Legal
Notice of Privacy Practices
This notice describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.
This applies to the health information we create and keep about you as a patient of thrē Clinic, and to everyone who works here — physicians, nurses, the nurse practitioner and administrative staff. It is separate from our website privacy policy, which covers what happens to information you send us through this site before you are a patient.
We are required by law to keep your health information private, to give you this notice explaining our legal duties and privacy practices, and to follow the terms of the notice currently in effect.
One thing about this practice changes what happens to your information, so it belongs at the top. We do not bill insurance. We do not send claims to your health plan and we do not receive payment from one. When you ask for a superbill so you can seek reimbursement yourself, we give it to you and you decide whether to send it on. The single largest routine disclosure most medical practices make — to a health plan — does not happen here unless you choose to make it.
How we may use and share your information without asking first
There are three categories where the law permits us to use your information without separate permission. In practice these are the ordinary business of taking care of you.
For treatment. To provide and coordinate your care. We send your Pap specimen to the laboratory and receive the result; we send a prescription to your pharmacy; we give your records to the hospital when you are admitted for delivery; we speak with the physician covering for us when we are unavailable.
For payment. To be paid for the care we provide. Because you pay us directly, this mostly means our own billing records and receipts. We keep a record of what you were charged and what you paid, and we prepare the superbill you asked for. We do not send that superbill to your insurer — you do.
For health care operations. To run the practice and keep the quality of care up. Reviewing charts to improve how we do things, training staff, and working with our lawyers, accountants and consultants — each of whom is bound to protect your information.
Other situations where the law permits or requires disclosure
We may use or share your information without your permission in these circumstances. Some we are required to do; others we may do.
- When required by law, including reporting we must make to state or federal authorities.
- Public health activities — reporting births and deaths, communicable disease, reactions to medications, and problems with medical products.
- Suspected abuse, neglect or domestic violence, where we are required or permitted to report. Arkansas makes every clinician here a mandated reporter of suspected child maltreatment.
- Health oversight, such as licensing bodies and audits.
- Judicial and administrative proceedings — in response to a court order, or to a subpoena or discovery request where the required assurances have been given. Our standing practice is that no records leave this office in response to a subpoena without review by the physician and by our attorney first. A subpoena is not the same thing as a court order.
- Law enforcement, in the limited circumstances the law allows.
- To avert a serious and imminent threat to your health or safety or to someone else's.
- Coroners, medical examiners and funeral directors.
- Organ and tissue donation.
- Workers' compensation, as state law requires.
- Specialized government functions — military, national security and protective services.
- Research, only where an institutional review board has approved the use and the required privacy protections are in place.
What always requires your written permission
We will ask you to sign an authorization before any of the following, and there are no exceptions.
- Most uses and disclosures of psychotherapy notes, if any are ever kept.
- Marketing — using your information to encourage you to buy a product or service where we are paid by a third party to do so.
- Selling your information. We do not and will not sell your health information.
- Any other use or disclosure not described in this notice.
You may cancel an authorization at any time, in writing. Cancelling it stops any future use or sharing. It cannot undo something we already did while it was in effect.
Two things worth stating plainly
Reproductive health information. We are an obstetrics and gynecology practice, so nearly everything in your chart is reproductive health information. Federal rules that would have imposed a separate attestation requirement before disclosing this category of information for investigative purposes were struck down by a federal court in 2025 and are no longer in effect. That does not change how we behave. We disclose your information only as this notice describes, we require review by the physician and our attorney before responding to any legal demand for reproductive health records, and we will tell you when we are permitted to tell you.
Substance use disorder records. If we ever create, receive or keep records protected by the federal substance use disorder confidentiality rules (42 CFR Part 2) — which can happen simply because another provider sent them to us — those records carry protections stronger than the rest of your chart. They may not be used or disclosed in any civil, criminal, administrative or legislative proceeding against you unless you give written consent or a court issues an order after you have had notice and a chance to be heard. Part 2 also limits what we may do with those records for treatment, payment and operations more tightly than HIPAA does, and where the two conflict, the stricter rule applies.
Your rights
These are yours to exercise. Ask any staff member, or write to the Privacy Officer below. We will not treat you differently for using any of them.
To see and get a copy of your records. Usually within 30 days. You may ask for paper or electronic copies, and you may ask us to send a copy to someone else. We may charge a reasonable cost-based fee. If we deny a request we will tell you why in writing and explain how to have that decision reviewed.
To ask us to correct your records. If you think something is wrong or incomplete, ask us to amend it. We may say no, and if we do we will explain why in writing, and you may file a statement of disagreement that becomes part of your record.
To get a list of who we shared it with. You may ask for an accounting of disclosures we made in the six years before your request. Routine disclosures — for treatment, payment, operations and ones you authorized — are not on that list. The first accounting in a 12-month period is free.
To ask us to limit what we use or share. You may ask us to restrict how we use or disclose your information. We are not required to agree, with one exception that matters here.
The exception: paying out of pocket. If you pay for a service in full, yourself, you may require us not to disclose information about that service to a health plan, and we must honor that. Because this practice is cash-pay, it may apply to everything we do for you. Worth knowing: if you submit your own superbill to your insurer, you have chosen to make that disclosure yourself, and this protection does not reach it.
To ask for confidential communication. You may ask us to contact you a particular way — a specific number, or by mail rather than by message — or at a particular address. We will accommodate reasonable requests and we will not ask you why.
To get a paper copy of this notice, any time you ask, even if you agreed to receive it electronically.
To be told if your information is breached. We will notify you if a breach compromises the privacy or security of your information.
To choose someone to act for you. A person with medical power of attorney, or your legal guardian, may exercise these rights on your behalf. We will confirm the authority before we act.
If you are under 18
Arkansas law lets a minor consent to some of her own care, and where she has consented herself she generally controls the information about it. It also has limits. We will not promise you confidentiality we cannot deliver. At your first private conversation with the physician, before you tell us anything, we will explain what stays between us and what does not. If you are ever unsure, ask before you answer — that question is always welcome and it will never be held against you.
Our duties
We are required by law to protect the privacy of your health information, to give you this notice, to follow the terms of the notice currently in effect, and to notify you if a breach compromises your information.
We may change this notice, and a change applies to information we already hold as well as information we create afterward. The current version is always posted in the office and on this page, with its effective date, and we will give you a copy when you ask.
How to complain
Tell us first if you are willing to — we would rather fix it. Our Privacy Officer is Tyler Lloyd, MD, at 215 NW A Street, Suite 410, Bentonville, Arkansas 72712 · 405.317.4893 · privacy@thre.health.
You may also complain to the federal government, and you do not have to tell us first. Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, D.C. 20201 · 1-877-696-6775 · hhs.gov/ocr/privacy/hipaa/complaints.
We will not retaliate against you for filing a complaint. Not in your care, not in your membership, not in any way. If you ever feel otherwise, say so directly to Dr. Lloyd.