Notice of Privacy Practices (HIPAA)

Effective date: [PENDING: launch date]

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

MelMedic [PENDING: legal entity name] ("we") is required by law to maintain the privacy and security of your protected health information ("PHI"), to give you this Notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect. Your health records are created and stored in our HIPAA-compliant electronic health record system (CharmHealth). This marketing website does not collect PHI.

How we may use and disclose your health information

• Treatment. We use your PHI to provide your care, for example, reviewing your history during a telehealth visit, sending a prescription electronically to a pharmacy, or ordering labs through Quest Diagnostics.
• Payment. We use PHI to process payment for your visit (for example, through our patient portal's payment system).
• Health care operations. We may use PHI to run the practice, quality review, credentialing, and improving care.
• Business associates. We share PHI with vendors that perform services for us (such as our EHR platform) only under written agreements requiring them to protect it.
• As required or permitted by law. Including public-health reporting, abuse or neglect reporting, health oversight, judicial and administrative proceedings, law enforcement in limited circumstances, and to avert a serious threat to health or safety.

Other uses and disclosures, including most uses for marketing, any sale of PHI, and most sharing of psychotherapy notes, will be made only with your written authorization, which you may revoke at any time.

Your rights regarding your health information

• Get a copy of your record. You may inspect and receive a copy of your health record, usually within 30 days of your request. We may charge a reasonable, cost-based fee.
• Ask us to correct your record. You may request an amendment if you believe information is incorrect or incomplete. We may deny the request in certain cases, but we will tell you why in writing.
• Request confidential communications. You may ask us to contact you in a specific way (for example, only at a certain phone number or email).
• Ask us to limit what we use or share. We are not required to agree to all restrictions, but if you pay in full out of pocket, you may require us not to share that information with a health plan for payment or operations purposes.
• Get a list of disclosures. You may request an accounting of certain disclosures for the six years prior to your request.
• Get a copy of this notice. You may request a paper or electronic copy at any time.
• Choose someone to act for you. A person with medical power of attorney or a legal guardian may exercise your rights on your behalf.

Breach notification

We will notify you promptly, as required by law, if a breach occurs that may have compromised the privacy or security of your PHI.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us using the contact information below, or with the U.S. Department of Health and Human Services, Office for Civil Rights (www.hhs.gov/ocr/privacy/hipaa/complaints). We will not retaliate against you for filing a complaint.

Changes to this notice

We can change the terms of this Notice at any time, and the changes will apply to all PHI we maintain. The current Notice, with its effective date, will always be available on this page and in the patient portal.

Privacy contact

Privacy Officer: Melanie Miller, FNP [PENDING: confirm designated privacy officer]
Phone: (877) 942-8808 · Fax: (877) 504-8854
Mailing address: P.O. Box 512, Bonner Springs, KS 66012