Notice of Privacy Practices

Prisk Orthopaedics and Wellness, PC d/b/a POWFIT MD 2490 Mosside Blvd., Monroeville, PA 15146 | (412) 525-7692 | powfitmd.com

Pre-launch draft date: August 22, 2026

Working draft: This document is undergoing Pennsylvania healthcare-counsel review. It is not approved for patient enrollment or a clinical launch.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who We Are

This Notice applies to Prisk Orthopaedics and Wellness, PC ("P.O.W., PC"), doing business as POWFIT MD, and its clinical providers, including:

Victor Prisk, MD - Founder and Medical Director, board-certified orthopaedic surgeon
Elizabeth Headlee, CRNP - Certified Registered Nurse Practitioner, practicing under a collaborative agreement with a physician as required by Pennsylvania law

It also applies to our employees, staff, and other personnel, whether care is delivered by telehealth through powfitmd.com or in person at our Monroeville-area office. In this Notice, "protected health information" or "PHI" means information that identifies you and relates to your health, the care we provide you, or payment for that care.

We are required by law to maintain the privacy and security of your PHI, to give you this Notice of our legal duties and privacy practices, to notify you if a breach of your unsecured PHI occurs, and to follow the terms of the Notice currently in effect.

How We May Use and Disclose Your Health Information

1. Uses and Disclosures That Do Not Require Your Authorization

Treatment. We use your PHI to provide, coordinate, and manage your medical care. Examples:

Your physician or nurse practitioner reviews your intake, history, labs, and prior notes in our electronic health record (ModMed, operated by Modernizing Medicine) before and during your visit.
We send prescriptions electronically through our EHR's Surescripts-connected e-prescribing system to the pharmacy of your choice. Controlled substances are prescribed only through certified electronic prescribing (EPCS), as Pennsylvania law requires.
When your care involves a compounded medication, we share the prescription and minimum necessary demographic information with the qualified pharmacy you select and that is able to lawfully fill it, using an approved electronic or other legally permitted secure transmission channel.
We share information with laboratories that perform your bloodwork, with a collaborating or covering physician, and with other providers involved in your care (for example, your primary care physician, with your knowledge).

Payment. We use and disclose PHI to bill and collect payment for services. Because we are primarily a cash-pay practice, this typically means processing your membership or visit charges. Card processing is handled by our payment processor using only the minimum transaction information (name, amount, generic service description) - we intentionally keep clinical details out of the payment system. If you ask us to provide a superbill or claim to your insurer, we will disclose the PHI needed to do so.

Health Care Operations. We use PHI to run the practice: quality review of visits and enabled administrative systems, staff training and supervision, auditing, compliance, business planning, and customer service. If a future recording or AI transcript contains PHI, it may be reviewed by our workforce for quality and safety only after the feature's notice, consent, safeguards, and retention rules are approved. Vendors that handle PHI on our behalf are "business associates" and are bound by written agreements when required. A planned vendor is not permitted to receive PHI until the exact service and configuration are approved.

Other uses and disclosures permitted or required by law, without your authorization:

Required by law - when federal, state, or local law compels disclosure.
Public health activities - reporting to public health authorities (e.g., disease reporting, FDA adverse event reporting).
Victims of abuse, neglect, or domestic violence - to authorized government agencies as permitted or required by law.
Health oversight - audits, investigations, inspections, and licensure activities by agencies such as the Pennsylvania Department of Health, the State Boards of Medicine and Nursing, HHS, and the DEA (including prescription monitoring obligations under Pennsylvania's PDMP/ABC-MAP program).
Judicial and administrative proceedings - in response to a court order, or a subpoena with required protections.
Law enforcement - in limited circumstances defined by law.
Coroners, medical examiners, funeral directors - as necessary to carry out their duties.
Organ and tissue donation - to organizations handling procurement or transplantation.
Research - only under an IRB/privacy-board waiver or with your authorization.
To avert a serious threat to health or safety - to someone able to prevent or lessen the threat.
Specialized government functions - military, national security, protective services, correctional institutions.
Workers' compensation - as authorized by workers' compensation laws.

Appointment reminders, treatment alternatives, and health-related services. We may contact you (portal message, email, text, or phone) to remind you of appointments, notify you of lab results or refills, or tell you about treatment options and services we offer that may be relevant to your care. You may choose how we contact you (see "Confidential Communications" below) and may opt out of texts by replying STOP.

Family and friends involved in your care. With your verbal agreement, or if you do not object when given the opportunity, we may share relevant PHI with a family member or other person involved in your care or payment for your care. In an emergency or if you are incapacitated, we will use professional judgment to decide whether sharing is in your best interest.

2. Uses and Disclosures That Require Your Written Authorization

We will obtain your written authorization before:

Marketing - using or disclosing your PHI for marketing purposes (and if we would receive payment from a third party for the communication, the authorization will say so). Face-to-face communications and gifts of nominal value do not require authorization.
Sale of PHI - we do not sell PHI; any such disclosure would require your authorization.
Psychotherapy notes - most uses and disclosures, in the rare event we hold any.
Any other use or disclosure not described in this Notice.

You may revoke an authorization at any time, in writing, except to the extent we have already relied on it.

Please note: testimonials, before-and-after photos, and participation in our patient referral program are entirely voluntary and occur only with your specific written authorization.

Your Rights Regarding Your Health Information

Right to inspect and copy. You may inspect and obtain a copy of your medical and billing records, in electronic or paper form. Submit a written request to our Privacy Officer. We will act on your request within 30 days (with one 30-day extension permitted by law, in which case we will tell you why and give a new date). We may charge a reasonable, cost-based fee for copies. In limited circumstances we may deny access; where the denial is reviewable, you may request a review by another licensed professional. Much of your record is also available to you directly through our patient portal.

Right to request an amendment. If you believe information in your record is incorrect or incomplete, you may request an amendment in writing, with a reason. We may deny the request in certain cases (for example, if the record was not created by us or is accurate and complete); if we deny it, we will explain why in writing and you may submit a statement of disagreement that becomes part of your record.

Right to an accounting of disclosures. You may request a list of certain disclosures of your PHI made in the six (6) years before your request - excluding, among others, disclosures for treatment, payment, and health care operations and disclosures you authorized. The first accounting in any 12-month period is free; we may charge a cost-based fee for additional requests after notifying you.

Right to request restrictions. You may ask us to restrict how we use or disclose your PHI for treatment, payment, or operations, or to limit what we share with family members. We are not required to agree to most restrictions, but if we do agree we will honor the restriction except in emergencies. One restriction is mandatory: if you pay for a service in full out of pocket and ask us not to disclose that service to your health plan for payment or operations purposes, we must comply. Because POWFIT MD is primarily cash-pay, this right is particularly relevant to our patients.

Right to confidential communications. You may ask us to contact you by specific means or at a specific location (for example, only by portal message, or only at a particular phone number or email). We will accommodate all reasonable requests and will not ask you why.

Right to a paper copy of this Notice. You may request a paper copy at any time, even if you agreed to receive it electronically. It is also posted at powfitmd.com and available at our office.

Right to breach notification. We will notify you in writing, without unreasonable delay and no later than 60 days after discovery, if a breach of your unsecured PHI occurs.

Right to choose someone to act for you. A person with medical power of attorney or legal guardianship over you may exercise your rights and make choices about your PHI; we will verify their authority before acting.

Our Duties

We are required by law to keep your PHI private and secure, to provide you this Notice, and to abide by its terms.
We will not use or disclose your PHI other than as described in this Notice, unless you authorize it in writing.
We maintain administrative, technical, and physical safeguards for PHI in all approved systems we use, including our EHR and approved Google Cloud-hosted portal services. AI-assisted chat and phone tools are not currently enabled for the new platform. If enabled later, they must meet the same approval, agreement, minimum-necessary, access, audit, retention, and human-oversight requirements. All clinical decisions are made by licensed clinicians, not by automated tools.
We reserve the right to change this Notice and to make the new Notice effective for all PHI we maintain. The current Notice will always be posted at powfitmd.com and available at our office, with its effective date at the top.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us and/or with the federal government. We will never retaliate against you for filing a complaint.

With the practice: Victor Prisk, MD, Privacy Officer (412) 525-7692, or by mail to Prisk Orthopaedics and Wellness, PC d/b/a POWFIT MD, 2490 Mosside Blvd., Monroeville, PA 15146

With the U.S. Department of Health and Human Services, Office for Civil Rights: 200 Independence Avenue S.W., Washington, D.C. 20201 1-877-696-6775 | https://www.hhs.gov/ocr/complaints

Questions

Contact our Privacy Officer, Victor Prisk, MD, at (412) 525-7692 or by mail to Prisk Orthopaedics and Wellness, PC d/b/a POWFIT MD, 2490 Mosside Blvd., Monroeville, PA 15146.

Acknowledgment of Receipt of Notice of Privacy Practices

Draft acknowledgment placeholder — not for patient use. Do not collect an acknowledgment against this working draft. Counsel must first approve the exact Notice version and effective date and the consent manifest must bind those exact bytes.

I acknowledge that I have received (or been offered) a copy of the Prisk Orthopaedics and Wellness, PC d/b/a POWFIT MD Notice of Privacy Practices identified by the approved version and effective date presented to me. I understand that I may request a paper copy at any time and that the current approved Notice is posted at powfitmd.com.

Patient Name: ______________________________ Date of Birth: ______________

Signature: ______________________________ Date: ______________

If signed by a personal representative:

Representative Name: ______________________________ Relationship / Authority: ______________

For office use only - if acknowledgment could not be obtained: We made a good-faith effort to obtain the patient's written acknowledgment of receipt of this Notice, but were unable to because: ☐ Patient declined to sign ☐ Telehealth registration - electronic acknowledgment captured in portal ☐ Other: ______________ Staff initials: ________ Date: ________