HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This HIPAA Notice of Privacy Practices (the “Notice”) describes how Kinstead Provider Group, P.A. and its affiliated professional entities, including independently owned and operated clinics affiliated with Kinstead Provider Group, P.A. (collectively, the “Practice”), may use and disclose health information about you. It also describes your rights and the Practice’s legal obligations regarding the use and disclosure of your health information.

The Practice is composed of licensed health care professionals who provide medical, behavioral health, and related professional services through Kinstead-affiliated professional entities (the “Kinstead Providers”). Certain non-clinical administrative, management, billing, technology, quality, and compliance services are provided to the Practice by Kinstead, Inc. and its affiliates, acting as a HIPAA Business Associate to the Practice (collectively, “Kinstead,” “we,” “us,” or “our”, as applicable).

Kinstead Provider Group, P.A., its affiliated professional entities, and Kinstead Providers participate in an organized health care arrangement (“OHCA”) as defined under the HIPAA Privacy Rule. As part of this OHCA, the legal entities that comprise the Practice may share protected health information with one another, as permitted by law, for purposes of treatment, payment, and health care operations, and for other purposes permitted or required by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Kinstead Providers may provide health care services via telehealth, in-person visits, home visits, and at other service delivery locations operated by or affiliated with the Practice.

All legal entities that comprise the Practice agree to comply with the terms of this Notice. This Notice applies only to information that is “protected health information” (“PHI”) as defined by HIPAA. It does not apply to information that is not covered by HIPAA. For information regarding non-HIPAA-covered products or services, please refer to Kinstead’s separate Privacy Policy, if applicable.

OUR LEGAL DUTIES

We understand that your health information is personal and we are committed to protecting your privacy. In addition, we are required by law to maintain the privacy of your Protected Health Information, to provide you with this Notice of our legal duties and privacy practices with respect to your Protected Health Information, and to notify you in the event of a breach of your unsecured Protected Health Information. When we use or disclose your Protected Health Information, we are required to abide by the terms of this Notice (or other notice in effect at the time of the use or disclosure).

HOW YOUR INFORMATION IS USED AND DISCLOSED

We may use and disclose your health information for purposes related to treatment, payment, and health care operations, which are essential to providing quality care. Federal and state law permit these uses and disclosures without requiring your authorization. The examples below are illustrative and not exhaustive.

• Treatment. We use and disclose your Protected Health Information to provide treatment and other services to you. For example, to provide clinical care services (e.g., primary care, psychiatry care, etc.); to consult with other clinicians about a medical condition, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to you or to describe a health-related product or service. We may also disclose Protected Health Information to other providers involved in your treatment.
• Payment.We may use and disclose your Protected Health Information to obtain payment for health care services that we provide to you. For example, disclosures to claim and obtain payment from Medicare, Medicaid, your health insurer, or other company or program that arranges or pays the cost of your health care (“Your Payer”) to verify that Your Payer will pay for the health care. We may also disclose Protected Health Information to your other health care providers when such Protected Health Information is required for them to receive payment for services they render to you.
• Health Care Operations. We may use and disclose your Protected Health Information for our health care operations, which include internal administration and planning and various activities that improve the quality and cost effectiveness of the care that we deliver to you. For example, we may use or disclose your Protected Health Information for quality assessment activities, employee review activities, communications with and/or about you, training, licensing, further developing the current and future capabilities of our practice, and conducting or arranging for other business activities.
• Health Information Exchanges (HIEs).The Practice may participate in health information exchanges (“HIEs”) and may electronically access or share your health information with other participating health care providers and organizations for treatment, payment, and health care operations, as permitted by law. If you reside in a state that permits you to opt out of HIE participation, or that requires your authorization to opt in, you may contact us at privacy@kinsteadhealth.com with the subject line “HIE Opt-Out” or “HIE Opt-In.” Information already shared may not be retractable.

Each of the entities listed at the beginning of this Notice may share Protected Health Information with the others as necessary to carry out treatment, payment, or health care operations relating to the Affiliated Covered Entity. We also may disclose your Protected Health Information with certain of our “business associates” or other third parties that perform various activities (e.g., billing, coordinating care, transcribing records) for us. We contractually require our business associates to implement safeguards to protect the privacy of your Protected Health Information.

DISCLOSURE TO RELATIVES, CLOSE FRIENDS, AND OTHER CAREGIVERS

We may use or disclose your Protected Health Information to a family member, other relative, a close personal friend or any other person identified by you when you are present for, or otherwise available prior to, the disclosure, if: (1) we obtain your agreement or provide you with the opportunity to object to the disclosure and you do not object; or (2) we reasonably infer that you do not object to the disclosure.

If you are not present for or unavailable prior to a disclosure (e.g., when we receive a telephone call from a family member or other caregiver), we may exercise our professional judgment to determine whether a disclosure is in your best interests. If we disclose information under such circumstances, we would disclose only information that is directly relevant to the person’s involvement with your care.

USES AND DISCLOSURES REQUIRING YOUR WRITTEN AUTHORIZATION

For any purpose other than the ones described above, we only use or disclose your Protected Health Information when you give us your written authorization. You may revoke (take back) your authorization, except to the extent that we have taken action in reliance upon it, by submitting a written statement to us using the contact information at the end of this Notice.

• Marketing. We must obtain your written authorization prior to using your Protected Health Information for purposes that are marketing under the HIPAA privacy rules. For example, we will not accept any payments from other organizations or individuals in exchange for making communications to you about treatments, therapies, health care providers, settings of care, case management, care coordination, products or services unless you have given us your authorization to do so or the communication is permitted by law.
• Sale of Protected Health Information. We will not make any disclosure of Protected Health Information that is a sale of Protected Health Information without your written authorization.
• Psychotherapy Notes. To the extent that we receive or create any psychotherapy notes about you, we will not use or disclose those psychotherapy notes without your authorization except as permitted by law.
• Uses and Disclosures of Your Highly Confidential Information. Federal and state law requires special privacy protections for certain health information about you (“Highly Confidential Information”), including mental health records, substance use disorder treatment records, and other health information that is given special privacy protection under state or federal laws other than HIPAA. However, in order for us to disclose any Highly Confidential Information for a purpose other than those permitted by law, we must obtain your authorization.

DISCLOSURES THAT MAY BE MADE WITHOUT AUTHORIZATION

We may disclose your health information without your authorization in the following circumstances, as permitted or required by applicable federal, state, or local law.

• Emergencies. Sufficient information may be shared to address an immediate emergency you are facing.
• Judicial and Administrative Proceedings. We may disclose your personal health information in the course of a judicial or administrative proceeding in response to a valid court order or other lawful process, including if you were to make a claim for Workers Compensation.
• Public Health Activities. If we felt you were an immediate danger to yourself or others, we may disclose health information about you to the authorities, as well as alert any other person who may be in danger.
• Child/Elder Abuse. We may disclose health information about you related to the suspicion of child and/or elder abuse or neglect.
• Criminal Activity or Danger to Others. We may disclose health information if a crime is committed on our premises or against our personnel, or if we believe there is someone who is in immediate danger.
• Health Oversight Activities. We may disclose health information to a health oversight agency for activities authorized by law. These activities might include audits or inspections and are necessary for the government to monitor the health care system and assure compliance with civil rights laws. Regulatory and accrediting organizations may review your case record to ensure compliance with their requirements. The minimum necessary information will be provided in these instances.
• Research. Under certain circumstances, we may use and disclose health information for research. We may permit researchers to look at non-identifying information to help them plan research projects.
• Business Associates. The Practice may disclose the minimum necessary health information to our business associates that perform functions on our behalf or provide us with services if the information is necessary for such functions or services. For example, the Practice contracts with a vendor for filing claims with insurance companies. In the process of filing claims, that organization will come into contact with your information. We also contract with a vendor that collects and manages internet or other electronic network activity on our sites and services and internally encodes it so that we can determine and manage information that might be health information. In addition, we have a vendor that collects and analyzes information about how our users interact with our website to support our health care operations. All of our business associates sign agreements to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract, and are obligated to promptly notify us in the event there is a breach of protected health information (as defined by HIPAA).
• Trusted Exchange Framework and Common Agreement (“TEFCA”). The Practice or its business associates may disclose health information through a TEFCA for HIPAA-authorized treatment purposes, subject to contractual agreements to protect the privacy and security of health information as required by HIPAA, in order to manage or coordinate your health care, arrange for additional services, and/or for our health care operations.
• Marketing, Appointments, and Communications. We may contact you regarding appointment scheduling or reminders, care coordination, and practice updates or educational information. You may opt out of non-essential communications at any time.

YOUR INDIVIDUAL RIGHTS

• Right to Inspect and Copy. You have the right to look at or get copies of your health information, with limited exceptions. Your request must be in writing. If you request a copy of the information, a reasonable charge may be made for the costs incurred.
• Right to Amend. You have the right to request that we amend your health information. Your request must be in writing, and it must explain why the information should be amended. We have the right to deny your request under certain circumstances.
• Right to an Accounting of Disclosures. You have the right to receive a list of instances in which we have disclosed your health information for a purpose other than treatment, payment, or health care operations. To request an accounting of disclosures, you must submit your request in writing to the Privacy Officer. Such accountings remain available for six years after the last date of service at the Practice.
• Right to Request Restrictions. You have the right to request a restriction or limitation on the health information we use or disclose about you. While you are in treatment, a written request should be made with your therapist. To request a restriction after therapy is completed, you must make your written request to the Privacy Officer. Please note that we are not required to agree to your request, except when a restriction is requested regarding a disclosure to a health plan in situations where the patient has paid for services in full and where the purpose of the disclosure is for payment. If we do agree, we will abide by the restriction unless the information is needed in an emergency or we are required to disclose it by law.
• Right to Request Confidential Communications. You have the right to request that we communicate with you about health matters in a certain way or at a certain location. For example, you may ask that we contact you only by mail or at work. You must make this request in writing and it must specify the alternative means or location that you would like us to use to provide you information about your health care. We will make every attempt to accommodate reasonable requests.
• Right to File Complaints. You may complain to us and to the Secretary of Health and Human Services if you believe your privacy rights have been violated. You may file a complaint with us by contacting the Privacy Officer at privacy@kinsteadhealth.com. You will not be retaliated against for filing a complaint. You may also contact the Privacy Officer for further information about this notice.

EMAIL AND TEXT MESSAGES

Some of our patients prefer to communicate with their provider via email or text message. Email and text messages have inherent privacy and security risks, and you should be aware of those before using emails and text messages. Errors in transmission or interception of messages can occur. Your email or text message is not a secure communication between you and your treating provider. At your health care provider’s discretion, your email or text message and any responses may become part of your medical record. Additionally, for an urgent or emergency situation, you should not rely on email or text message communication with providers affiliated with the Practice. In those situations, call 911.

The Practice’s current SMS program is strictly informational and healthcare-related and does not include marketing or promotional messages. Messages may include appointment confirmations, reminders, cancellations or rescheduling notices, care coordination, intake or form reminders, account notifications, insurance or payment information, treatment-related notifications, and responses to support requests.

You may consent to receive these messages either verbally during a telephone call, with the consent documented in the electronic health record, or by selecting an optional, unchecked SMS consent checkbox in an intake form. Consent is voluntary and is not a condition of receiving treatment, purchasing a service, or obtaining care. Message frequency varies, and message and data rates may apply.

Reply STOP to opt out of SMS messages. You may receive one final confirmation message after opting out, and no further SMS messages will be sent unless you opt in again. Reply HELP for assistance, call (646) 494-4425, or email support@kinsteadhealth.com. Mobile carriers are not liable for delayed or undelivered messages.

Mobile information, SMS opt-in data, and consent will not be sold or shared with third parties or affiliates for their own marketing or promotional purposes. Information may be disclosed to telecommunications carriers, messaging providers, and other business associates or service providers only as necessary to deliver and support requested messages, maintain consent and opt-out records, prevent fraud or abuse, or comply with law, subject to applicable privacy and security requirements.

ABOUT KINSTEAD AND KINSTEAD-AFFILIATED PROFESSIONAL ENTITIES

Kinstead, Inc. does not provide professional medical or behavioral health services. It provides administrative, billing, technology, compliance, and operational support to Kinstead-affiliated professional entities pursuant to HIPAA-compliant Business Associate Agreements. Professional services are provided exclusively by licensed Kinstead Providers through professional entities owned and governed in accordance with applicable state law and overseen by licensed clinical leadership.

KINSTEAD-AFFILIATED PROFESSIONAL ENTITIES

Kinstead Provider Group, P.A. and other affiliated professional entities operating under the Kinstead platform (as updated from time to time).