Effective Date: September 22, 2026
Last Updated: September 22, 2026

This Notice of Privacy Practices describes how Iconic Plastic Surgery uses and discloses protected health information, how we protect your medical information, and the rights you have regarding your health information.

This Notice applies to Iconic Plastic Surgery and members of our workforce who have access to protected health information as part of their work for the practice. Independent hospitals, surgery centers, laboratories, pharmacies, healthcare professionals, or other organizations involved in your care might maintain their own privacy practices and notices.

Your Rights

You have rights regarding the health information we maintain about you. These rights include access to your records, requests for corrections, confidential communications, certain restrictions on disclosures, an accounting of certain disclosures, and the right to file a privacy complaint.

Access Your Medical Records

You have the right to inspect or obtain an electronic or paper copy of medical records and other health information maintained about you, subject to limitations permitted by law.

California law generally provides patients the right to inspect medical records within five working days after a qualifying written request and to receive requested copies within 15 days after receipt of a qualifying written request and any applicable fees.

Reasonable fees permitted by applicable law might apply to certain record requests. Contact our Privacy Officer for instructions regarding medical record requests.

Request a Correction or Amendment

You have the right to ask us to correct or amend health information that you believe is incorrect or incomplete.

We might deny certain requests as permitted by law. If a request is denied, we will provide information regarding the denial and any additional rights available to you.

Request Confidential Communications

You have the right to ask us to communicate with you about health matters in a particular way or at a particular location.

For example, you might request that we contact you only at a specific telephone number, email address, or mailing address. We will accommodate reasonable requests as required by law.

Request Restrictions

You have the right to ask us to limit certain uses or disclosures of your protected health information for treatment, payment, or healthcare operations.

We are not required to agree to every requested restriction. If we agree to a restriction, we will follow it except where disclosure is permitted or required by law, including circumstances involving emergency treatment.

If you pay for a healthcare service or item entirely out of pocket, you have the right to request that information about the service or item not be disclosed to your health plan for payment or healthcare operations. We will honor the request unless disclosure is required by law.

Receive an Accounting of Certain Disclosures

You have the right to request a list of certain disclosures of your protected health information made during the six years before your request.

The accounting generally does not include disclosures made for treatment, payment, healthcare operations, disclosures made directly to you, disclosures authorized by you, and certain other disclosures excluded by law.

One accounting during a 12-month period will be provided without charge. A reasonable cost-based fee might apply to additional requests during the same 12-month period.

Receive a Copy of This Notice

You have the right to request a paper copy of this Notice at any time, including when you previously agreed to receive it electronically.

Choose Someone to Act for You

If another person has legal authority to act on your behalf, such as a healthcare agent, personal representative, parent, guardian, or another legally authorized representative, that person is permitted to exercise applicable privacy rights on your behalf.

We will verify the person’s legal authority before acting on a request where verification is required.

Your Choices

For certain uses and disclosures of health information, you have the right to tell us your preferences.

Family, Friends, and Others Involved in Your Care

You have the right to tell us whether health information should be shared with family members, close friends, caregivers, or other people involved in your care or payment for your care.

If you are unable to communicate your preference, we are permitted to share information when, using professional judgment, the disclosure is in your best interest and is permitted by law.

Disaster Relief and Emergency Situations

We are permitted to disclose limited health information to organizations assisting with disaster relief or emergency response when permitted by applicable law.

Marketing

Most uses of protected health information for marketing purposes require your written authorization.

Certain communications concerning your treatment, treatment alternatives, appointment reminders, or health-related products or services are permitted by law without a marketing authorization.

Marketing email and text-message preferences are also governed by applicable communications laws and our website privacy practices.

Sale of Protected Health Information

Iconic Plastic Surgery does not sell your protected health information. Any disclosure that legally constitutes a sale of protected health information requires written authorization unless an exception applies under applicable law.

Psychotherapy Notes

Most uses and disclosures of psychotherapy notes require written authorization when such records are maintained by the practice, except where an exception applies under law.

Fundraising

Iconic Plastic Surgery does not currently use protected health information for fundraising communications. If fundraising communications involving protected health information are conducted in the future, applicable privacy rights and opt-out requirements will be honored.

How We Use and Disclose Health Information

Federal and state law permit or require certain uses and disclosures of protected health information without separate written authorization. The following sections describe common situations.

Treatment

We use and disclose health information to provide, coordinate, and manage your healthcare.

For example, information might be shared with physicians, nurses, surgical facilities, anesthesiology professionals, laboratories, pharmacies, imaging providers, or other healthcare professionals involved in your treatment.

Payment

We use and disclose health information to obtain payment for healthcare services and to administer billing activities.

Where applicable, information might be provided to an insurance carrier, health plan, financing administrator, or another organization involved in processing payment for covered healthcare services.

Healthcare Operations

We use and disclose health information for healthcare operations necessary to run our practice and support patient care.

These activities include quality assessment, staff training, credentialing, compliance activities, auditing, legal services, business management, patient service activities, and efforts to improve the quality of care.

Business Associates

We work with service providers that perform functions involving protected health information on our behalf. When required by HIPAA, these organizations operate as business associates and enter into agreements requiring appropriate safeguards for protected health information.

Public Health and Safety

We are permitted to disclose health information for public health and safety activities authorized by law, including:

• Preventing or controlling disease, injury, or disability
• Reporting adverse reactions or problems involving medications or medical devices
• Supporting product recalls
• Reporting suspected abuse, neglect, or domestic violence as required or permitted by law
• Preventing or reducing a serious and imminent threat to health or safety

Health Oversight Activities

We are permitted to disclose health information to health oversight agencies for activities authorized by law, including audits, investigations, inspections, licensing activities, and regulatory reviews.

Research

Protected health information might be used or disclosed for research when the research satisfies applicable legal requirements, including required authorization, institutional review, waiver, or other permitted processes.

Required by Law

We will disclose health information when federal, California, or other applicable law requires us to do so.

We are also required to provide information to the U.S. Department of Health and Human Services when necessary to demonstrate compliance with federal health privacy requirements.

Organ and Tissue Donation

We are permitted to disclose health information to organ procurement organizations and similar organizations involved in organ, eye, or tissue donation when permitted by law.

Coroners, Medical Examiners, and Funeral Directors

We are permitted to disclose health information to coroners, medical examiners, and funeral directors when permitted or required by law.

Workers’ Compensation

We are permitted to disclose health information as authorized or required for workers’ compensation programs and similar programs established by law.

Law Enforcement and Government Requests

We are permitted to disclose health information for certain law enforcement or government purposes when the disclosure satisfies applicable legal requirements. This includes certain health oversight activities and special government functions authorized by law.

Lawsuits and Legal Proceedings

Health information might be disclosed in response to a valid court order, administrative order, subpoena, discovery request, or another lawful process, subject to applicable federal and California privacy protections.

Substance Use Disorder Records

Federal law provides additional protections for certain substance use disorder patient records governed by 42 CFR Part 2.

To the extent Iconic Plastic Surgery receives or maintains records protected by 42 CFR Part 2, those records will receive the additional protections required by federal law.

Part 2 records generally will not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you unless permitted by applicable law, including where appropriate written consent or a qualifying court order and subpoena are obtained.

Where Part 2 information is involved in fundraising communications, applicable advance notice and patient choice requirements will be followed.

California Medical Privacy Protections

Iconic Plastic Surgery is located in California and follows applicable California medical privacy laws in addition to federal HIPAA requirements.

California law provides additional protections for medical information and for certain categories of sensitive health information. These protections include restrictions involving certain mental health information, HIV-related information, and other medical information receiving heightened protection under California law.

California law also treats certain individually identifying immigration-status information collected or known by a healthcare provider as protected medical information. We will follow applicable California restrictions governing disclosure of this information.

Where California law provides stronger privacy protections than federal law, we will follow the more protective requirement.

Our Responsibilities

Iconic Plastic Surgery is required to:

• Maintain the privacy and security of your protected health information
• Follow the duties and privacy practices described in the current version of this Notice
• Provide you with a copy of this Notice when required or requested
• Notify affected individuals following a breach of unsecured protected health information when notification is required by law
• Use or disclose only the protected health information reasonably appropriate for permitted purposes, subject to applicable law
• Honor valid written authorizations and applicable requests to revoke those authorizations

We will not use or disclose your protected health information for purposes outside those described in this Notice unless you provide written authorization or the use or disclosure is otherwise permitted or required by law.

When written authorization is required, you generally have the right to revoke the authorization in writing. A revocation does not affect actions already taken in reliance on a valid authorization before the revocation was received.

Privacy and Security Breaches

Iconic Plastic Surgery maintains administrative, technical, and physical safeguards designed to protect protected health information.

If a breach of unsecured protected health information occurs and applicable law requires notification, we will provide the required notices within the applicable legal timeframes.

File a Privacy Complaint

If you believe your privacy rights have been violated, you have the right to submit a complaint to Iconic Plastic Surgery.

You will not be retaliated against or denied treatment for submitting a privacy complaint or exercising a privacy right.

Privacy Officer
Iconic Plastic Surgery
3144 El Camino Real, Suite 200
Carlsbad, CA 92008
Phone: 760-637-5288
Email: dr.dsouza@iconicplasticsurgery.com

File a Complaint With the U.S. Department of Health and Human Services

You also have the right to file a privacy complaint with the U.S. Department of Health and Human Services Office for Civil Rights.

U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue SW
Washington, DC 20201
Phone: 1-877-696-6775
Website: File a HIPAA Complaint

Iconic Plastic Surgery will not retaliate against you for filing a complaint with the practice or the U.S. Department of Health and Human Services.

Changes to This Notice

Iconic Plastic Surgery reserves the right to revise this Notice and our privacy practices as permitted by law.

A revised Notice will apply to protected health information we already maintain as well as information created or received after the revised Notice takes effect.

When this Notice is materially revised, the updated version will be available at our office, upon request, and on our website. The effective date at the top of the Notice will identify the current version.

Related Privacy Information

This HIPAA Notice of Privacy Practices specifically addresses protected health information governed by healthcare privacy laws. Information collected through general website browsing, advertising technologies, cookies, marketing systems, and other website activities is also addressed in our other privacy disclosures.

• Privacy Policy and California Privacy Notice
• Terms and Conditions
• Notice at Collection

Questions About This Notice

Questions regarding this Notice, your medical records, or your health information privacy rights should be directed to:

Privacy Officer
Iconic Plastic Surgery
3144 El Camino Real, Suite 200
Carlsbad, CA 92008
Phone: 760-637-5288
Email: dr.dsouza@iconicplasticsurgery.com