Privacy Policy

Information collected through the website

The website (annapolistmj.com) collects only the minimum information needed to schedule a consultation: name, phone number, email address, and an optional brief description of symptoms. No payment information, Social Security numbers, or insurance details are collected through the site. The site is served over HTTPS with TLS encryption end-to-end. Web form submissions are transmitted directly to a secured practice inbox accessible only to authorized front-desk staff.

Information collected in the office

Clinical and demographic information collected during in-person care is stored in our HIPAA-compliant practice management system, hosted by a vendor operating under a signed Business Associate Agreement (BAA). Access is restricted by role-based permissions, protected by unique user credentials and multi-factor authentication, and logged for audit purposes.

Administrative and physical safeguards

• All workforce members complete HIPAA training at onboarding and annually thereafter.
• Business Associate Agreements are in place with every vendor that touches protected health information — including our practice management software, imaging vendor, email and communications provider, and billing partners.
• Physical records, when used, are stored in locked areas accessible only to authorized staff.
• Workstations auto-lock when idle, and the office network is protected by a managed firewall and endpoint security.

Patient rights

Patients receive our Notice of Privacy Practices at the start of care and have the right to access, amend, or request restrictions on their health information in accordance with 45 CFR § 164.524–528. Requests are honored within the timelines required by federal law.

Marketing and advertising data

Information collected for ad performance measurement (for example, Google Ads conversion tracking) is configured to exclude protected health information. We do not transmit patient identifiers, symptom descriptions, or appointment details to advertising platforms. Any cookies or analytics deployed on the website are disclosed in this Privacy Policy, and the site honors applicable consent requirements.

Breach notification

In the event of a breach involving unsecured protected health information, the practice will notify affected individuals, the U.S. Department of Health and Human Services, and, where required, the media, in accordance with the HIPAA Breach Notification Rule.

Contact

Questions about this Privacy Policy or our information practices can be directed to our Privacy Officer at (410) 626-9680 or info@annapolistmj.com, or by mail at 888 Bestgate Rd, Suite 101, Annapolis, MD 21401.