Notice of Privacy Practices

This website notice describes privacy practices for protected health information created or received in connection with telehealth services coordinated through Biovana. Medical services are provided by independent licensed providers through AyaRx, and pharmacy services are provided by e-RxHub. Those covered healthcare entities are responsible for their own HIPAA duties and may give you an entity-specific Notice of Privacy Practices. If an entity-specific notice differs from this website notice, that entity's notice controls its practices.

Biovana provides non-clinical coordination. Uniloop supplies technology and acts as a business associate where it handles protected health information on behalf of a covered entity. A business associate does not replace the treating provider or pharmacy as the covered entity responsible for the medical or pharmacy record.

Subject to applicable law, you have the right to:

• inspect or obtain an electronic or paper copy of your medical or pharmacy record, usually within 30 days; a reasonable cost-based fee may apply;
• ask to correct information you believe is wrong or incomplete; a request may be denied with a written explanation, usually within 60 days;
• ask to be contacted in a specific way or at a different address;
• request limits on certain uses or disclosures; a covered entity is not always required to agree, except in circumstances required by law, including certain services paid in full out of pocket;
• receive an accounting of certain disclosures made during the six years before your request; one accounting in a 12-month period is available without charge;
• receive a paper copy of this notice even if you agreed to receive it electronically;
• choose an authorized personal representative to exercise rights for you; and
• file a complaint without retaliation.

Contact the provider or pharmacy that maintains the record to exercise these rights. Identity and authority may need to be verified before a request is fulfilled.

For certain health information, you may tell the covered entity how you want information shared, such as with family, friends, or others involved in your care or payment. If you cannot communicate, information may be shared when a provider believes it is in your best interest and the law permits it.

Written authorization is generally required for uses and disclosures not described in the applicable notice, including most uses of psychotherapy notes, most marketing involving payment, and a sale of protected health information. You may revoke an authorization in writing, except to the extent action has already been taken in reliance on it.

As permitted or required by law, health information may be used or disclosed to:

• provide, coordinate, or manage treatment, including consultation and prescription fulfillment;
• bill for services, process payment, and determine benefits or coverage;
• operate healthcare services, including quality review, training, licensing, auditing, security, and compliance;
• send treatment, refill, safety, appointment, or service reminders;
• address public-health and safety activities, adverse-event reporting, product recalls, or suspected abuse or neglect;
• comply with health oversight, licensing, regulatory, or other legal requirements;
• respond to judicial proceedings, law enforcement, workers' compensation, or other government requests when legally permitted;
• work with coroners, medical examiners, funeral directors, or organ-procurement organizations; and
• reduce or prevent a serious and imminent threat to health or safety.

Only the minimum information reasonably necessary will be used or disclosed when the HIPAA minimum-necessary rule applies. Business associates may receive information to perform contracted services and must protect it as required by their agreements and law.

Certain records, including substance use disorder patient records subject to 42 CFR Part 2, psychotherapy notes, genetic information, reproductive healthcare information, HIV-related information, and mental-health records, may receive additional protection under federal or state law. To the extent Part 2 applies, those records will not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your written consent or a qualifying court order and subpoena, as required by law.

• Maintain the privacy and security of protected health information as required by law.
• Notify affected individuals promptly if a breach may have compromised information.
• Follow the duties and privacy practices described in the notice applicable to that entity.
• Provide a copy of the applicable notice and make it available on request.
• Not use or disclose information outside the applicable notice unless authorized in writing or otherwise permitted or required by law.

For records maintained by an AyaRx provider, use the secure patient portal or contact AyaRx at hello@ayarx.com or (630) 556-8491. For pharmacy records, contact e-RxHub at support@e-rxhub.com or (800) 311-5805. Ask for the applicable privacy contact or entity-specific Notice of Privacy Practices.

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by visiting hhs.gov/hipaa/filing-a-complaint, calling 1-877-696-6775, or writing to 200 Independence Avenue SW, Washington, DC 20201. You will not be retaliated against for filing a complaint.

A covered entity may change its notice and make the revised terms effective for information it already maintains and information received in the future. The current website notice will be posted here. Ask your provider or pharmacy for its current entity-specific notice.