Notice of Privacy Practices & Privacy Policy

Notice of Privacy Practices and Privacy Policy

VirtualMD 360, P.A. HIPAA Notice of Privacy Practices and Privacy Policy

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN OBTAIN ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

VirtualMD 360, P.A is committed to helping you to understand with whom and under which circumstances that we may share any information that we may obtain from you. We recognize the importance of protecting the privacy of your personal information, and we have prepared this Privacy Policy and Notices of Privacy Practices to provide you with important information about the privacy practices applicable to VirtualMD 360 and any website, “Site,” or Service that links to or refers to this Privacy Policy or Notices of Privacy Practices. Also, any identifiable information that you provide to us for purposes of obtaining medical care from VirtualMD 360, P.A. will also be subject to VirtualMD 360, P.A ’s Health Insurance Portability and Accountability Act Notice of Privacy Practices (the “HIPAA Notice”). This HIPAA Notice describes how VirtualMD 360, P.A. and other individuals or entities can use and disclose your Protected Health Information, or PHI, and describes your rights as it relates to your PHI. 

During your treatment by contracted physicians of VirtualMD 360, P.A., herein referred to as VirtualMD 360, our physicians may gather information about your medical history and current health condition to provide you with services. This information is known as PHI and includes personal identifying information such as your name, date of birth, contact information such as your full name, email address, phone number, and mailing address, as well as personal health information including your medical conditions and diagnoses, general health, prescriptions, previous treatments, and health insurance information. PHI also includes your username and password, payment information including detailed credit card information, billing, and any other information you provide to VirtualMD 360, P.A. 

For healthcare providers including contracted physicians of VirtualMD 360, P.A., PHI includes information about your employment, such as your practice locations, job title, primary specialty and sub-specialty, medical license information and status, educational background, date of birth, gender, spoken languages, photograph, address, social security number, Tax ID number, bank account information, NPI number, other professional license information.

This Notice explains how your PHI may be used and shared with others and explains your privacy rights regarding your PHI.  VirtualMD 360, P.A. is required by law to abide by the terms of this Notice, to make sure that any information that identifies you is kept private, and to provide you this Notice of our legal duties and practices with respect to your PHI. We are also required to provide you with notification if there is a breach of your PHI. We utilize measures to help protect your information from any theft, loss, misuse, unauthorized access, unauthorized disclosure, destruction, and alteration. Any data storage system or data transmission over any public network or Internet is guaranteed to be 100 percent secure. 

Uses and Disclosures of Your PHI for Treatment, Payment, and Health Care Operations

We may use your PHI to carry out treatment, payment, and health care operations without your written authorization. The following categories provide various examples of the various ways that we may use and disclose your PHI for these purposes. VirtualMD 360 may use your PHI to carry out treatment, payment, and health care operations without your written authorization. 

Treatment: Treatment is medical care provided to a patient for an illness or injury and is the provision, management, or coordination of healthcare. We may use and disclose your PHI to provide you with medical services and treatment. As an example, we may:

· Use and disclose your PHI to provide and coordinate treatment, medication, and services you receive from VirtualMD 360.

· Disclose your PHI to third parties, such as doctors, pharmacies, laboratories, hospitals, insurance companies, government agencies, or other healthcare providers to assist them in providing you with care or treatment options or to assist with coordination of your medical care. 

· Contact you to provide treatment-related services such as appointment reminders.

Sometimes, use and disclosure of your PHI for treatment purposes may be made through a Health Information Exchange or similar system or through shared electronic medical record. 

Payment: Payment includes the activities necessary to obtain reimbursement for providing you with medical care. We may use and disclose your PHI to obtain payment for the services we provide to you or for other payment activities related to the services we provide to you. As an example, we may:

· Share your PHI with your insurer, health plan, or other third-party payer to determine whether your insurer or third-party payer will reimburse you for the treatment you received at VirtualMD 360 or pay VirtualMD 360 directly. This allows VirtualMD 360 to determine the payment amount that you may owe VirtualMD 360. 

· Share your information with authorized third-party service providers and vendors that help us with specific services such as payment processing, billing, customer service, email outreach, business analytics, marketing, data processing, hosting, and performance monitoring. Authorized third-party service providers and vendors and service may not use your PHI for purposes other than those related to the services they are providing to VirtualMD 360.

· Contact you about a payment or balance due for services you received at VirtualMD 360.

· Disclose your PHI to other health plans, healthcare providers, or other HIPAA-Covered Entities who may need it for their payment actions.

Health Care Operations: Health care operations include the activities necessary for VirtualMD 360 to run its business operations. We may use and disclose your PHI to operate our business. As an example, we may:

· Use and disclose your PHI to review treatment, perform quality assessment and performance activities.

· We may share your information in connection with a substantial business transaction, such as a merger, website or asset sale, consolidation, or bankruptcy.

· Use and disclose your PHI to provide customer services to you such as resolving complaints and coordinating your medical care.

· Use and disclosure of your PHI to contact you about health-related products or services such as programs for our patients.

· Disclose your PHI to other HIPAA Covered Entities or their Business Associates that have provided services to you so that they can drive efficiency and quality improvement of their healthcare operations including healthcare services they provide.

· Use or disclose your de-identified PHI data, which all your personally identifiable information has been removed, for business planning, analytics, or other purposes. 

· Share your PHI to Corporate affiliates that are subject to this Notice. 

VirtualMD 360 may share your PHI for any other purposes disclosed to you at the time we collect your PHI or pursuant to your direction or consent.

VirtualMD 360 and the telehealth platform that we use, VirtualMD Health, may automatically collect specific information when you use our Services such as your browser type, time and date of visit,  Internet service provider, Internet protocol (IP)address, computer’s IP address, device identifiers, nearby Wi-Fi cell towers, advertising identifiers, operating system, mobile device’s GPS signal information, website pages visited before and after using our Services, nearby Wi-Fi access points, link clicked while on website, and other server log information. Pixel tags, cookies, and similar technology may be used to collect this information. By using our Services, you are providing your consent to our use of cookies and similar technology to automatically collect this information. You may be able to disable or refuse cookies or similar technology by adjusting your device’s web browser settings. Please review your device’s web browser instructions which is usually located in the “Help” section. By disabling, refusing, or deleting these technologies, the entire functionality of the Services may not be available to you.

Technical data such as the memory state of your mobile device or computer may be collected in order to address and solve any technical difficulties, such as system crashes while using our Services, and to improve our Services. Your browser settings or device settings may allow you to have control over this technical data collection. By using our Services, you are providing your consent to the collection of this technical data. 

Do Not Track, DNT, is a web browser setting that requests that a web application disable its tracking of an individual user. You may choose to turn on the DNT setting in your web browser which then sends Do not Track signal to websites, advertising networks, plug-in providers, analytics companies, plug in providers, and other web services that you encounter during browsing. There is currently no universally agreed upon standard consensus on how companies you encounter during browsing should interpret DNT signals and so most sites do not change their practices when they receive a DNT signal. We currently do not act in response to receiving these DNT signals.

If you access third-party organizations and services such as Google, Twitter, of Facebook through our Services for your log-in to our Services or for your ability to share your Services experience information, then we may receive information about you from these other third-party sources. We may use this third-party data in combination with our first-party data about you, such as your name and email address, to contact you via email, direct mail, or other communication channel. If you engage in public activities on the Site or any third party sites that we provide a link to connect, you must be aware that any information shared by you may be collected, read, or used by other users of these sites. While participating on these sites, use caution in disclosing any personal information and know that we are not responsible for any information you share on these public sites. Information collected by these third-party public sites may not have the same security measures and protection as information you submit to us. We are not responsible for the protection and security of any information you share on these sites. 

Some of our Services may contain links to content maintained by third party organizations that we do not control.  We may allow some third parties, including business partners and advertising service providers, to collect information about your online activities through cookies and other similar technologies. These third-party organizations may use this information to display ads on our Services and other locations online which are customized to your preferences, interests, and characteristics.  We are not responsible for the Privacy Practices of these third parties, and our Privacy Policy does not cover the Privacy Practices of these third-party sites or organizations. These third-party organizations may give you the opportunity to opt-out of targeted advertising. You may be able to disable targeted advertising within mobile device, mobile app, or browser settings. Please review your devices’ settings for more information. You may need to contact the third-party company for more opt-out information.

Other Uses and Disclosures of Your PHI that Do Not Require Authorization

VirtualMD 360 is also allowed or required to share your PHI, without your authorization, in certain instances or when certain conditions have been met as follows: 

· Individuals Involved in Your Care or Payment for Your Care: We may disclose your PHI to a personal representative, friend, or family member who helps pay for your medical care or is involved in your medical care. We may also make these disclosures after your death as authorized by applicable law, unless doing so is inconsistent with any prior expressed preference. We may use or disclose your PHI to notify or assist in notifying a family member, personal representative, or any other person responsible for your care regarding your location, status, or general condition. We may also use or disclose your PHI to disaster relief organizations so that your family or other persons responsible for your care can be notified of your location, general condition, or death. If you are unable to agree or object to the use or disclosure, we may disclose such information as necessary if we determine that it is in your best interest.

· Business Associates: When VirtualMD 360 contracts with third parties to perform certain services for us, such as billing or consulting, these third-party service providers, known as "Business Associates," may need access to your PHI to perform these services. They are required by law and their agreements with us to protect your PHI in the same way we do.

· Disclosures to Parents or Legal Guardians: If you are a minor (age less than 18 years old), we may release your PHI to your parents or legal guardians when we are permitted or required under state and federal law. We do not knowingly permit persons under the age of 18 to create accounts that would grant or allow access to our Services.

· Required by Law: We may disclose your PHI when required by law to do so. This disclosure may include providing your PHI to the Department of Health and Human Services.

· Workers' Compensation: We may disclose your PHI as necessary to comply with workers' compensation laws or other similar programs.

· Law Enforcement: We may disclose your PHI to law enforcement officials for certain law enforcement purposes. If we are legally obligated to disclose information to a third party about you, VirtualMD 360 will attempt to notify you by sending an email to you using the email address in your records if available unless this would be considered a violation of the law. Examples of law enforcement disclosures: 

Ø VirtualMD 360 may use or disclose your PHI to report certain injuries.

Ø We may disclose your PHI when we believe the information constitutes evidence of criminal conduct that occurs at our business locations. 

Ø We may disclose your PHI to law enforcement officials in the case of an administrative request, court orders, subpoenas, warrants, legal process, legal claims, or similar process and to protect and defend the rights, safety, interests, and security of VirtualMD 360, our users, affiliates, or the public.

· Public Health Reporting: We may disclose your PHI to public health agencies as authorized by law. For example, we may report reactions to medications or other products to the U.S. Food and Drug Administration or other authorized entity, and we may use or disclose your PHI in order to help with product recalls or notify individuals of potential exposure to a communicable disease or risk of spreading a disease or condition.

· Reporting Victims of Abuse or Neglect: We may disclose your PHI to the appropriate government authority if we believe you have been the victim of abuse, domestic violence, or neglect. This disclosure is only made if you agree with disclosure or when we are required or authorized by law to make this disclosure.

· Health Oversight Activities: We may disclose your PHI to an oversight agency for oversight activities authorized by law. Oversight activities include investigations, audits, inspections, licensure or disciplinary actions, or administrative, civil, and criminal proceedings, as necessary for oversight of the government programs, health care system, and civil rights laws.

· Research: Under certain circumstances, we may disclose your PHI for research purposes and your separate written authorization for disclosure may be needed.

· To Prevent a Serious Threat to Safety or Safety: If there is a serious threat to your safety and health or the health and safety of the another person or the general public, VirtualMD 360 may use and disclose your PHI in a limited manner to persons who are able to help lessen or prevent the threat.

· Decedents: We may disclose PHI to coroners, medical directors, medical examiners, or funeral directors so that they can carry out their duties. 

· Judicial and Administrative Proceedings: VirtualMD 360 may disclose your PHI in response to an administrative or court order, discovery request, subpoena, or other lawful process.

· Specialized Government Functions: In certain instances, VirtualMD 360 may use or disclose your PHI to authorized federal officials for the management of national security activities and other specialized government purposes. As an example, if you are a member of the U.S. military or member of a foreign military, VirtualMD 360 may disclose your PHI as required by military command authorities, only if certain circumstances are met.

· Organ or Tissue Donation: Consistent with applicable law, VirtualMD 360 may disclose your PHI to organ procurement organizations for the purpose of tissue donation and transplant.

· Correctional Institution: If you are an inmate or become an inmate of a correctional institution, we may disclose your PHI to the correctional institution or its agents to assist them in providing for the safety of the correctional institution, providing you with medical care, protecting your health and safety, or protecting the health and safety of others.

· Affiliated Covered Entity: VirtualMD 360 entities are part of an affiliated group of entities which is collectively known as VirtualMD 360, P.A. This affiliated group of entities treats itself as a single entity under the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder (collectively, "HIPAA"), also referred to as an Affiliated Covered Entity, for purposes of using and disclosing your health information. When permitted by HIPAA, we may disclose your PHI to other VirtualMD 360 entities that are part of this Affiliated Covered Entity.

Uses or Disclosures for Purposes that Require Your Authorization

Use and disclosure of your PHI for purposes other than those described above may only be made with your written authorization. Without your authorization, VirtualMD 360 will not use or disclose your PHI for marketing purposes and will not sell your PHI to third parties (except for, in connection with, the transfer of a business to another health care provider required to comply with HIPAA). 

We will obtain your written authorization before using or disclosing your PHI for purposes other than those described in this Notice or otherwise permitted by law. You may revoke your authorization at any time by submitting a written notice to the VirtualMD 360 Privacy Office. Your revocation will be effective upon acknowledgment of our receipt. Your revocation will not undo any use or disclosure of your PHI that occurred before you provided us with notification and will not undo any actions taken based upon your previous written authorization. 

State laws may be stricter and may prohibit certain uses and disclosures that are identified above. When state law is more protective of your privacy, we will abide by the privacy laws of that state. As an example, some state laws require added protection for medical records related to the treatment of mental health, drug and alcohol treatment, and HIV-related medical information. If you have a question about how VirtualMD 360 complies with your state's laws, please contact VirtualMD 360 via email at privacy@virtualmd360.com.

Your Health Information Rights

Obtain a Copy of the Notice: You have the right to obtain a paper copy of our current Notice at any time. You may do so by visiting VirtualMD360.com and printing a copy directly from our website. You may also obtain by contacting VirtualMD 360 via email at privacy@virtualmd360.com.

Inspect and Obtain a Copy of Your PHI: With a few exceptions, you have the right to see and obtain a copy of the PHI we maintain about you. You may request access to your PHI electronically. You may also ask us to provide a copy of your PHI to another person or entity. A reasonable fee may be charged for the expense of fulfilling your request as permitted under HIPAA and/or state law. We may deny your request to inspect and copy your record in certain limited circumstances. If we deny your request, we will provide you with written notification and will let you know if and how you may request a review of the denial.

Request an Amendment: If you feel that the PHI we maintain about you is incorrect or incomplete, you may request that we amend it. To request an amendment, submit a written request to the VirtualMD 360. You must provide a supporting reason for your request of the amendment. You will be provided with a written explanation if we do not approve your request for an amendment.

Receive an Accounting of Disclosures: You have the right to request an accounting of disclosures we make of your PHI for purposes other than treatment, payment, or health care operations. Please note that certain other disclosures need not be included in the accounting we provide to you. To obtain an accounting, submit a written request to VirtualMD 360. We will provide one accounting of disclosures per a 12-month period at no cost to you. You may be charged for the cost of any subsequent accountings of disclosure; we will provide you with advance notification of the cost involved at which time you may choose to modify or withdraw your request. 

Disclosure Option For California Residents: You have the right to request and obtain a once a year, free of charge, disclosure of specific information for the previous calendar year of any of your specific personal information, if any, that was shared with third parties for their direct marketing purposes. We do not disclose your personal information to third parties for their direct marketing purposes.

Request a Restriction on Certain Uses and Disclosures:You have the right to request additional restrictions on our use and disclosure of your PHI by sending your written request to VirtualMD 360. We are not required to agree to your request except where the disclosure is to a health plan or insurer for purposes of carrying out payment or health care operations, is not otherwise required by law, and the PHI is related to a health care item or service for which you, or a person on your behalf, has paid in full out-of-pocket. VirtualMD Health currently only accepts full payments via credit card for services provided. We do not currently submit any claims for payment to any health plans. 

Request Confidential Communications: You have the right to request that we communicate with you at a specific location or at a specific way. For example, you may request that we contact you only via email of in writing at a specific mailing address. To request confidential communication of your PHI, you must submit a written request to VirtualMD 360 stating how, when, or where you would like to be contacted by VirtualMD 360. We will accommodate any reasonable requests.

Request to Opt Out: You have the right opt out of receiving communications regarding general health, wellness, or treatment options by emailing us at privacy@virtualmd360.com. You may or may not include in your request that we delete your personal information. 

Notification of a Breach: We will notify you if there is a breach of your unsecured PHI that is governed by HIPAA.

Exercise Rights Through a Personal Representative:You may exercise your rights through a personal representative as required or permitted by applicable law. Your personal representative may be required to produce proof of authority to act on your behalf before that individual can be given access to your PHI or allowed to take any action for you on your behalf.

Complaints: If you believe your privacy rights have been violated, you may file a formal complaint with VirtualMD 360 Privacy Department or with the Secretary of the United States Department of Health and Human Services. All complaints must be submitted in writing. You will not be penalized or retaliated against in any way for filing a formal complaint.

Written Requests and Additional Information: you may request additional information about VirtualMD 360's privacy practices or obtain forms for submitting written requests by contacting VirtualMD 360 Privacy Office. 

VirtualMD 360 Privacy Office Contact Information:

VirtualMD 360, P.A. 

ATTN: Privacy Office

301 W. Bay Street, Suite 14141

Jacksonville, FL 32202

Toll-free telephone: (800) 880-9139

If you have any questions about this Notice of Privacy Practices and Privacy Policy, please email us at privacy@virtualmd360.com. 

For International Users: We do not offer telemedicine visits to residents outside the United States of America. We maintain information in the United States of America and in accordance with the governing laws of the United States of America. By using the Site and providing us with your information, you consent to the transfer of your information to the United States for processing by us in accordance with this Notice and Privacy Policy. We may be required to disclose your personal information due to lawful requests by public authorities, for instance, to meet law enforcement requirements or national security requirements.

Changes to this Notice

We reserve the right to make changes to this Notice and Privacy Policy from time to time and as permitted by law. We reserve the right to make the revised Notice and Privacy Policy effective for the PHI we already have regarding you as well as any information we receive in the future, as of the effective date of the revised Notice and Privacy Policy. We will promptly revise our Notice and Privacy Policy if we make material or important changes to our privacy practices or Privacy Policy. When we update this Notice and Privacy Policy, we will revise the “Effective Date” date and post the new Notice and Privacy Policy. It is recommended that you review the Notice and Privacy Policy every time you visit the Services to in order to stay informed of any changes to our Notice of Privacy Practices and Privacy Policy. Upon your written request, we will provide a revised Notice to you. The revised Notice will also be included on our website. 

Effective Date. This Notice is effective as of March 17, 2020.