HIPAA Notice of Privacy Practices

Effective Date: [MONTH DD, YYYY]

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice applies to Radiant Health for Women ("Radiant Health," "we," "us") and describes the privacy practices we follow for your protected health information ("PHI"). PHI is health information that identifies you, including information about your care, your records, and payment for services. We are required by law to protect the privacy of your PHI, give you this notice, and follow the notice currently in effect.

This notice covers patient medical information. Information collected from visitors to our website is described separately in our Website Privacy Policy.

1. How We May Use and Disclose Your Information

We may use and disclose your PHI without your written authorization for the following purposes.

Treatment. To provide, coordinate, and manage your care. Example: we share your lab results with a cardiologist or your primary care clinician, send a prescription to your pharmacy, or consult another clinician about your care.

Payment. To obtain payment for services. Example: we process your card or membership payment through a payment processor, send you a statement or receipt, and, if you ask us to, provide records you can submit to an insurer or HSA/FSA for reimbursement. We do not bill insurance for our services. However, if a medication we prescribe requires approval from your health plan or its pharmacy benefit manager, we may electronically submit the clinical information needed to request prior authorization through a prior-authorization platform. Because this involves your health plan, you may tell us you do not want a prior authorization request submitted.

Health care operations. To run our practice. Example: quality review, staff training, scheduling, record management, legal and compliance activities, and working with vendors who help us operate, such as our electronic health record and patient portal, telephone, text-messaging, and video platforms, laboratories, and payment processors. Vendors who handle PHI for us must agree in writing to protect it. Except for treatment, we share only the minimum information necessary for the purpose.

Other ways we may contact you. We may use your PHI to remind you of appointments, follow up on results, or tell you about treatment options or health-related services that may interest you. We will use the contact methods you have given us and honor your communication preferences (see Section 4).

Others involved in your care. With your agreement, or if you are unable to agree and we believe it is in your best interest, we may share relevant information with a family member or friend involved in your care or payment.

Telehealth and electronic communications. We offer telehealth visits using secure, access-restricted video technology, and we communicate with you through a secure patient portal, telephone, and, if you have agreed, text messaging. Electronic communication carries some risk of interception or misdirection that a face-to-face visit does not. Text messages and regular email may not be encrypted, so we limit what we send that way and ask that you not use them for sensitive medical details. Please use the patient portal for clinical communication. You may tell us at any time that you do not want to be contacted by text or email.

2. Other Uses and Disclosures Permitted or Required by Law

We may use or disclose PHI without your authorization when law permits or requires it, including:

  • Required by law, including to HHS when it investigates our compliance

  • Public health activities, such as reporting certain diseases, injuries, or adverse events involving medications or devices

  • Abuse, neglect, or domestic violence, when reporting is required or permitted by law

  • Health oversight activities, such as licensing board (Colorado Medical Board, Colorado Board of Nursing, or similar) and government audits or investigations

  • Judicial and administrative proceedings, in response to a court order or, in some cases, a subpoena or lawful request

  • Law enforcement, as permitted by law

  • Serious threat to health or safety of a person or the public

  • Coroners, medical examiners, and funeral directors

  • Organ and tissue donation

  • Workers' compensation, as authorized by law

  • Research, only as permitted by law, such as with institutional review board approval or de-identified data

  • Specialized government functions, such as military or national security, if applicable

3. Uses and Disclosures That Require Your Written Authorization

We will obtain your written authorization before:

  • Using or disclosing psychotherapy notes (with limited exceptions)

  • Using or disclosing PHI for marketing where we receive payment from a third party

  • Selling your PHI

  • Any other use or disclosure not described in this notice

You may revoke an authorization at any time in writing, except to the extent we have already acted on it.

4. Your Rights

You have the right to:

  1. Inspect and get a copy of your medical and billing records, including an electronic copy where available. We will respond within 30 days (one 30-day extension is allowed with written notice). We may charge a reasonable, cost-based fee as permitted by law.

  2. Request an amendment if you believe information in your record is incorrect or incomplete. We may deny the request in certain cases and will explain why in writing.

  3. Request confidential communications, such as contact at a different phone number, address, or email. We will accommodate reasonable requests.

  4. Request restrictions on how we use or disclose your PHI. We are not required to agree, except that we must agree to your request not to disclose PHI to a health plan for payment or operations if the disclosure is not required by law and relates to a service you paid for in full out of pocket.

  5. Receive an accounting of certain disclosures we made of your PHI in the six years before your request.

  6. Receive a paper copy of this notice at any time, even if you agreed to receive it electronically.

  7. Choose someone to act for you. If someone holds your medical power of attorney or is your legal guardian, that person may exercise your rights and make choices about your PHI.

  8. Be notified of a breach. We will notify you if your unsecured PHI is breached, as required by law.

  9. File a complaint if you believe your privacy rights were violated (see Section 8). We will not retaliate against you for filing a complaint.

To exercise any of these rights, contact us using the information in Section 7. Requests must be in writing.

5. Substance Use Disorder (SUD) Treatment Records

Some records we may receive from programs that treat substance use disorders are protected by an additional federal law, 42 CFR Part 2, which is in some respects stricter than HIPAA. Radiant Health is not a substance use disorder treatment program. If we receive Part 2 records from such a program with your consent for treatment, payment, and health care operations, we may use and disclose them for those purposes as described in this notice. Part 2 records, and testimony relaying their content, may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless you consent in writing or a court issues an order after notice to you and an opportunity to be heard. You may revoke a Part 2 consent in writing, and you have the right to file a complaint as described below.

6. Colorado Law

Colorado and other state laws sometimes give greater protection to certain categories of information, such as HIV/sexually transmitted infection information, mental health, substance use, genetic, and reproductive health care information. When Colorado law is stricter than HIPAA, we follow the stricter law. This may include requiring your written consent or a court order before certain disclosures that HIPAA alone would allow.

7. Our Responsibilities, and How to Contact Us

We are required by law to maintain the privacy and security of your PHI; provide you with this notice; follow its terms; and notify you of a breach of unsecured PHI. We will not use or share your information other than as described here unless you tell us we may in writing.

We reserve the right to change this notice and make the new notice apply to all PHI we maintain. The current notice will be posted on our website and available at our office and upon request. The effective date appears at the top.

Privacy Officer: Kari Waddell Radiant Health for Women [Street Address, Boulder, CO ZIP] Phone: [PHONE] Email: [EMAIL] (Please do not send medical details by regular email.)

8. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us using the contact information above, and/or with the U.S. Department of Health and Human Services, Office for Civil Rights:

200 Independence Avenue S.W., Washington, D.C. 20201 1-877-696-6775 | www.hhs.gov/ocr/privacy/hipaa/complaints

We will not retaliate against you for filing a complaint.

Last updated: [MONTH DD, YYYY]