Notice of Privacy Practices

1. Our pledge regarding your health information

BloomHart Health PLLC (“BloomHart,” “we,” “us,” or “our”) understands that health information about you and your care is personal. We are committed to protecting your protected health information (“PHI”). We create and maintain records of the care and services you receive from us so that we can provide quality care and comply with legal requirements.

This Notice applies to records of your care created or maintained by BloomHart, including records created through telehealth visits. It explains how we may use and disclose your PHI, your rights, and our legal duties.

We are required by law to:

• Maintain the privacy and security of your PHI.
• Give you this Notice of our legal duties and privacy practices.
• Follow the terms of the Notice currently in effect.
• Notify you if a breach occurs that compromises the privacy or security of your unsecured PHI, as required by law.
• Obtain your written authorization before using or disclosing your PHI in ways not described in this Notice, unless otherwise permitted or required by law.
• Change this Notice when permitted or required by law. Revised notices will apply to information we already maintain and to information we receive in the future. The current Notice will be available on our website, through our secure patient portal, and upon request.

2. How we may use and disclose your PHI

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your care. For example, we may consult with other health care providers involved in your care, communicate with your primary care clinician, send a referral and relevant clinical information to another provider, or send prescriptions to your pharmacy.

Payment

We may use and disclose your PHI to bill for and collect payment for our services. For example, we may provide information to an insurance plan, verify eligibility or benefits, submit claims, or respond to questions about a claim.

Health care operations

We may use and disclose your PHI to operate and improve our practice. Examples include quality assessment and improvement, compliance activities, auditing, staff training, licensing, credentialing, and business planning.

Business associates

We use outside companies that perform services for us, such as electronic health record, telehealth video, secure patient portal, scheduling, billing, e-prescribing, payment-processing, and information-technology vendors. These business associates may receive PHI only as needed to perform their work and are required by contract and law to protect it.

Appointment reminders and health-related services

We may use or disclose PHI to contact you about appointments, treatment alternatives, or health-related services offered by BloomHart. We use the communication preferences you provide.

People involved in your care or payment

We may share relevant PHI with a family member, friend, caregiver, or other person you identify as involved in your care or payment for care, unless you object or applicable law requires your written authorization.

3. Psychotherapy notes and referrals

BloomHart does not create or maintain psychotherapy notes as HIPAA defines that term. Psychotherapy notes are separate notes kept apart from the medical record that document or analyze the contents of counseling sessions.

When we recommend therapy or refer you to a therapist, we may create a referral or clinical note for that provider. These notes are part of your BloomHart medical record, are not psychotherapy notes, and may be shared for treatment purposes as permitted by law.

Therapists outside BloomHart are separate providers. They maintain their own records under their own notices of privacy practices.

If BloomHart later begins maintaining psychotherapy notes, we will update this Notice. Most uses or disclosures of psychotherapy notes require written authorization, subject to limited legal exceptions.

4. Uses and disclosures that require your written authorization

We will obtain your written authorization before:

• Using or disclosing your PHI for marketing purposes, except where limited exceptions are permitted by law.
• Selling your PHI.
• Using or disclosing psychotherapy notes, if we ever maintain them, except where permitted or required by law.
• Making other uses or disclosures not described in this Notice.

You may revoke an authorization at any time by giving us written notice. Revocation does not affect actions already taken based on the authorization before it was revoked.

5. Other uses and disclosures that do not require your authorization

Subject to applicable legal limits, we may use or disclose PHI without your authorization in the following situations:

• Required by Law: When federal, state, or local law requires it.
• Public Health: To prevent or control disease, injury, or disability; report adverse events involving medications or devices; or notify people who may have been exposed to a communicable disease.
• Abuse, Neglect, or Domestic Violence: To report suspected child abuse or neglect and, when required by law, abuse, neglect, or exploitation of an adult.
• Serious Threat to Health or Safety: When we believe in good faith that disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety or that of another person.
• Health Oversight: To government agencies and licensing boards for audits, investigations, inspections, and licensing.
• Judicial and Administrative Proceedings: In response to a court order, administrative order, subpoena, discovery request, or other lawful process, as permitted or required by law.
• Law Enforcement: For law-enforcement purposes as permitted or required by law.
• Coroners, Medical Examiners, and Funeral Directors: To identify a deceased person, determine cause of death, or allow funeral directors to perform their duties.
• Organ and Tissue Donation: To organizations that facilitate organ, eye, or tissue donation and transplantation.
• Research: For research as permitted by law and subject to required safeguards.
• Specialized Government Functions: For military, national-security, protective-service, and correctional-institution functions as permitted by law.
• Workers’ Compensation: As permitted by workers’ compensation or similar programs.
• Disaster Relief: To public or private disaster-relief organizations so they can notify family members about your location, condition, or death.
• De-identified Information and Limited Data Sets: We may use or disclose information that has been de-identified, or a limited data set, as permitted by law and subject to required protections.
• Compliance Reviews: To the U.S. Department of Health and Human Services when it investigates our compliance with privacy laws.

6. Your rights regarding your PHI

You have the following rights. To exercise any of them, submit a written request to the Privacy Officer using the contact information above.

Right to request restrictions

You may ask us to limit how we use or disclose your PHI for treatment, payment, or health care operations, or to limit disclosures to people involved in your care. We are not required to agree to every request. However, if you pay for a service in full out of pocket and ask us not to disclose information about that service to your health plan for payment or health care operations, we must honor that request unless disclosure is otherwise required by law.

Right to request confidential communications

You may ask us to contact you in a specific way or at a specific location, such as through the secure portal, at a certain phone number, or by mail at a different address. We will accommodate reasonable requests.

Right to inspect and receive copies

You may inspect and receive a paper or electronic copy of your medical and billing records and may ask us to send a copy directly to another person or provider you designate in writing. We will respond within the time required by law and may charge a reasonable, cost-based fee where allowed by law.

Right to request an amendment

If you believe information in your record is incorrect or incomplete, you may ask us to amend it. We may deny a request in certain circumstances. If we do, we will provide a written explanation as required by law.

Right to receive an accounting of disclosures

You may ask for a list of certain disclosures of your PHI made by BloomHart in the six years before your request. This list generally does not include disclosures for treatment, payment, health care operations, disclosures you authorized, or other disclosures excluded by law.

Right to receive a copy of this Notice

You may receive a paper or electronic copy of this Notice at any time, even if you agreed to receive it electronically.

Right to choose a personal representative

If someone has legal authority to act for you, such as a health care agent, guardian, or personal representative, that person may exercise your rights and make choices about your PHI. We will verify that person’s authority before acting on a request.

Right to be notified of a breach

We will notify you if there is a breach of unsecured PHI, as required by law.

7. Minors and personal representatives

For patients under 18, a parent or legal guardian is generally the personal representative and may exercise privacy rights on the minor’s behalf. In some circumstances, applicable law may allow a minor to consent to specific services or may limit parental access to related information. BloomHart will follow applicable law when determining access to a minor patient’s information.

8. Additional protections under applicable law

Federal and state law may provide protections for certain health information that are more restrictive than HIPAA. When applicable law provides greater privacy protection or greater patient rights, BloomHart will follow the more protective requirement.

9. Substance use disorder records

BloomHart does not currently maintain SUD counseling notes. If BloomHart creates or maintains records subject to 42 C.F.R. Part 2, those records will be used and disclosed only as permitted by applicable federal law. BloomHart will revise this Notice if its practices change in a way that requires additional notice.

10. Telehealth privacy practices

Secure platform

We provide telehealth visits through a secure, HIPAA-compliant platform operated by a business associate.

No recording without consent

We do not audio-record or video-record telehealth sessions unless you provide written consent.

Location and privacy

Please attend telehealth visits from a private location where you cannot be overheard. We may ask you to confirm your physical location at the beginning of each visit so that we can follow applicable laws and arrange emergency assistance if needed.

Emergency contact

We may ask for an emergency contact and may use that information if we believe you are at serious risk of harm.

Email and text

Regular email, voicemail, and text messages are not appropriate for detailed health information. Please use our secure patient portal for messages containing health information. Do not send symptoms, diagnoses, medication questions, insurance details, records, or urgent concerns to our general email address. We may use phone, email, or text for limited administrative communications, such as scheduling, only as permitted by law and your communication preferences.

11. Questions and complaints

If you have questions about this Notice, want to exercise a privacy right, or believe your privacy rights have been violated, contact:

Privacy Officer
BloomHart Health PLLC
4920 Niagara Rd #122
College Park, MD 20740
Phone: (301) 500-0568
Email: info@bloomharthealth.com

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:

U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue S.W.
Washington, D.C. 20201
Phone: 1-877-696-6775
Website: www.hhs.gov/hipaa/filing-a-complaint

We will not retaliate against you in any way for filing a complaint.

12. Changes to this Notice

We may change this Notice. Any revised Notice will apply to PHI we already maintain and PHI we receive in the future. The current Notice will be posted on our website, available through our secure patient portal, and provided upon request. The effective date appears at the top of this Notice.