Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This page is a working template. The highlighted items below still need to be filled in, and a lawyer must sign off before it goes live. Each highlight is colour-coded by who handles it:
- You provide — a detail only you know (an address, an email, a date).
- Web team — a technical item the WellPeps web team completes. Nothing for you to do.
- Lawyer — a wording or legal decision for your attorney.
Just these items — everything else is handled by the web team or your lawyer:
- Your company's exact legal name.
- The names of the professional / medical entities that actually provide care through WellPeps (e.g. "WellPeps Medical Group, P.A." and any state affiliates).
- Whether any WellPeps service involves substance-use-disorder treatment — a simple yes or no.
- The name or title of your designated HIPAA Privacy Official.
- A mailing address and an email for your privacy office.
- The date this notice goes live.
This draft is written as if WellPeps and its affiliated medical practices issue this notice together. If your lawyer decides WellPeps is only a technology vendor to independent practices, then the practices issue the notice on their own and WellPeps comes off it. That decision depends on your corporate structure, so we need that from you and a ruling from your attorney before the rest of the page is final.
Lawyer: decide who officially issues this notice — WellPeps together with the medical entities, or the medical entities alone. You provide: your corporate structure (which company employs the providers, and the professional entity names) so your lawyer can make that call.
Who We Are
This notice covers You provide: your company's legal name and the affiliated professional entities providing care through the WellPeps platform: You provide: the professional entity names, e.g. WellPeps Medical Group, P.A. and state affiliates (together, “we”). We are required by law to maintain the privacy of your protected health information (“PHI”), give you this notice of our legal duties and privacy practices, and follow the terms of the notice currently in effect.
How We May Use and Disclose Your Health Information
Without your authorization, for:
- Treatment — e.g., your provider shares your intake and history with the pharmacy filling your prescription;
- Payment — e.g., processing your subscription charge or verifying coverage;
- Health care operations — e.g., quality review, licensing, and platform improvement;
- When required by law, for public-health activities, health oversight, judicial proceedings, law enforcement as permitted, to avert a serious threat to health or safety, and other purposes permitted by 45 CFR Part 164.
Only with your written authorization:
- Marketing uses of PHI;
- Sale of PHI (we do not sell PHI);
- Most uses and disclosures of psychotherapy notes, if any;
- Any other use not described in this notice. You may revoke an authorization at any time, in writing, except to the extent we have already relied on it.
You confirm: do any current or planned services involve substance-use-disorder treatment? A simple yes or no. Lawyer: if yes, 42 CFR Part 2's stricter consent rules apply and this notice needs a dedicated section.
Your Rights
- Access — inspect and receive a copy of your PHI, usually within 30 days, in the form you request where readily producible;
- Amendment — request correction of PHI you believe is wrong or incomplete;
- Accounting of disclosures — a list of certain disclosures we made in the prior six years;
- Restrictions — request limits on how we use or share PHI. We must agree when you pay fully out-of-pocket and ask us not to tell your health plan;
- Confidential communications — ask us to contact you in a specific way or at a specific location;
- Paper copy — receive a paper copy of this notice on request even if you agreed to electronic delivery;
- Breach notification — be notified if a breach compromises your unsecured PHI.
Changes to This Notice
We can change this notice, and the change will apply to PHI we already hold. The current notice will always be posted on this page with its effective date.
Complaints and Contact
If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.
Privacy Official: You provide: the name or title of your HIPAA Privacy Official
You provide: your privacy office mailing address
Email: You provide: a privacy contact email | Phone:
(833) 935-7377
HHS Office for Civil Rights: 200 Independence Avenue S.W., Washington, D.C. 20201 | 1-800-368-1019 | hhs.gov/ocr/complaints