HIPAA Notice of Privacy Practices

Effective Date: September 1, 2026
BEM NS Aesthetic Medical Service, PC, doing business as Entre Nous Aesthetics

 

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

At Entre Nous Aesthetics, protecting the privacy of our patients is an important part of the trust you place in us. This Notice of Privacy Practices explains how we may use and disclose your protected health information, the rights you have regarding that information, and our responsibilities under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and other applicable federal and California privacy laws.

“Protected health information,” or “PHI,” generally means individually identifiable information about your health, medical history, treatment, payment for health care, or health care services. In our practice, PHI may include information such as your medical history, treatment records, prescriptions, clinical photographs, treatment plans, procedure documentation, communications with our providers and staff, and billing or payment information.

Your Rights

You have certain rights regarding your health information.

Access Your Medical Records

You may ask to inspect or obtain an electronic or paper copy of your medical record and other health information we maintain about you.

We will provide access or copies within the time required by applicable law. We may charge a reasonable fee permitted by law for copying, supplies, postage, or preparation of records.

In some limited circumstances, we may deny access to certain information. If we deny your request, we will explain the reason and, when applicable, your right to have that decision reviewed.

Ask Us to Correct Your Medical Record

If you believe information in your medical record is incorrect or incomplete, you may ask us to amend it.

We may deny your request in certain circumstances, but if we do, we will provide an explanation in writing. You may also have the right to submit a statement explaining your disagreement.

Request Confidential Communications

You may ask us to communicate with you in a particular way or at a particular location.

For example, you may ask us to:

  • Call only a particular telephone number;
  • Communicate with you by text or email;
  • Avoid leaving detailed voicemail messages; or
  • Send correspondence to a particular mailing address.

We will accommodate reasonable requests.

Ask Us to Limit What We Use or Disclose

You may ask us not to use or disclose certain health information for treatment, payment, or health care operations.

We are generally not required to agree to every requested restriction. However, if you pay for a health care service or item completely out of pocket and ask us not to disclose information about that service to your health plan for payment or health care operations, we will honor that request unless disclosure is required by law.

If we agree to another restriction, we will comply with it except when disclosure is necessary to provide emergency treatment or otherwise permitted by law.

Receive an Accounting of Certain Disclosures

You may request a list, called an “accounting of disclosures,” showing certain disclosures we have made of your PHI during the six years preceding your request.

The accounting does not include every disclosure. For example, disclosures for treatment, payment, health care operations, disclosures you specifically authorized, and certain other disclosures are generally excluded.

We will provide one accounting within a 12-month period without charge. We may charge a reasonable, cost-based fee for additional requests during the same period after notifying you of the cost.

Obtain a Copy of This Notice

You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

The current Notice is also available on our website.

Choose Someone to Act for You

If you have given another person legal authority to act on your behalf, such as through a health care power of attorney, guardianship, or other lawful arrangement, that person may exercise your privacy rights when permitted by law.
We may require appropriate documentation verifying that person’s authority.

File a Privacy Complaint

If you believe your privacy rights have been violated, you may file a complaint with us.

Contact:

Privacy Officer
Sandra Ewers, MS, PA-C

Entre Nous Aesthetics
1047 El Camino Real, Ste. 100
Menlo Park, CA 94025

Phone: (650) 363-0300

Email: info@enaesthetics.com

You may also file a complaint with:

U.S. Department of Health and Human Services
Office for Civil Rights

200 Independence Avenue, S.W.
Washington, D.C. 20201

Phone: 1-877-696-6775

We will not retaliate against you for filing a complaint or exercising any of your privacy rights.

Your Choices About Your Health Information

For certain health information and certain types of disclosures, you may tell us your preferences.

Family Members, Friends, and Others Involved in Your Care

You may tell us whether we may share relevant information with a family member, friend, caregiver, or other person involved in your care or payment for your care.

If you are unable to tell us your preference, such as during an emergency, we may disclose limited information when we reasonably believe doing so is in your best interest and is permitted by law.

We may also disclose information when necessary to prevent or lessen a serious and imminent threat to the health or safety of you or another person.

Marketing and Sale of Health Information

We will obtain your written authorization before using or disclosing your PHI for marketing when HIPAA or other applicable law requires such authorization.

We do not sell your protected health information.

We may contact you about appointments, follow-up care, treatment alternatives, health-related services, products, or other communications permitted by law.

You may tell us that you do not wish to receive certain optional promotional communications.

Photographs, Videos, Testimonials, and Social Media

Clinical photography is an important part of aesthetic medicine and may be used as part of your medical record to document treatment, monitor progress, plan future care, and compare treatment results.

We will not use identifiable patient photographs, videos, testimonials, or other identifiable health information for public-facing advertising, social media, promotional materials, or similar marketing purposes without obtaining any authorization required by law.

Authorizing such use is voluntary. Declining to permit marketing use of your photographs or information will not affect your ability to receive treatment from us.

Psychotherapy Notes

If we maintain psychotherapy notes, we will obtain written authorization before using or disclosing those notes in circumstances in which authorization is required by law.

Fundraising

Entre Nous Aesthetics does not currently use patient PHI for fundraising activities.

How We May Use and Disclose Your Health Information

HIPAA allows or requires us to use or disclose your health information in certain circumstances without obtaining a separate authorization from you.

Treatment

We may use or disclose your PHI to provide, coordinate, or manage your medical care.

For example, one of our providers may review information from another provider involved in your care, or we may share relevant medical information with another health care professional to coordinate treatment.

Payment

We may use and disclose your health information to obtain payment for services or to administer financial transactions related to your care.

For example, information may be used to process a payment, respond to a payment dispute, determine benefits when applicable, or communicate with another entity involved in payment for your care.

Health Care Operations

We may use and disclose PHI as necessary to operate our medical practice and maintain the quality of care we provide.

Examples may include:

  • Reviewing the quality of patient care;
  • Training and supervising workforce members;
  • Conducting compliance, auditing, and risk-management activities;
  • Managing scheduling and patient communications;
  • Evaluating provider performance;
  • Maintaining our information systems;
  • Conducting credentialing or licensing activities;
  • Performing business planning and administrative functions; and
  • Improving our services and patient experience.

Business Associates

We may share PHI with outside companies or individuals that perform services for our medical practice and require access to PHI to perform those services.

These organizations are known as “business associates.” Examples may include companies that provide electronic medical records, patient communication systems, billing or payment services, data hosting, IT services, records storage, or other support functions.

When required by HIPAA, business associates must enter into agreements requiring them to appropriately safeguard PHI.

Appointment Reminders and Patient Communications

We may use your contact information to communicate with you regarding appointments, scheduling, pre-treatment or post-treatment instructions, follow-up care, prescriptions, treatment recommendations, and other matters relating to your care.

Depending on your preferences and the communication information you provide to us, these communications may occur by telephone, voicemail, text message, email, mail, or another permitted method.

Public Health and Safety Activities

We may disclose your health information for legally permitted public health and safety purposes, including:

  • Reporting certain diseases or health conditions;
  • Reporting adverse events or problems with medications or medical devices;
  • Assisting with product recalls;
  • Reporting suspected abuse, neglect, or domestic violence when permitted or required by law; and
  • Preventing or reducing a serious threat to health or safety.

Health Oversight Activities

We may disclose PHI to government agencies or other authorized entities conducting health oversight activities, such as audits, inspections, investigations, licensing activities, disciplinary proceedings, or compliance reviews.

When Required by Law

We will disclose PHI when federal, state, or local law requires us to do so.
This may include disclosures to the U.S. Department of Health and Human Services when necessary to demonstrate our compliance with HIPAA.

Judicial and Administrative Proceedings

We may disclose health information in response to certain court orders, administrative orders, subpoenas, discovery requests, or other lawful processes when the requirements of applicable privacy law have been satisfied.

Law Enforcement

We may disclose PHI to law enforcement when specifically permitted or required by law.

Workers’ Compensation

We may disclose health information as authorized by and to the extent necessary to comply with workers’ compensation laws or similar programs.

Coroners, Medical Examiners, and Funeral Directors

We may disclose relevant health information to a coroner, medical examiner, or funeral director as permitted or required by law.

Organ and Tissue Donation

When applicable, we may disclose health information to organizations involved in organ, eye, or tissue donation and transplantation as permitted by law.

Research

We may use or disclose PHI for research only when the requirements and safeguards imposed by applicable law have been satisfied.

We do not automatically provide patient information to researchers simply because a research request is made.

Special Government Functions

When permitted by law, we may disclose PHI for certain governmental functions such as military activities, national security activities, protective services, correctional activities, or other specifically authorized governmental purposes.

Substance Use Disorder Records

Certain substance use disorder treatment records may receive additional protection under federal law, including 42 C.F.R. Part 2.

To the extent that we receive or maintain records protected by 42 C.F.R. Part 2, those records may not be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding against you unless the disclosure is permitted by applicable federal law, including when you provide the required written consent or when an appropriate court order and legal process authorize the disclosure.

Additional restrictions may apply to redisclosure and other uses of records protected by Part 2.

California Privacy Protections

Because Entre Nous Aesthetics provides health care in California, your medical information may also be protected by California privacy laws, including the California Confidentiality of Medical Information Act (“CMIA”) and other laws governing medical records and sensitive health information.

California law may provide protections that are more restrictive than HIPAA in certain circumstances.

Where California or another applicable law provides greater privacy protection than HIPAA, we will follow the law that provides the greater protection.

Additional restrictions may apply to certain types of sensitive information, including, when applicable:

  • Mental or behavioral health information;
  • Psychotherapy records;
  • Substance use disorder information;
  • HIV/AIDS-related information;
  • Genetic information;
  • Reproductive or sexual health information;
  • Information concerning services to which a minor may independently consent; and
  • Other categories of medical information receiving special protection under California or federal law.

We will obtain written authorization for uses or disclosures of such information whenever authorization is required by applicable law.

Uses and Disclosures Requiring Your Written Authorization

Other than as described in this Notice or otherwise permitted or required by law, we will not use or disclose your PHI without your written authorization.

You may revoke an authorization in writing at any time, except to the extent that we have already relied upon the authorization or applicable law provides otherwise.

Revoking an authorization will not affect actions we already took while the authorization was valid.

Our Responsibilities

Entre Nous Aesthetics is required by law to:

  • Maintain the privacy and security of your protected health information;
  • Provide you with this Notice describing our legal duties and privacy practices;
  • Follow the terms of the Notice currently in effect;
  • Notify affected individuals following a breach of unsecured PHI when notification is required by law;
  • Limit uses and disclosures of PHI as required by applicable law; and
  • Honor the privacy rights described in this Notice.

We will not use or disclose your information for purposes not described in this Notice unless you authorize us to do so or another use or disclosure is permitted or required by law.

Changes to This Notice

We reserve the right to change this Notice and our privacy practices.

Any revised Notice may apply to PHI we already maintain as well as information we receive in the future.

When we make a material change, the revised Notice will be made available upon request, posted at our practice when required, and posted on our website.

The effective date shown at the top of the Notice identifies the version currently in effect.

Questions or Additional Information

If you have questions about this Notice, our privacy practices, or your rights regarding your health information, please contact:

Privacy Officer

Sandra Ewers, MS, PA-C

Entre Nous Aesthetics
1047 El Camino Real, Ste. 100
Menlo Park, California 94025

Phone: (650) 363-0300
Email: info@enaesthetics.com