HIPAA Notice of Privacy Practices

Who this notice applies to

The clinical services offered through ProtocolRX — including telehealth visits, prescriptions, prescription fulfillment, and clinical messaging — are provided by our licensed telehealth partner and its network of independent, licensed physicians (the “Covered Entity”). ProtocolRX LLC provides the platform, payment processing, education, and logistics infrastructure and acts as a Business Associateof the Covered Entity under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). We handle your Protected Health Information (“PHI”) only as permitted by our Business Associate Agreement with the Covered Entity.

Uses and disclosures of your PHI

The Covered Entity and its Business Associates may use and disclose your PHI for the following purposes:

Treatment. To provide, coordinate, or manage your healthcare. Example: a physician reviews your intake and sends a prescription to a partner pharmacy.
Payment. To bill and collect payment for your care. Example: submitting a charge to Stripe on your behalf.
Healthcare operations. To support the internal operations of the Covered Entity and its Business Associates, including quality assessment, credentialing, and legal review.
Business associates. To vendors under written Business Associate Agreements who help us deliver care (e.g., cloud hosting, telehealth infrastructure, email delivery, identity verification).
Required by law. To comply with subpoenas, court orders, mandatory reporting laws (e.g., suspected abuse), and public health reporting (e.g., adverse events reported to the FDA).
Health oversight. To state medical boards, boards of pharmacy, and other regulators.
Serious threat to health or safety. To prevent or reduce a serious threat to your safety or the safety of others.
With your authorization. For any other use or disclosure. You may revoke a written authorization at any time.

Uses that require your authorization

Most uses and disclosures of psychotherapy notes.
Uses and disclosures of PHI for marketing purposes.
Any sale of PHI.

Your rights

Right to inspect and copy. You have the right to review and receive a copy of your medical record.
Right to amend. You may request that we amend your medical record if you believe it is incorrect or incomplete.
Right to an accounting of disclosures. You may request a list of certain disclosures we have made of your PHI.
Right to request restrictions. You have the right to request restrictions on how we use or disclose your PHI. We are not required to agree, except that we must agree to restrict disclosure to a health plan for a service you paid for out of pocket in full.
Right to request confidential communications. You may request that we communicate with you in a specific way (e.g., only by email).
Right to a paper copy of this notice. You may request a paper copy of this notice at any time by emailing support@protocolrx.com.
Right to be notified of a breach. If we discover a breach of your unsecured PHI, we will notify you as required by law.

Our duties

We are required by law to maintain the privacy and security of your PHI.
We will let you know promptly if a breach occurs that may have compromised the privacy or security of your PHI.
We must follow the duties and privacy practices described in this notice and give you a copy of it.
We may change our privacy practices; if we do, we will post the updated notice with a new effective date.

Complaints

If you believe your privacy rights have been violated, you may file a complaint by emailing support@protocolrx.com or by contacting the U.S. Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue SW, Washington, DC 20201, or via the OCR complaint portal at hhs.gov/hipaa/filing-a-complaint.

You will not be retaliated against for filing a complaint.

Privacy Official

ProtocolRX has designated a Privacy Official who is responsible for the privacy practices described in this notice and for handling complaints or requests related to your Protected Health Information.

Privacy Official: Zahir Dossa, Founder
Email: privacy@protocolrx.com

Contact

Questions about this notice or about how your PHI is used: privacy@protocolrx.com for privacy-specific questions, or support@protocolrx.com for general support.