​​

NOTICE OF PRIVACY PRACTICES

​

Lisa R. Kroopf, MD, a Professional Medical Corporation

Doing business as:

Monterey Pain & Spine Institute
Majestic MD Spa

172 El Dorado Street
Monterey, CA 93940

Monterey Pain & Spine Institute: (831) 901-3940
Majestic MD Spa: (831) 231-8586

​

Effective Date: July 14, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, HOW YOU CAN ACCESS THIS INFORMATION, AND YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION.

PLEASE REVIEW IT CAREFULLY.

​

This Notice applies to Lisa R. Kroopf, MD, a Professional Medical Corporation, including its operations under the names Monterey Pain & Spine Institute and Majestic MD Spa.

Throughout this Notice, the terms “we,” “our,” “us,” and “the Practice” refer collectively to the corporation and both practice names.

​

We are required by law to maintain the privacy and security of your protected health information, provide you with this Notice of our legal duties and privacy practices, and follow the terms of the Notice currently in effect.

Protected health information generally includes information that identifies you and relates to:

• Your past, present, or future physical or mental health or condition;

• Healthcare services provided to you; or

• Payment for your healthcare.
   

Your Rights

You have the following rights regarding your health information.

Get an electronic or paper copy of your medical record

You may ask to inspect or receive an electronic or paper copy of your medical record and other health information we maintain about you.

We will generally provide a copy or summary within the time required by law. We may charge a reasonable, cost-based fee as permitted by federal and California law.

In limited circumstances, we may deny access to certain information. When applicable, you may have the right to request a review of that decision.

Ask us to correct your medical record

You may ask us to correct health information that you believe is inaccurate or incomplete.

We may deny your request in certain circumstances. If we deny it, we will provide a written explanation as required by law. You may submit a written statement of disagreement for inclusion in your record.

Request confidential communications

You may ask us to contact you in a particular way or at a particular location.

For example, you may ask us to:

• Contact you only at a specific telephone number;

• Avoid leaving detailed voicemail messages;

• Send mail to a different address; or

• Use a particular email address.

We will accommodate reasonable requests.

Ask us to limit what we use or disclose

You may ask us not to use or disclose certain health information for treatment, payment, or healthcare operations.

We are generally not required to agree to your request.

However, we generally must agree when:

• The disclosure would be made to a health plan for payment or healthcare operations;

• The information relates only to a healthcare service or item for which you, or someone other than the health plan, paid in full; and

• The disclosure is not otherwise required by law.

Receive a list of certain disclosures

You may request an accounting of certain disclosures of your health information made during the six years before the date of your request, or another period permitted by law.

The accounting will not include every disclosure. For example, it generally will not include disclosures:

• For treatment, payment, or healthcare operations;

• Made directly to you;

• Made with your written authorization;

• Incidental to an otherwise permitted use or disclosure;

• Made to family members or others involved in your care when legally permitted; or

• Made for certain national-security, correctional, or law-enforcement purposes.

We will provide one accounting during any 12-month period without charge. We may charge a reasonable fee for additional requests after informing you of the cost.

Receive a copy of this Notice

You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

A current copy is also available on our website.

Choose someone to act for you

If you have given someone medical power of attorney, or another person is legally authorized to act for you, that person may exercise your privacy rights and make choices about your health information.

We may verify that the person has the appropriate legal authority before taking action.

File a privacy complaint

You may file a complaint if you believe your privacy rights have been violated.

You may contact:

HIPAA Privacy Officer
Lisa R. Kroopf, MD, a Professional Medical Corporation
Monterey Pain & Spine Institute and Majestic MD Spa
172 El Dorado Street
Monterey, CA 93940

Phone: [Insert primary privacy-contact number]
Email: [Insert privacy-contact email]

You may also file a complaint with the:

U.S. Department of Health and Human Services
Office for Civil Rights

We will not retaliate against you for filing a complaint.

Your Choices

For certain health information, you may tell us your preferences regarding how we disclose it.

Family members, friends, caregivers, and others involved in your care

You may tell us whether we may disclose relevant health information to:

• A family member;

• A friend;

• A caregiver;

• A personal representative; or

• Another person involved in your care or payment for your care.

If you are unable to communicate your preference, such as during an emergency, we may disclose relevant information if we determine that doing so is in your best interest and is permitted by law.

We may also disclose information when necessary to lessen a serious and imminent threat to your health or safety or the health or safety of another person.

You may identify individuals with whom we are authorized to communicate on a separate patient-communication form.

Disaster-relief situations

We may disclose limited information to an organization assisting with disaster-relief efforts so that family members or others responsible for your care may be informed of your location, general condition, or death.

You may tell us not to make this disclosure when circumstances permit.

Marketing

We must obtain your written authorization for most uses or disclosures of protected health information for marketing purposes.

Certain communications about treatment alternatives, care coordination, case management, our own healthcare services, or health-related products and services may be permitted without written authorization when allowed by law.

Sale of health information

We will not sell your protected health information without your written authorization, except where otherwise permitted by law.

Fundraising

We may contact you regarding fundraising activities when legally permitted. You may tell us not to contact you again for fundraising purposes.

If we maintain substance-use-disorder patient records protected by 42 CFR Part 2, we will provide clear and conspicuous notice before using such information for fundraising and give you an opportunity to opt out.

Psychotherapy notes

Most uses or disclosures of separately maintained psychotherapy notes require your written authorization when such notes are maintained and protected under applicable law.

How We May Use and Disclose Your Information

We may use or disclose your protected health information without your written authorization for the following purposes.

Treat you

We may use or disclose your health information to provide, coordinate, or manage your healthcare.

For example, we may disclose relevant information to:

• Your primary care physician;

• A referring physician;

• A specialist;

• A pharmacy;

• A laboratory;

• An imaging facility;

• A hospital;

• A surgery center;

• A therapist; or

• Another healthcare provider involved in your care.

Bill for your services

We may use or disclose your health information to obtain payment for services provided to you.

For example, we may disclose information to:

• Your health plan;

• A claims administrator;

• A billing company;

• A utilization-review organization;

• A workers’ compensation carrier, when legally permitted; or

• Another person or organization responsible for payment.

This may include determining eligibility, obtaining prior authorization, submitting claims, appealing payment decisions, coordinating benefits, collecting amounts owed, or responding to coverage inquiries.

Run our organization

We may use or disclose your health information for healthcare operations necessary to manage the Practice and improve the quality of care.

Examples include:

• Quality assessment and improvement;

• Reviewing provider performance;

• Staff training;

• Credentialing;

• Compliance activities;

• Auditing;

• Legal and accounting services;

• Business planning and management;

• Patient-safety activities;

• Customer service;

• Care coordination;

• Evaluating the effectiveness of our services; and

• Managing memberships, packages, programs, or patient accounts.

Contact you about appointments and healthcare services

We may contact you regarding:

• Appointments and scheduling changes;

• Appointment reminders;

• Follow-up care;

• Test or imaging results;

• Treatment recommendations;

• Prescription or medication matters;

• Treatment alternatives;

• Healthcare services that may be relevant to you; and

• Administration of memberships, packages, credits, deposits, or patient accounts.

We may communicate using telephone calls, voicemail, email, text message, patient portals, or other communication methods you have provided or authorized.

Electronic communications may involve privacy risks. Your communication preferences and consent for voicemail, email, and text messaging may be addressed in a separate communication-consent form.

Work with our business associates

We may disclose health information to outside individuals or organizations that perform services for us.

Examples include:

• Billing companies;

• Information-technology providers;

• Electronic health-record vendors;

• Scheduling and electronic-intake platforms;

• Medical-record storage providers;

• Laboratories;

• Accountants;

• Attorneys;

• Consultants;

• Collection agencies; and

• Practice-management providers.

Our business associates are required to appropriately protect your health information.

Help with public-health and safety issues

We may use or disclose health information for certain public-health and safety activities, including:

• Preventing or controlling disease;

• Reporting certain communicable diseases;

• Reporting adverse reactions to medications, devices, or products;

• Reporting product recalls;

• Reporting suspected abuse, neglect, or domestic violence;

• Preventing or reducing a serious threat to health or safety;

• Complying with workplace-surveillance requirements when legally authorized; and

• Reporting information to authorized public-health agencies.

Health-oversight activities

We may disclose health information to authorized agencies for activities such as:

• Audits;

• Investigations;

• Inspections;

• Licensure or disciplinary proceedings;

• Government healthcare-program oversight;

• Compliance reviews; and

• Other legally authorized oversight activities.

Comply with the law

We may use or disclose health information when federal, California, or local law requires or permits us to do so.

When California law or another applicable law provides greater privacy protection than HIPAA, we will follow the more protective law.

Respond to lawsuits and legal actions

We may disclose health information in response to:

• A court order;

• An administrative order;

• A subpoena;

• A discovery request; or

• Another lawful legal process.

We will disclose information only after applicable legal requirements have been satisfied.

Law-enforcement purposes

We may disclose limited health information to law-enforcement officials when permitted or required by law.

This may include disclosures:

• In response to certain court orders, warrants, subpoenas, or administrative requests;

• To identify or locate certain individuals;

• To report certain wounds or injuries;

• Concerning suspected criminal activity on our premises;

• Concerning a death that may have resulted from criminal conduct; or

• To prevent or lessen a serious and imminent threat to health or safety.

Coroners, medical examiners, and funeral directors

We may disclose health information to coroners, medical examiners, or funeral directors when permitted or required by law.

Organ and tissue donation

We may disclose health information to organizations involved in organ, eye, or tissue donation and transplantation when applicable.

Workers’ compensation

We may disclose health information as authorized by and necessary to comply with workers’ compensation laws or similar programs.

Research

We may use or disclose health information for research when:

• You provide written authorization;

• An authorized institutional review board or privacy board approves a waiver; or

• Another provision of law permits the use or disclosure.

Specialized government functions

When legally permitted, we may disclose health information for certain:

• Military and veterans’ activities;

• National-security and intelligence activities;

• Protective services;

• Correctional-institution activities; or

• Government-benefit programs.

Uses and Disclosures Requiring Written Authorization

We will obtain your written authorization before using or disclosing your health information when authorization is required by law.

Examples may include:

• Uses or disclosures not otherwise permitted for treatment, payment, or healthcare operations;

• Most uses or disclosures of psychotherapy notes;

• Most marketing communications for which the Practice receives financial remuneration;

• The sale of protected health information; and

• Disclosures to individuals or organizations not otherwise permitted to receive the information.

You may revoke an authorization in writing at any time.

Your revocation will not affect actions already taken in reliance on the authorization before it was revoked.

We will not condition treatment on your signing an authorization except in limited circumstances permitted by law.

Substance-Use-Disorder Patient Records

To the extent that the Practice receives or maintains substance-use-disorder patient records protected by 42 CFR Part 2, those records may receive additional federal confidentiality protections.

Part 2 records, and testimony describing information contained in those records, generally may not be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding against you unless:

1. You provide valid written consent; or

2. A court issues an order and a subpoena or similar legal mandate that satisfies applicable federal requirements.

A general authorization for the release of medical records may not always be sufficient to authorize the use or disclosure of information protected by Part 2.

When permitted by law, a patient may provide a single consent for future uses and disclosures of Part 2 records for treatment, payment, and healthcare operations. Information disclosed under such consent may be redisclosed as permitted by HIPAA, except when Part 2 or another law provides additional restrictions.

To the extent we maintain Part 2 records, we will comply with applicable breach-notification requirements and provide appropriate notice before using Part 2 information for fundraising communications.

This section does not mean that Monterey Pain & Spine Institute or Majestic MD Spa operates a federally assisted substance-use-disorder treatment program. It applies when the Practice receives, maintains, uses, or discloses records that are legally protected by Part 2.

Our Responsibilities

We are required to:

• Maintain the privacy and security of your protected health information;

• Provide you with this Notice describing our legal duties and privacy practices;

• Follow the terms of the Notice currently in effect;

• Notify you following a breach when required by law;

• Honor your privacy rights as described in this Notice; and

• Avoid using or disclosing your information other than as described in this Notice unless you provide written authorization or the law otherwise permits or requires the use or disclosure.

We will notify you promptly if a breach occurs that may have compromised the privacy or security of your protected health information, as required by law.

Changes to This Notice

We reserve the right to change the terms of this Notice and our privacy practices.

Any revised Notice may apply to health information we already maintain as well as information we create or receive in the future.

When we make a material change, we will update the effective date and make the current Notice available:

• At our offices;

• Upon request; and

• On our website.

Questions or Additional Information

For questions about this Notice or our privacy practices, contact:

HIPAA Privacy Officer
Lisa R. Kroopf, MD, a Professional Medical Corporation
Doing business as Monterey Pain & Spine Institute and Majestic MD Spa

172 El Dorado Street
Monterey, CA 93940

Phone: 831-901-3940
Email: admin@montereypainandspine.com

Notice based on the current HHS model for healthcare providers. It includes the required effective date and the updated language concerning substance-use-disorder records that covered entities were required to add beginning February 16, 2026. (HHS.gov)