventing disease• Helping with product recalls• Reporting adverse reactions to medications• Reporting suspected abuse, neglect, or domestic violence• Preventing or reducing a serious threat to anyone’s health or safety• Health Oversight Activities. We may disclose your PHI to a health oversightagency for activities authorized by law. One example of a health oversightagency is a state health insurance regulator or Medicaid program. Theseoversight activities include, for example, audits, investigations, inspections,licensure, and other activities necessary for the government to monitor the healthcare system, government programs, and compliance with civil rights laws.• Lawsuits and Other Legal Disputes. We may use and disclose PHI in respondingto a court or administrative order, a subpoena, or a discovery request. We mayalso use and disclose your PHI without your authorization to the extent permittedby law in any other way related to our legal disputes, such as to defend against alawsuit or in arbitration.• Law Enforcement Officials. We may disclose your PHI to the police or other lawenforcement officials as required or permitted by law.• Comply with Law. We will share information about you if state or federal lawsrequire it, including with the Department of Health and Human Services if it wantsto see that we’re complying with federal privacy law.• Coroners and Medical Examiners. We may disclose your PHI to a coroner ormedical examiner as authorized by law.• Organ and Tissue Donation. We may disclose your PHI to organizations thatfacilitate organ, eye, or tissue procurement, tissue banking, or transplantation.• Research. We can use or share your information for health research.• Specialized Government Functions. We may use and disclose your PHI to unitsof the government with special functions, such as the U.S. military or the U.S.Department of State, under certain circumstances.• Correctional Institutions. If you are or become an inmate of a correctionalinstitution, we may disclose to the institution, or its agents, PHI necessary foryour health and the health and safety of other individuals.• Workers’ Compensation. We may disclose your PHI as authorized by and to theextent necessary to comply with state laws relating to workers’ compensation orother similar programs.
Restrictions on Certain Types of Information
In some cases, state laws provide special protections for, and may restrict the use ordisclosure of, certain kinds of PHI. For example, additional protections may apply in somestates to genetic, mental health, biometric, minors, prescriptions, sexually transmitteddisease and/or HIV/AIDS-related information. In these situations, we will comply with themore stringent applicable laws pertaining to such use or disclosure.Some of your health information may be protected by federal law under 42 CFR Part 2,which provides additional privacy protections for records related to substance use disorder(SUD) treatment. These protections apply in addition to HIPAA.If you have provided your written consent to a treating provider, and we receive SUDrecords through that consent, we may use and disclose those records for treatment,payment, and health care operations consistent with your consent. A single consent mayauthorize all future uses and disclosures for these purposes.We will not use or disclose your SUD records any civil, criminal, administrative, orlegislative proceedings against you, unless you consent or we have an order of a courtcompelling the disclosure and you have been provided with notice of the order.
Situations That Do Require Your Authorization
If we need to use your PHI for reasons that have not been described in the sections above,we will obtain your written permission, which is referred to as a written “authorization.” Ifyou authorize us to use or disclose PHI about you, you may revoke that authorization inwriting at any time. If you revoke your authorization, we will no longer use or disclose PHIabout you for the reasons stated in that written authorization, except to the extent we havealready acted in reliance on your authorization. Any revocation of an authorization appliesonly to what you or your representative had authorized and does not apply to the situationsabove where we are permitted to use or disclose PHI about you without an authorization.You understand that we are unable to take back any disclosures that we have alreadymade with your permission and that we are required to retain our records of the care we provide to you.
Your Rights Regarding Your PHI
You have the following rights regarding PHI that we maintain about you. You may contactus to obtain additional information and instructions for exercising these rights in any of themanners described at the end of this Notice.• Right to Request Additional Restrictions. You may request restrictions on our useand disclosure of your PHI for treatment, payment, and health care operations.While we will consider all requests for additional restrictions carefully, we are notrequired to agree to a requested restriction (except where you request that wenot disclose PHI to a health plan, and the PHI relates solely to a health care itemor service for which you personally have paid in full).• Right to Receive Confidential Communications. You may request to receive yourPHI by alternative means of communication or at alternative locations. Forexample, you can request that we only contact you at work or by mail. To requestconfidential communications, you must make your request in writing. We will notask you for the reason for your request. We will accommodate all reasonablerequests. Your request must specify how or where you wish to be contacted. Wenote, however, that because our Health Care Services work best through anonline digital platform, a request for alternative communications may negativelyimpact how you experience the Health Care Services.• Copies of Your Records. You have an absolute right to obtain copies of the PHIabout you that we collect and use in the normal course of providing health careservices to you. You do not have a right to obtain copies of PHI in researchdatabases or in data sets that we use to study and improve the quality of ourbusiness, to train our employees, or to manage the legal and financial aspects ofour business.• We require that you make any request to obtain a copy of PHI aboutyou in a manner that we can reliably conclude is authentic. You mayrequest a copy of PHI about you in writing on paper, via an email wherewe have the means to confirm your identity, or throughcontacting privacy@abbycare.org in a manner that allows our supportteam to confirm your identity. If you would like your attorney or otherlegal representative to request PHI about you on your behalf, he or shemust request the copy in writing as we have not issued any digitalidentity credentials to your representatives. We reserve the right toreject an online request as inauthentic.• Once we receive your authentic request, we will determine if theinformation that you have requested is easily available to you throughyour account with us, and we may instruct you how to access it. Ifproviding the requested information entails more work from us, we willhave up to 30 days to complete that work, which we may extend byanother 30 days if necessary to prepare the data.• Once we receive your authentic request, we also will discuss with youthe form and format in which you would like to receive the information,among those that we offer. For example, we will discuss with youwhether you would like the information printed or in a securespreadsheet. We will also discuss with you how to deliver theinformation. We are obliged to send PHI securely, and we do not allowthe copying of PHI onto mobile storage devices like thumb-drives inorder to protect the security of our systems.• We will provide (or transmit at your request) one copy of your PHI percalendar year at no cost to you. If you request more than one copy percalendar year, we may charge you for copying andmailing/transmission, and we will supply you with an estimate beforeproceeding.• Right to Amend Your Records. You have the right to request that we amend PHIthat we maintain about you. If you desire to amend your records, you mustsubmit your request in writing, which may include an email or a secure messagethat we believe is authentically from you. We will comply with your request unlesswe believe that the information that would be amended is already accurate andcomplete or other special circumstances apply. If we deny your request, you willbe permitted to submit a statement of disagreement for inclusion in your records.• Right to Receive an Accounting of Disclosures. You can request that we provideyou with an “accounting of disclosures,” which summarizes the people andorganizations outside of Abby Care to whom we have disclosed PHI about you(other than other covered entities that have a relationship with you and that havereceived PHI for permitted purposes as described above in this Notice). Youmust request any accounting of disclosures in writing and not by phone to ensurethat we have written records detailing your request. You may request anaccounting of disclosures in writing on paper, via an email where we have themeans to confirm your identity, or through contacting privacy@abbycare.org in amanner that allows our support team to confirm your identity. We reserve theright to reject an online request as inauthentic. By submitting a written request,you may obtain an accounting of certain disclosures of your PHI made by usduring any period of time within the six years preceding the date of your request.Your written request should indicate in which form you would like to receive thislist (e.g., on paper or electronically). We will provide (or transmit at your request)one accounting of disclosures per calendar year at no cost to you. If you requestmore than one accounting of disclosures per calendar year, we may charge youthe costs of fulfilling your request, and we will supply you with an estimate beforeproceeding.• Copy of this Notice. You are entitled to a copy of this Notice. You may obtain acopy of this Notice at our website: https://www.abbycare.org/hipaa. You mayprint out a paper copy of this Notice from our website at any time. You are alsoentitled to ask that we print this Notice and mail it to you. To receive a papercopy of this Notice from us, you may contact us in any of the manners describedat the end of this Notice.
Changes to this Notice
This Notice describes how we may access health information about you in compliance withHIPAA and how that information may be used in compliance with HIPAA. We are requiredto abide by the terms of the Notice that are currently in effect. We may prospectivelychange the terms of this Notice from time to time, but we may not change this Notice in away that would violate HIPAA. Changes will apply to PHI that we currently maintain as wellas new PHI that we receive after the change occurs. If we make material changes to ourprivacy practices, we will post the new Notice on our website athttps://www.abbycare.org/hipaa. To receive a paper copy of any revised Notice from us,you may contact us in any of the manners described at the end of this Notice.
Concerns or Complaints
If you desire further information about your privacy rights, if you are concerned that wehave violated your privacy rights, or if you disagree with a decision that we made aboutaccess to your PHI, you may contact our Privacy Officer in any of the manners describedat the end of this Notice. You also may send a written complaint to the U.S. Department ofHealth and Human Services, Office of Civil Rights (and we can provide you with theoffice’s current address) or your state board governing your treating health care provider.We will not take any action against you for filing a complaint.
How to Contact Us
If you would like more information about your privacy rights, please contact us by calling(855) 817-2229 and asking to speak with the Privacy Officer or byemailing privacy@abbycare.org. Please direct any written requests to Abby Care at: Wellspring Care Inc.
Attn: Privacy Officer
612 Howard Street, Suite 400
San Francisco, CA 94105
Version Effective: July 13, 2026
