MEDY Weight Loss Notice of Privacy Practices — Attorney-Review Draft

Covered entity proposed for this notice: Kaiser-Backert Medical Weight Loss Clinic, Inc., doing business as MEDY Weight Loss

Effective date: [DATE] Status: Draft adapted from the current HHS Model Notice of Privacy Practices for a HIPAA-covered healthcare provider. MEDY’s privacy official and California healthcare counsel must tailor and approve it before use.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Your information. Your rights. Our responsibilities.

Your rights

You have the right to:

Obtain an electronic or paper copy of your medical record
Ask us to correct your medical record
Request confidential communications
Ask us to limit certain uses or disclosures
Obtain an accounting of certain disclosures
Obtain a paper copy of this notice
Choose someone authorized to act for you
File a complaint if you believe your privacy rights were violated

Your choices

You have choices about how we use and share information in certain situations, including when we:

Share information with family, friends, or others involved in your care
Share information in a disaster-relief situation
Use information for marketing
Sell health information
Use or disclose psychotherapy notes, if MEDY maintains them

Our uses and disclosures

As permitted or required by law, we may use and share information to:

Treat you and coordinate care
Run our organization
Bill for services and conduct payment activities
Address public-health and safety matters
Comply with law
Respond to organ and tissue donation requests
Work with a medical examiner, coroner, or funeral director
Address workers’ compensation, law-enforcement, health-oversight, and other government requests
Respond to lawsuits and legal actions

Your rights in detail

Obtain a copy of your medical record

You may ask to see or obtain an electronic or paper copy of your medical record and other health information we maintain about you. Ask us how to submit the request.

We will provide a copy or summary, usually within 30 days of the request, subject to permitted extensions and exceptions. We may charge a reasonable, cost-based fee as allowed by law. California law may provide additional access rights or shorter timelines in some circumstances; counsel must confirm the final wording and operational procedure.

Ask us to correct your medical record

You may ask us to correct information that you believe is incorrect or incomplete. We may deny the request in circumstances permitted by law, but we will explain a denial in writing, generally within 60 days as required by HIPAA.

Request confidential communications

You may ask us to contact you in a particular way or at a different address. We will accommodate reasonable requests as required by law.

You may ask us not to use or share certain information for treatment, payment, or healthcare operations. We are generally not required to agree, and we may deny a request when permitted by law, including when the restriction could affect care. If we agree, we may still disclose information for emergency treatment as permitted by law.

If you pay for a service or healthcare item out of pocket in full, you may ask us not to share that information with your health plan for payment or healthcare operations. We will agree unless a law requires disclosure.

Obtain an accounting of disclosures

You may ask for a list of certain disclosures made during the six years before the request. The accounting does not include disclosures for treatment, payment, and healthcare operations and certain other disclosures excluded by law.

We will provide one accounting in a 12-month period without charge. We may charge a reasonable, cost-based fee for an additional accounting during that period after informing you of the cost.

Obtain a copy of this notice

You may ask for a paper copy at any time, even if you agreed to receive it electronically. We will provide one promptly.

Choose someone to act for you

If a person has legal authority to act as your personal representative, such as through a medical power of attorney or guardianship, that person may exercise your rights. We will verify the person’s authority before acting.

File a complaint

You may complain to MEDY using the contact information below if you believe your rights were violated.

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting HHS’s complaint page.

MEDY will not retaliate against you for filing a complaint.

Your choices in detail

When you have a clear preference about how we share information in the situations below, tell us what you want us to do. We will follow your instructions as required by law.

You may tell us whether to:

Share information with family, close friends, or others involved in your care or payment for care
Share information in a disaster-relief situation

If you cannot tell us your preference—for example, because you are unconscious—we may share information when we determine that doing so is in your best interest and the law permits it. We may also share information when necessary to reduce a serious and imminent threat to health or safety.

We will not use or disclose protected health information for the following purposes unless you provide written authorization or another law specifically permits it:

Marketing purposes that require authorization
Sale of protected health information
Most uses and disclosures of psychotherapy notes, if MEDY maintains them

How MEDY may use and disclose health information

Treatment

We may use and share health information to treat you and coordinate care with other professionals involved in your treatment.

Healthcare operations

We may use and share health information to run our practice, improve care, train staff, manage services, conduct quality activities, and contact you when necessary.

Payment

We may use and share health information to bill and obtain payment. [Because MEDY reports that it does not accept insurance for clinic services, confirm whether payment disclosures to health plans occur in any context and tailor this section.]

Public health and safety

We may disclose information as permitted or required for public-health and safety activities, including disease prevention, product recalls, adverse-event reporting, suspected abuse or neglect, and prevention or reduction of a serious threat to health or safety.

Compliance with law and oversight

We will disclose information when state or federal law requires it, including to HHS when it investigates our compliance. We may disclose information to health-oversight agencies for activities authorized by law.

Organ donation, death, and funeral activities

When applicable, we may disclose information to organ-procurement organizations, coroners, medical examiners, or funeral directors as permitted by law.

Workers’ compensation, law enforcement, and government functions

We may use or disclose information for workers’ compensation claims, law-enforcement purposes, health oversight, and special government functions when permitted or required by law.

Lawsuits and legal actions

We may disclose information in response to a court or administrative order, subpoena, discovery request, or other lawful process, subject to HIPAA and stricter California requirements.

Appointment reminders and service communications

We may contact you about appointments, treatment alternatives, and health-related services as permitted by law and according to your communication preferences. [Confirm channels, vendors, and opt-out procedures.]

California and specially protected information

California law and other federal law may provide greater protection for certain information, potentially including mental-health, substance-use-disorder, HIV, genetic, reproductive-health, and other specially protected records. MEDY will comply with laws that provide greater protection than HIPAA.

MEDY provides medical weight-management services and does not diagnose or treat mental-health conditions, substance-use disorders, HIV or sexually transmitted infections, genetic conditions, or reproductive-health conditions. Information about these conditions may nevertheless be considered during an initial consultation or later care when MEDY determines whether weight-management services are appropriate or modifies a patient’s program. Diagnoses in these areas come from the patient’s other healthcare providers rather than MEDY.

Counsel must confirm how specially protected information that appears in MEDY’s weight-management record should be addressed. If MEDY ever maintains records subject to 42 CFR Part 2, the final notice must include the applicable Part 2 language in the current HHS model.

Our responsibilities

We are required by law to maintain the privacy and security of protected health information.
We will notify affected individuals as required if a breach may have compromised the privacy or security of their information.
We must follow the duties and privacy practices described in the notice currently in effect and provide a copy upon request.
We will not use or disclose information other than as described in this notice unless you authorize us in writing or the law permits or requires it.
You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it or another legal exception applies.

Changes to this notice

We may change this notice, and the revised notice may apply to information we already maintain and information we receive in the future. The current notice will be available upon request, at MEDY clinics, and on MEDY’s website.

Contact MEDY

Privacy official/contact: MEDY Privacy Officer

Kaiser-Backert Medical Weight Loss Clinic, Inc. dba MEDY Weight Loss

Telephone: 209-299-4455

Email: office@medyweightloss.com Mailing address: 15810 S Harlan Rd, Unit B, Lathrop, CA 95330

Attorney and operational review items

Confirm covered-entity status and exact entity/entities covered.
Confirm the privacy official and request/complaint workflow.
Reconcile federal rights with California access, authorization, and medical-confidentiality requirements.
Confirm the treatment of specially protected information that MEDY may receive as health history but does not itself diagnose or treat. MEDY confirms it does not conduct research or fundraising.
MEDY confirms that its existing clinic and telehealth compliance processes handle patient notices and acknowledgments after the website scheduling handoff. Those internal systems and agreements are outside the website build.
Choose the effective date and revision process.
Post the approved notice prominently at each clinic and on the website.
Continue MEDY’s existing clinic and telehealth notice and acknowledgment procedures.
Train staff on the approved notice and request procedures.