Notice of Privacy Practices

How We May Use and Disclose Your Health Information

The following uses and disclosures may be made without your written authorization, as permitted by HIPAA (45 CFR 164.506, 164.510, 164.512):

Treatment

• We may use and disclose your PHI to facilitate the treatment and healthcare services provided by your physician through MEDFlow.
• Examples: sharing visit notes with a consulting specialist; transmitting a prescription to a pharmacy; sharing lab results with your treating provider.

Payment

• We may use and disclose your PHI so your provider can bill and receive payment for services rendered.
• Examples: submitting claims to payers; verifying insurance coverage; processing direct-pay membership fees.

Health Care Operations

• We may use and disclose your PHI for activities necessary to operate the platform, including quality improvement, compliance monitoring, training, and system security audits.
• We do not use individually identifiable PHI for AI model training; any analytics uses de-identified or aggregated data meeting HIPAA Safe Harbor or Expert Determination standards.

Other Permitted Disclosures

• Public Health Activities: reporting to public health authorities as required by law (e.g., communicable disease reporting, vital statistics).
• Health Oversight Activities: disclosures to government agencies for audits, investigations, or licensure activities.
• Judicial and Administrative Proceedings: disclosures pursuant to a court order, subpoena, or other lawful process.
• Law Enforcement: limited disclosures to law enforcement officials as required by law or pursuant to legal process.
• Serious Threats to Health or Safety: disclosures necessary to prevent or lessen a serious and imminent threat to a person or the public.
• As Required by Law: any other uses or disclosures specifically required by applicable federal, state, or local law.
• [PLACEHOLDER: Add any state-specific permitted disclosures required in the jurisdiction(s) where the covered entity operates.]

Your Rights Regarding Your Health Information

You have the following rights under HIPAA (45 CFR 164.522–164.528). To exercise any right, submit a written request to [email protected].

Right to Access (45 CFR 164.524)

• You have the right to inspect and obtain a copy of your PHI maintained in a designated record set.
• Requests will be fulfilled within 30 days (one 30-day extension is permitted with written notice).
• We may charge a reasonable, cost-based fee for copies. We will not charge for electronic copies to the individual.
• [PLACEHOLDER: Specify the fee schedule for copies before finalizing.]

Right to Amend (45 CFR 164.526)

• You have the right to request an amendment of your PHI if you believe it is incorrect or incomplete.
• We may deny the request if we determine the PHI is accurate and complete, or if the information was not created by us.
• If denied, you may submit a written statement of disagreement, which we will include with the disputed record.

Right to an Accounting of Disclosures (45 CFR 164.528)

• You have the right to request an accounting of disclosures of your PHI made during the six years prior to the date of your request.
• This right does not apply to disclosures made for treatment, payment, or health care operations, or to disclosures made pursuant to your authorization.

Right to Request Restrictions (45 CFR 164.522(a))

• You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or health care operations.
• We are not required to agree to a requested restriction except: we must agree to restrict disclosure to a health plan if you pay out-of-pocket in full for a service and request that the service not be disclosed to the plan.

Right to Confidential Communications (45 CFR 164.522(b))

• You have the right to request that we communicate with you about health matters through a specific means or at a specific location.
• Example: you may request that appointment reminders be sent only to a specific phone number or email address.
• Reasonable requests will be accommodated.

Right to a Paper Copy of This Notice

• You have the right to receive a paper copy of this Notice at any time, even if you have agreed to receive the Notice electronically.
• Contact [email protected] to request a paper copy.

Our Duties

• We are required by law to maintain the privacy and security of your PHI.
• We are required to provide you with this Notice of our legal duties and privacy practices with respect to PHI.
• We are required to follow the terms of this Notice currently in effect.
• We reserve the right to change the terms of this Notice and to make the new provisions effective for all PHI we maintain. Revised Notices will be posted on our website and made available to you upon request.
• We will not use or disclose your PHI except as described in this Notice or as otherwise required or permitted by applicable law.
• Technical safeguards: all PHI is encrypted at rest using AES-256-GCM and in transit using TLS 1.3. Access is controlled by role-based authentication and subject to HIPAA-compliant audit logging.

Contact Us

For questions about this Notice or to exercise your rights:

• Company: IGNITE Health Systems LLC
• HIPAA Privacy & Security Officer: Bhaven Murji — [email protected]
• Website: ignitehealthsystems.com
• HHS OCR (complaints): hhs.gov/hipaa/filing-a-complaint