Notice of Privacy Practices (HIPAA)

Who Is Covered By This Notice

This Notice of Privacy Practices applies to Journey Care Solutions and all of its employed and contracted wound care clinicians, nursing staff, administrative personnel, and business associates who create, receive, maintain, or transmit your protected health information on our behalf. When we refer to "we," "us," or "our" in this Notice, we mean all of these individuals and entities acting under our direction.

Our Legal Duty

We are required by law to:

• Maintain the privacy of your protected health information (PHI)
• Provide you with this Notice of our legal duties and privacy practices
• Notify you following a breach of unsecured PHI
• Abide by the terms of the Notice currently in effect

We reserve the right to change the terms of this Notice. If we make material changes, we will post the revised Notice on our website and make it available upon request. Changes apply to all PHI we maintain, including records created before the change.

What Is Protected Health Information (PHI)?

Protected Health Information is any information we hold that relates to your past, present, or future physical health or condition, the provision of healthcare to you, or payment for healthcare — and that identifies you or could reasonably be used to identify you. PHI includes information in paper records, electronic records (ePHI), photographs, verbal communications, and any other form.

Examples of PHI we create and maintain include: wound photographs, clinical progress notes, wound measurements, diagnosis codes (ICD-10), treatment plans, Medicare and insurance records, visit schedules, and communications with your care team.

How We May Use and Disclose Your Health Information

Treatment

We use and disclose your PHI to provide, coordinate, and manage your wound care and related healthcare services. For example, a wound care specialist who visits you will document their findings in a progress note and may share that note with your primary care physician, the medical director of your skilled nursing facility, your home health agency nurse, or other members of your treating care team. We may also share information with specialists or laboratories if additional consultation or testing is required.

Payment

We use and disclose your PHI as necessary to bill and collect payment for services we provide. For example, we submit claims to Medicare Part B including diagnosis codes, procedure codes, wound descriptions, and clinical documentation to support reimbursement. We may contact Medicare or your insurance carrier for eligibility verification, prior authorization, or claims status. We may also use PHI to collect unpaid balances, including through a collection agency if necessary (subject to applicable law).

Healthcare Operations

We may use and disclose your PHI for our internal business and clinical operations, including:

• Quality assurance and clinical quality improvement activities
• Training wound care clinicians and administrative staff
• Business planning, management, and administration
• Conducting or arranging for legal, audit, or compliance services
• Credentialing and licensing of clinical staff
• Performance evaluation of our clinicians
• Conducting patient satisfaction assessments

Other Permitted Uses and Disclosures (No Authorization Required)

Federal law permits us to use or disclose your PHI without your written authorization in the following circumstances:

• As Required by Law: We will disclose PHI when required to do so by federal, state, or local law, including mandatory reporting obligations
• Public Health Activities: We may disclose PHI to public health authorities authorized to collect information for purposes such as preventing or controlling disease, injury, or disability; reporting child abuse or neglect; reporting reactions to medications; or notifying persons who may have been exposed to communicable diseases
• Victims of Abuse, Neglect, or Domestic Violence: We may disclose PHI to government authorities authorized to receive reports of abuse, neglect, or domestic violence, as required or permitted by law
• Health Oversight Activities: We may disclose PHI to oversight agencies conducting audits, investigations, inspections, or licensure actions, including the California Department of Public Health, the Medical Board of California, and the Centers for Medicare & Medicaid Services (CMS)
• Judicial and Administrative Proceedings: We may disclose PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process, subject to applicable protections
• Law Enforcement: We may disclose PHI to law enforcement officials under specifically defined circumstances, including pursuant to a valid court order, warrant, or subpoena, or to report certain types of wounds (such as gunshot wounds, as required by California law)
• Coroners, Medical Examiners, and Funeral Directors: We may disclose PHI as necessary to identify a deceased person, determine the cause of death, or perform other legally authorized duties
• Organ and Tissue Donation: We may disclose PHI to organizations involved in organ, tissue, or eye procurement, banking, or transplantation
• Research: Under certain conditions, we may use or disclose PHI for research purposes when an Institutional Review Board or Privacy Board has reviewed and approved the research protocol and waived the authorization requirement
• Serious Threats to Health or Safety: We may use or disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, to the extent consistent with applicable law and standards of ethical conduct
• Specialized Government Functions: We may disclose PHI for national security, intelligence activities, or protective services for the President and other officials
• Workers' Compensation: We may disclose PHI to the extent authorized by and necessary to comply with workers' compensation and similar programs
• Inmates: If you are an inmate of a correctional institution, we may disclose PHI necessary for the institution to provide healthcare or to protect the health and safety of you or others

Uses and Disclosures Requiring Your Written Authorization

We will obtain your signed, written authorization before using or disclosing your PHI for any purpose not described in this Notice, including:

• Most uses and disclosures of psychotherapy notes (if applicable)
• Marketing communications — we will never use your PHI for marketing without your explicit authorization
• Sale of PHI — we will never sell your PHI under any circumstances
• Disclosures not otherwise permitted by law

You may revoke any written authorization at any time by submitting a written revocation to us. Revocations are effective upon receipt, except to the extent we have already relied on the authorization prior to receiving your revocation.

Your Rights Regarding Your Health Information

You have the following rights with respect to the PHI we maintain about you. To exercise any of these rights, please submit a written request to our Privacy Officer using the contact information at the end of this Notice.

Right to Access and Receive Copies of Your Records

You have the right to inspect and receive a copy of your PHI that we maintain in a designated record set, which includes your clinical records and billing records. We will respond to your written request within five (5) business days for inspection and provide copies within 15 calendar days under California law (which is more stringent than the 30 days permitted by HIPAA).

We may charge a fee for copying records that reflects our reasonable, cost-based costs for labor, supplies, and postage, as permitted by California Health & Safety Code § 123110. We will provide the fee schedule upon request before processing your request.

If you request records in electronic format (for PHI maintained in an electronic health record), we will provide them in a readable electronic format. We may deny access in limited circumstances, such as when the information was compiled in anticipation of civil, criminal, or administrative litigation, or when a licensed healthcare professional has determined access would be harmful to you or others. If access is denied, we will provide a written explanation and inform you of your right to request a review of the denial.

Right to Request Amendment

You have the right to request that we amend PHI in your record that you believe is inaccurate or incomplete. We will respond to your written request within 60 days (with a possible 30-day extension). We may deny the request if the information was not created by us, is not part of our records, would not be available for inspection under applicable law, or is accurate and complete in our judgment. If we deny your request, we will provide a written explanation, and you have the right to submit a written statement of disagreement that we will include in your record.

Right to an Accounting of Disclosures

You have the right to request a list (an "accounting") of certain disclosures of your PHI that we have made during the six (6) years prior to your request. This right applies to disclosures made for purposes other than treatment, payment, or healthcare operations, and other exceptions defined by HIPAA. We will provide the first accounting in any 12-month period free of charge. For subsequent requests within the same 12-month period, we may charge a reasonable fee.

Right to Request Restrictions on Use and Disclosure

You have the right to request that we restrict certain uses and disclosures of your PHI. For example, you may request that we not share information about a particular condition with a specific family member. We are not required to agree to a requested restriction except in one specific situation: if you request that we restrict disclosure to a health plan for a service that you paid for entirely out of pocket, and the disclosure is not otherwise required by law, we are required to comply with that restriction. If we agree to a restriction, we will honor it unless it is needed to provide emergency treatment.

Right to Request Confidential Communications

You have the right to request that we communicate with you about your health information in a specific way or at a specific location. For example, you may ask that we contact you only by telephone at a specific number, or only by mail to a specific address. We will accommodate reasonable requests and will not ask you to explain your reasons for the request.

Right to Be Notified Following a Breach

You have the right to be notified if your unsecured PHI has been subject to a breach. We will notify you without unreasonable delay and in no case later than 60 days after discovery of the breach. Notification will include: a description of what happened; the types of information involved; steps you should take to protect yourself; what we are doing to investigate and mitigate the breach; and contact information to ask questions. For breaches affecting 500 or more California residents, we will also notify the California Department of Public Health and prominent media outlets, as required by California law.

Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice at any time, even if you have previously agreed to receive it electronically. Please contact us to request a paper copy.

Medical Record Retention

We retain your medical records in accordance with California and federal law. Our retention schedule is as follows:

• Adult patient records: Minimum of 10 years from the date of service, pursuant to California Health & Safety Code § 123111 and CMS conditions of participation for Medicare providers (42 CFR § 486.348)
• Minor patient records: Until the patient's 19th birthday, or 10 years from the date of service, whichever is later, pursuant to California Health & Safety Code § 123111(b)
• Records involving litigation: Retained until the conclusion of any related legal proceeding, regardless of the standard retention period
• Medicare billing and claims records: Minimum of 7 years from the date of service, pursuant to 42 CFR § 422.504 and CMS Program Integrity Manual requirements
• Authorization forms: Retained for 6 years from the date of creation or the date when the authorization was last in effect, whichever is later (45 CFR § 164.530(j))

When records reach the end of their required retention period, we destroy them using NIST 800-88-compliant methods for electronic records and cross-cut shredding for paper records, ensuring complete and irreversible destruction.

Electronic Health Records and Health Information Exchanges

Journey Care Solutions maintains clinical records in electronic format. You have the right to obtain electronic copies of your records maintained in an electronic health record system in a format that is readable and accessible to you. We do not currently participate in a regional Health Information Exchange (HIE); however, if we do in the future, we will update this Notice and provide you with information about your opt-out rights.

How to Exercise Your Rights or File a Complaint

To exercise any of the rights described in this Notice, please submit a written request to our Privacy Officer. We will acknowledge your request within 5 business days and respond within the applicable legal timeframe. We will never retaliate against you for exercising your rights under this Notice.

Journey Care Solutions — Privacy Officer
21405 Devonshire St #207
Chatsworth, CA 91311
Phone: (818) 465-5772
Fax: (818) 465-9213
Email: [email protected]

Filing a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights. Filing a complaint will not affect the care you receive from us.

U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue SW
Washington, D.C. 20201
Toll-free: 1-877-696-6775 (voice) • 1-800-537-7697 (TDD)
Online: www.hhs.gov/ocr/complaints

You may also file a complaint with the California Department of Public Health or the Medical Board of California if you believe your California medical privacy rights have been violated.