Your Protected Health Information. Your Rights. Our Responsibilities. 

This Notice of Privacy Practices (“Notice”) describes how protected health information collected by or on behalf of the covered entities providing services through Clinics for Abortion and Reproductive Excellence, LLC (such information, “PHI”) may be used and disclosed under federal law and the enhanced privacy protections established under Colorado state law. It also explains how you can access this information. 

Our Notice of Privacy Practices does not apply to services that are NOT offered by or on behalf of Clinics for Abortion and Reproductive Excellence, LLC, such as financial assistance through external abortion funds, information provided to my-iud.com for birth control, and certain unauthenticated webpages on www.carecliniccolorado.com that are not an entry point for clinical services. Such services are subject to the general Privacy Policy available at https://carecliniccolorado.com/privacy-policy/. Please review this Notice carefully. 

Your Rights

You have the right to: 

• Get an immediate paper or electronic copy of your medical record 
• Request corrections to your paper or electronic medical record 
• Request highly confidential or alternative channels of communication 
• Ask us to restrict the PHI we share (including a complete block on health insurance sharing if paying out-of-pocket) 
• Receive a historical accounting of those with whom we’ve shared your PHI 
• Get a physical copy of this privacy notice at any time 
• Formally designate someone to act for you under a medical power of attorney 
• File a local or federal complaint if you believe your privacy rights have been compromised 

Your Choices

You have explicit choices in the way that we use and share PHI as we: 

• Discuss your care or condition with family and close friends 
• Provide disaster relief coordination 
• Market clinic services (requires written authorization; we never sell your PHI) 
• Engage in clinic fundraising efforts 

Our Permitted Uses and Disclosures

We typically limit the use and sharing of your PHI to situations where we: 

• Provide medical treatment to you 
• Manage our clinic operations and internal healthcare improvements 
• Bill for your services (unless restricted by an out-of-pocket payment directive) 
• Comply with mandatory public health and safety requirements 
• Respond to legally binding in-state court orders or valid administrative subpoenas that comply with Colorado shield law frameworks 

Detailed Breakdown of Your Rights

When it comes to your PHI, you have certain rights. This section explains your rights and some of our responsibilities to help you. 

Get an electronic or paper copy of your medical record

• You can ask to see or get an electronic or paper copy of your medical record and other PHI we have about you. 
• We will provide a copy or a summary of your PHI, usually within 30 days of your request. We may charge a reasonable, cost-based fee for duplication. 

Ask us to correct your medical record

• You can ask us to correct PHI about you that you think is incorrect or incomplete. 
• We may decline your request if the record was not created by us or is deemed accurate, but we will notify you of the denial in writing within 60 days. 

Request confidential communications

• You can ask us to contact you in a specific, secure way (for example, strictly via a designated cellular number rather than an office phone) or to send mail to an alternative address. 
• We will accommodate all reasonable requests to protect your safety and privacy. 

Ask us to limit what we use or share

• You can ask us not to use or share certain PHI for treatment, payment, or our operations. We are not required to agree to your request if it directly compromises the delivery of emergency medical care. 
• Out-of-Pocket Protection: If you pay for a service or reproductive health item out-of-pocket in full, you have the absolute right to demand that we do not share that PHI with your health insurance plan for the purpose of payment or operations. We will honor this request unless a specific, non-waivable federal law requires disclosure. 

Get a list of those with whom we have shared your PHI

• You can ask for an accounting of the times we have shared your PHI for six years prior to the date you ask, detailing who we shared it with and why. 
• We exclude routine disclosures made for treatment, payment, and health care operations, as well as disclosures you explicitly authorized. We provide one accounting per year for free, but will charge a cost-based fee for subsequent requests within a 12-month window. 

Prescription Label Anonymity (Colorado SB 25-129 Protection)

• To protect patient and practitioner privacy and physical safety, Colorado law permits practitioners to exclude an individual practitioner’s name from medication abortion prescriptions (such as mifepristone and misoprostol). At the request of our practitioners, we have listed our collective healthcare practice name (Clinics for Abortion and Reproductive Excellence, LLC) on the prescription label instead of an individual provider’s name. 

File a complaint if you feel your rights are violated

• You can complain if you feel we have violated your health information privacy rights by contacting us directly at [email protected] or by calling 719-884-4070. 
• You can also file a formal complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/. 
• We strictly prohibit and will not engage in any form of retaliation against you for filing a complaint. 

Detailed Breakdown of Your Choices

For certain circumstances, you can tell us your choices about what we share. If you have a clear preference for how we share your PHI in the situations described below, speak with our clinic staff and we will strictly follow your instructions. 

In these cases, you have both the right and choice to tell us to:

• Share information with your family, close friends, or others directly involved in your care 
• Share information in a localized disaster relief situation 

If you are incapacitated or unable to communicate your preference (for example, if you are unconscious), we will only share your minimal necessary PHI if we determine, through professional medical judgment, that it is strictly in your best interest or needed to lessen a serious and imminent threat to health or safety. 

In these cases, we NEVER share your PHI unless you explicitly provide written, signed authorization:

• Marketing purposes or promotional communications 
• The sale of your PHI (which our clinic does not engage in) 
• The sharing of psychotherapy or clinical counseling notes 

Detailed Breakdown of Our Uses and Disclosures

How do we typically use or share your PHI?

We typically use or share your PHI in the following ways: 

• Treat you: We use your PHI to coordinate your reproductive care and share it with other healthcare professionals who are actively participating in your treatment. 
  • Example: A clinic practitioner sends a diagnostic lab order or coordinates with the specific pharmacy filling your prescription. 
• Run our organization: We use and share your PHI to run our clinical practice, evaluate the quality of our care, train staff, and contact you securely when necessary. 
• Bill for your services: We use and share your PHI to securely bill and collect payment from health plans, verified funding networks, or other billing entities you have approved. 

Protection Against Out-of-State Legal Actions (Colorado Shield Law Compliance)

Colorado law (SB 23-188 and SB 25-129) provides robust, comprehensive protections for individuals seeking or providing legally protected reproductive healthcare activities within the state. 

• Hostile Out-of-State Requests: Our clinic, our workforce, and our state-regulated partners are strictly prohibited by Colorado law from cooperating with, responding to, or assisting any out-of-state or federal investigations, civil lawsuits, criminal prosecutions, subpoenas, or search warrants that seek to impose civil or criminal liability for seeking, receiving, or facilitating lawful reproductive healthcare services in Colorado. 
• Subpoena Verification: We will refuse to comply with third-party subpoenas or data demands unless the requesting party provides an explicit, legally binding affirmation confirming that the request does not pertain to out-of-state civil, criminal, or administrative enforcement actions targeting legally protected reproductive care. We actively reserve the right to dispute, block, or legally challenge any demand we determine to be overbroad, vague, or lacking proper authority under Colorado law. 
• State Public Health Reporting Safeguards: To the extent that the clinic is required by law to submit statistical healthcare information to the Colorado Department of Public Health and Environment (CDPHE), state law strictly prohibits the collection or sharing of personally identifiable information (such as your name, date of birth, address, employer, or spouse’s name). Any information utilized for public health statistics is strictly aggregated and kept confidential under penalty of state data privacy breach laws. 

Other Permitted or Required Disclosures (In-State Public Good)

We are permitted or required to share your PHI in limited other ways that contribute to the public good, provided we meet strict statutory conditions under both HIPAA and Colorado law: 

• Public Health and Safety Issues: Reporting adverse reactions to medications, assisting with verified medical product recalls, or reporting suspected domestic violence, child abuse, or neglect as mandated by Colorado law.
• Special Government Functions: Addressing valid in-state workers’ compensation claims, or interacting with health oversight agencies for legally authorized clinical auditing activities.
• Medical Examiners: Sharing minimal necessary data with a coroner, medical examiner, or funeral director in the event of an individual’s death.

Our Responsibilities

• We are required by law to maintain strict privacy, data security, and confidentiality of your PHI.
• We will notify you promptly via secure channels if a data breach occurs that may have compromised the privacy, security, or integrity of your PHI.
• We must strictly adhere to the duties and privacy practices outlined in this Notice and provide you with an accessible copy.
• We will not use or share your PHI for any purpose other than those described in this document unless you grant us clear, written permission. If you grant permission, you may revoke it in writing at any time.

Effective Date: September 18, 2026
For further information regarding consumer privacy rights, visit: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.