Your Information. Your Rights. Our Responsibilities.
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
Effective Date: November 1, 2026
Wellness Merge Physical Therapy, 903 Nissley Rd, Lancaster, PA 17601 • Phone: 717-686-0681 • Fax: 717-618-6709 • Email: contact@wellnessmerge.com • wellnessmerge.com
This Notice applies to Wellness Merge Physical Therapy, including its Lancaster clinic, its in-home Physical Therapy services across Lancaster County, and its on-site Physical Therapy services for residents where it provides care. It applies to all of the records of your care that we maintain, whether created in the clinic, in your home, or in another care setting.
Our responsibilities
We are required by law to maintain the privacy and security of your protected health information (PHI). PHI is information about you, including demographic information, that may identify you and relates to your past, present, or future physical or mental health or condition, the provision of health care to you, or payment for that care.
We will follow this Notice. We must follow the duties and privacy practices described in this Notice and give you a copy of it.
We will not share beyond this Notice without your written permission. We will not use or share your information other than as described in this Notice unless you tell us we can in writing. If you tell us we can, you may change your mind at any time by telling us in writing.
We will notify you of a breach. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your unsecured PHI, as required by federal and Pennsylvania law, and in any event as required under HIPAA, generally within 60 days of discovery.
We may change this Notice. We may change this Notice at any time. Changes will apply to all PHI we hold, including PHI created before the change. The new Notice will be available at our clinic, on request, and on our website. We will give you a copy of a materially revised Notice when required by law.
Your rights
When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.
Get a copy of your medical record. You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. Ask us how to do this. We will provide a copy or summary, usually within 30 days of your request. We may charge a reasonable, cost-based fee for copying and mailing, as permitted by law.
Ask us to correct your record. You can ask us to correct health information about you that you think is incorrect or incomplete. Ask us how to do this. We may say no to your request, but we will tell you why in writing within 60 days.
Request confidential communications. You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. We will say yes to all reasonable requests.
Ask us to limit what we share. You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request, and we may say no if it would affect your care. If you pay for a service or item out of pocket in full, you can ask us not to share that information with your health plan for payment or operations, and we will honor that request.
Get a list of those with whom we have shared your information. You can ask for a list (accounting) of the times we have shared your health information for six years before the date you ask, who we shared it with, and why. We will include all disclosures except those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We will provide one accounting a year for free, but will charge a reasonable, cost-based fee if you ask for another one within 12 months. For disclosures through an electronic health record, the accounting period and scope are as required by HIPAA.
Get a copy of this Notice. You can ask for a paper copy of this Notice at any time, even if you have agreed to receive it electronically. We will provide you with a paper copy promptly.
Choose someone to act for you. If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action. Pennsylvania law on personal representatives, guardians, and minors who may consent to their own care is described in the Pennsylvania law section.
File a complaint. You can complain if you feel we have violated your rights by contacting us using the information in the Questions and complaints section. You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting https://www.hhs.gov/hipaa/filing-a-complaint/index.html. We will not retaliate against you for filing a complaint.
Your choices
For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions, subject to the law.
Tell family and friends about your condition, and provide disaster relief. We can share information with your family, close friends, or others involved in your care, or share information in a disaster relief situation, only as described in the Other ways we may use or share your information section and subject to your choice where HIPAA gives you one.
Marketing, sale, and psychotherapy notes. We never share your information for marketing purposes, sell your information, or share most psychotherapy notes unless you give us written permission. If you give permission, you may revoke it in writing at any time, except for uses or disclosures already made in reliance on it.
Hospital directory and fundraising — not applicable at this time. We do not maintain a hospital directory and do not use your information for fundraising in the manner described in the federal model notice. If we ever do so, we will update this Notice and, where required, give you a choice to opt out before we use your information for that purpose.
Our uses and disclosures — how we typically use or share your information
We typically use or share your health information in the following ways. We limit uses and disclosures to the minimum necessary where HIPAA requires it, and to what is needed for the purpose described.
| Purpose | How we use or share it | Example |
|---|---|---|
| Treat you | We can use your health information and share it with other professionals who are treating you. | A physician treating you asks about your progress; we share your evaluation, plan of care, and progress notes with your referring physician and with other therapists on your care team, including physical therapist assistants working under a physical therapist’s plan of care. |
| Run our organization | We can use and share your health information to run our practice, improve your care, and contact you when necessary. | We use health information to manage treatment, schedule visits, review quality, train staff, and coordinate in-clinic, in-home, and on-site care. |
| Bill for your services | We can use and share your health information to bill and get payment from health plans or other entities. | We share information needed for billing with Medicare, a commercial health plan, or another payer, and with our billing vendors under contract. |
| Appointment reminders and care coordination | We may contact you by phone, text, email, or mail about appointments, treatment alternatives, and health-related benefits and services that may interest you, as permitted by law. | We may leave a voicemail or send a reminder about an upcoming visit, subject to any confidential-communications request you have made. |
| Business associates | We may share PHI with vendors that perform functions for us, such as electronic health record, patient portal, scheduling, and billing services, only under a written contract requiring them to protect your PHI. |
Other ways we may use or share your information, as permitted or required by law
We are allowed or required to share your information in other ways — usually in ways that contribute to the public good, such as public health and research. We must meet many conditions in the law before we can share your information for these purposes.
Help with public health and safety. To help with public health and safety issues, such as preventing disease, helping with product recalls, reporting adverse reactions to medications, and reporting suspected abuse, neglect, or domestic violence, as required by law.
Health oversight. For health oversight activities, such as audits, investigations, and inspections by agencies that oversee health care, including the Pennsylvania State Board of Physical Therapy and other regulators.
Comply with the law. To comply with the law, including a court order, search warrant, or subpoena that meets legal requirements, subject to the more stringent Pennsylvania protections in the Pennsylvania law section.
Lawsuits, legal actions, and law enforcement. To respond to lawsuits and legal actions, and to law enforcement for purposes permitted by law, such as to identify or locate a suspect, fugitive, material witness, or missing person, or to report a crime on our premises.
Workers’ compensation. To address workers’ compensation, as required by Pennsylvania workers’ compensation law, for a work-related injury or illness.
Research. For research, only as permitted by HIPAA and, where required, with approval from an Institutional Review Board or privacy board, or as otherwise permitted for research preparation and for research on decedents.
Serious threat to health or safety. To avert a serious threat to health or safety, where we believe in good faith that disclosure is necessary to prevent or lessen a serious and imminent threat to a person or the public, and to someone who can lessen the threat.
Coroner, medical examiner, funeral director, and organ donation. To a coroner, medical examiner, or funeral director, as necessary to carry out their duties, and for organ, eye, or tissue donation purposes as permitted by law, where applicable.
Specialized government functions. For specialized government functions, such as military and veterans’ activities, national security, and intelligence activities, and to correctional institutions as permitted by law.
Disaster relief. For disaster relief, to an entity assisting in disaster relief efforts, so your family can be notified about your condition, status, and location, subject to your choice where applicable.
Family, personal representatives, and others involved in your care. To your personal representative, and, as permitted by HIPAA and Pennsylvania law, to family members or others involved in your care, limited to information directly relevant to their involvement, unless you object or we judge that disclosure would not be in your best interest.
We will not use or share your information other than as described in this Notice unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.
How we protect your information in our practice
Minimum necessary and workforce access. Access is limited to workforce members who need the information for treatment, payment, or operations, and to business associates under contract.
Safeguards. We use administrative, technical, and physical safeguards for paper and electronic records, including our electronic health record and patient portal, and we train our workforce on privacy and security.
Incidental disclosures. In the clinic, in your home, and on site, staff will take reasonable steps to avoid incidental disclosures, such as speaking privately about your care where practicable and not leaving records where unauthorized persons can see them.
Patient portal and communications. Do not send medical records or personal health information through public website features, social media, or developer contact links. Use our patient portal for health-related messages and documents, or call us at 717-686-0681.
Pennsylvania law — how it fits with HIPAA
HIPAA sets a federal floor for privacy protection. Where Pennsylvania law is more stringent — that is, where it gives you greater privacy protection — Pennsylvania law controls, as provided in 45 CFR 160.203. Where Pennsylvania law is less stringent, HIPAA controls. This Section summarizes the Pennsylvania rules most relevant to a Pennsylvania Physical Therapy practice. It is a summary, not a substitute for legal advice, and it does not change any stricter rule that applies to a particular record.
Physical Therapy practice in Pennsylvania. Pennsylvania Physical Therapy Practice Act, 63 P.S. §§ 1301–1312, and the regulations of the Pennsylvania State Board of Physical Therapy, 49 Pa. Code Chapter 40, govern the practice of Physical Therapy in Pennsylvania, including the Board’s ethics and confidentiality duties. Under those duties, a physical therapist and physical therapist assistant must protect a patient’s confidential information and not disclose it except as authorized by the patient or as permitted or required by law. If you have a question about a disclosure required by the Board or another regulator, contact our Privacy Officer.
Record retention in Pennsylvania. Pennsylvania law generally requires health care records to be retained for at least 7 years after the last treatment or service. For a minor, records are generally retained until at least 1 year after the patient reaches majority. HIPAA separately requires us to retain HIPAA compliance documentation, such as this Notice, policies, and accounting records, for 6 years from creation or last effective date, under 45 CFR 164.530(j).
HIV-related information — Pennsylvania. Confidentiality of HIV-Related Information Act, 35 P.S. §§ 7601–7612, especially § 7607: HIV-related information may not be disclosed or redisclosed except as expressly permitted by that Act, generally only with a separate, specific written consent signed by the subject of the information, or as otherwise expressly permitted by the Act. A general authorization for release of medical information is not sufficient for HIV-related information. If your record contains HIV-related information, we will apply this stricter Pennsylvania rule.
Drug and alcohol information — Pennsylvania and federal. Pennsylvania Drug and Alcohol Abuse Control Act, 71 P.S. § 1690.108, and, for federally assisted substance use disorder programs, federal law at 42 CFR Part 2: drug and alcohol records are confidential and may be disclosed only with patient consent or as otherwise expressly permitted by those laws, with additional limits on redisclosure and, for Part 2 records, on use in investigations or legal proceedings against you without written consent or a court order and subpoena. If your record contains drug or alcohol information, we will apply the stricter rule.
Mental health information — Pennsylvania. Mental Health Procedures Act, 50 P.S. § 7111: mental health records and documents concerning persons in treatment are confidential and may be disclosed only as permitted by that Act, generally with written consent or as otherwise expressly permitted by the Act. If your record contains mental health information, we will apply this stricter Pennsylvania rule. This includes the rule that, in Pennsylvania, certain mental health information may not be disclosed in response to a subpoena alone without authorization or a court order as required by that Act.
Minors. Minors and personal representatives: Under HIPAA, a parent or guardian is generally the personal representative of an unemancipated minor, except where Pennsylvania law permits the minor to consent to the care on their own. In those cases, the minor, not the parent, generally controls the records for that care, subject to the specific Pennsylvania minor-consent law and to HIPAA. If you are a minor, a parent, or a guardian and are unsure who controls a particular record, contact our Privacy Officer before requesting or authorizing a disclosure.
Breach notification — Pennsylvania. Pennsylvania breach notification: In addition to HIPAA breach notification, Pennsylvania’s Breach of Personal Information Notification Act, 73 P.S. §§ 2301–2329, may apply to a breach involving personal information as defined by that Act. We will provide notice as required by both federal and Pennsylvania law.
Direct access. Pennsylvania direct access: Pennsylvania permits direct access to Physical Therapy without a physician referral in the circumstances provided by the Practice Act and Board regulations. Direct access does not change this Notice: your privacy rights and our duties under this Notice apply whether or not you were referred by a physician.
If there is a conflict between this summary and the statute or regulation itself, the statute or regulation controls. If you believe a more stringent Pennsylvania rule applies to your record, tell our Privacy Officer and we will apply it.
Changes to this Notice
We can change the terms of this Notice, and the changes will apply to all health information we have about you. The new Notice will be available upon request, in our clinic, and on our website. We will provide a copy of a materially revised Notice as required by law, and we will post the current Notice prominently in our clinic and on any website we maintain that provides information about our services or benefits, as required by 45 CFR 164.520(c).
Questions and complaints — Privacy Officer
If you have questions about this Notice, or you believe your privacy rights have been violated, contact:
Privacy Officer, Wellness Merge Physical Therapy
Attn: Kay Patel, MSPT — Clinical Director
903 Nissley Rd, Lancaster, PA 17601 • Phone: 717-686-0681 • Fax: 717-618-6709 • Email: contact@wellnessmerge.com
You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting https://www.hhs.gov/hipaa/filing-a-complaint/index.html. You will not be retaliated against for filing a complaint.
For more information about HIPAA privacy, see https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/privacy-practices-health-care-provider/index.html and the HHS model Notice of Privacy Practices for a covered health care provider.
Website services and external links
This website is hosted on Shopify. Shopify may process technical information such as device, browser and usage information to operate its platform. Public pages may also request fonts from Google. Google Maps, Instagram, WhatsApp and the patient portal are external services. Their privacy practices apply when you choose to visit them. Map content is not automatically embedded on this website.
Use the patient portal for health-related messages and documents. The Charcode Solutions WhatsApp credit is for website-development inquiries and is not a channel for patient care.