HIPAA Notice of Privacy Practices

This Notice of Privacy Practices (“Notice”) describes how protected health information (“PHI”) about you may be used and disclosed in connection with the Oxiline RX program, and how you can get access to this information. Your clinical care and medical records are provided and maintained through our clinical partner, MD Integrations, and the US-licensed clinicians who treat you (together, your “Care Team”), who are the covered health care providers and the holders of your medical record. Oxiline RX Corp. supports the program as a services platform and, where it handles PHI on behalf of your Care Team, does so as a business associate under written business associate agreements. Oxiline is designed so that PHI is not stored on Oxiline’s own servers.

Your Care Team is required by law to maintain the privacy and security of your PHI, to provide you this Notice of its legal duties and privacy practices, to abide by the terms of the Notice currently in effect, and to notify you following a breach of unsecured PHI.

Your PHI may be used and disclosed without your written authorization for the following purposes:

• Treatment — to evaluate you, prescribe when appropriate, manage your dosing and side effects, and coordinate your care with the pharmacies that fill your prescriptions and with other clinicians involved in your care. Example: your clinician sends your prescription and relevant health information to the dispensing pharmacy.
• Payment — to bill and collect payment for the services and medications you receive. Example: confirming that treatment was approved so your membership can be billed.
• Health care operations — for quality improvement, safety monitoring, licensing and credentialing, auditing, and administrative functions that support your care.

Your PHI may also be used or disclosed without your authorization in the following limited situations, subject to the conditions of applicable law:

• As required by law, including reporting required by federal or state law.
• Public health activities, such as reporting adverse drug events to the FDA or communicable-disease reporting to public health authorities.
• Reporting abuse, neglect, or domestic violence to authorized authorities.
• Health oversight activities, such as audits, investigations, and inspections by licensing and regulatory agencies.
• Judicial and administrative proceedings, in response to a court or administrative order, or in certain cases a subpoena or discovery request.
• Law enforcement purposes, in the limited circumstances HIPAA permits.
• To avert a serious threat to your health or safety or the health or safety of others.
• Coroners, medical examiners, and funeral directors, and organ and tissue donation organizations, as permitted by law.
• Research, under strict conditions such as institutional review board approval or with de-identified information.
• Specialized government functions, such as military, national security, and correctional purposes, and workers’ compensation as authorized by law.
• Business associates — service providers (including Oxiline) that perform functions on your Care Team’s behalf, under written agreements requiring them to safeguard your PHI.

The following uses and disclosures will be made only with your written authorization:

• Marketing communications that HIPAA treats as marketing.
• Any sale of your PHI (which we do not do).
• Most uses and disclosures of psychotherapy notes, where they exist.
• Any other use or disclosure not described in this Notice.

You may revoke an authorization at any time by contacting support@oxilinerx.com in writing. Revocation does not affect uses or disclosures already made in reliance on the authorization.

You have the following rights with respect to your PHI:

• Access. You may inspect and obtain a copy of your medical record, including an electronic copy, generally within 30 days of your request. A reasonable, cost-based fee may apply to copies.
• Amendment. You may request that your record be corrected if you believe it is inaccurate or incomplete. A request may be denied in certain cases (for example, if the record is accurate and complete), and you will be told why in writing and may submit a statement of disagreement.
• Accounting of disclosures. You may request a list of certain disclosures of your PHI made in the six years before your request (excluding, for example, disclosures for treatment, payment, and operations).
• Restrictions. You may request restrictions on how your PHI is used or disclosed. Your Care Team is not required to agree to every request — but it must agree not to disclose PHI to your health plan for a service you (or someone on your behalf) paid for in full out of pocket, if you request it. Because the Oxiline RX program is cash-pay, you may make this request for any service in the program.
• Confidential communications. You may request to be contacted in a specific way or at a specific location (for example, only by email), and reasonable requests will be accommodated.
• Breach notification. You have the right to be notified following a breach of your unsecured PHI.
• Paper copy. You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.

To exercise any of these rights, contact support@oxilinerx.com; requests will be routed to the record holder, or you may make them directly with your Care Team through the patient portal.

PHI is stored and processed within a HIPAA-compliant environment maintained by our clinical partner, protected by administrative, technical, and physical safeguards including encryption, access controls, and audit logging, under appropriate business associate arrangements. Oxiline is designed so that PHI is not stored on Oxiline’s own servers, and analytics on our websites are designed to exclude health information. For more about how we handle non-clinical information, see our Privacy Policy.

The terms of this Notice may be changed at any time, and the new Notice will be effective for all PHI maintained at that time, including PHI created or received before the change. When the Notice is materially revised, the updated version will be posted on this page with a new effective date, and you can always obtain the current Notice here or by contacting support@oxilinerx.com.

To exercise your rights, ask questions about this Notice, or raise a privacy concern, contact support@oxilinerx.com.

If you believe your privacy rights have been violated, you may file a complaint with us at the address above and with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights: 200 Independence Avenue, S.W., Washington, D.C. 20201; 1-800-368-1019; or online at hhs.gov/ocr/complaints. You will not be penalized or retaliated against for filing a complaint.