Notice of Health Insurance Portability and Accountability Act ("HIPAA") Privacy Practices

THIS NOTICE DESCRIBES HOW YOUR MEDICAL INFORMATION MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

YOUR INFORMATION. YOUR RIGHTS. OUR RESPONSIBILITIES.

This Notice of HIPAA Privacy Practices (“Notice”) describes how DCV Emergency Physician, LLC d/b/a VIDA (“VIDA,” “we,” “us,” or “our”) may use and disclose your Protected Health Information (“PHI”), your rights regarding your PHI, and certain obligations we have under federal law. This Notice applies to PHI created or received by us in connection with the provision of medical services through VIDA Clínica Virtual (“Medical Services”). We operate several offerings under the Website. This Notice applies specifically to PHI associated with Medical Services. Information collected through VIDA Notes, The Health Recovery Toolkit, or other non-clinical portions of the Website that does not constitute PHI is generally governed by our Privacy Policy, rather than this Notice.

YOUR RIGHTS

You have the right to get a copy of your medical record. You may request to inspect and obtain a copy of your PHI that we maintain in a designated record set, subject to certain limitations under applicable law. We may charge a reasonable, cost-based fee where permitted by law.

You have the right to request correction of your medical record. You may ask us to correct PHI that you believe is inaccurate or incomplete. We may deny your request in certain circumstances permitted by law. If we deny your request, we will explain why and provide information about your right to submit a written statement of disagreement where applicable.

You have the right to request confidential communications. You may ask us to contact you in a particular way or at a particular location. For example, you may request that we contact you only by email, by telephone, or at a particular mailing address. We will accommodate reasonable requests where required by law.

You have the right to ask us to limit what we use or share. You may ask us not to use or disclose certain PHI for treatment, payment, or health care operations. We are not required to agree to every request. However, if you ask us not to disclose PHI to a health plan for purposes of payment or health care operations concerning a health care item or service that you, or someone on your behalf, has paid for completely out-of-pocket, we will agree to the request unless disclosure is otherwise required by law.

You have the right to get a list of certain disclosures. You may request an accounting of certain disclosures of your PHI made by us during the six years preceding the date of your request, subject to limitations and exclusions under HIPAA. Certain disclosures, including disclosures for treatment, payment, and health care operations, are generally excluded from an accounting.

You have the right to get a copy of this Notice. You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically. You may also access the current version of this Notice in our Website.

You have the right to choose someone to act for you. If you have given someone medical power of attorney or if someone is your legal guardian, that person may be able to exercise your rights and make decisions regarding your PHI on your behalf. We will verify that the person has the appropriate legal authority before taking action.

You have the right to file a complaint. If you believe your privacy rights have been violated, you may file a complaint with the U.S. Department of Health and Human Services Office (“HHS”) for Civil Rights. You will not be retaliated against for filing a complaint.

YOUR CHOICES

People involved in your care. We may disclose PHI to a family member, close friend, caregiver, or another person you identify who is involved in your care or payment for your care, when permitted by law. Where appropriate, we may disclose information to these individuals based on your agreement or, when permitted by law, based on our professional judgment regarding your best interests.

Disaster relief. We may disclose PHI to organizations involved in disaster relief efforts so that your family or other persons involved in your care can be notified about your condition, location, or other information as permitted by law.

Marketing. We may communicate with you about our own health-related products and services in ways permitted by law. Certain uses or disclosures of PHI for marketing require your written authorization. We will obtain your authorization when required by law. Marketing activities involving non-PHI information collected through the broader Website services are governed by our Privacy Policy.

Sale of PHI. We will not sell your PHI without your written authorization except as otherwise permitted by law. To the extent a disclosure constitutes a sale of PHI under applicable law and authorization is required, we will obtain that authorization before making the disclosure.

HOW WE MAY USE AND DISCLOSE YOUR PHI WITHOUT YOUR AUTHORIZATION

Applicable law permits us to use and disclose your PHI without your written authorization for certain purposes. The following are examples of the principal circumstances in which we may do so.

Treatment. We may use and disclose your PHI to provide, coordinate, or manage your medical care. For example, we may share relevant information with another health care professional involved in your care.

Payment. We may use and disclose your PHI to obtain payment for Medical Services or to determine or facilitate payment for those services. For example, we may provide information to a health plan or other entity responsible for payment, when permitted by law.

Health Care Operations. We may use and disclose your PHI for health care operations. Health care operations may include activities such as:

• quality assessment and improvement;
• evaluating the performance of health care professionals;
• reviewing the competence or qualifications of health care professionals;
• care coordination;
• compliance activities;
• auditing;
• administrative activities;
• business management; and
• other activities permitted under HIPAA and/or applicable law.

For example, we may use PHI to evaluate and improve the quality and effectiveness of our clinical services.

Required by Law. We may use or disclose your PHI when required to do so by federal, state, or local law, provided the disclosure meets the applicable legal requirements.

Public Health. We may disclose your PHI for public health activities permitted or required by law. These may include disclosures to:

• prevent or control disease, injury, or disability;
• report certain diseases or conditions;
• report adverse events or product-related information;
• support public health investigations; or
• other public health activities permitted by law.

Health Oversight. We may disclose PHI to a health oversight agency for activities authorized by law. These activities may include audits, investigations, inspections, licensing actions, disciplinary proceedings, and other oversight activities involving the health care system or government programs.

Law Enforcement. We may disclose PHI for law enforcement purposes when permitted or required by applicable law. For example, disclosures may occur in response to:

• a court order, warrant, subpoena, or similar legal process;
• a request to identify or locate a suspect, fugitive, missing person, or certain other individuals;
• information concerning a crime victim in circumstances permitted by law; or
• other law enforcement purposes authorized by HIPAA and/or applicable law.

Judicial and Administrative Proceedings. We may disclose your PHI in response to a court or administrative tribunal order, subpoena, discovery request, or other lawful process when the applicable HIPAA and/or applicable law requirements are satisfied.

Workers' Compensation. We may disclose your PHI as necessary to comply with workers' compensation laws and other similar programs established by law.

Serious Threats to Health or Safety. We may use or disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, when permitted by applicable law.

Specialized Government Functions. We may disclose PHI for certain specialized government functions, including certain military, national security, intelligence, protective services, and other government activities when authorized by law.

Military and Veterans. Where applicable and/or permitted by law, we may disclose PHI concerning members or veterans of the armed forces for activities authorized by law.

Correctional Institutions and Lawful Custody. Where applicable, we may disclose PHI concerning individuals in correctional institutions or otherwise in lawful custody when permitted or required by law.

Coroners, Medical Examiners, and Funeral Directors. We may disclose PHI to coroners and medical examiners for purposes such as identifying a deceased person or determining the cause of death. We may also disclose PHI to funeral directors as necessary to carry out their duties, as permitted by applicable law.

Research. We may use or disclose PHI for research purposes when permitted by HIPAA and/or other applicable law. Depending on the circumstances, research uses or disclosures may require your authorization, approval by an institutional review board or privacy board, or compliance with other applicable requirements. We will not use or disclose your PHI for research in a manner that requires authorization without obtaining the required authorization.

Decedents. We may disclose PHI concerning deceased individuals to coroners, medical examiners, and funeral directors as permitted by law. HIPAA protections for PHI generally continue for 50 years following an individual's death, subject to applicable law and exceptions.

Substance Use Disorder Records. To the extent we create or maintain records that are subject to the federal confidentiality requirements applicable to substance use disorder patient records under 42 CFR Part 2, those records may be subject to additional protections. Applicable law may impose restrictions on the use and disclosure of certain substance use disorder records beyond those that apply under HIPAA generally. Should that be the case, we will comply with applicable law requirements, including applicable consent, use, disclosure, and patient-rights requirements.

Other Uses And Disclosures Require Your Authorization. Except as described in this Notice or otherwise permitted or required by law, we will obtain your written authorization before using or disclosing your PHI. Examples may include certain:

• uses and disclosures for marketing;
• sales of PHI;
• research activities; and
• other uses or disclosures for which HIPAA requires authorization.

If you provide an authorization, you may generally revoke it in writing at any time, except to the extent we have already relied on the authorization or as otherwise permitted by law.

OUR RESPONSIBILITIES

We are required by law to:

• maintain the privacy and security of your PHI;
• provide you with this Notice describing our legal duties and privacy practices with respect to your PHI;
• comply with the terms of the Notice currently in effect;
• notify you as required by law if a breach occurs that compromises the privacy or security of your PHI; and
• use and disclose your PHI only as permitted or required by law or as otherwise authorized by you.

We will make reasonable efforts to limit uses and disclosures of PHI to the minimum necessary to accomplish the intended purpose, where the HIPAA and/or applicable law minimum necessary standard applies. HHS identifies the minimum necessary standard as a core HIPAA privacy protection requiring covered entities to take reasonable steps to limit unnecessary uses and disclosures. We will not use or disclose your PHI for purposes other than those described in this Notice unless you provide written authorization or the use or disclosure is otherwise permitted or required by law.

More Stringent Federal Or State Privacy Laws. Certain federal or state laws may provide additional privacy protections for particular categories of health information or impose requirements that are more protective than HIPAA. We will comply with applicable federal and state privacy requirements governing PHI. Because the Website is a virtual medical practice, state-specific requirements should be reviewed based on the jurisdictions in which patients are located when Medical Services are provided.

Breach Notification. If we determine that a breach of unsecured PHI has occurred, we will provide notification as required by applicable law. The timing, content, and method of notification will depend on the nature and circumstances of the breach and applicable legal requirements.

Changes to this Notice. We may change the terms of this Notice as permitted by HIPAA and/or applicable law. If we make a material change to our privacy practices, we will promptly revise this Notice as required by applicable law. The current Notice will be available upon request and will be prominently posted on the Website. The effective date appearing at the end of this Notice identifies the version currently in effect.

HOW TO OBTAIN A COPY OR ASK QUESTIONS

You may request a paper or electronic copy of this Notice at any time. If you have questions about this Notice or our privacy practices concerning PHI, please contact us at: vidaclinicavirtual@gmail.com.

HOW TO FILE A PRIVACY COMPLAINT

If you believe that we have violated your privacy rights, you may file a complaint directly with us using the contact information above. You may also file a complaint with:

U.S. Department of Health and Human Services
Office for Civil Rights

You may submit a complaint through the HHS Office for Civil Rights complaint process. We will not retaliate against you for filing a complaint.

ACKNOWLEDGMENT OF RECEIPT

We will request that patients acknowledge receipt of this Notice. Signing or otherwise acknowledging receipt of this Notice does not constitute an authorization for uses or disclosures of PHI beyond those permitted or required by law. If you decline to sign an acknowledgment, that does not prevent us from using or disclosing your PHI as permitted by HIPAA and/or applicable law. We will document its efforts to obtain the acknowledgment and any applicable reason why it was not obtained.