Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE — USED AND DISCLOSED
AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

Effective Date: [10/10/2025]

This Notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Mansfield Cosmetic Surgery Center and Dr. Michael L. Thornton understand the importance of privacy and are committed to maintaining the confidentiality of your medical information. We maintain a record of the medical care we provide and may receive such records from others. We use these records to provide quality medical care, obtain payment for services, and meet our professional and legal obligations to operate this practice properly. We are required by federal and Texas law to maintain the privacy of your protected health information (“PHI”), to provide you with this Notice, and to notify you in the event of a breach of unsecured health information.

If you have any questions about this Notice or wish to exercise your privacy rights, please contact our Privacy Officer at:

Privacy Officer: Dr. Michael L. Thornton
Mansfield Cosmetic Surgery Center
550 N. Walnut Creek Drive, #120
Mansfield, TX 76063
817-477-9000

---

How We May Use or Disclose Your Health Information

We collect and maintain your health information in an electronic medical record. The record is the property of Mansfield Cosmetic Surgery Center, but the information in it belongs to you. The law permits us to use or disclose your information for the following purposes as allowed by HIPAA and Texas law.

Treatment
We use and disclose your information to provide and coordinate your care. This includes sharing medical information with other physicians, nurses, pharmacists, laboratories, imaging centers, and other providers involved in your treatment. We may also share relevant information with family members or others assisting in your care unless you request otherwise.

Payment
We use and disclose your information to obtain payment for the services we provide. This may include submitting information to your health plan for claims, prior authorizations, or eligibility verification, and assisting other providers in their billing efforts.

Health Care Operations
We use and disclose your information for practice operations, including quality assessment, staff training, accreditation, auditing, credentialing, and compliance activities. We may share your information with business associates—such as billing, IT, or legal services—that perform functions for us under written agreements requiring them to protect your data. We may also disclose information for peer review, medical education, and other lawful operational purposes permitted by HIPAA and Texas law.

Appointment Reminders
We may contact you by telephone, voicemail, text message, email, or postal mail to remind you of appointments or to reschedule care. Reasonable safeguards are used to protect your information.

Sign-In and Waiting Room
We may use limited information when you sign in or when calling your name in the waiting area. Only the minimum necessary information is used, consistent with TMB guidance and HIPAA privacy standards.

Family Communication and Notification
We may disclose limited information to notify a family member, personal representative, or caregiver of your location and condition. If you are unable to agree or object, we will use professional judgment in determining what is in your best interest. In emergencies or disasters, we may share information to assist with relief efforts.

Marketing and Educational Communication
We may contact you with information about services offered by Mansfield Cosmetic Surgery Center or Dr. Michael L. Thornton that may be beneficial to your health or recovery. We will not sell or disclose your information for paid marketing without your written authorization. We may, however, send you information related to postoperative care, new treatment options, or health-related education consistent with Texas Medical Board advertising and patient communication rules.

Sale of Health Information
We will not sell your protected health information without your express written authorization. Any authorization will clearly state that compensation will be received and may be revoked at any time.

Required by Law
We will use or disclose information when required by law, such as reporting abuse, neglect, or domestic violence; responding to judicial or administrative orders; or cooperating with law enforcement officials.

Public Health and Safety
We may disclose information to public-health authorities for disease control, product safety, or reporting adverse drug reactions. We may also disclose information to prevent or lessen a serious threat to the health or safety of a person or the public.

Health Oversight and Legal Requirements
We may disclose information to health-oversight agencies for inspections, audits, or investigations required by law. We may also disclose information during judicial or administrative proceedings when required by court order or subpoena, consistent with HIPAA and Texas Medical Board regulations.

Law Enforcement
We may disclose information to law-enforcement officials as required by law, such as reporting certain injuries or responding to lawful court orders, subpoenas, or warrants.

Coroners, Organ Donation, and Research
We may share information with coroners, medical examiners, or funeral directors as necessary for their duties. We may also share information for organ and tissue donation or limited medical research purposes as permitted by law.

Workers’ Compensation
We may disclose information as necessary to comply with workers’ compensation or similar laws related to workplace injuries or illnesses.

Change of Ownership
If Mansfield Cosmetic Surgery Center or Dr. Michael L. Thornton’s practice is sold, merged, or reorganized, your medical record will transfer to the new owner, who must continue to protect your information and honor this Notice.

Breach Notification
If a breach of unsecured protected health information occurs, we will notify you promptly as required by the Health Information Technology for Economic and Clinical Health (HITECH) Act and Texas Health & Safety Code §181. Notification may be by mail, email, or another legally permitted method.

Compliance with Texas Law
We comply fully with the Texas Medical Records Privacy Act and Texas Medical Board rules (including 22 TAC §165.1 and §165.5) requiring secure maintenance, retention, and release of medical records. Where Texas law provides greater protection or access rights than HIPAA, Mansfield Cosmetic Surgery Center follows Texas law.

---

When We May Not Use or Disclose Your Health Information

Except as described in this Notice or as otherwise permitted by law, we will not use or disclose your information without your written authorization. You may revoke your authorization in writing at any time, and it will apply to future uses and disclosures.

---

Your Health Information Rights

Request for Privacy Restrictions
You have the right to request restrictions on certain uses or disclosures of your information. While we are not required to agree to all requests, we must honor a request to withhold information from your health plan when you have paid for a service completely out-of-pocket.

Confidential Communications
You may request communications in a specific format or to a specific address—for example, at work or through a particular email account. We will accommodate all reasonable written requests.

Inspect and Copy
You have the right to inspect and obtain a copy of your health information. Requests must be in writing. We may charge a reasonable fee as allowed under HIPAA and Texas law for copies and administrative costs. We will respond within the time period required by law, generally within 15 business days under Texas regulations.

Amendment Requests
If you believe your information is inaccurate or incomplete, you may request an amendment in writing. We may deny requests in certain cases but will provide a written explanation and allow you to submit a statement of disagreement that will accompany your record.

Accounting of Disclosures
You may request a list of certain disclosures of your information made by Mansfield Cosmetic Surgery Center during a specified time frame. This right excludes disclosures made for treatment, payment, operations, and those you authorized.

Paper or Electronic Copy
You have the right to receive a paper or electronic copy of this Notice at any time, even if you have agreed to receive it electronically.

File a Complaint
If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the U.S. Department of Health and Human Services, Office for Civil Rights. Mansfield Cosmetic Surgery Center and Dr. Michael L. Thornton will not retaliate against you for filing a complaint.

U.S. Department of Health & Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
Toll-Free: 1-877-696-6775

---

Changes to This Notice

Mansfield Cosmetic Surgery Center and Dr. Michael L. Thornton reserve the right to change this Notice at any time. The revised Notice will apply to all medical information we maintain, including information created before the change. The most current Notice will be posted in our office reception area and on our website, and copies will be available upon request at every appointment.

---

Acknowledgment of Receipt

You will be asked to sign an acknowledgment that you received this Notice of Privacy Practices. Your acknowledgment will be kept in your medical record as required by the Texas Medical Board.