Privacy Policy & HIPAA
Notice of Privacy Practices

This Privacy Policy and HIPAA Notice of Privacy Practices applies to Marshall H. Brown, DDS & Associates, located at 1818 8th Avenue, Fort Worth, TX 76110, and all associated dental professionals, staff members, volunteers, trainees, and other personnel working under our supervision (collectively referred to as "our practice," "we," "us," or "our").

This document governs both: (1) how we handle your Protected Health Information (PHI) as a dental healthcare provider subject to HIPAA, and (2) how we collect and handle personal information through our website at marshallhbrown.com.

This Notice applies to all records of the care and services you receive at our practice, whether created by our staff, by other healthcare professionals treating you, or any information we receive from other healthcare providers. Our practice will abide by the terms of the version of this Notice currently in effect.

Protected Health Information (PHI) is any information we hold that relates to your past, present, or future physical or mental health condition, the provision of dental or healthcare services to you, or payment for those services — and that could be used to identify you individually.

PHI includes, but is not limited to:

• Your name, address, date of birth, Social Security number, and telephone number
• Dental and medical history, diagnoses, and treatment records
• X-rays, photographs, and clinical examination findings
• Prescription and medication information
• Insurance information, billing records, and payment history
• Information provided by other treating healthcare providers
• Any other information that could identify you in connection with your healthcare

Information We Collect Through Our Website

When you interact with our website, we may collect non-PHI information including:

• Your name and email address (when provided voluntarily through contact forms)
• Phone number (when submitted via appointment request forms)
• IP address, browser type, and device information (automatically collected)
• Pages visited and time spent on our website (analytics data)

HIPAA permits us to use and disclose your PHI for the following primary purposes without requiring your separate written authorization. These uses are known as Treatment, Payment, and Healthcare Operations (TPO):

Treatment

We use your PHI to provide, coordinate, or manage your dental care and related services. For example, we share relevant information with dental specialists, oral surgeons, labs, or other healthcare providers involved in your care. We may also contact you to remind you of upcoming appointments or follow up on treatment.

Example: Dr. Brown shares your X-rays and treatment notes with an oral surgeon for a referral.

Payment

We use and disclose your PHI to bill you and to collect payment from your insurance company or other payer for the dental services we provide. This includes verifying insurance coverage, submitting claims, and resolving billing disputes.

Example: We submit a claim to your dental insurer for a crown procedure, including your diagnosis and treatment information.

Healthcare Operations

We use PHI for internal business purposes necessary to run our practice effectively, including quality assessment, staff training, compliance reviews, and administrative functions.

Example: We review patient records to evaluate quality of care and identify areas for improvement.

Additional Uses That May Not Require Authorization

• Appointment reminders via phone, text, or mail
• Information about treatment alternatives or other health-related benefits and services
• Contacting family members or caregivers involved in your care (as appropriate)
• Public health activities required by law
• Health oversight activities (e.g., audits, inspections)
• As required by law (e.g., court orders, subpoenas)
• For research purposes under strict privacy protections
• To prevent serious threats to health or safety
• For workers' compensation purposes
• Coroners, medical examiners, and funeral directors
• Organ and tissue donation

Uses That Require Your Written Authorization

For any purpose not described in this Notice, we will ask for your written authorization before using or disclosing your PHI. You may revoke your authorization in writing at any time. Common examples:

• Marketing purposes (we do not sell your PHI)
• Sale of your PHI to third parties (we do not do this)
• Any use not permitted by HIPAA without your consent

We may share your health information with the following categories of third parties as permitted or required by law:

Business Associates

All Business Associates are required by law to sign a Business Associate Agreement (BAA) that obligates them to maintain the same privacy and security standards we follow under HIPAA.

Under HIPAA, you have significant rights regarding your Protected Health Information. To exercise any of these rights, please submit a written request to our Privacy Officer at the address listed in Section 12.

When you visit marshallhbrown.com, we may collect non-personally identifiable information automatically through standard web technologies. This information is used solely to improve website performance and your experience.

Information Collected Automatically

• IP address (anonymized where possible)
• Browser type, version, and operating system
• Referring website or source
• Pages visited and time spent on each page
• Date and time of visit
• General geographic location (city/region level only)

Contact Form Data

When you submit an appointment request or contact form, we collect only the information you provide: your name, phone number, and email address. This information is used only to respond to your inquiry and schedule your appointment.

Email Communications

Unencrypted email is not fully secure. If you choose to contact us by email, you accept the risk that information may not remain private. For sensitive health matters, please call our office directly.

Our website uses standard browser cookies and similar technologies to enhance your browsing experience. Cookies are small data files stored on your device by your browser.

You can control and delete cookies through your browser settings at any time. We do not use cookies to collect or transmit your Protected Health Information. For full details, see our Cookie Policy.

We implement comprehensive administrative, physical, and technical safeguards as required by HIPAA's Security Rule (45 CFR Part 164, Subpart C).

Administrative Safeguards

• Designated HIPAA Privacy Officer responsible for policy implementation
• Regular staff training on HIPAA Privacy and Security Rules
• Written privacy and security policies and procedures
• Business Associate Agreements with all applicable vendors
• Sanction policies for workforce members who violate privacy rules

Physical Safeguards

• Locked office facilities with controlled access
• Secure storage of physical patient records
• Workstation controls to prevent unauthorized computer screen access
• Secure disposal of PHI through shredding and certified destruction

Technical Safeguards

• Encrypted electronic health records system
• Unique user IDs and passwords for all staff accessing PHI
• Automatic logoff from systems after periods of inactivity
• Audit logs tracking access to electronic PHI
• SSL/TLS encryption on our website (HTTPS)
• Firewall and antivirus protection on all practice computers
• Regular security risk assessments