Privacy Policy & Information Protection

Effective Date: January 1, 2025

Last Revised: January 1, 2025

1. Scope and Application

This Privacy Policy applies to Health Care Insight Hub, a healthcare facility located at 971 N Citrus Dr, La Habra, California(CA), 90631 ("Facility," "we," "our," or "us"). This policy governs the collection, use, disclosure, and protection of Protected Health Information (PHI) and personally identifiable information (PII) in compliance with the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH), and applicable state privacy regulations.

2. Categories of Information Collected

2.1 Protected Health Information (PHI)

In accordance with 45 CFR § 160.103, we collect and maintain PHI, which includes individually identifiable health information transmitted or maintained in any form or medium by a covered entity or business associate. This encompasses:

• Demographic information including full legal name, residential address, telephone numbers, email addresses, and date of birth
• Social Security numbers and government-issued identification numbers
• Health insurance information, policy numbers, and coverage details
• Emergency contact information and authorized representatives
• Employment information and financial data related to healthcare services

2.2 Clinical and Medical Information

Our healthcare operations require the collection and maintenance of comprehensive medical information, including but not limited to:

• Complete medical history, family medical history, and genetic information
• Current health conditions, diagnoses, and treatment plans
• Laboratory results, diagnostic imaging, and pathology reports
• Prescription medications, dosages, and pharmaceutical history
• Clinical notes, physician observations, and care coordination documentation
• Mental health records and substance abuse treatment information

2.3 Digital Information and Website Analytics

Through our digital platforms and website analytics, we collect technical information including:

• Internet Protocol (IP) addresses, browser type and version, and operating system information
• Website navigation patterns, page views, session duration, and referral sources
• Search queries, form submissions, and user interaction data
• Device identifiers, mobile application usage, and geolocation data (when permitted)
• Cookies, web beacons, and similar tracking technologies as detailed in our Cookie Policy

3. Permitted Uses and Disclosures of Protected Health Information

3.1 Treatment, Payment, and Healthcare Operations (TPO)

In accordance with 45 CFR § 164.506, we may use and disclose PHI without authorization for the following purposes:

• Treatment: Provision, coordination, and management of healthcare services by healthcare providers
• Payment: Activities related to reimbursement for healthcare services, including billing, claims processing, and collection activities
• Healthcare Operations: Quality assessment, case management, business planning, administrative functions, and compliance activities
• Care coordination among multidisciplinary healthcare teams and consulting specialists
• Maintenance of comprehensive electronic health records and clinical documentation systems

3.2 Digital Platform and Communication Services

Website and digital platform information is utilized for:

• Enhancement of user experience and website functionality optimization
• Processing of patient inquiries, appointment requests, and service communications
• Delivery of appointment reminders, health education materials, and preventive care notifications
• Performance analytics, security monitoring, and system maintenance activities
• Compliance with accessibility standards and regulatory requirements

4. HIPAA Privacy Rule Compliance and Regulatory Framework

Health Care Insight Hub operates as a HIPAA-covered entity under 45 CFR § 160.102 and maintains comprehensive compliance with the HIPAA Privacy Rule (45 CFR Part 164, Subpart E), Security Rule (45 CFR Part 164, Subpart C), and Breach Notification Rule (45 CFR Part 164, Subpart D). Our privacy practices are designed to meet or exceed federal and state regulatory requirements for healthcare information protection.

4.1 Protected Health Information Safeguards

All PHI is subject to stringent protection measures in accordance with HIPAA standards. We maintain administrative, physical, and technical safeguards designed to ensure the confidentiality, integrity, and availability of PHI in all forms and media.

4.2 Minimum Necessary Standard

In compliance with 45 CFR § 164.502(b), we adhere to the minimum necessary standard, limiting the use, disclosure, and request of PHI to the minimum amount reasonably necessary to accomplish the intended purpose, except where otherwise permitted or required by law.

5. Information Sharing

5.1 Healthcare Providers

We may share your information with:

• Physicians and specialists involved in your care
• Nurses, technicians, and other healthcare staff
• Laboratories and diagnostic imaging centers
• Pharmacies for prescription fulfillment

5.2 Business Associates

We may share information with business associates who help us operate our healthcare services, including:

• Insurance companies and billing services
• Medical equipment and software vendors
• Legal and accounting professionals
• Quality assurance and accreditation organizations

6. Data Security

We implement appropriate technical, physical, and administrative safeguards to protect your information:

6.1 Technical Safeguards

• Encryption of data in transit and at rest
• Secure network infrastructure and firewalls
• Regular security updates and patches
• Access controls and user authentication

6.2 Physical Safeguards

• Secure facilities with controlled access
• Locked filing cabinets for paper records
• Secure disposal of confidential information
• Workstation and device security measures

6.3 Administrative Safeguards

• Employee training on privacy and security
• Background checks for staff with access to PHI
• Regular risk assessments and audits
• Incident response and breach notification procedures

7. Your Rights

Under HIPAA and applicable privacy laws, you have the right to:

7.1 Access Your Information

You have the right to inspect and obtain copies of your medical records and other health information we maintain about you.

7.2 Request Amendments

You may request that we amend your health information if you believe it is incorrect or incomplete.

7.3 Request Restrictions

You may request restrictions on how we use or disclose your health information for treatment, payment, or healthcare operations.

7.4 Request Confidential Communications

You may request that we communicate with you about your health information in a particular way or at a specific location.

7.5 Accounting of Disclosures

You have the right to receive an accounting of certain disclosures of your health information that we have made.

8. Cookies and Tracking Technologies

Our website may use cookies and similar tracking technologies to enhance your browsing experience:

8.1 Types of Cookies

• Essential Cookies: Necessary for website functionality
• Analytics Cookies: Help us understand how visitors use our site
• Preference Cookies: Remember your settings and preferences

8.2 Managing Cookies

You can control cookies through your browser settings. However, disabling certain cookies may affect website functionality.

9. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

10. Children's Privacy

We do not knowingly collect personal information from children under 13 through our website without parental consent. If you believe we have collected information from a child under 13, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on our website and updating the "Last Updated" date. Your continued use of our services constitutes acceptance of the updated policy.

12. Contact Information

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

13. Complaints

If you believe your privacy rights have been violated, you may file a complaint with:

• Our Privacy Officer using the contact information above
• The U.S. Department of Health and Human Services Office for Civil Rights

You will not be retaliated against for filing a complaint.