Download this Notice of Privacy Practices (PDF)
Effective date: November 2, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This notice describes the privacy practices of Barlow Health Services. It explains how we may use and disclose protected health information, our responsibilities, and your rights.
For questions or help using your rights, contact:
Barlow Health Services, ATTN Privacy Officer
301 W Main Street, Thurmont, MD 21788
Phone: (301) 660-3095
Email: office@barlowhealthservices.com
Please call for instructions before sending medical records or sensitive health details through ordinary email.
Your rights
See or receive your records. You may ask to inspect or obtain an electronic or paper copy of medical and billing information we maintain about you, subject to applicable legal exceptions. Contact the Privacy Officer for instructions. We respond within the time required by law and may charge only fees permitted by law. If we deny a request, we explain the reason and any available review rights.
Request a correction. You may ask us to amend information you believe is inaccurate or incomplete. Tell the Privacy Officer what you want corrected and why. We may deny a request when permitted by law, but we will explain the denial in writing and explain your right to submit a statement of disagreement.
Request confidential communications. You may ask us to contact you in a particular way or at a particular address. Contact the Privacy Officer with your preferred arrangement. We accommodate reasonable requests.
Ask us to restrict uses or disclosures. You may ask us to limit information used or shared for treatment, payment, or health care operations. We generally do not have to agree. However, when you or someone other than your health plan pays in full for an item or service, you may request that we not disclose information solely about that item or service to your health plan for payment or health care operations. We must honor a qualifying request unless disclosure is required by law. Contact the office before information is submitted to your plan so that the request can be addressed.
Request an accounting of disclosures. You may ask the Privacy Officer for a list of certain disclosures made during a period of up to six years before your request. Disclosures for treatment, payment, health care operations, and certain other legally excluded disclosures are not included. One accounting in a 12-month period is free; any fee for additional accountings will be explained in advance and must be permitted by law.
Receive this notice. You may request a paper copy at any time, even if you previously agreed to receive it electronically. Contact the office for a copy.
Have a representative act for you. A person legally authorized to act as your personal representative may exercise applicable rights on your behalf. We verify the person’s authority and apply any legal limitations.
File a complaint. If you believe your privacy rights were violated, contact the Privacy Officer using the information above. You may also complain to the U.S. Department of Health and Human Services Office for Civil Rights through its complaint instructions. We will not retaliate against you for making a complaint.
How we may use and disclose information
These uses and disclosures are subject to applicable law. When another law provides greater protection, including laws governing certain mental-health or substance-use-disorder records, we follow the applicable additional restrictions.
Maryland protections. Maryland law limits disclosure and redisclosure of medical records and generally prohibits their sale, rental, or barter, with a limited exception for a lawful practice or facility ownership transfer. We follow these restrictions. Mental-health records have additional protections; when disclosed without authorization, only information relevant to the permitted purpose may be released. Legal demands must meet applicable Maryland procedural and notice requirements. These restrictions apply in addition to the federal protections described here. Maryland Health–General §§ 4-302, 4-307, and 4-306.
Treatment. We may use your information to provide care and share it with other professionals involved in treating you. For example, we may share relevant results with a clinician coordinating your care.
Payment. We may use and disclose information to bill and obtain payment for care. For example, a health plan may receive information about services when processing a claim, subject to an applicable restriction you requested.
Health care operations. We may use and disclose information to operate the practice, review quality, and manage services. For example, we may review records to evaluate how care is delivered. Service providers who handle protected health information for us must meet applicable privacy obligations.
People involved in your care. When permitted, we may share relevant information with people involved in your care or payment, based on your agreement or opportunity to object. If you cannot express a preference, we may use professional judgment as allowed by law. Similar rules may permit limited sharing for disaster relief.
Other legally permitted or required purposes. Subject to the conditions and limits of applicable law, we may disclose information for public-health reporting; reporting suspected abuse or neglect; health oversight; approved research or research permitted under privacy rules; workers’ compensation; organ or tissue donation; coroners, medical examiners, or funeral directors; certain law-enforcement or government functions; and court or administrative proceedings. We may share information when necessary to address a serious and imminent threat as permitted by law, and when legally required, including with HHS to assess privacy-rule compliance. A request or subpoena does not automatically permit every disclosure.
Additional protection for Part 2 records. To the extent we hold substance-use-disorder patient records protected by 42 CFR Part 2, we will not use or disclose those records, or testimony revealing their contents, in civil, criminal, administrative, or legislative proceedings against you without your written consent or a qualifying court order after the required notice and opportunity to be heard. A court order authorizing disclosure must also be accompanied by a subpoena or another legal requirement compelling disclosure. Other applicable Part 2 limits also apply.
When written permission is required
Uses and disclosures not described in this notice require your written authorization unless otherwise permitted or required by law. Marketing and most uses or disclosures of psychotherapy notes require authorization, subject to the exceptions established by law. Federal authorization rules do not override Maryland’s prohibition on sale, rental, or barter of medical records; we follow the stricter applicable rule.
You may revoke an authorization in writing by contacting the Privacy Officer. Revocation generally applies to future uses and disclosures; it does not undo actions already taken in reliance on your authorization or other exceptions allowed by law.
A newsletter subscription by itself does not establish a valid HIPAA marketing authorization. Communications that fall within a legal exception remain subject to applicable privacy protections.
Fundraising. We do not use your protected health information for fundraising.
Our responsibilities
We are required by law to protect the privacy of your protected health information, provide this notice of our duties and practices, and notify affected people following a breach of unsecured protected health information as required by law. We follow the notice currently in effect.
We may revise this notice and, where permitted, make the revised terms apply to information we already maintain as well as information received later. We will provide the revised notice on request, make it available on our website and at any service location, and follow applicable notice-distribution requirements. The effective date will identify the applicable version.
Questions about website information
This medical privacy notice is separate from the website privacy notice. Public website browsing does not create a patient account or submit an intake form. Contact the office for help accessing the practice’s Tebra patient communication channel.
For website privacy information, see the website privacy page.