HIPAA Notice of Privacy Practices

2. Uses and Disclosures of PHI

Treatment

We may use or disclose PHI so that your healthcare providers, attorneys-of-record, and authorized care team members can coordinate and provide treatment, referrals, imaging, and follow-up care related to your personal injury matter.

Payment

We may use or disclose PHI to bill and obtain payment for services, including communicating with health plans, attorneys handling liens, medical funding companies, and billing/RCM partners authorized to act on the provider's behalf.

Healthcare Operations

We may use or disclose PHI to support routine operations such as quality assessment, audit logging, staff training, case management, and system administration of the MediFlow 360 platform.

As Required or Permitted by Law

• To comply with court orders, subpoenas, or other lawful process.
• To public health authorities, for required reporting (e.g., abuse, communicable disease).
• For health oversight activities, law enforcement requests, or to avert a serious threat to health or safety.
• To workers' compensation programs as authorized by law.

Uses Requiring Your Written Authorization

Other uses and disclosures of PHI — including most uses for marketing, sales of PHI, and most uses of psychotherapy notes — will be made only with your written authorization. You may revoke an authorization in writing at any time, except to the extent we have already relied on it.

3. Your Rights Regarding Your PHI

• Right of Access: Request to inspect and obtain a copy of PHI we maintain about you, in the format you reasonably request when readily producible.
• Right to Amend: Request that we amend PHI you believe is inaccurate or incomplete.
• Right to an Accounting of Disclosures: Request a list of certain disclosures of your PHI made in the six (6) years prior to your request.
• Right to Request Restrictions: Request that we restrict certain uses and disclosures of your PHI. We will agree where required by law (for example, where you have paid out-of-pocket in full for an item or service).
• Right to Confidential Communications: Request that we contact you by a specific means or at a specific location (for example, by mail rather than text).
• Right to a Paper Copy: Obtain a paper copy of this Notice on request, even if you have agreed to receive it electronically.
• Right to Breach Notification: Be notified, in accordance with HIPAA and California Civil Code §§ 1798.29 / 1798.82, if a breach involves your unsecured PHI.

To exercise any of these rights, contact us using the information at the bottom of this Notice. We may require requests to be made in writing and may require verification of identity.

4. Our Duties

• We are required by law to maintain the privacy and security of PHI.
• We will notify affected individuals if a breach occurs that may have compromised the privacy or security of their PHI.
• We must abide by the terms of this Notice currently in effect.
• We reserve the right to change this Notice and to make the new Notice effective for all PHI we maintain. The current Notice will be posted at /hipaa-notice.

5. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us at the address below, or with the U.S. Department of Health and Human Services Office for Civil Rights (HHS OCR):

We will not retaliate against you for filing a complaint.