Notice of Privacy Practices
Effective Date: January 1, 2025
Who We Are
R Med+Spa Durango ("we," "us," or "our practice") is committed to protecting the privacy of your health information. This Notice of Privacy Practices ("Notice") describes how we may use and disclose your Protected Health Information ("PHI") and your rights regarding that information. We are required by law to maintain the privacy of your PHI and to provide you with this Notice.
Contact: R Med+Spa Durango · Durango, Colorado · Phone: (970) 501-0610 · Email: rmedspa@icloud.com
How We May Use and Disclose Your PHI
The following describes the ways we may use and disclose your health information:
Treatment
We may use your PHI to provide, coordinate, or manage your medical treatment. For example, we may share your information with other healthcare providers involved in your care.
Payment
We may use and disclose your PHI to bill for services, obtain payment, or verify insurance coverage.
Healthcare Operations
We may use and disclose your PHI to conduct quality assessments, staff training, compliance activities, and business management functions.
Appointment Reminders
We may contact you by phone, email, or text to remind you of scheduled appointments or follow-up care.
As Required by Law
We may disclose your PHI when required to do so by federal, state, or local law, or to public health authorities for disease control, injury reporting, or investigations.
Emergency Situations
We may disclose your PHI to emergency responders or medical personnel to prevent serious harm or death.
Uses Requiring Your Written Authorization
Other uses and disclosures of your PHI not described in this Notice will only occur with your written authorization. This includes: most uses or disclosures of psychotherapy notes; uses or disclosures of PHI for marketing purposes; and sales of PHI. You may revoke your authorization in writing at any time, except where we have already acted on it.
Your Rights Regarding Your PHI
Right to Access
You have the right to inspect and obtain a copy of your PHI maintained in our records. We may charge a reasonable fee for copying and mailing.
Right to Amend
You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny the request in certain circumstances.
Right to an Accounting of Disclosures
You have the right to request a list of disclosures we have made of your PHI, except for disclosures made for treatment, payment, or healthcare operations.
Right to Request Restrictions
You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree to a restriction except as provided by law.
Right to Confidential Communications
You have the right to request that we communicate with you by alternative means or at an alternative location. We will honor reasonable requests.
Right to a Paper Copy of This Notice
You have the right to a paper copy of this Notice at any time, even if you have agreed to receive it electronically.
Right to Be Notified of a Breach
You have the right to be notified if there is a breach of your unsecured PHI.
How to Exercise Your Rights
To exercise any of the rights described above, please contact us at:
How to File a Complaint
If you believe your privacy rights have been violated, you may file a complaint with us directly, or with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.
U.S. Department of Health and Human Services
Office for Civil Rights · 200 Independence Avenue, S.W. · Washington, D.C. 20201
www.hhs.gov/ocr/privacy/hipaa/complaints/Changes to This Notice
We reserve the right to change the terms of this Notice at any time. Changes will apply to all PHI we maintain. We will post any revised Notice in our practice and on our website, and will make a copy available upon request.
Patient Portal Security
Access to your patient portal is protected by multi-factor authentication (email address, last name, date of birth, and a one-time verification code). All data is encrypted in transit and at rest. Sessions automatically expire after 15 minutes of inactivity. All access to your health information is logged for security auditing purposes.
Questions about this notice? We're happy to help.