PHI Privacy Notice Last modified:  September 13, 2023

 

THIS NOTICE OF PRIVACY PRACTICES (“PHI PRIVACY NOTICE”) APPLIES TO CLIENTS (i.e., PATIENTS).  IF YOU ARE A HEALTH CARE SERVICE PROVIDER PLEASE REFER TO OUR PLATFORM AGREEMENT AND BUSINESS ASSOCIATE AGREEMENT (“BAA”) WHICH GOVERNS OUR RESPECTIVE RIGHTS AND OBLIGATIONS REGARDING PROTECTED HEALTH INFORMATION.

THIS NOTICE OF PRIVACY PRACTICES (“PHI PRIVACY NOTICE”) DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. THIS NOTICE ALSO DESCRIBES YOUR RIGHTS AND SOME OBLIGATIONS SKEDGEALERT HAS REGARDING THE USE AND DISCLOSURE OF YOUR MEDICAL INFORMATION. PLEASE REVIEW IT CAREFULLY.

This PHI PRIVACY Notice is incorporated by reference into the SkedgeAlert Privacy Policy.  Capitalized words in this PHI PRIVACY Notice that are not defined shall have the definition set forth in the SkedgeAlert Privacy Policy or in the SkedgeAlert Terms of Service and the Health Care Special Terms included therein, (“Terms”).

SkedgeAlert is a web application that allows patients to schedule health care appointments with health care Service Providers, amongst other services. In performing its scheduling services, SkedgeAlert may be provided with the following personally identifiable information (“PII”), which may be construed as protected health information (“PHI”) pursuant to the Health Insurance Portability and Accountability Act (“HIPAA”): name, phone number, e-mail address, date of birth, doctor name, date/time/duration of appointment, availability for appointment, location of appointment, and purpose for appointment, (hereinafter the “SkedgeAlert Health Information”).

In some cases, PHI may be directly shared with SkedgeAlert by the patient’s health care Service Provider pursuant to a ‘business associate agreement’ which complies with HIPAA. In other cases, the patient will provide their scheduling information and preferences directly to SkedgeAlert via computer, mobile phone, or other device, by using our SkedgeAlert application or Services. In this context SkedgeAlert may be deemed a ‘business associate’ under HIPAA and must comply with the security and privacy rules set forth therein.
 
SKEDGEALERT’S PLEDGE AND RESPONSIBILITIES REGARDING YOUR PROTECTED HEALTH INFORMATION 
We understand that protected health information about you and your health is personal. We care about protecting your health information and will comply with all applicable federal and state laws to take steps to protect this information. PHI includes certain information we create or receive that identifies you, including information regarding your health or payment for your health care services at a medical facility, whether by hospital personnel, your personal doctor or other practitioners involved in your care. The information SkedgeAlert will receive will be limited to the SkedgeAlert Health Information.
 
TO THE EXTENT ANY SUCH INFORMATION SHARED WITH SKEDGEALERT BY A HEALTH CARE SERVICE PROVIDER OR A PATIENT IS DEEMED PROTECTED HEALTH INFORMATION, THE FOLLOWING NOTICE OF PRIVACY PRACTICES AND HIPAA REQUIREMENTS WILL APPLY:

• We will maintain the privacy and security of your PHI and provide notice to you of our legal duties and privacy practices with respect to PHI.

• We will let you know if a breach occurs that may have compromised the privacy or security of your PHI.

• We must follow the duties and privacy practices described in this notice and give you a copy of it.

• We will not use or share your PHI other than as described here unless you tell us we can in writing.

If you tell us we can, you may change your mind at any time if you let us know in writing.
 
WHO WILL FOLLOW THIS NOTICE
This notice only describes the practices of SkedgeAlert. Your health care Service Provider may have different privacy practices than SkedgeAlert. For information on your health care Service Provider’s privacy practices, please contact your health care Service Provider directly.
 
OTHERS WHO MAY ACCESS OR USE YOUR PROTECTED HEALTH INFORMATION
Your PHI may only be shared by us with you, your health care Service Providers, SkedgeAlert and to those additional persons and for those additional purposes which you have agreed to in our Terms. Except as otherwise set forth in the authorizations you have agreed to in the Terms, those persons with access to your protected health care information will only use your PHI on a “need to know” basis subject to applicable state and federal laws.
 
YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION
Unless indicated otherwise, you may exercise one of your privacy rights by submitting a written request to SkedgeAlert at contactus@skedgealert.com or 2522 N. Proctor St. #273, Tacoma, WA 98406. For more specific instructions on what information to include in a written request, contact SkedgeAlert by phone at 253-271-3500.
 
DATA SECURITY
We care about the safety and security of your information. However, the safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of the Services, you are responsible for keeping this password confidential. You should not share your password or login credentials with anyone. While we have implemented security infrastructure and processes to meet the security and privacy rules of HIPAA, you are responsible for the security and privacy of the passwords and devices you utilize to access our Services.

1. YOU HAVE A RIGHT TO:

   1. GET AN ELECTRONIC OR PAPER COPY OF YOUR PROTECTED HEALTH CARE INFORMATION. SkedgeAlert will possess no medical records or PHI about you, other than the SkedgeAlert Health Information we receive from you or your health care Service Provider. Upon your request, we can only provide you with the information in our possession related to scheduling your health care appointments.  We likely will not maintain any records constituting a ‘designated record set’ (“DRS”) under HIPAA. Pursuant to our Health Care Special Terms, which you have agreed to, upon your request for your protected health information, we will provide you with a ‘Summary’ or ‘Explanation’ of the protected information requested, in lieu of providing a DRS, as authorized under 45 CFR § 164.524(c)(2)(iii).

      1. To request an opportunity to inspect and/or copy your SkedgeAlert Health Information in either paper or electronic format, please submit a request to SkedgeAlert at contactus@skedgealert.com or 2522 N. Proctor St. #273, Tacoma, WA 98406 or by phone at 253-271-3500.

      2. You may be charged a fee for copying, mailing or other supplies associated with your request.

      3. In certain limited circumstances, we may deny your request to inspect and/or copy your protected information. You may request that the denial be reviewed.

   2. ASK US TO CORRECT CERTAIN PROTECTED HEALTH INFORMATION. SkedgeAlert will possess no medical records or PHI about you, other than the SkedgeAlert Health Information we receive from you or your health care Service Provider. Given the nature of the information we will possess, it is unlikely that we will be able to accommodate a request to amend this information. Nevertheless, if you feel that information we have about you is incorrect or incomplete you can request an amendment to such information. We may say “no” to your request, but we’ll tell you why in writing.

   3. REQUEST AN ACCOUNTING OF CERTAIN DISCLOSURES. You may request an accounting of certain disclosures of PHI we have about you listing all the disclosures we made of your PHI to others. a. This list will not include disclosures made to you or for the purposes of treatment, payment, or health care operations. b. We may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

   4. REQUEST RESTRICTIONS: You may request in writing that we limit the way we use and disclose your PHI.

      1. You also have the right to request a limit on the SkedgeAlert Health Information we disclose about you to someone who is involved in your health care or the payment of your care.

      2. If you want to put such a restriction in place, please notify SkedgeAlert at contactus@skedgealert.com or 2522 N. Proctor St. #273, Tacoma, WA 98406 or by phone at 253-271-3500.

      3. If your request conflicts with our Health Care Special Terms or constitutes a revocation of a health care authorization, you will forfeit your ability to utilize our Services. However, please be advised that your medical treatment, medical payments, enrollment, or eligibility for medical benefits cannot and will not be conditioned upon your agreement to our Health Care Special Terms.

      4. We are not required to agree to your request, and we may say “no” if it would affect your care. If we do agree to your request, we will comply unless the information is needed to provide emergency treatment to you.

   5. RIGHT TO REQUEST NONDISCLOSURE TO HEALTH PLANS FOR SELF-PAID ITEMS OR SERVICES. Please contact your health care Service Provider to make the request for nondisclosure to health plans of self-paid items. SkedgeAlert will not receive any information regarding your payment for your health care services and we will not be able to help you.  Nevertheless, if we receive such information, you may have the right to request in writing that healthcare items or services for which you self-pay for in full in advance of your visit, will not be disclosed by SkedgeAlert to your health plan.

      1. We will say “yes” unless a law requires us to share that information.

      2. You are responsible for notifying your health care Service Providers of any restriction requests.

   6. REQUEST CONFIDENTIAL COMMUNICATIONS. SkedgeAlert will possess no medical records or PHI about you, other than the SkedgeAlert Health Information we receive from you or your health care Service Provider. We will only share this information with you and your Service Provider, and as otherwise set forth in our Health Care Special Terms. Nevertheless, you may request in writing that confidential communications about medical matters be made in a certain way or at a certain location.

      1. We will say yes to all reasonable requests. You do not have to provide a reason, but the request must specify how or where you wish to be contacted.

      2. However, if your request conflicts with our Health Care Special Terms or constitutes a revocation of a health care authorization made therein, you will forfeit your ability to utilize our Services. Nevertheless, please be advised that your medical treatment, medical payments, enrollment, or eligibility for medical benefits cannot and will not be conditioned upon your agreement to our Health Care Special Terms.  

   7. CHOOSE SOMEONE TO ACT FOR YOU.  If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your SkedgeAlert Health Information as provided in this notice, provided that you and such person(s) agree and adhere to our Health Care Special Terms.

   8. RECEIVE A PAPER COPY OF THIS NOTICE. You can request a copy of this Notice at any time from SkedgeAlert by notifying SkedgeAlert at contactus@skedgealert.com or 2522 N. Proctor St. #273, Tacoma, WA 98406 or by phone at 253-271-3500.

   9. USES AND DISCLOSURE OF YOUR PROTECTED HEALTH INFORMATION BY SKEDGEALERT.  SkedgeAlert will use your information in the following ways:

      1. SCHEDULING FOR TREATMENT PURPOSES. We may use and disclose your PHI as authorized in the Health Care Special Terms, including providing your PHI to you and your Service Providers in order to schedule your medical treatment and health care services with health care Service Providers.  This use and disclosure may be to doctors, nurses, technicians, health care students, or other health system personnel who are involved in your care. We may also use or disclosure your PHI in order to verify the scheduling of your appointments with your health care Service Provider and in order to receive and collect payment from your health care Service Provider for providing our Services to your Service Providers.

      2. HEALTH SYSTEM OPERATIONS: Your information is primarily utilized for scheduling health care appointments and is stored in an encrypted and secure environment. We can use and disclose your PHI to run our business, improve the scheduling of your care, and contact you when necessary as follows:  

         1. Running our business includes activities such as administering the scheduling of your appointments via a web application and improving our service.

         2. We may also use and disclose your information to other individuals (such as consultants and attorneys) and organizations that help us with our business activities.

         3. We may also use your PHI for internal purposes, like ensuring the quality of our scheduling services, identifying training needs, reviewing outcomes, sending customer surveys, and other administrative activities.

         4. We may use and disclose your PHI for data aggregation services relating to the health care operations of your health care Service Provider.  

         5. We may use and disclose your PHI to de-identify the SkedgeAlert Health Information in accordance with 45 CFR 164.514(a)-(c).  Once de-identified, SkedgeAlert may use and disclose the de-identified PHI for business administration or other commercial purposes.

         6. We may also disclose your information to Business Associates, or companies that provide a service to us or on our behalf and have provided satisfactory assurances that they will protect your PHI.

      3. INCIDENTAL DISCLOSURES. Certain incidental disclosures of your PHI may occur as a byproduct of lawful and permitted use and disclosure of your PHI. Reasonable safeguards are in place to minimize these disclosures.

   10. PAYMENT. SkedgeAlert does not charge you any fee for your use of our Services. SkedgeAlert receives compensation from your health care Service Provider for providing our Services and not from you. However, you are responsible for all fees, costs, and taxes associated with the service provided by your health care Service Providers. Further, you are responsible for all fees, costs, and taxes, associated with the use of a computer, mobile phone, or any other device utilized by you to access our Services, including all equipment costs, and any and all fees, costs, and taxes associated with your internet service provider and mobile carrier data plan.

   11. CONTACTING YOU. We may use and disclose SkedgeAlert Health Information to reach you about appointments and other matters. We may contact you by web or mobile application, mail, telephone, e-mail, texting, or other messaging service.

   12. LIMITED DATA SET INFORMATION. We may disclose limited PHI to third parties for purposes of research, public health and health care operations. This limited data set will not include any information that could be used to identify you directly.

   13. COMPLIANCE WITH LAWS. We will share information about you if state or federal laws require it, including the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.

   14. GOVERNMENT REQUESTS AND LAW ENFORCEMENT. We can use or share SkedgeAlert Health Information about you:

       1. With health oversight agencies for activities authorized by law.

       2. For special government functions such as military, national security, and presidential protective services.

       3. In limited circumstances, for law enforcement purposes or with a law enforcement official.

   15. LAWSUITS AND DISPUTES. We may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process, if you are involved in a lawsuit or a dispute. We may use or disclose your PHI to enforce the terms of any agreement we have with you.

   16. HEALTH-RELATED BENEFITS AND SERVICES. We may use or disclose information to tell you about health-related benefits, services, or medical education classes.

2. AUTHORIZATION REQUIRED. Under 45 CFR 164.508(a)(2)-(a)(4), your authorization is required for the use or disclosure of your protected health information (1) of psychotherapy notes; (2) for marketing purposes, where remuneration is received; and (3) for the sale of your protected health information. When you agreed to our Health Care Special Terms, you acknowledged and agreed to the following authorizations which may constitute the ‘marketing’ or ‘sale of your PHI under HIPAA:  By use of our Services, you will have the ability to schedule services with various Service Providers on our Platform, which includes sharing your PHI with your Service Providers. We may also communicate with you about separate products and services (for use or purchase) offered by any other Service Provider on our Platform.  Also, we will share your SkedgeAlert Health Information with Service Providers with whom you elect to connect through our Services. We may also use your demographic information and search history to market to Service Providers (not currently on our Platform) for the purpose of attracting said parties unto our Platform and Services. In addition, please be advised that we will receive financial remuneration from Service Providers who use our Platform. The foregoing uses and disclosures of your SkedgeAlert Health Information may be construed as the ‘marketing’ or ‘sale’ of your SkedgeAlert Health Information under HIPAA. (Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.  A ‘sale of protected health information’ constitutes a disclosure of protected health information by SkedgeAlert, where SkedgeAlert directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information in exchange for the protected health information). See 45 CFR 164.508(a)(3) and 45 CFR 164.508(a)(4)). You authorize the foregoing uses and disclosures of your SkedgeAlert Health Information which may constitute the ‘marketing’ or ‘sale of your SkedgeAlert Health Information under HIPAA.

3. AUTHORIZED REPRESENTATIVE. You acknowledge, agree and warrant that you have the lawful right to utilize our Services on behalf of others. If you are using the Services to schedule appointments on behalf of adult(s) or unemancipated minor(s), you hereby agree and warrant that you have the authority (in accordance with 45 CFR 164.502) to authorize SkedgeAlert to use and disclose the SkedgeAlert Health Information of said adult(s) or unemancipated minor(s) in accordance with our Health Care Special Terms and this PHI Privacy Notice.

4. ADOLESCENT RIGHTS. You acknowledge that adolescents have rights to consent to certain health care treatment and access health care information without parental notification or consent and you warrant that you have the lawful authority to use our Services on behalf of adolescents. Applicable federal and state laws, including HIPAA, grants unto unemancipated minors the right to consent to certain health care services without parental consent and without parental notification. You hereby acknowledge, agree and warrant that you are solely responsible and liable for ensuring that your use of the Platform or Services on behalf of an unemancipated minor(s), and your access to and use and disclosure of the SkedgeAlert Health information of unemancipated minor(s) on our Platform, shall fully comply and comport with any and all applicable laws granting unemancipated minor(s) the right to consent to health care services and access to health care information. You further agree to forever hold harmless, defend and indemnify SkedgeAlert for any violation of an unemancipated minor(s)’ rights, caused in part or in whole by your use of our Services. You acknowledge that given the nature of our Services, which are primarily limited to scheduling appointments, our Services do not allow us to verify whether an unemancipated minor(s) has an independent right to use and disclose SkedgeAlert Health Information and therefore you agree that we may wholly rely on your representations made by agreement to our Terms.

5. OTHER USES AND DISCLOSURES OF YOUR PROTECTED HEALTH INFORMATION. Other uses and disclosures of your PHI not covered by our current Terms, this notice or applicable laws will only be made with your written permission.

6. REVOCATION. You may revoke any permission to use or disclose your PHI by submitting a request in writing to SkedgeAlert (see Section 8 below). If you revoke your permission, we will no longer use or disclose your PHI for the reasons covered by your revoked authorization unless required by law. However, revocation of a health care authorization will result in your inability to utilize our Services. Nevertheless, please be advised that your medical treatment, medical payments, enrollment, or eligibility for medical benefits cannot and will not be conditioned upon your assent to our authorization(s) and agreement to our Terms. You understand that we are unable to reverse any uses or disclosures we have made prior to revocation and that we may need to retain certain information provided to us about you allowed under our Terms or required pursuant to HIPAA.

7. CHANGES TO THIS NOTICE. SkedgeAlert can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request, at our facilities, and on our website.

8. QUESTIONS AND COMPLAINTS. If you have general questions about this notice, please contact SkedgeAlert by phone: 253-271-3500 email: contactus@skedgealert.com. If you believe your privacy rights have been violated, you may file a complaint with SkedgeAlert at 2522 N. Proctor St. #273, Tacoma, WA 98406. If we cannot resolve your concerns, you also have the right to file a written complaint with the Secretary of the Department of Health and Human Services (HHS), Office for Civil Rights. We will not retaliate against you for filing a complaint and the quality of your care will not be jeopardized.

9. RECORD RETENTION. We will retain your SkedgeAlert Health Information to the extent it must be retained in accordance with HIPAA or as otherwise required to meet our legal obligations or business requirements. Information that does not need to be maintained under HIPAA may be deleted, destroyed, de-identified, or otherwise utilized or anonymized by SkedgeAlert without notice to you.  If information about you must be retained under HIPAA, then, upon termination or expiration of the provision of Services to you, we will, if feasible, destroy the remaining SkedgeAlert Health Information that we still maintain in any form. If not feasible to destroy, or if we must retain such SkedgeAlert Health Information in order to meet our legal obligations or business requirements, we will extend HIPAA protections to the information and limit further uses and disclosures to those purposes that make the destruction of the information infeasible.