Notice of Privacy Practices

Who we are

Curia Health US Physicians, PLLC ("the practice", "we", "us") is a concierge medical practice. This notice describes the privacy practices of the practice, its physicians and its workforce, and applies to the medical information we create, receive and hold about you, which this notice calls your health information.

Administrative and technical support for the practice is provided by Curia Health US, LLC, of 1950 Spring Valley Drive, Dripping Springs, TX 78620, under a written business associate agreement.

We are required by law to maintain the privacy of your health information, to give you this notice of our legal duties and privacy practices, to notify you if a breach of your unsecured health information occurs, and to follow the terms of the notice currently in effect.

This notice covers the US practice only. The organizations in the United Kingdom that run your membership and provide your UK care are separate from this practice, and they have their own privacy notice, which is Schedule 1 to your Membership Agreement. Schedule 1 names them.

How we may use and disclose your health information

For treatment. We use your health information to provide your care, and we share it with other professionals treating you. For example, we send your history and results to a specialist we refer you to. We also share it with the clinicians and care coordinators at our affiliated organizations in the United Kingdom who are involved in your program, so that your care is coordinated and your record is complete. Schedule 1 names those organizations. That means your health information travels to the United Kingdom, where it is protected under United Kingdom data protection law and by the safeguards described in Schedule 1.

For payment. We use and share your health information to bill and collect payment. For example, we provide information to Curia Health US, LLC, our administrative services organization, to prepare your invoice. As a concierge practice we do not bill insurers unless you ask us to help you with a claim.

For health care operations. We use and share your health information to run the practice: quality review, training, credentialing, obtaining professional advice, and administrative and technical support provided under contract by Curia Health US, LLC, which is bound by a written business associate agreement to protect your information.

Appointment reminders and care options. We may contact you to remind you of appointments and to tell you about treatment alternatives or health services that may be relevant to you.

Other uses and disclosures permitted or required by law, without your authorization. When required by federal, state or local law; for public health activities, such as reporting communicable disease or adverse drug reactions; to report suspected abuse, neglect or domestic violence where the law requires it; for health oversight activities such as audits, inspections and licensure; in judicial and administrative proceedings in response to lawful orders or process; for limited law enforcement purposes; to coroners, medical examiners and funeral directors; for organ and tissue donation; for research approved under legally required protections; to prevent or lessen a serious and imminent threat to health or safety; for specialized government functions such as military or national security purposes; and for workers' compensation as authorized by law.

Uses and disclosures that require your written authorization. We will not use or disclose psychotherapy notes, except as the law narrowly permits; use or disclose your health information for marketing purposes; or sell your health information, without your written authorization. Any other use or disclosure not described in this notice will be made only with your written authorization. You may revoke an authorization at any time in writing. Revoking it does not undo anything we already did in reliance on it.

Fundraising. We do not use your health information for fundraising.

If this practice or your UK care team changes

We may change our name. If we do, we are the same practice with the same duties to you, your records stay where they are, and we will publish this notice under the new name.

If instead this practice is transferred to, merged with, or replaced by another organization that is a HIPAA covered entity, your health information goes with it so that your care continues. HIPAA treats that as part of our health care operations, so we do not need your authorization for it, and the new organization will give you its own Notice of Privacy Practices.

The same is true in the United Kingdom. The organization there that holds your UK records and provides your UK regulated care may change. Schedule 1 explains how that works and what choices you have. Your care team, and the name you deal with, are designed to stay the same through it.

Your rights

Right to request restrictions. You may ask us to restrict how we use or disclose your health information for treatment, payment or health care operations. We are not required to agree to every request. However, where you, or someone other than a health plan acting on your behalf, have paid for an item or service in full out of pocket, and you ask us not to disclose the related information to your health plan for payment or operations purposes, we must and will honor that restriction, unless the disclosure is required by law.

Right to confidential communications. You may ask us to contact you in a particular way or at a particular location, for example only at a specific email address or telephone number. We will accommodate reasonable requests.

Right to access and copies. You may inspect and obtain a copy of your health information in our designated record set, including an electronic copy where we hold it electronically. We will normally respond within 30 days. We may charge a reasonable, cost-based fee.

Right to amendment. You may ask us to amend health information you believe is incorrect or incomplete. We may decline in certain cases. If we do, we will tell you why in writing, and tell you how to respond, including by adding a statement of disagreement to your record.

Right to an accounting of disclosures. You may ask for a list of certain disclosures we have made of your health information in the six years before your request. This does not cover disclosures for treatment, payment or health care operations, or disclosures you authorized. The first accounting in any twelve-month period is free.

Right to a paper copy of this notice. You may ask for one at any time, even if you agreed to receive this notice electronically.

Right to notice of a breach. We will notify you following any breach of your unsecured health information, as the law requires.

To exercise any of these rights, write to our Privacy Officer using the contact details below.

Our duties, and changes to this notice

We are required by law to maintain the privacy of your health information, to give you this notice, to notify you of a breach of your unsecured health information, and to abide by the terms of the notice currently in effect.

We may change this notice and our privacy practices at any time. Any revised notice will apply to all health information we hold, including information created or received before the change. The current notice is always available from the practice, posted on our website with its effective date shown, and provided in paper form on request.

The version attached to your Membership Agreement is the version current when you signed it. The version posted on our website is the one in effect.

Complaints

If you believe your privacy rights have been violated, you may complain to our Privacy Officer using the contact details below, and to the Secretary of the US Department of Health and Human Services, Office for Civil Rights, through ocrportal.hhs.gov.

You will never be penalized or retaliated against for filing a complaint.

Contact

Privacy Officer: Jeff Haggard, Curia Health US Physicians, PLLC, 1950 Spring Valley Drive, Dripping Springs, TX 78620. Email jeff@curia.health.

State law

Where the law of your state gives you greater privacy protection than this notice describes, we follow the stricter law.