Notice of privacy practices

[LEGAL ENTITY NAME, e.g. Bedrock TPA, LLC] is committed to protecting the privacy of your protected health information (“PHI”). We are required by law to maintain the privacy and security of your PHI, provide you with this notice of our legal duties and privacy practices, notify you following a breach of unsecured PHI, and abide by the terms of the notice currently in effect.

Effective date: [EFFECTIVE DATE]

How we may use and disclose your health information

For treatment, payment, and health care operations

We may use and disclose your PHI to administer your health benefits, including determining eligibility, processing and paying claims, coordinating care, conducting utilization review and care management, and performing administrative activities related to your plan.

To business associates

We may share your PHI with vendors who perform services on our behalf, such as claims processing or network services. Each is required by written agreement to safeguard your information.

To the plan sponsor

We may disclose PHI to your employer or plan sponsor as permitted by HIPAA, for example to administer the plan, once the plan documents include the required certifications and restrictions.

As required or permitted by law

We may use or disclose your PHI when required by federal, state, or local law, and for purposes such as public health activities, health oversight, reporting abuse or neglect, judicial and administrative proceedings, law enforcement, workers' compensation, organ donation, research under approved protocols, coroners and funeral directors, and to avert a serious threat to health or safety.

Uses requiring your written authorization

Most uses and disclosures of psychotherapy notes, uses and disclosures for marketing purposes, and any sale of PHI require your written authorization. Other uses not described in this notice will be made only with your written authorization, which you may revoke at any time in writing.

Your rights regarding your health information

• Right to access: You may request to inspect and obtain a copy of the health information we maintain about you, including an electronic copy.
• Right to amend: You may request that we correct health information you believe is inaccurate or incomplete.
• Right to an accounting of disclosures: You may request a list of certain disclosures we have made of your health information.
• Right to request restrictions: You may request that we limit how we use or disclose your health information. We are not required to agree to every request.
• Right to confidential communications: You may request that we communicate with you in a specific way or at a specific location.
• Right to be notified of a breach: You will be notified if a breach compromises the privacy or security of your information.
• Right to a paper copy: You may request a paper copy of this notice at any time, even if you agreed to receive it electronically.

Our responsibilities

We are required to maintain the privacy and security of your PHI, notify you if a breach affects your information, and follow the duties and privacy practices described in this notice. We will not use or share your information other than as described here unless you tell us we can in writing.

Your California rights

California law, including the Confidentiality of Medical Information Act (CMIA), may provide additional protections for your medical information. Where California law is more protective than HIPAA, we follow California law.

Changes to this notice

We reserve the right to change this notice and to make the revised notice effective for health information we already have as well as any information we receive in the future. The current notice will always be posted on this website with its effective date.

Contact our Privacy Officer

To exercise any of the rights above, or to ask questions about this notice, contact:

[PRIVACY OFFICER NAME & TITLE]
[LEGAL ENTITY NAME, e.g. Bedrock TPA, LLC]
Phone: 424-835-1391
Email: info@bedrock-tpa.com

Complaints

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer above. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:

U.S. Department of Health and Human Services
200 Independence Avenue SW, Room 509F, HHH Building
Washington, D.C. 20201
1-800-368-1019, 1-800-537-7697 (TDD)
hhs.gov/hipaa/filing-a-complaint

You will not be penalized or retaliated against for filing a complaint.

This notice is provided as a general summary of our privacy practices for informational purposes and is not legal advice. It must be reviewed and approved by counsel or a HIPAA compliance advisor before publication. The full Notice of Privacy Practices applicable to your plan governs and is available upon request.