NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
EFFECTIVE DATE: JANUARY 5, 2025
VERSION 1.0
WHO WE ARE
Shape Health LLC (“Shape,” “we,” “us,” or “our”) is committed to protecting your health information. This Notice of Privacy Practices describes our legal duties and privacy practices with respect to your Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).
Our Contact Information:
Shape Health LLC
6202 Alchemy Street
Las Cruces, New Mexico 88012
Phone: (575) 339-1671
Email: privacy@shapehealth.io
Privacy Officer: Josiah Fielder
Email: privacy@shapehealth.io
OUR LEGAL DUTIES
We are required by federal and state law to:
- Maintain the privacy and security of your Protected Health Information
- Provide you with this Notice of our legal duties and privacy practices with respect to your health information
- Follow the terms of the Notice currently in effect
- Notify you if we are unable to agree to a requested restriction on how your information is used or disclosed
- Accommodate reasonable requests you may have to communicate health information by alternative means or at alternative locations
We reserve the right to change our privacy practices and the terms of this Notice at any time, provided such changes are permitted by applicable law. We reserve the right to make the changes in our privacy practices and the new terms of our Notice effective for all health information that we maintain, including health information we created or received before we made the changes.
If we make material changes to our privacy practices, we will:
- Post the revised Notice on our website at shapehealth.io/privacy-practices
- Make copies of the revised Notice available upon request
- Provide you with the revised Notice within 60 days of the material change
You may request a copy of our Notice at any time. For more information about our privacy practices, or for additional copies of this Notice, please contact us using the information listed above.
WHAT IS PROTECTED HEALTH INFORMATION (PHI)?
Protected Health Information is information about you, including demographic information, that may identify you and that relates to:
- Your past, present, or future physical or mental health or condition
- The provision of health care to you
- Your past, present, or future payment for the provision of health care
PHI includes information we create, receive, maintain, or transmit in any form (electronic, paper, or oral) that identifies you or could be used to identify you.
HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION
The following categories describe different ways that we use and disclose health information. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.
Uses and Disclosures for Treatment, Payment, and Health Care Operations
We may use and disclose your PHI for the following purposes without your written authorization:
1. Treatment
We may use and disclose your health information to provide, coordinate, or manage your health care and related services. This includes consultation between health care providers regarding your care and referrals of you from one health care provider to another.
Examples:
- Coordinating your care with health coaches, nutritionists, and other care providers
- Sharing information with specialists who consult on your treatment
- Communicating with your primary care physician about your health goals and progress
- Providing telehealth services and virtual consultations
- Discussing your health status during coaching team meetings
- Maintaining records of your appointments, assessments, and treatment plans
2. Payment
We may use and disclose your health information to obtain payment for services we provide to you, to determine your eligibility for coverage, and to bill and collect payment from you, your insurance company, or a third party.
Examples:
- Verifying your insurance coverage and obtaining prior authorizations
- Submitting claims to your health insurance company
- Collecting payment for services rendered
- Determining medical necessity for insurance purposes
- Conducting utilization review activities
- Responding to insurance company requests for additional information
3. Health Care Operations
We may use and disclose your health information for our health care operations, which are necessary to run our practice and ensure that all of our patients receive quality care.
Examples:
- Conducting quality assessment and improvement activities
- Training students, trainees, and health care professionals
- Business planning and development activities
- General administrative activities
- Complying with legal, regulatory, and accreditation requirements
- Conducting or arranging for medical reviews, audits, and legal services
- Business management and general administrative activities
Other Uses and Disclosures Without Your Authorization
We may also use and disclose your PHI without your authorization in the following situations:
4. Required by Law
We will disclose your health information when required to do so by federal, state, or local law, including:
- Reports of suspected abuse, neglect, or domestic violence to appropriate authorities
- Disclosures to law enforcement officials as required by law or in response to a valid subpoena or court order
- Disclosures for judicial and administrative proceedings
- Compliance with workers' compensation laws
5. Public Health Activities
We may disclose your health information to public health authorities for activities such as:
- Preventing or controlling disease, injury, or disability
- Reporting births, deaths, and certain diseases as required by law
- Reporting adverse reactions to medications or problems with medical products
- Notifying individuals who may have been exposed to a communicable disease
- Notifying appropriate authorities if we believe a patient has been the victim of abuse, neglect, or domestic violence
6. Health Oversight Activities
We may disclose health information to health oversight agencies for activities authorized by law, including:
- Audits, investigations, inspections, and licensure activities
- Government monitoring of the health care system
- Government benefit programs
- Civil rights laws compliance
7. Law Enforcement
We may release health information if asked to do so by a law enforcement official in response to:
- A court order, subpoena, warrant, summons, or similar process
- Limited information to identify or locate a suspect, fugitive, material witness, or missing person
- Information about an individual who is or is suspected to be a victim of a crime
- Information about a death we believe may be the result of criminal conduct
- Information about criminal conduct at our facilities
- In emergency circumstances, to report a crime
8. Judicial and Administrative Proceedings
We may disclose health information in response to a court or administrative order, subpoena, discovery request, or other lawful process, provided we receive satisfactory assurance that efforts have been made to notify you of the request or to obtain a protective order.
9. Serious Threat to Health or Safety
We may use and disclose your health information when necessary to prevent or lessen a serious and imminent threat to your health and safety or the health and safety of the public or another person. Any disclosure would be to someone able to help prevent or reduce the threat.
10. Workers' Compensation
We may disclose your health information to comply with workers' compensation laws and other similar programs that provide benefits for work-related injuries or illnesses.
11. Coroners, Medical Examiners, and Funeral Directors
We may release health information to a coroner or medical examiner when necessary for them to carry out their duties, such as identifying a deceased person or determining the cause of death. We may also release health information to funeral directors as necessary to carry out their duties.
12. Organ and Tissue Donation
If you are an organ donor, we may release health information to organizations that handle organ procurement or organ, eye, or tissue transplantation, or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.
13. Research
We may use and disclose your health information for research purposes when the research has been approved by an institutional review board or privacy board that has reviewed the research proposal and established protocols to ensure the privacy of your information. We will obtain your authorization for uses or disclosures of your health information for research purposes except when:
- An institutional review board or privacy board has determined that the use or disclosure poses minimal risk to your privacy
- The research involves only information of decedents
- The researcher represents that the use or disclosure is necessary for research purposes and will not be further disclosed
14. Military and Veterans
If you are a member of the armed forces, we may release health information about you as required by military command authorities. We may also release health information about foreign military personnel to the appropriate foreign military authority.
15. National Security and Intelligence Activities
We may release health information to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law, including for the provision of protective services to the President or others legally authorized.
16. Correctional Institutions
If you are or become an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose your health information to the correctional institution or law enforcement official if necessary:
- For the institution to provide you with health care
- To protect your health and safety or the health and safety of others
- For the safety and security of the correctional institution
17. Business Associates
We may disclose your health information to our business associates that perform functions on our behalf or provide us with services if the information is necessary for such functions or services. Our business associates are required, under contract with us and pursuant to federal law, to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract and as permitted by federal law.
Examples of business associates include:
- Third-party billing services
- Insurance verification services
- Electronic health record vendors
- IT support and cloud storage providers
- Legal and accounting professionals
- Third-party administrators who assist in benefits determination
Uses and Disclosures That Require Your Authorization
Other uses and disclosures of your health information not covered by this Notice or the laws that apply to us will be made only with your written authorization. Specifically, we must obtain your authorization for the following:
18. Marketing
We must obtain your written authorization prior to using or disclosing your health information for marketing purposes, except when the communication is made:
- Face-to-face by us to you
- To provide you with a promotional gift of nominal value
If we receive any financial remuneration for making a marketing communication, we will prominently state that in our request for your authorization.
19. Sale of Health Information
We will not sell your health information without your written authorization. A “sale” occurs when we receive direct or indirect remuneration from or on behalf of the recipient of the protected health information in exchange for your health information.
20. Psychotherapy Notes
If we maintain psychotherapy notes about you, we must obtain your written authorization before using or disclosing these notes, except:
- For our own use in treating you
- For our own training programs
- To defend ourselves in legal proceedings initiated by you
- When required by law
- For health oversight activities of your therapist
- To coroners or medical examiners after your death
- To avert a serious and imminent threat to health or safety
21. Other Uses
Other uses and disclosures of your health information not described in this Notice will be made only with your written authorization. You may revoke your authorization at any time, in writing, except to the extent that we have already taken action in reliance on your authorization.
YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION
You have the following rights regarding your health information:
1. Right to Inspect and Copy
You have the right to inspect and obtain a copy of your health information that may be used to make decisions about your care. This includes medical and billing records, but does not include psychotherapy notes.
To inspect and copy your health information:
- Submit your request in writing to our Privacy Officer
- We may charge a reasonable, cost-based fee for copying, mailing, and supplies
- We will respond to your request within 30 days (or 60 days if your records are stored off-site)
- We may deny your request in certain limited circumstances, and you may request a review of that denial
We may provide you with a summary or explanation of the health information instead of access to the health information itself, if you agree to such a summary or explanation and to the fees imposed for such summary or explanation, if any.
2. Right to Request Amendments
If you believe that your health information is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for us.
To request an amendment:
- Submit your request in writing to our Privacy Officer
- Include a reason that supports your request
- We will respond within 60 days
We may deny your request if:
- The information was not created by us (unless the person or entity that created the information is no longer available)
- The information is not part of the health information kept by or for us
- You would not be permitted to inspect and copy the information
- The information is accurate and complete
If we deny your request, you have the right to submit a written statement of disagreement, and we may prepare a written rebuttal. All information related to any request to amend will be included with your health record.
3. Right to an Accounting of Disclosures
You have the right to request an “accounting of disclosures.” This is a list of certain disclosures we have made of your health information.
The accounting will not include disclosures:
- For treatment, payment, and health care operations
- Made to you or pursuant to your authorization
- Made for national security or intelligence purposes
- To correctional institutions or law enforcement officials
- That occurred prior to April 14, 2003
- Incidental to otherwise permitted uses and disclosures
To request an accounting:
- Submit your request in writing to our Privacy Officer
- Specify the time period for the accounting (not to exceed six years and not including dates before April 14, 2003)
- The first accounting you request within a 12-month period will be free; we may charge a reasonable fee for subsequent requests
We will provide the accounting within 60 days (or 90 days if we notify you in writing of a 30-day extension).
4. Right to Request Restrictions
You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a limit on the health information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend.
We are not required to agree to your request except in the following situation:
If you pay out-of-pocket in full for a service and request that we not disclose health information to your health plan solely for payment or health care operations purposes (and not for treatment), we must agree to your request unless disclosure is otherwise required by law.
To request restrictions:
- Submit your request in writing to our Privacy Officer
- Tell us what information you want to limit
- Specify whether you want to limit our use, disclosure, or both
- Indicate to whom you want the limits to apply
If we agree to your request, we will comply with your request unless the information is needed to provide you with emergency treatment. We may terminate our agreement to your restriction if we give you notice of the termination, and the termination will only affect health information created or received after you receive the notice. You may request that we terminate our agreement to a restriction by submitting a written request to our Privacy Officer.
5. Right to Request Confidential Communications
You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail.
To request confidential communications:
- Submit your request in writing to our Privacy Officer
- Specify how or where you wish to be contacted
- We will accommodate all reasonable requests
We will not ask you the reason for your request.
6. Right to a Paper Copy of This Notice
You have the right to a paper copy of this Notice at any time, even if you have agreed to receive the Notice electronically. You may obtain a copy of this Notice at our website at shapehealth.io/privacy-practices or by contacting our Privacy Officer.
7. Right to be Notified of a Breach
You have the right to be notified in the event that we (or one of our business associates) discover a breach of your unsecured protected health information. We will notify you in writing by first-class mail, or by email if you have indicated a preference to receive information electronically. In some circumstances, we may provide notification by other methods as appropriate.
8. Right to File a Complaint
If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the Department of Health and Human Services.
To file a complaint with us:
- Contact our Privacy Officer in writing at the address listed at the beginning of this Notice
- Call us at (575) 339-1671
- Email us at privacy@shapehealth.io
To file a complaint with the Secretary of Health and Human Services:
- Submit your complaint to the Office for Civil Rights
- Visit www.hhs.gov/ocr/privacy/hipaa/complaints/ for more information
All complaints must be submitted in writing. You will not be penalized or retaliated against for filing a complaint.
SPECIAL SITUATIONS
Appointment Reminders and Health-Related Communications
We may contact you to:
- Remind you of upcoming appointments
- Provide information about treatment alternatives or health-related benefits and services that may be of interest to you
- Inform you about our programs and services
- Conduct patient satisfaction surveys
If you do not wish to receive these communications, you may opt out by contacting our Privacy Officer.
Individuals Involved in Your Care or Payment for Your Care
Unless you object, we may disclose health information about you to a family member, other relative, close personal friend, or any other person you identify who is involved in your medical care or payment for your care. We will only disclose health information directly relevant to the person's involvement in your care or payment.
We may also disclose your health information to notify, or assist in notifying, a family member, personal representative, or another person responsible for your care of your location, general condition, or death.
If you are present and capable of making health care decisions, we will give you an opportunity to object to these disclosures before we make them. If you are not present, or if you are incapacitated or facing an emergency medical situation and cannot object, we will use our professional judgment to determine whether the disclosure is in your best interest.
Disaster Relief Efforts
We may disclose your health information to disaster relief organizations (such as the Red Cross) so that your family can be notified about your condition, status, and location.
Fundraising Activities
We do not currently engage in fundraising activities. If we decide to do so in the future, we will:
- Only use limited information (such as your name, address, phone number, dates of service, department of service, treating physician, outcome information, and health insurance status) for this purpose
- Provide you with an opportunity to opt out of receiving fundraising communications
- Honor all opt-out requests
ELECTRONIC HEALTH INFORMATION AND TELEHEALTH
When we provide services via telehealth or maintain your health information electronically, we take appropriate technical, physical, and administrative measures to safeguard your information, including:
- Encryption of data in transit and at rest
- Secure authentication and access controls
- Regular security risk assessments
- Workforce training on privacy and security practices
- Use of secure, HIPAA-compliant platforms for telehealth services
When using telehealth services:
- You are responsible for protecting your own device and connection
- You should ensure you are in a private location during telehealth appointments
- You should use a secure internet connection (avoid public Wi-Fi when possible)
- You should verify the identity of the healthcare provider before sharing information
CHANGES TO THIS NOTICE
We reserve the right to change this Notice and to make the revised or changed Notice effective for health information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice on our website. The Notice will contain the effective date on the first page.
QUESTIONS OR COMPLAINTS
If you have questions about this Notice or wish to file a complaint about our privacy practices, please contact:
Privacy Officer: Josiah Fielder
Shape Health LLC
6202 Alchemy Street
Las Cruces, New Mexico 88012
Phone: (575) 339-1671
Email: privacy@shapehealth.io
You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services:
Office for Civil Rights
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
Phone: 1-877-696-6775
Website: www.hhs.gov/ocr/privacy/hipaa/complaints/
You will not be penalized, retaliated against, or denied services for filing a complaint.
ACKNOWLEDGMENT OF RECEIPT
You will be asked to sign an Acknowledgment of Receipt of this Notice. The purpose of this acknowledgment is to verify that you have been provided with a copy of this Notice. Your signature on the acknowledgment is not a consent to use or disclose your health information beyond the terms described in this Notice.
This Notice of Privacy Practices complies with the privacy requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 CFR Parts 160 and 164, as amended.
EFFECTIVE DATE: JANUARY 5, 2025