Notice of Privacy Practices

Who follows this notice

This notice is provided by the [Cabana-affiliated medical group, legal name to be finalized with counsel] (the “Practice”), the independently owned and operated medical group whose licensed clinicians provide your care. The Practice is a HIPAA covered entity and is required by law to protect the privacy of your protected health information (PHI), to give you this notice of its legal duties and privacy practices, and to follow the terms of the notice currently in effect.

How we may use and disclose your health information

We may use and disclose your PHI, without your separate authorization, for the following core purposes:

• Treatment. To provide and coordinate your care, for example, sharing your information with your provider, a pharmacy filling your prescription, or a laboratory processing your tests.
• Payment. To bill and collect payment for services, for example, providing an itemized receipt you may submit to an HSA/FSA administrator.
• Health care operations. To run the Practice, for example, quality review, training, and coordinating with the technology platform and business associates who support your care under written agreement.

We may also use or disclose PHI when required or permitted by law, including for public health activities, health oversight, to avert a serious threat to health or safety, for certain law-enforcement or legal-process purposes, and to comply with workers’ compensation or similar programs.

Uses and disclosures that require your authorization

Most uses and disclosures not described above will be made only with your written authorization. In particular, we will obtain your authorization before any marketing that involves your PHI, any sale of PHI, and most uses or disclosures of psychotherapy notes (if any). We do not sell your protected health information. You may revoke an authorization in writing at any time, except to the extent we have already acted on it.

Your rights over your health information

• Access and copies. You may inspect and request a copy of your medical and billing records, in a form and format you request where readily producible.
• Amendment. You may ask us to correct information you believe is inaccurate or incomplete.
• Accounting of disclosures. You may request a list of certain disclosures we have made of your PHI.
• Restrictions. You may request limits on how we use or share your PHI. If you pay for a service in full, out of pocket, you may request that we not share that information with a health plan.
• Confidential communications. You may ask us to contact you a certain way or at a certain location.
• Paper copy. You may request a paper copy of this notice at any time, even if you agreed to receive it electronically.
• Breach notification. You have the right to be notified if a breach affects the privacy or security of your PHI.
• Revoke authorization. You may revoke any authorization you previously gave, as described above.

Our duties

We are required by law to maintain the privacy and security of your PHI, to notify you following a breach of unsecured PHI, to abide by the terms of the notice currently in effect, and to provide you this notice. We reserve the right to change this notice and to make the revised notice effective for PHI we already have as well as information we receive in the future.

Changes to this notice

If we materially change this notice, we will update the “Last updated” date and post the revised notice. You may request a copy of the current notice at any time.

How to file a complaint

If you believe your privacy rights have been violated, you may file a complaint with us at concierge@trycabana.com, or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.

Contact and effective date

To exercise any right described here, or to reach our Privacy Officer, contact us at concierge@trycabana.com. [Privacy Officer name, mailing address, and effective date to be finalized with counsel.]