Privacy Policy

Pacific Bone & Joint | Paul N. Morton, MD

Last updated: October 4, 2026

Pacific Bone & Joint respects your privacy. This Website Privacy Policy explains how information may be collected, used, disclosed, and protected when you visit our websites or communicate with us through website-based services.

1. Scope of This Privacy Policy

This Privacy Policy applies to information collected through websites operated by or on behalf of Pacific Bone & Joint, including pacificboneandjoint.com and related Pacific Bone & Joint web properties that link to this policy.

This Website Privacy Policy is separate from Pacific Bone & Joint's Notice of Privacy Practices.

If you become a patient, certain information that Pacific Bone & Joint creates, receives, or maintains about your healthcare may constitute protected health information ("PHI") under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and other applicable laws.

PHI maintained as part of your medical record is governed by our Notice of Privacy Practices and applicable law rather than solely by this Website Privacy Policy.

Nothing in this Website Privacy Policy is intended to modify or replace our Notice of Privacy Practices.

2. Information You Provide to Us

You may voluntarily provide information to Pacific Bone & Joint when you:

request an appointment;
submit a contact form;
request information about a treatment or service;
communicate with our office;
request a second opinion;
register for a patient service;
submit insurance or scheduling information;
upload documents or images through an authorized patient platform; or
otherwise interact with a website feature.

Depending on the service, information you provide may include:

name;
telephone number;
email address;
date of birth;
preferred location;
preferred appointment date or time;
reason for your visit;
insurance information;
communication preferences;
information contained in a message you submit; and
other information you choose to provide.

Please provide only the information reasonably necessary for us to respond to your request.

3. Medical Information and Website Forms

Website forms, ordinary email, and standard text messaging may not be appropriate for detailed or highly sensitive medical information unless the communication occurs through a specifically designated secure healthcare platform.

Do not use a general website contact form to send information that is not necessary to schedule an appointment or respond to your inquiry.

When information you submit becomes part of your medical record, its subsequent use and disclosure may be governed by HIPAA, Hawaiʻi law, our Notice of Privacy Practices, and other applicable requirements.

4. Information Collected Automatically

When you visit our website, certain information may be collected automatically by our website, hosting provider, analytics providers, security services, or other technology vendors.

This information may include:

Internet Protocol ("IP") address;
browser type;
device type;
operating system;
referring website;
pages viewed;
approximate geographic region;
date and time of access;
time spent on particular pages;
links or buttons selected;
general navigation patterns;
website errors;
form interactions; and
other technical information regarding website use.

This information helps us maintain, secure, understand, and improve our websites.

5. Website Analytics

Pacific Bone & Joint may use website analytics services such as Google Analytics 4 to understand how visitors find and use our websites.

Analytics information may include:

pages viewed;
approximate geographic location derived from an IP address;
device and browser information;
referring source;
time spent on pages;
navigation through the site; and
certain website interactions or conversion events.

For example, analytics systems may record events such as:

selecting a telephone-number link;
selecting an appointment button;
submitting a website form;
visiting a scheduling page;
reaching an appointment-confirmation page; or
interacting with educational content.

Analytics information is primarily used to understand website performance and improve the experience for visitors.

We do not intentionally send medical diagnoses, treatment details, medical-record information, or other information we consider protected health information to general-purpose website analytics providers.

6. Microsoft Clarity and Website Experience Analytics

Pacific Bone & Joint may use Microsoft Clarity or similar website-experience tools to better understand how visitors use our websites.

These tools may provide aggregated or pseudonymous information regarding website interaction, such as:

pages visited;
scrolling behavior;
navigation paths;
clicks or taps;
device and browser characteristics; and
general website usability patterns.

These tools may use cookies or similar technologies.

Where session-replay or similar functionality is used, we endeavor to configure website tools so that information entered into sensitive fields is masked, excluded, or otherwise protected as appropriate.

These technologies are used to identify website problems, improve usability, and better understand how visitors interact with the website.

7. Cookies and Similar Technologies

Cookies are small files or identifiers that a website may store on your browser or device.

Our websites may use cookies and similar technologies for several purposes.

Essential and Functional Technologies

These technologies may be used to:

maintain website functionality;
remember user preferences;
maintain security;
prevent malicious or automated activity; and
provide requested website features.

Analytics Technologies

Analytics cookies may be used to distinguish visits, understand website traffic, and measure how visitors interact with different pages or features.

Advertising and Measurement Technologies

Pacific Bone & Joint may use advertising, attribution, or conversion-measurement technologies in connection with online marketing campaigns.

These technologies may help us understand whether an advertisement resulted in a website visit, telephone call, appointment inquiry, or other interaction.

We do not intend to use advertising technologies to disclose medical-record information or protected health information to advertising platforms.

8. Your Choices Regarding Cookies

You can generally control or delete cookies through your browser settings.

Depending upon your browser and device, you may be able to:

block cookies;
delete stored cookies;
restrict third-party cookies;
limit tracking; or
use privacy or tracking-prevention features.

Blocking certain technologies may affect some website functionality.

Google also provides tools that allow users to opt out of certain Google Analytics tracking.

Browser privacy settings, global privacy signals, and similar technologies continue to evolve. We may update our practices as applicable requirements and available technologies change.

9. Website Hosting and Security Services

Our websites may use third-party hosting, content-delivery, domain-management, security, and infrastructure providers.

These providers may automatically receive technical information necessary to deliver and secure a website, including IP addresses, browser information, requested pages, timestamps, and security-related information.

For example, services such as Cloudflare or similar infrastructure providers may process technical information for purposes such as:

delivering website content;
improving website speed;
identifying malicious traffic;
preventing denial-of-service attacks;
detecting automated activity; and
maintaining website security.

Their handling of information may also be governed by their own privacy policies and service agreements.

10. Appointment Scheduling and Patient Communication Services

Pacific Bone & Joint may use third-party healthcare communication or scheduling services to manage appointment requests and communicate with patients.

These may include platforms used for:

appointment scheduling;
secure messaging;
telephone communication;
text messaging;
intake forms;
appointment reminders;
patient registration;
document exchange; or
other patient communications.

If you are redirected from our website to a patient-communication or scheduling platform, information submitted through that service may be governed by that provider's privacy terms as well as agreements between that provider and Pacific Bone & Joint.

Where required, healthcare vendors that handle protected health information on our behalf are expected to operate under applicable privacy and security requirements.

11. Email, Telephone, and Text Communications

If you provide your email address or telephone number, we may use it to respond to your inquiry or communicate with you regarding matters such as:

appointment requests;
scheduling;
office information;
treatment-related communications;
administrative matters; or
services you have requested.

Email and ordinary SMS text messaging may not always be encrypted.

By requesting communication through a particular method, you acknowledge the inherent privacy limitations of that communication method.

You may ask us to use a different reasonable communication method when available.

12. How We Use Website Information

Information collected through our websites may be used to:

respond to inquiries;
process appointment requests;
communicate with patients or prospective patients;
provide requested information;
operate our websites;
improve website content and usability;
understand which services or educational materials are useful to visitors;
measure marketing effectiveness;
protect our websites from malicious activity;
troubleshoot technical problems;
comply with legal obligations; and
support the administration of Pacific Bone & Joint.

We do not use general website analytics to make automated medical decisions about your diagnosis or treatment.

13. Disclosure of Information

Pacific Bone & Joint does not sell patient medical records.

Information collected through our websites may be shared with third parties when reasonably necessary to operate our websites or provide requested services.

Such parties may include:

website hosting providers;
cloud infrastructure providers;
analytics providers;
information-security providers;
appointment and communication platforms;
technology vendors;
professional advisers;
contractors providing services on our behalf; and
governmental or legal authorities when disclosure is required by law.

We may also disclose information when reasonably necessary to:

comply with lawful process;
investigate fraud or security threats;
protect the rights or property of Pacific Bone & Joint;
protect the safety of patients, staff, visitors, or others; or
enforce applicable agreements.

If website information becomes part of a patient's medical record, subsequent disclosures may be governed by our Notice of Privacy Practices and applicable law.

14. Sale of Personal Information

Pacific Bone & Joint does not sell patient medical information.

We do not knowingly sell information submitted through patient contact or appointment forms to third parties for their independent marketing purposes.

Certain digital advertising or analytics activities may be treated as "sharing," "targeted advertising," or a similar concept under some state privacy laws even when information is not exchanged for money.

We periodically evaluate our use of website technologies in light of evolving healthcare and privacy requirements.

15. Advertising

Pacific Bone & Joint may advertise its services through third-party platforms such as search engines, social-media platforms, healthcare directories, or other digital services.

We may use limited website-measurement technologies to determine whether an advertisement generated website traffic or an inquiry.

We do not intentionally provide advertising platforms with information from your medical record or information describing a specific diagnosis or course of medical treatment.

The privacy practices of advertising platforms are governed by their own policies.

16. Third-Party Websites and Embedded Content

Our websites may contain links to or embedded content from other organizations, including:

hospitals;
medical societies;
medical journals;
manufacturers;
insurance organizations;
financing companies;
scheduling services;
mapping services;
video platforms;
review platforms;
social-media platforms; and
other healthcare resources.

When you interact with a third-party service, that third party may collect information according to its own privacy policy.

Pacific Bone & Joint does not control and is not responsible for the privacy practices of unaffiliated third-party websites.

We encourage you to review the privacy policy of any external website you visit.

17. Online Videos and Educational Content

Some pages may contain embedded videos or other content hosted by third-party providers.

When you load or interact with embedded content, the provider may receive technical information such as your IP address, browser information, device information, and your interaction with the content.

When feasible, Pacific Bone & Joint may use privacy-enhanced embedding or similar features intended to reduce unnecessary tracking.

18. Security

Pacific Bone & Joint uses reasonable administrative, technical, and physical safeguards appropriate to the nature of the information we maintain.

Our websites are intended to use encrypted HTTPS connections when transmitting information between your browser and the website.

We also use technical and organizational controls intended to protect information from unauthorized access, alteration, disclosure, or destruction.

However, no website, computer system, wireless network, email system, or electronic transmission method can be guaranteed to be completely secure.

For that reason, please do not submit unnecessary sensitive medical information through ordinary website forms or unsecured electronic communications.

19. Retention

Information collected through our websites is retained only as reasonably necessary for the purposes for which it was collected, operational needs, security, legal obligations, dispute resolution, or other legitimate purposes.

Different categories of information may have different retention periods.

For example:

server logs may be retained according to the schedule of our hosting or security provider;
analytics information may be retained according to our analytics configuration and the policies of the analytics provider;
communications may be retained as appropriate for administrative purposes; and
information incorporated into a patient's medical record is retained according to healthcare record-retention requirements and our applicable policies.

We may modify retention periods as legal, operational, or technological requirements change.

20. Your Privacy Choices

Depending on the type of information involved and applicable law, you may be able to request that Pacific Bone & Joint:

update inaccurate contact information;
change your communication preferences;
stop certain nonessential communications;
answer questions regarding information you have submitted;
address concerns regarding website privacy; or
direct you to the appropriate process for exercising rights involving your medical record.

Rights involving protected health information are governed by our Notice of Privacy Practices and applicable healthcare privacy law.

21. Do Not Track and Browser Privacy Signals

Some browsers and devices transmit "Do Not Track," Global Privacy Control, or similar privacy preference signals.

Standards governing these technologies continue to evolve.

Where applicable law requires us to recognize a particular privacy signal, we will endeavor to do so.

Otherwise, you may control cookies and tracking technologies through your browser or device settings.

22. Children

Our websites are directed primarily toward adults seeking information regarding orthopedic healthcare.

We do not knowingly use our general website to solicit personal information directly from children under 13.

A parent or legal guardian may submit information on behalf of a minor for purposes such as requesting medical care.

Information relating to a minor who becomes a patient is handled in accordance with applicable healthcare privacy requirements.

23. International Visitors

Pacific Bone & Joint is located in Hawaiʻi, United States.

If you access our website from another country, information submitted through the website may be processed or stored in the United States or other jurisdictions in which our service providers operate.

Privacy laws in those jurisdictions may differ from the laws in your country.

Submitting a request from another country does not itself establish a physician-patient relationship or indicate that Pacific Bone & Joint is authorized to provide medical care in that jurisdiction.

24. Data Breaches and Security Incidents

If Pacific Bone & Joint becomes aware of a security incident involving information subject to legally mandated notification requirements, we will provide notice as required by applicable law.

Security incidents involving protected health information are handled in accordance with applicable HIPAA breach-notification requirements and other applicable law.

25. Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect changes in:

our websites;
services;
technology;
legal requirements;
analytics practices;
advertising practices; or
privacy standards.

When this policy is updated, the "Last updated" date at the top of the page will be revised.

Material changes may also be identified on this page or communicated through other appropriate means.

26. Notice of Privacy Practices

This Website Privacy Policy addresses information associated primarily with use of our websites and online services.

Patients of Pacific Bone & Joint have additional privacy rights regarding protected health information.

Those rights are described in Pacific Bone & Joint's separate Notice of Privacy Practices, which is available from the practice and should also be made available through our website.

If there is a conflict between this Website Privacy Policy and our Notice of Privacy Practices concerning protected health information, the Notice of Privacy Practices and applicable law govern.

27. Contact Us

If you have questions about this Website Privacy Policy or our website privacy practices, please contact:

Pacific Bone & Joint
Honolulu, Hawaiʻi
Website: pacificboneandjoint.com
Phone: (808) 439-6201
Email: contact@pacificboneandjoint.com

You may also contact our office using the contact information provided on our website.

For questions specifically regarding your medical record or HIPAA privacy rights, please contact Pacific Bone & Joint using the privacy contact information listed in our Notice of Privacy Practices.

Notice of Privacy Practices

This notice is effective as of August 1, 2020.

We are required by federal law to maintain the privacy of your Protected Health Information and to provide you with notice of our legal duties and privacy practices regarding Protected Health Information. “Protected Health Information” is information that we keep in electronic, paper, or another form, including demographic information collected from you and is created or received by us and relates to your past, present, or future physical or mental health or condition, the provision of health care services to you, or the past, present or future payment for the healthcare services we deliver to you that identifies you or which we reasonably believe can be used to identify you.

We are required by federal law to comply with the terms of this notice. We reserve the right to make changes in our privacy practices regarding your Protected Health Information. If we change our privacy practices, that change will apply to all Protected Health Information that we maintain about you. However, before we change our privacy practices, we will provide you with written notice of any changes.

How we may use and disclose your information

We may use and disclose your Protected Health Information for a variety of purposes. For example:

Treatment: We may disclose your Protected Health Information to another physician, such as a specialist, to whom we refer you for medical treatment.
Health Care Operations: We may disclose your Protected Health Information to a health plan, managed care plan, individual practice association, or to a management services organization that analyzes our delivery of medical services to evaluate our health care quality management, case management, or professional competence. We may also provide your Protected Health Information to other health care providers such as laboratories or ambulance companies for purposes of their health care operations.
Payment: We may disclose your Protected Health Information to obtain payments. Disclosures for “payment” include: (a) disclosure to a health plan to determine your eligibility or coverage under the plan; (b) disclosures to a health plan to obtain reimbursement for delivering medical services to you; (c) disclosures to billing services or collection agencies; (d) disclosures for utilization management and determinations of whether the medical services we deliver to you are necessary or appropriate; or (e) disclosures to determine whether the amount we charge you for medical services are justifiable.
Reminders and Treatment Alternatives: We may contact you to provide you with appointment reminders or information about medical treatment alternatives or other health-related benefits and services that may be of interest to you.

We may use or disclose your Protected Health Information in connection with treatment, payment, or health care operations if we deliver health care products or services to you based on the orders of another health care provider and we report the diagnosis or results associated with the health care services directly to another health care provider who provides the products or reports to you. We may use or disclose your Protected Health Information that was created or received in emergency treatment situations, to carry out treatment, payment, or health care operations if we attempt to obtain your consent as soon as reasonably practicable after the delivery of such treatment.

We may disclose your Protected Health Information without your authorization in the following circumstances: (a) for public health activities, such as controlling communicable diseases, reporting child abuse or neglect, to monitor or evaluate the quality, safety, or effectiveness of FDA-regulated products or services; (b) for reporting victims of abuse, neglect or domestic violence; (c) for health oversight activities such as overseeing government benefit programs; (d) in response to judicial or administrative orders such as subpoenas; (e) for law enforcement purposes such as mandatory reporting of certain types of wounds and/or identifying or locating individuals; (f) for certain research purposes; (g) to avert a serious threat to the health or safety of an individual or general public and (h) for selected governmental functions such as national security. In each of these situations, we will keep records that explain our attempt to obtain your consent and the reason why consent was not obtained.

We are required to disclose your Protected Health Information: (a) to you upon your request and (b) to the U.S. Department of Health and Human Services (DHHS) when DHHS investigates to determine whether we are complying with federal law.

We may disclose your name, your location in our facility, your general condition, and your religious affiliation, if any, in our facilities directory, unless you object verbally or in writing.

In all other circumstances, we must obtain your authorization to use or disclose your Protected Health Information. You will be required to sign an authorization form that permits us to use and disclose your Protected Health Information for certain purposes, and we may not condition the delivery of medical treatment to you on your providing the requested written authorization. You have the right to revoke your authorization in writing as long as we have not acted in reliance on the authorization.

Your rights

You have the following rights with respect to your Protected Health Information:

The right to request restrictions on our use and disclosure of your Protected Health Information for treatment, payment, or health care operations. If we agree to any restriction, then we cannot violate that restriction except in the case of emergency treatment. However, we are not required to agree to any restrictions.
The right to request in writing and to receive confidential communications of your Protected Health Information by alternative means (mail or email) or at alternative locations (office or business workplace).
The right to request in writing access to our office to inspect and copy your Protected Health Information. Except in cases where Protected Health Information is not maintained or accessible on-site, we will act on a request for access no later than thirty (30) days after we receive your request.
The right to request in writing that we amend your Protected Health Information. Your request must contain the reasons to support the requested amendment. We will act upon your request within sixty (60) days after we receive your request.
The right to receive an accounting of all our disclosures of your Protected Health Information in the six (6) years prior to the date of your request, except for disclosures: (a) to carry out treatment, payment, and health care operations; (b) to you; (c) for our directory or to persons involved in your care; (d) for national security or intelligence purposes; (e) to correctional institutions or law enforcement officials; (f) pursuant to any written authorization that you give to us or (g) that occurred prior to April 14, 2004.

Complaints

If you believe that we have violated your privacy rights then you may file a written complaint with Paul N Morton, LLC. You may also file a complaint with the Office for Civil Rights of the DHHS. Your complaint must be: (a) in writing, either on paper or electronically; (b) name the Company and describe the acts or omissions you believed to be in violation of the Privacy Rules; (c) be filed within 180 days of when you knew or should have known that the act or omission complained of occurred unless the time limit is waived by the DHHS for good cause shown. The complaint may be sent to the Office of Civil Rights – U.S. Department of Health and Human Services Region IX, 50 United Nations Plaza, Room 322, San Francisco, CA 94102. We will not retaliate against you for filing a complaint.

If you wish to obtain additional information about any of the matters discussed in this notice, you may contact Dr. Morton at (808) 439-6201.

SMS Terms of Service

By opting into SMS from a web form or other medium, you are agreeing to receive SMS messages from Pacific Bone and Joint. This includes SMS messages for appointment scheduling, appointment reminders, post-visit instructions, lab notifications, and billing notifications. Message frequency varies. Message and data rates may apply. We do not share or sell SMS opt-in, or phone numbers for the purpose of SMS. Message HELP for help. Reply STOP to any message to opt out.