HIPAA Notice of Privacy Practices

This Notice of Privacy Practices describes how Reform MD Rx and its affiliated healthcare providers may use and disclose your protected health information (PHI) to carry out treatment, payment, and healthcare operations, and outlines your rights regarding that information. This notice applies to services delivered through our telehealth platform.

For professional review. This draft is provided for review by qualified legal and compliance counsel and a licensed privacy officer. It must be finalized to reflect your specific covered-entity status, business associate agreements, and applicable federal and state requirements before publication.

Treatment: We may use and disclose your PHI to provide, coordinate, and manage your healthcare and related services. This includes sharing information with licensed healthcare providers, pharmacies, and laboratory services involved in your care.

Payment: We may use and disclose your PHI so that the treatment and services you receive may be billed to a payment source, such as a health plan, HSA/FSA administrator, or third-party financing provider.

Healthcare Operations: We may use and disclose your PHI for practice operations, including quality assessment, provider review, training of healthcare professionals, and business planning.

Under HIPAA, you have the right to:

• Request access to and a copy of your PHI.
• Request an amendment or correction of your PHI.
• Request an accounting of certain disclosures of your PHI.
• Request restrictions on certain uses and disclosures of your PHI.
• Request that we communicate with you in a confidential manner.
• Receive a printed or electronic copy of this Notice.

We maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of your PHI in accordance with applicable federal regulations. Access to PHI is limited to authorized personnel who require it to perform their duties.

Business Associate Agreements (BAAs). Where any vendor, service provider, or partner creates, receives, maintains, or transmits protected health information on our behalf, a written Business Associate Agreement consistent with 45 CFR §164.504(e) must be in place before any PHI is shared. BAAs must be executed and current for every covered vendor — including the telehealth evaluation platform (Qualiphy), pharmacy fulfillment partners, payment processors handling protected data, hosting providers, and any analytics or communication tools that may come into contact with PHI. No PHI is transmitted to a vendor without a signed, current BAA.

Minimum necessary. We limit uses, disclosures, and requests of PHI to the minimum necessary to accomplish the intended purpose, except for treatment purposes or as otherwise required or permitted by law.

Preview note: This prototype website does not collect, transmit, or store protected health information through ordinary marketing forms. No medical intake, health history, or prescription data is processed by this website itself. All clinical evaluation and medical intake is handled through the separate, HIPAA-covered Qualiphy workflow.

If you have questions about this Notice or believe your privacy rights have been violated, you may contact our Privacy Officer at help@reformmdrx.com. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.