HIPAA Notice of Privacy Practices

Your Rights

You have the right to:

1. Get a copy of your medical record

You may ask to see or get a copy of your medical record and other health information we maintain about you. We will provide a copy or summary as required by law.

2. Ask us to correct your medical record

You may ask us to correct health information you believe is incorrect or incomplete. We may deny the request in some circumstances, but we will explain why in writing.

3. Request confidential communications

You may ask us to contact you in a specific way, such as by phone, email, mail, or at a different address. We will accommodate reasonable requests when required by law.

4. Ask us to limit what we use or share

You may ask us not to use or share certain health information for treatment, payment, or health care operations. We are not always required to agree, but we will consider your request. If you pay for a health care item or service out of pocket in full, you may ask us not to share that information with your health insurer for payment or operations purposes, unless required by law.

5. Get a list of certain disclosures

You may ask for a list of certain times we have shared your health information, who we shared it with, and why.

6. Get a copy of this notice

You may ask for a paper or electronic copy of this notice at any time.

7. Choose someone to act for you

If you have given someone medical power of attorney or if someone is your legal guardian, that person may exercise your rights and make choices about your health information, as permitted by law.

8. File a complaint

You may complain if you believe your privacy rights have been violated. You may contact VIPCARE.Life directly. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. VIPCARE.Life will not retaliate against you for filing a complaint.

Your Choices

For certain health information, you may tell us your preferences about what we share. If you have a clear preference, tell us what you want us to do.

You may have choices about whether we share information with:

• Family, friends, caregivers, or others involved in your care
• Individuals helping pay for your care
• Others during disaster relief or emergency situations

If you are not able to tell us your preference, we may share information if we believe it is in your best interest or needed to lessen a serious and imminent threat to health or safety.

We generally will not use or share your information for marketing purposes or sell your information without your written authorization, unless permitted by law.

Our Uses and Disclosures

We may use and share your health information for the following purposes:

1. Treatment

We may use and share your health information to provide, coordinate, or manage your medical care. Example: We may share information with a specialist, hospital, pharmacy, laboratory, imaging center, home health agency, or emergency department involved in your care.

2. Payment

We may use and share your health information to bill and receive payment from health plans or other entities when applicable. Example: We may provide information to your health insurer so it will pay for covered services.

3. Health Care Operations

We may use and share your health information to operate the practice, improve care, train, conduct quality review, manage records, communicate with you, and run business operations.

4. Care Coordination and Referrals

We may share information with other clinicians, specialists, hospitals, pharmacies, laboratories, imaging centers, and care partners when needed for your care.

5. Appointment Reminders and Communications

We may use your information to contact you about appointments, follow-up, care plans, test results, membership matters, billing, or practice updates.

6. Health-Related Services

We may contact you about treatment alternatives, preventive care, chronic care, wellness services, or health-related services that may be relevant to you.

7. Required by Law

We may use or share your information when required by federal, state, or local law.

8. Public Health and Safety

We may share health information for public health activities, such as disease reporting, preventing or controlling disease, reporting adverse events, or preventing serious threats to health or safety.

9. Abuse, Neglect, or Domestic Violence

We may disclose information to appropriate authorities if required or permitted by law.

10. Health Oversight Activities

We may share information with health oversight agencies for audits, investigations, inspections, licensure, discipline, or compliance activities.

11. Legal Proceedings

We may share information in response to a court or administrative order, subpoena, discovery request, or other lawful process, as permitted by law.

12. Law Enforcement

We may share information with law enforcement officials when required or permitted by law.

13. Coroners, Medical Examiners, and Funeral Directors

We may share information with coroners, medical examiners, or funeral directors as permitted by law.

14. Organ and Tissue Donation

We may share information with organ procurement organizations when applicable.

15. Workers' Compensation

We may share information as authorized by workers' compensation or similar laws.

16. Research

We may use or share information for research only as permitted by law and applicable privacy protections.

17. Business Associates

We may share information with vendors and service providers who help us operate the practice, such as EHR, billing, telehealth, scheduling, secure messaging, legal, accounting, IT, or compliance vendors. These vendors must agree to protect your information as required by HIPAA when applicable.

Sensitive Information

Some types of information may receive additional protection under federal or state law, including certain behavioral health, substance-use disorder, HIV, genetic, reproductive health, minor consent, or other sensitive information. VIPCARE.Life will follow applicable federal and state privacy laws for such information.

Electronic Communications, Telemedicine, and Texting

VIPCARE.Life may use electronic systems for telemedicine, scheduling, messaging, documentation, billing, and communication. Electronic communications may include phone, text, email, portal messages, video visits, or other technology. Some methods may carry privacy or security risks. VIPCARE.Life will use reasonable safeguards, but patients should not use unsecured or delayed communication methods for emergencies.

Telehealth appointments, messages, and related health and billing information are protected by HIPAA, and HHS states that covered providers should use telehealth platforms that ensure secure communications and data storage.

Breach Notification

VIPCARE.Life will notify affected individuals as required by law if there is a breach of unsecured protected health information. Massachusetts may also require notice to state agencies when Massachusetts residents' personal information is acquired or used by an unauthorized person or for an unauthorized purpose.

Our Responsibilities

VIPCARE.Life is required to:

• Maintain the privacy and security of your protected health information
• Provide you with this Notice
• Follow the duties and privacy practices described in this Notice
• Notify you if a breach occurs that may compromise the privacy or security of your protected health information
• Not use or share your information other than as described here unless you authorize us in writing
• Allow you to revoke an authorization in writing, except to the extent we have already relied on it

HHS explains that the HIPAA Privacy Rule is designed to protect individually identifiable health information while allowing important uses and disclosures for care and related functions.

Changes to This Notice

VIPCARE.Life may change this Notice and make the revised Notice apply to information already maintained by the practice as well as information received in the future. The current Notice will be posted on the VIPCARE.Life website.