FaceLoveFacial Plastic Surgery

HIPAA

Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: September 3, 2026

Who to contact about this Notice

Privacy Officer: Sanjay P. Keni, MD

Practice: Sanjay P. Keni, MD, S.C., d/b/a FaceLove Facial Plastic Surgery

Address: One TransAm Plaza Drive, Suite 312, Oakbrook Terrace, IL 60181

Phone: 630.613.9660   Email: support@drkeni.com

Our legal duty

We are required by applicable federal and state law to maintain the privacy of your Protected Health Information (PHI), to give you this Notice describing our legal duties and privacy practices, to notify you following a breach of unsecured PHI, and to abide by the terms of the Notice currently in effect.

Changes to this Notice

We reserve the right to change this Notice and to make the revised Notice effective for all PHI we maintain, including information created or received before the change. If we make a material change, we will post the revised Notice in our office and on our website, and you may obtain a copy at any time by asking at the front desk or contacting the Privacy Officer above.

How we may use and disclose your health information

  • Treatment. We may use your health information to provide you with care, and share it with physicians, nurses, technicians, students, and other personnel involved in your care, including providers outside this practice who are treating you.
  • Payment. We may use and disclose your health information to bill and collect payment from you, an insurance company, or another third party, and to obtain prior authorization for care.
  • Health care operations. We may use your health information to run the practice — assessing quality of care, reviewing the performance of staff, training, licensing and accreditation, audits, and business planning.
  • Appointment reminders, treatment alternatives, and health-related benefits. We may contact you to remind you of an appointment, to follow up after a procedure, or to tell you about treatment options or services that may be of interest to you.
  • People involved in your care. Unless you object, we may share information relevant to your care with a family member, friend, or other person you identify, and we may notify such a person of your location or general condition.

Other uses and disclosures permitted or required without your authorization

We may use or disclose your health information without your authorization in the following circumstances, subject to the limits set by law:

  • As required by law, including by federal, state, or local statute, regulation, or court order.
  • Public health activities, such as reporting disease, injury, births and deaths, adverse events involving drugs or devices, and product recalls.
  • Victims of abuse, neglect, or domestic violence, to the authorities permitted by law to receive such reports.
  • Health oversight activities, including audits, investigations, inspections, and licensure or disciplinary actions.
  • Judicial and administrative proceedings, in response to a court or administrative order, or to a subpoena or discovery request where the required assurances have been given.
  • Law enforcement, in the limited circumstances the law allows — for example certain reportable wounds, identifying or locating a suspect or missing person, or a crime on our premises.
  • Coroners, medical examiners, and funeral directors, to permit them to carry out their duties.
  • Organ and tissue donation, to organizations that handle procurement or transplantation.
  • Research, where an institutional review board or privacy board has approved a waiver of authorization, or where the information has been de-identified.
  • To avert a serious and imminent threat to the health or safety of you or another person.
  • Specialized government functions, including military and veterans activities, national security and intelligence, protective services, and correctional institutions.
  • Workers’ compensation, as authorized by and to the extent necessary to comply with workers’ compensation laws.

Stronger protections under state and other federal law

Where state law or another federal rule gives greater privacy protection or imposes stricter limits on disclosure than HIPAA, we follow the stricter rule.

  • Mental health and developmental disabilities records. Under the Illinois Mental Health and Developmental Disabilities Confidentiality Act (740 ILCS 110/), mental health records and communications are strictly confidential. We will not disclose them without your specific written consent, even for routine treatment or care coordination, unless an explicit statutory exception applies.
  • Substance use disorder records. Under 42 CFR Part 2, records originating from a federally assisted substance use disorder program may not be used or disclosed in criminal, civil, or administrative proceedings against you without your specific written consent or an authorizing court order.
  • HIV and AIDS information. Under the Illinois AIDS Confidentiality Act, HIV test results and related identifying information will not be released without your specific, separate written authorization, except as expressly required or permitted by state public health law.
  • Genetic and biomarker information. Under the Illinois Genetic Information Privacy Act (410 ILCS 513/), genetic test results and protected biomarker data are confidential and will not be disclosed to any outside party without your prior informed written consent.

Uses and disclosures that require your written authorization

The following always require your specific written authorization:

  • Psychotherapy notes, except in the narrow circumstances the law allows.
  • Marketing communications, and any disclosure that constitutes a sale of your health information.
  • Use of your photographs, video, or testimonial for teaching, publication, our website, social media, or advertising. Clinical photography is part of your medical record and is taken as part of your care; any use beyond your record is optional, is described in a separate consent and authorization form, and is entirely up to you.

Any other use or disclosure not described in this Notice will be made only with your written authorization. You may revoke an authorization at any time by writing to the Privacy Officer. Revocation stops any future use or disclosure, but it cannot undo anything we did in reliance on the authorization before we received your revocation.

Your rights

  • Inspect and copy. You may inspect and request a copy of your medical and billing records, on paper or electronically. We will respond within 30 days and may charge a reasonable, cost-based fee.
  • Request an amendment. If you believe information in your record is incomplete or incorrect, you may ask us to amend it. We may deny the request, and if we do we will explain why in writing and you may submit a statement of disagreement.
  • Accounting of disclosures. You may request a list of certain disclosures we have made of your health information.
  • Request restrictions. You may ask us to restrict how we use or disclose your information. We are not required to agree — with one exception: if you pay for an item or service in full, out of pocket, you have the right to restrict disclosure of that information to your health plan, and we must honor that request.
  • Confidential communications. You may ask us to contact you a particular way or at a particular address — for example by cell phone only, or at a different mailing address.
  • Breach notification. You have the right to be notified if there is a breach of your unsecured health information.
  • Revoke an authorization. You may revoke any written authorization you have given us, as described above.
  • Paper copy of this Notice. You may ask for a paper copy at any time, even if you agreed to receive it electronically.
  • Choose someone to act for you. If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will confirm the person has this authority before we act.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with the Privacy Officer named above, or with the U.S. Department of Health and Human Services, Office for Civil Rights, or with the Illinois Attorney General. We will give you the address on request. You will not be penalized or retaliated against in any way for filing a complaint.

Effective date

This Notice takes effect on September 3, 2026 and remains in effect until we replace it.

Separately from this Notice, our privacy policy describes what this website collects, and our biometric policy describes how before-and-after photographs are aligned.