Notice of Privacy Practices (NPP)

Our Responsibilities

We are required by law to maintain the privacy and security of your protected health information (PHI), give you this Notice, and follow the terms of this Notice. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your PHI. We will not use or share your information other than as described here unless you tell us we can in writing.

How We May Use and Disclose Your PHI — Without Your Authorization

We typically use or share your PHI in these ways:

• Treatment: To provide, coordinate, or manage your care, including telemedicine visits and consultations.
• Payment: To bill and receive payment from you or a health plan, when applicable (e.g., claims, eligibility, benefits).
• Health Care Operations: To run our practice, improve quality, and conduct administrative tasks (e.g., audits, quality assurance, training).

Other uses/disclosures permitted or required by law include: public health and safety; health oversight activities; organ donation; research (under strict safeguards); to comply with laws and court/administrative orders; law enforcement; coroners/medical examiners; workers’ compensation; to avert a serious threat to health or safety; and specialized government functions as applicable. We disclose only the minimum necessary unless an exception applies.

Uses and Disclosures That Require Your Written Authorization

We will obtain your written authorization for uses/disclosures not described in this Notice, including most marketing, any sale of PHI, and sharing psychotherapy notes (if applicable). You may revoke an authorization in writing at any time; revocation will not affect prior actions taken in reliance on your authorization.

Your Rights

When it comes to your PHI, you have rights:

• Get an electronic or paper copy of your medical record: You can ask to see or get a copy of your record (including electronic). We will provide a copy or summary, usually within 30 days, and may charge a reasonable, cost-based fee.
• Ask us to correct your record: You can request we correct PHI you think is incorrect or incomplete. We may deny your request, but we’ll tell you why in writing.
• Request confidential communications: You can ask us to contact you in a specific way (e.g., different phone or email) or to send mail to a different address.
• Ask us to limit what we use or share: You can ask us not to use/share certain PHI for treatment, payment, or health care operations. We are not required to agree, and may say no if it would affect your care. If you pay in full out-of-pocket for a specific item or service, you can ask us not to share information about that item or service with your health plan; we will say yes unless a law requires us to share.
• Get a list of disclosures (accounting): You can ask for a list of certain disclosures we made of your PHI for up to six years before your request.
• Get a copy of this Notice: You can request a paper or electronic copy at any time; it is also posted on our website.
• Choose someone to act for you: If you have given someone medical power of attorney or have a legal guardian, that person can exercise your rights.
• File a complaint: You can complain to us or to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights if you feel your privacy rights have been violated. We will not retaliate for filing a complaint.

Telemedicine & Website

We deliver care exclusively via telemedicine using a secure EMR/patient portal. We do not collect PHI on our public website. For your privacy, please submit medical information only through the secure patient portal or during telemedicine sessions.

Fundraising and Marketing

We do not use your PHI for fundraising. We may contact you about appointment reminders or services related to your care. We will obtain your written authorization for marketing communications if required by law.

Business Associates

We share PHI with vendors who support our operations (e.g., EMR/telehealth platform, e‑fax) only after obtaining a Business Associate Agreement that requires them to safeguard PHI. Our payment processor (Stax) handles card data and does not receive PHI; payment occurs within our EMR integration whenever applicable.

Changes to This Notice

We may change this Notice, and the changes will apply to all information we have about you. The new Notice will be available on our website and upon request with an updated effective date.

Questions, Requests, or Complaints

To exercise your rights, request a copy of this Notice, or file a complaint with us, contact: Keonte’ A. Fisher, FNP-C (Privacy Officer) · info@discreetcare.org · 757-347-2462. You may also file a complaint with HHS OCR at https://www.hhs.gov/ocr/privacy/hipaa/complaints/. We will not retaliate against you for filing a complaint.

‍