HIPAA Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
1. Who We Are and What This Notice Covers
This Notice is issued by ABL Physician Services PLLC (the "Practice"). The Practice is a covered health care provider under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, "HIPAA"). In this Notice, "we," "us," and "our" mean the Practice. This Notice applies to protected health information ("PHI") the Practice creates, receives, maintains, or transmits in connection with your care, including medical intake information, telehealth encounters, secure messages, laboratory and prescription information, medical records, and related billing and payment records.
Independent laboratories, pharmacies, and other treating providers are responsible for their own privacy practices. A payment processor handles the payment and account information needed to process charges. This Notice does not govern information collected solely through the public marketing Website before it becomes part of the Practice's care or record systems. Information collected through the public Website, its subdomains, and the A Better Lou online checkout is described in the Website Privacy Policy of A Better Lou MSO, LLC, which is a separate notice of information practices and is not a HIPAA notice.
2. How HIPAA and Other Privacy Laws Apply
The Practice is a health care provider and covered entity under HIPAA. We comply with the HIPAA Privacy Rule when using and disclosing PHI, protect electronic PHI under the HIPAA Security Rule, and provide notice when required by the HIPAA Breach Notification Rule. HIPAA also gives you the rights concerning PHI described in this Notice and requires us to follow the privacy practices stated here.
HIPAA provides a federal floor of privacy protection. We also comply with other federal and state laws that provide greater privacy protection or additional rights. This Notice governs the Practice's PHI practices. It does not govern records maintained independently by laboratories, pharmacies, or other treating providers.
Section 15 adds state-specific protections based on where you are located during care. If a state law is more protective than this Notice, that law controls.
3. Your Rights
To exercise any right described below, contact the Practice's Privacy Officer using the information in Section 13. We may ask for a written request and information needed to verify your identity or the authority of a personal representative. These rights are required by HIPAA and may be supplemented by more protective federal or state law.
Get an electronic or paper copy of your records. You have the right to access, inspect, and receive a copy of the medical records and other health information we maintain about you. We will usually provide a copy or summary within 30 days, unless applicable law requires a shorter period. If additional time is permitted and needed, we will tell you in writing. We may charge only a reasonable, cost-based fee allowed by law.
Ask us to correct your records. You may ask us to amend health information you believe is incorrect or incomplete. We may deny the request when law allows, but we will explain the denial in writing and describe any further rights you have.
Request confidential communications. You may ask us to contact you in a particular way or at a particular location. We will accommodate reasonable requests. Tell us if leaving a voicemail, sending mail, or using a particular email address could put you at risk.
Ask us to limit what we use or share. You may ask us not to use or disclose certain information for treatment, payment, or health care operations. We are not always required to agree. If we agree, we will follow the restriction except when information is needed for emergency treatment or law permits otherwise.
Request a self-pay restriction. If you pay in full out of pocket for an item or service and ask us not to disclose it to a health plan for payment or health care operations, we will honor the request unless a law requires the disclosure. The Practice does not ordinarily submit information to health plans.
Get an accounting of certain disclosures. You may ask for a list of certain disclosures made during the six years before your request. The list generally does not include disclosures for treatment, payment, or health care operations, disclosures you authorized or asked us to make, and certain other disclosures excluded by law. It will include disclosures required by law unless an accounting exception applies. We will provide one accounting in a 12-month period without charge and may charge a reasonable, cost-based fee for an additional request after warning you in advance.
Get a paper copy of this Notice. You may ask for a paper copy at any time, even if you agreed to electronic delivery. We will provide one promptly and without charge.
Choose someone to act for you. A personal representative who has legal authority to act for you may exercise your privacy rights. We will verify the person's authority before acting.
File a complaint. You may complain to us or to the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you, reduce your care, or charge you differently for exercising a privacy right or filing a complaint.
4. Your Choices
In the situations described below, tell us your preference. We will follow your instructions when the law gives you that choice. A more protective state rule may require written permission even when federal law would allow an informal choice.
Family, friends, and others involved in your care or payment. You may tell us to share relevant information with a family member, close friend, caregiver, or another person involved in your care or payment. If you cannot tell us your preference, we may share limited information when permitted by law and when we reasonably believe it is in your best interest.
Disaster relief. We may share limited information with a disaster-relief organization when permitted by law so that family or others responsible for your care can be notified of your location, general condition, or death.
Hospital directory. The Practice does not maintain a hospital directory.
Fundraising. The Practice does not currently use health information to contact patients for fundraising. If this practice changes, we will revise this Notice as required and provide any opt-out right required by law.
5. How We Usually Use and Share Health Information
Treat you. We may use your information and share it with professionals involved in your care. For example, a Provider may review your medical history and laboratory results, send a prescription to the pharmacy you choose, coordinate an ordered test with an independent laboratory, or share the information needed for a supervised care-team member to support your care.
Run the Practice. We may use and share information to operate the Practice, improve care, manage quality, train and supervise the workforce, credential Providers, conduct compliance and security reviews, resolve complaints, and plan services. For example, we may review records to evaluate whether the telehealth intake and follow-up process is working safely.
Bill and receive payment. We may use and share the minimum information needed to process your private-pay charges, invoices, refunds, receipts, and payment questions. For example, we may send payment and account information to the payment processor to charge the payment method you selected. We do not submit insurance claims to health plans on your behalf.
Communicate about your care and account. We may contact you about appointments, prescriptions, laboratory orders, results, treatment instructions, refills, care coordination, safety messages, billing, and account administration. Care-related communications are not promotional marketing merely because they describe a health-related service.
Platform. References to "the Platform" in this Notice mean A Better Lou MSO, LLC, the separate nonclinical management, technology, and support company that operates the A Better Lou Website and online checkout. This is the same meaning the term has in the Website Privacy Policy, the Website Terms of Use, the Terms and Conditions of Service, the Analytics and Advertising Policy, and the Telehealth and Electronic Signature Consent. The Platform is not a health care provider and does not make clinical decisions. When and to the extent the Platform creates, receives, maintains, or transmits PHI for a function it performs on the Practice's behalf, it does so as a business associate under a written business associate agreement.
Electronic health record vendor. The Practice uses Canvas Medical, Inc. as its electronic health record and telehealth technology system to document, store, and manage your medical records and telehealth encounters. Canvas Medical is a business associate of the Practice under a HIPAA-compliant business associate agreement and has access to your PHI as necessary to perform its EHR and telehealth platform functions. Canvas Medical is not the Platform.
Use service providers and the Platform for limited functions. We may allow vendors to create, receive, maintain, or transmit PHI for functions they perform for the Practice. The Platform may perform limited checkout, consent-record, payment-administration, receipt, refund, account-support, or related administrative functions. When and to the extent the Platform or another vendor handles PHI on the Practice's behalf, it must do so under HIPAA-compliant written terms, including a business associate agreement when required. This limited administrative role does not authorize access to the Practice-controlled clinical questionnaires, encounter content, medical records, recordings, transcripts, clinical notes, laboratory results, or prescription records.
Create de-identified information. We may remove identifiers so the information no longer identifies you under the applicable legal standard. We may use or share properly de-identified information for quality improvement, operations, research, and planning. We do not permit a recipient to re-identify information when a legal or contractual restriction prohibits it.
6. Other Uses and Disclosures Allowed or Required by Law
We may use or disclose PHI for the purposes below only after satisfying every condition imposed by HIPAA and other applicable law. A stricter federal or state rule, including 42 C.F.R. Part 2 when it applies to particular records, may limit or prohibit a disclosure that HIPAA would otherwise permit.
Public health and safety. We may report information for disease prevention or control, product recalls, adverse reactions, communicable-disease reporting, and other authorized public-health activities. We may disclose information to prevent or lessen a serious and imminent threat to health or safety when law permits.
Abuse, neglect, or domestic violence. We may report suspected abuse, neglect, exploitation, or domestic violence when required or permitted by law, including reports concerning a child, elder, or vulnerable adult.
Comply with law, health oversight, and compliance. We may use or disclose PHI when federal or state law requires it. We may disclose PHI for authorized audits, inspections, investigations, licensing, accreditation, and compliance reviews, including to the U.S. Department of Health and Human Services when it asks to determine compliance with federal privacy law.
Legal proceedings and law enforcement. We may disclose information in response to a court or administrative order, or in response to a subpoena or other lawful process, only after all conditions imposed by applicable law are met. We may disclose limited information to law enforcement for purposes specifically permitted by law.
Coroners, medical examiners, funeral directors, and organ donation. We may share information with authorized persons for identification, determining cause of death, performing legal duties, arranging disposition, or facilitating organ, eye, or tissue donation.
Workers' compensation and specialized government functions. We may disclose information as authorized for workers' compensation, military or veterans' activities, national security, protective services, correctional institutions, or lawful custody.
Research. We may use or disclose health information for research when an Institutional Review Board or Privacy Board has approved a waiver of authorization, or when another law permits the use. Otherwise, we obtain your written authorization. The State Privacy Law Addendum may impose a stricter consent requirement for identifiable telehealth images or other sensitive records.
7. Uses and Disclosures Requiring Written Authorization
Most uses and disclosures of psychotherapy notes, uses and disclosures for marketing, and disclosures that constitute a sale of health information require your written authorization unless a legal exception applies. Other uses and disclosures not described in this Notice will be made only with your written authorization. You may revoke an authorization in writing at any time, except to the extent we already acted in reliance on it or another law limits revocation.
The Practice does not use health information from your care for targeted advertising or advertising measurement without a valid, separate authorization when one is required. Any optional consent to receive promotional email, text, or telephone messages is separate from treatment, payment, electronic-record delivery, and acknowledgment of this Notice. Refusing optional marketing consent will not affect your eligibility, pricing, or care.
8. Special Protections for Sensitive Information
Substance use disorder records protected by 42 C.F.R. Part 2. To the extent we receive or maintain substance use disorder patient records protected by 42 C.F.R. Part 2, those records, or testimony describing their contents, will not be used or disclosed in a civil, criminal, administrative, or legislative proceeding against you unless you give written consent or a court issues an order after you or the record holder receives notice and an opportunity to be heard. A court order authorizing the use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure. If the Practice ever uses Part 2 records for fundraising, it will first give you a clear and conspicuous opportunity to elect not to receive those communications.
Mental and behavioral health information. Psychotherapy notes and records created in providing mental-health services may receive additional federal or state protection. We obtain specific permission when required and follow any special court-process, consent, and redisclosure limits.
HIV, sexually transmitted infection, genetic, reproductive, and biometric information. Applicable law may place additional restrictions on these categories. We use or disclose them only as permitted by the law that applies to the information and the state where care is delivered.
Information about minors. The Practice provides services only to adults age 18 and older. If the Practice nevertheless holds information about a minor, the minor's and personal representative's rights are determined by applicable law.
9. Telehealth, Secure Portal, and Electronic Communications
This Notice applies to health information created or maintained for the Practice through asynchronous questionnaires, audio-only or audio-video visits, secure messaging, electronic prescribing, laboratory coordination, and other telehealth services. Telehealth records are part of the Practice's medical record and receive the same confidentiality protection as comparable in-person records, together with any additional protection in Section 15.
The secure patient portal and secure patient messaging are the channels for medical details and asynchronous clinical communication. Standard email, SMS text, and social media are not secure channels for medical information. We may use standard email or text for limited scheduling, billing, account, and other communications when permitted and according to your choices. Do not send urgent or detailed medical information through an unsecured channel.
We record a clinical telehealth encounter only after session-specific notice and affirmative consent from every participant before recording begins. If a participant refuses or withdraws consent, recording will not begin or will stop. Support or administrative calls may be recorded consistent with applicable law, including any prior notice or consent that the law of the applicable state requires. Any recording that becomes part of the Practice's health information is protected under this Notice.
These contacts and messaging channels are not monitored continuously and are not for emergencies or crisis care. If you think you may have a medical emergency, call 911 or go to the nearest emergency department.
10. Our Responsibilities and Breach Notification
HIPAA Breach Notification. We are required by law to notify you following a breach of your unsecured protected health information. If we discover a breach of your unsecured PHI as defined under HIPAA, we will notify you as soon as reasonably practicable after we have completed our investigation and determined that a breach occurred, and in no event later than 60 calendar days after discovery of the breach. "Discovery" occurs on the first day the breach is known to us or would have been known by exercising reasonable diligence. Notice will include a description of the breach, the types of information involved, steps you should take to protect yourself, what we are doing to investigate and mitigate the breach, and contact information for questions. We will provide notice by first-class mail to your last known address, or by email if you have agreed to electronic notice and we have a valid email address on file. If we do not have sufficient contact information for you, or if a breach affects 10 or more individuals for whom we lack contact information, we will provide substitute notice by conspicuous posting on our Website or, for large breaches, by notice in major media serving the affected area.
We will also report the breach to the U.S. Department of Health and Human Services in the timeframe required by HIPAA.
State Breach Notification Laws. In addition to HIPAA, many states require notification when personal information (including health information) is breached. If a breach affects your information and you are a resident of or received care in a state with its own breach-notification law, we will also comply with that state's requirements, including timing, content, and recipient (such as the state attorney general or consumer reporting agencies) as required by that state's law. When both HIPAA and a state law apply, we will comply with the requirement that provides greater protection or the shorter notification deadline.
Timing. We will provide breach notification in the most expedient time possible and without unreasonable delay, consistent with the needs of law enforcement, the time necessary to determine the scope of the breach and restore the integrity of our systems, and the requirements of applicable law. When state law requires notice sooner than HIPAA's 60-day deadline, we will meet the shorter state deadline.
11. Changes to This Notice
We may change the terms of this Notice and make the revised terms effective for all health information we maintain, including information created or received before the revision. We will not implement a material change before the revised Notice's effective date unless law requires it. The effective date will not be earlier than the date the revised Notice is first printed or otherwise published.
The current Notice will be available upon request, in the secure patient portal, and prominently on the Website page that provides information about patient services or benefits. If the Practice maintains a physical service-delivery location, the current Notice will also be available and prominently posted there as required by applicable law.
12. Complaints
You may file a privacy complaint with the Practice's Privacy Officer using Section 13. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights through its complaint portal at www.hhs.gov/hipaa/filing-a-complaint, by email to OCRComplaint@hhs.gov, or by mail to Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Room 509F HHH Building, Washington, DC 20201. Federal complaints generally must be filed within 180 days after you knew of the event, subject to extension for good cause. We will not retaliate against you for filing a complaint or exercising a privacy right.
13. Privacy Officer and Contact Information
Practice privacy, medical-record, and patient-rights requests: Privacy Officer, ABL Physician Services PLLC, 333 N Wilmot Rd Ste 340-18, Tucson, AZ 85711; phone (480) 944-3221. Use the secure patient portal at https://abetterlou.canvasmedical.com/app/login for medical-record or HIPAA requests and detailed health information. You may email privacy@abetterlou.com or support@abetterlou.com to request a secure follow-up, but do not include medical details in ordinary email.
Do not include detailed medical information in ordinary email. Use the secure patient portal for medical details. To request this Notice in an accessible alternative format or to request an auxiliary aid or service, contact support@abetterlou.com.
14. Delivery, Acknowledgment, and Availability
Initial delivery. We provide this Notice electronically through checkout or the secure patient portal automatically when you first request clinical services and no later than the first service we provide. If you have not agreed to electronic notice, electronic delivery fails, or electronic delivery is not feasible, we will provide a paper copy no later than the first service, except in an emergency when the Notice may be provided as soon as reasonably practicable afterward.
Acknowledgment of receipt. We make a good-faith effort to obtain and document your written or electronic acknowledgment that you received this Notice. If we cannot obtain it, we document the effort and the reason. Your care is not conditioned on acknowledgment.
Effect of receipt. Receipt or acknowledgment of this Notice is not consent to treatment, not agreement to separate terms of service or any other agreement, not permission for optional marketing communications, not authorization to use or disclose information beyond what law and this Notice permit, and not a waiver of any right.
Ongoing availability. You may download or print the Notice from the secure patient portal or Website and may request a free paper copy at any time. We retain each issued version and either your acknowledgment or our documentation of the good-faith effort to obtain it.
15. State Privacy Law Addendum
This Addendum forms part of the Notice. The section for the state where you are physically located during care supplements the core Notice. Other category-specific laws may apply, and applicable law controls even if no state section appears. Arizona is active as of the Effective Date. Illinois is included for prospective activation and applies when a selected Plan is shown as available there and care is furnished there. If an addendum rule conflicts with the core Notice, the more protective rule controls.
Arizona (A.R.S. Sections 12-2292 and 36-3602). Medical records, payment records, and information in those records are privileged and confidential and may be disclosed only as authorized by state or federal law or by a written authorization signed by you or your health care decision maker. Telehealth reports are part of your medical record. We will not disseminate images or information that identify you for research or educational purposes without your consent unless state or federal law authorizes the use. Telehealth informed consent is addressed separately from acknowledgment of this Notice. If the Practice participates in an Arizona health information organization, we will provide any separate notice and choice required before information is made available through that organization.
Illinois Mental Health Records (740 ILCS 110/1 et seq.). If the Practice creates or receives records or communications in providing mental-health or developmental-disabilities services that are protected by the Illinois Mental Health and Developmental Disabilities Confidentiality Act, we will disclose them only with a legally sufficient written consent or as the Act specifically permits. Written consent must include: the name of the person whose information is being disclosed; the name of the person or entity authorized to make the disclosure; the name and relationship of the person or entity to whom disclosure is made; the purpose of the disclosure; the nature of the information; your right to inspect and copy the information before disclosure (you have 30 days to review unless you waive this right in the consent); an expiration date or event; and your signature and date. Information disclosed with your consent may not be redisclosed by the recipient except as specifically authorized in your consent or as the Act permits; we will notify recipients of this restriction. You have the right to inspect and copy your mental health records unless a specific exception applies (for example, if access would be harmful to you or another person). If we deny access, we will provide written grounds and inform you of your right to have the denial reviewed or to petition a court. Mental health records and communications are privileged. We will not disclose them in a civil, criminal, administrative, or legislative proceeding except with your written waiver or a court order issued after you have received notice and an opportunity to be heard. We will follow the Act's additional requirements for court orders, subpoenas, and access. Other Illinois laws may impose additional protections for HIV, genetic, and other sensitive information when applicable.
Illinois Breach Notification. If the Practice experiences a breach of your personal information as defined under the Illinois Personal Information Protection Act (815 ILCS 530), we will notify you in the most expedient time possible and without unreasonable delay, and will notify the Illinois Attorney General when required by Illinois law, in addition to any notice required by HIPAA. See Section 10 for breach-notification procedures.
1. Who We Are and What This Notice Covers
This Notice is issued by ABL Physician Services PLLC (the "Practice"). The Practice is a covered health care provider under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, "HIPAA"). In this Notice, "we," "us," and "our" mean the Practice. This Notice applies to protected health information ("PHI") the Practice creates, receives, maintains, or transmits in connection with your care, including medical intake information, telehealth encounters, secure messages, laboratory and prescription information, medical records, and related billing and payment records.
Independent laboratories, pharmacies, and other treating providers are responsible for their own privacy practices. A payment processor handles the payment and account information needed to process charges. This Notice does not govern information collected solely through the public marketing Website before it becomes part of the Practice's care or record systems. Information collected through the public Website, its subdomains, and the A Better Lou online checkout is described in the Website Privacy Policy of A Better Lou MSO, LLC, which is a separate notice of information practices and is not a HIPAA notice.
2. How HIPAA and Other Privacy Laws Apply
The Practice is a health care provider and covered entity under HIPAA. We comply with the HIPAA Privacy Rule when using and disclosing PHI, protect electronic PHI under the HIPAA Security Rule, and provide notice when required by the HIPAA Breach Notification Rule. HIPAA also gives you the rights concerning PHI described in this Notice and requires us to follow the privacy practices stated here.
HIPAA provides a federal floor of privacy protection. We also comply with other federal and state laws that provide greater privacy protection or additional rights. This Notice governs the Practice's PHI practices. It does not govern records maintained independently by laboratories, pharmacies, or other treating providers.
Section 15 adds state-specific protections based on where you are located during care. If a state law is more protective than this Notice, that law controls.
3. Your Rights
To exercise any right described below, contact the Practice's Privacy Officer using the information in Section 13. We may ask for a written request and information needed to verify your identity or the authority of a personal representative. These rights are required by HIPAA and may be supplemented by more protective federal or state law.
Get an electronic or paper copy of your records. You have the right to access, inspect, and receive a copy of the medical records and other health information we maintain about you. We will usually provide a copy or summary within 30 days, unless applicable law requires a shorter period. If additional time is permitted and needed, we will tell you in writing. We may charge only a reasonable, cost-based fee allowed by law.
Ask us to correct your records. You may ask us to amend health information you believe is incorrect or incomplete. We may deny the request when law allows, but we will explain the denial in writing and describe any further rights you have.
Request confidential communications. You may ask us to contact you in a particular way or at a particular location. We will accommodate reasonable requests. Tell us if leaving a voicemail, sending mail, or using a particular email address could put you at risk.
Ask us to limit what we use or share. You may ask us not to use or disclose certain information for treatment, payment, or health care operations. We are not always required to agree. If we agree, we will follow the restriction except when information is needed for emergency treatment or law permits otherwise.
Request a self-pay restriction. If you pay in full out of pocket for an item or service and ask us not to disclose it to a health plan for payment or health care operations, we will honor the request unless a law requires the disclosure. The Practice does not ordinarily submit information to health plans.
Get an accounting of certain disclosures. You may ask for a list of certain disclosures made during the six years before your request. The list generally does not include disclosures for treatment, payment, or health care operations, disclosures you authorized or asked us to make, and certain other disclosures excluded by law. It will include disclosures required by law unless an accounting exception applies. We will provide one accounting in a 12-month period without charge and may charge a reasonable, cost-based fee for an additional request after warning you in advance.
Get a paper copy of this Notice. You may ask for a paper copy at any time, even if you agreed to electronic delivery. We will provide one promptly and without charge.
Choose someone to act for you. A personal representative who has legal authority to act for you may exercise your privacy rights. We will verify the person's authority before acting.
File a complaint. You may complain to us or to the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you, reduce your care, or charge you differently for exercising a privacy right or filing a complaint.
4. Your Choices
In the situations described below, tell us your preference. We will follow your instructions when the law gives you that choice. A more protective state rule may require written permission even when federal law would allow an informal choice.
Family, friends, and others involved in your care or payment. You may tell us to share relevant information with a family member, close friend, caregiver, or another person involved in your care or payment. If you cannot tell us your preference, we may share limited information when permitted by law and when we reasonably believe it is in your best interest.
Disaster relief. We may share limited information with a disaster-relief organization when permitted by law so that family or others responsible for your care can be notified of your location, general condition, or death.
Hospital directory. The Practice does not maintain a hospital directory.
Fundraising. The Practice does not currently use health information to contact patients for fundraising. If this practice changes, we will revise this Notice as required and provide any opt-out right required by law.
5. How We Usually Use and Share Health Information
Treat you. We may use your information and share it with professionals involved in your care. For example, a Provider may review your medical history and laboratory results, send a prescription to the pharmacy you choose, coordinate an ordered test with an independent laboratory, or share the information needed for a supervised care-team member to support your care.
Run the Practice. We may use and share information to operate the Practice, improve care, manage quality, train and supervise the workforce, credential Providers, conduct compliance and security reviews, resolve complaints, and plan services. For example, we may review records to evaluate whether the telehealth intake and follow-up process is working safely.
Bill and receive payment. We may use and share the minimum information needed to process your private-pay charges, invoices, refunds, receipts, and payment questions. For example, we may send payment and account information to the payment processor to charge the payment method you selected. We do not submit insurance claims to health plans on your behalf.
Communicate about your care and account. We may contact you about appointments, prescriptions, laboratory orders, results, treatment instructions, refills, care coordination, safety messages, billing, and account administration. Care-related communications are not promotional marketing merely because they describe a health-related service.
Platform. References to "the Platform" in this Notice mean A Better Lou MSO, LLC, the separate nonclinical management, technology, and support company that operates the A Better Lou Website and online checkout. This is the same meaning the term has in the Website Privacy Policy, the Website Terms of Use, the Terms and Conditions of Service, the Analytics and Advertising Policy, and the Telehealth and Electronic Signature Consent. The Platform is not a health care provider and does not make clinical decisions. When and to the extent the Platform creates, receives, maintains, or transmits PHI for a function it performs on the Practice's behalf, it does so as a business associate under a written business associate agreement.
Electronic health record vendor. The Practice uses Canvas Medical, Inc. as its electronic health record and telehealth technology system to document, store, and manage your medical records and telehealth encounters. Canvas Medical is a business associate of the Practice under a HIPAA-compliant business associate agreement and has access to your PHI as necessary to perform its EHR and telehealth platform functions. Canvas Medical is not the Platform.
Use service providers and the Platform for limited functions. We may allow vendors to create, receive, maintain, or transmit PHI for functions they perform for the Practice. The Platform may perform limited checkout, consent-record, payment-administration, receipt, refund, account-support, or related administrative functions. When and to the extent the Platform or another vendor handles PHI on the Practice's behalf, it must do so under HIPAA-compliant written terms, including a business associate agreement when required. This limited administrative role does not authorize access to the Practice-controlled clinical questionnaires, encounter content, medical records, recordings, transcripts, clinical notes, laboratory results, or prescription records.
Create de-identified information. We may remove identifiers so the information no longer identifies you under the applicable legal standard. We may use or share properly de-identified information for quality improvement, operations, research, and planning. We do not permit a recipient to re-identify information when a legal or contractual restriction prohibits it.
6. Other Uses and Disclosures Allowed or Required by Law
We may use or disclose PHI for the purposes below only after satisfying every condition imposed by HIPAA and other applicable law. A stricter federal or state rule, including 42 C.F.R. Part 2 when it applies to particular records, may limit or prohibit a disclosure that HIPAA would otherwise permit.
Public health and safety. We may report information for disease prevention or control, product recalls, adverse reactions, communicable-disease reporting, and other authorized public-health activities. We may disclose information to prevent or lessen a serious and imminent threat to health or safety when law permits.
Abuse, neglect, or domestic violence. We may report suspected abuse, neglect, exploitation, or domestic violence when required or permitted by law, including reports concerning a child, elder, or vulnerable adult.
Comply with law, health oversight, and compliance. We may use or disclose PHI when federal or state law requires it. We may disclose PHI for authorized audits, inspections, investigations, licensing, accreditation, and compliance reviews, including to the U.S. Department of Health and Human Services when it asks to determine compliance with federal privacy law.
Legal proceedings and law enforcement. We may disclose information in response to a court or administrative order, or in response to a subpoena or other lawful process, only after all conditions imposed by applicable law are met. We may disclose limited information to law enforcement for purposes specifically permitted by law.
Coroners, medical examiners, funeral directors, and organ donation. We may share information with authorized persons for identification, determining cause of death, performing legal duties, arranging disposition, or facilitating organ, eye, or tissue donation.
Workers' compensation and specialized government functions. We may disclose information as authorized for workers' compensation, military or veterans' activities, national security, protective services, correctional institutions, or lawful custody.
Research. We may use or disclose health information for research when an Institutional Review Board or Privacy Board has approved a waiver of authorization, or when another law permits the use. Otherwise, we obtain your written authorization. The State Privacy Law Addendum may impose a stricter consent requirement for identifiable telehealth images or other sensitive records.
7. Uses and Disclosures Requiring Written Authorization
Most uses and disclosures of psychotherapy notes, uses and disclosures for marketing, and disclosures that constitute a sale of health information require your written authorization unless a legal exception applies. Other uses and disclosures not described in this Notice will be made only with your written authorization. You may revoke an authorization in writing at any time, except to the extent we already acted in reliance on it or another law limits revocation.
The Practice does not use health information from your care for targeted advertising or advertising measurement without a valid, separate authorization when one is required. Any optional consent to receive promotional email, text, or telephone messages is separate from treatment, payment, electronic-record delivery, and acknowledgment of this Notice. Refusing optional marketing consent will not affect your eligibility, pricing, or care.
8. Special Protections for Sensitive Information
Substance use disorder records protected by 42 C.F.R. Part 2. To the extent we receive or maintain substance use disorder patient records protected by 42 C.F.R. Part 2, those records, or testimony describing their contents, will not be used or disclosed in a civil, criminal, administrative, or legislative proceeding against you unless you give written consent or a court issues an order after you or the record holder receives notice and an opportunity to be heard. A court order authorizing the use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure. If the Practice ever uses Part 2 records for fundraising, it will first give you a clear and conspicuous opportunity to elect not to receive those communications.
Mental and behavioral health information. Psychotherapy notes and records created in providing mental-health services may receive additional federal or state protection. We obtain specific permission when required and follow any special court-process, consent, and redisclosure limits.
HIV, sexually transmitted infection, genetic, reproductive, and biometric information. Applicable law may place additional restrictions on these categories. We use or disclose them only as permitted by the law that applies to the information and the state where care is delivered.
Information about minors. The Practice provides services only to adults age 18 and older. If the Practice nevertheless holds information about a minor, the minor's and personal representative's rights are determined by applicable law.
9. Telehealth, Secure Portal, and Electronic Communications
This Notice applies to health information created or maintained for the Practice through asynchronous questionnaires, audio-only or audio-video visits, secure messaging, electronic prescribing, laboratory coordination, and other telehealth services. Telehealth records are part of the Practice's medical record and receive the same confidentiality protection as comparable in-person records, together with any additional protection in Section 15.
The secure patient portal and secure patient messaging are the channels for medical details and asynchronous clinical communication. Standard email, SMS text, and social media are not secure channels for medical information. We may use standard email or text for limited scheduling, billing, account, and other communications when permitted and according to your choices. Do not send urgent or detailed medical information through an unsecured channel.
We record a clinical telehealth encounter only after session-specific notice and affirmative consent from every participant before recording begins. If a participant refuses or withdraws consent, recording will not begin or will stop. Support or administrative calls may be recorded consistent with applicable law, including any prior notice or consent that the law of the applicable state requires. Any recording that becomes part of the Practice's health information is protected under this Notice.
These contacts and messaging channels are not monitored continuously and are not for emergencies or crisis care. If you think you may have a medical emergency, call 911 or go to the nearest emergency department.
10. Our Responsibilities and Breach Notification
HIPAA Breach Notification. We are required by law to notify you following a breach of your unsecured protected health information. If we discover a breach of your unsecured PHI as defined under HIPAA, we will notify you as soon as reasonably practicable after we have completed our investigation and determined that a breach occurred, and in no event later than 60 calendar days after discovery of the breach. "Discovery" occurs on the first day the breach is known to us or would have been known by exercising reasonable diligence. Notice will include a description of the breach, the types of information involved, steps you should take to protect yourself, what we are doing to investigate and mitigate the breach, and contact information for questions. We will provide notice by first-class mail to your last known address, or by email if you have agreed to electronic notice and we have a valid email address on file. If we do not have sufficient contact information for you, or if a breach affects 10 or more individuals for whom we lack contact information, we will provide substitute notice by conspicuous posting on our Website or, for large breaches, by notice in major media serving the affected area.
We will also report the breach to the U.S. Department of Health and Human Services in the timeframe required by HIPAA.
State Breach Notification Laws. In addition to HIPAA, many states require notification when personal information (including health information) is breached. If a breach affects your information and you are a resident of or received care in a state with its own breach-notification law, we will also comply with that state's requirements, including timing, content, and recipient (such as the state attorney general or consumer reporting agencies) as required by that state's law. When both HIPAA and a state law apply, we will comply with the requirement that provides greater protection or the shorter notification deadline.
Timing. We will provide breach notification in the most expedient time possible and without unreasonable delay, consistent with the needs of law enforcement, the time necessary to determine the scope of the breach and restore the integrity of our systems, and the requirements of applicable law. When state law requires notice sooner than HIPAA's 60-day deadline, we will meet the shorter state deadline.
11. Changes to This Notice
We may change the terms of this Notice and make the revised terms effective for all health information we maintain, including information created or received before the revision. We will not implement a material change before the revised Notice's effective date unless law requires it. The effective date will not be earlier than the date the revised Notice is first printed or otherwise published.
The current Notice will be available upon request, in the secure patient portal, and prominently on the Website page that provides information about patient services or benefits. If the Practice maintains a physical service-delivery location, the current Notice will also be available and prominently posted there as required by applicable law.
12. Complaints
You may file a privacy complaint with the Practice's Privacy Officer using Section 13. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights through its complaint portal at www.hhs.gov/hipaa/filing-a-complaint, by email to OCRComplaint@hhs.gov, or by mail to Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Room 509F HHH Building, Washington, DC 20201. Federal complaints generally must be filed within 180 days after you knew of the event, subject to extension for good cause. We will not retaliate against you for filing a complaint or exercising a privacy right.
13. Privacy Officer and Contact Information
Practice privacy, medical-record, and patient-rights requests: Privacy Officer, ABL Physician Services PLLC, 333 N Wilmot Rd Ste 340-18, Tucson, AZ 85711; phone (480) 944-3221. Use the secure patient portal at https://abetterlou.canvasmedical.com/app/login for medical-record or HIPAA requests and detailed health information. You may email privacy@abetterlou.com or support@abetterlou.com to request a secure follow-up, but do not include medical details in ordinary email.
Do not include detailed medical information in ordinary email. Use the secure patient portal for medical details. To request this Notice in an accessible alternative format or to request an auxiliary aid or service, contact support@abetterlou.com.
14. Delivery, Acknowledgment, and Availability
Initial delivery. We provide this Notice electronically through checkout or the secure patient portal automatically when you first request clinical services and no later than the first service we provide. If you have not agreed to electronic notice, electronic delivery fails, or electronic delivery is not feasible, we will provide a paper copy no later than the first service, except in an emergency when the Notice may be provided as soon as reasonably practicable afterward.
Acknowledgment of receipt. We make a good-faith effort to obtain and document your written or electronic acknowledgment that you received this Notice. If we cannot obtain it, we document the effort and the reason. Your care is not conditioned on acknowledgment.
Effect of receipt. Receipt or acknowledgment of this Notice is not consent to treatment, not agreement to separate terms of service or any other agreement, not permission for optional marketing communications, not authorization to use or disclose information beyond what law and this Notice permit, and not a waiver of any right.
Ongoing availability. You may download or print the Notice from the secure patient portal or Website and may request a free paper copy at any time. We retain each issued version and either your acknowledgment or our documentation of the good-faith effort to obtain it.
15. State Privacy Law Addendum
This Addendum forms part of the Notice. The section for the state where you are physically located during care supplements the core Notice. Other category-specific laws may apply, and applicable law controls even if no state section appears. Arizona is active as of the Effective Date. Illinois is included for prospective activation and applies when a selected Plan is shown as available there and care is furnished there. If an addendum rule conflicts with the core Notice, the more protective rule controls.
Arizona (A.R.S. Sections 12-2292 and 36-3602). Medical records, payment records, and information in those records are privileged and confidential and may be disclosed only as authorized by state or federal law or by a written authorization signed by you or your health care decision maker. Telehealth reports are part of your medical record. We will not disseminate images or information that identify you for research or educational purposes without your consent unless state or federal law authorizes the use. Telehealth informed consent is addressed separately from acknowledgment of this Notice. If the Practice participates in an Arizona health information organization, we will provide any separate notice and choice required before information is made available through that organization.
Illinois Mental Health Records (740 ILCS 110/1 et seq.). If the Practice creates or receives records or communications in providing mental-health or developmental-disabilities services that are protected by the Illinois Mental Health and Developmental Disabilities Confidentiality Act, we will disclose them only with a legally sufficient written consent or as the Act specifically permits. Written consent must include: the name of the person whose information is being disclosed; the name of the person or entity authorized to make the disclosure; the name and relationship of the person or entity to whom disclosure is made; the purpose of the disclosure; the nature of the information; your right to inspect and copy the information before disclosure (you have 30 days to review unless you waive this right in the consent); an expiration date or event; and your signature and date. Information disclosed with your consent may not be redisclosed by the recipient except as specifically authorized in your consent or as the Act permits; we will notify recipients of this restriction. You have the right to inspect and copy your mental health records unless a specific exception applies (for example, if access would be harmful to you or another person). If we deny access, we will provide written grounds and inform you of your right to have the denial reviewed or to petition a court. Mental health records and communications are privileged. We will not disclose them in a civil, criminal, administrative, or legislative proceeding except with your written waiver or a court order issued after you have received notice and an opportunity to be heard. We will follow the Act's additional requirements for court orders, subpoenas, and access. Other Illinois laws may impose additional protections for HIV, genetic, and other sensitive information when applicable.
Illinois Breach Notification. If the Practice experiences a breach of your personal information as defined under the Illinois Personal Information Protection Act (815 ILCS 530), we will notify you in the most expedient time possible and without unreasonable delay, and will notify the Illinois Attorney General when required by Illinois law, in addition to any notice required by HIPAA. See Section 10 for breach-notification procedures.