HIPAA Privacy Statement
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
Effective and last updated: August 19, 2026
Our Commitment & Scope
Optimal Health Primary Care, LLC (“we,” “us,” or “our”) is a covered entity under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the HITECH Act and their implementing regulations. We are required by law to maintain the privacy and security of your protected health information (“PHI”), to provide you with this notice of our legal duties and privacy practices with respect to PHI, to notify you following a breach of unsecured PHI, and to follow the terms of the notice currently in effect. This notice applies to all PHI created or received by our providers, staff, and workforce members in connection with telehealth care delivered in Nevada, Utah, Iowa, New Mexico, Vermont, New York, Florida, and Washington.
This HIPAA notice is separate from, and in addition to, our website and SMS Privacy Policy, which governs non-health website, marketing, and text-messaging data.
What Is Protected Health Information?
PHI is individually identifiable health information we create or receive that relates to your past, present, or future physical or mental health, the health care provided to you, or payment for that care. It includes information such as your name, date of birth, contact details, insurance and payment data, symptoms, diagnoses, medications, allergies, lab results, provider notes, telehealth visit records, and signed consent forms.
How We May Use and Disclose Your PHI Without Authorization
Treatment. We use and disclose PHI to provide, coordinate, and manage your care — for example, sharing your history with a consulting specialist, sending prescriptions to your pharmacy, or ordering labs and imaging.
Payment. We use and disclose PHI to bill and collect payment for services — for example, verifying coverage, processing your card payment, or documenting the medical necessity of a visit.
Health Care Operations. We use and disclose PHI for quality assessment, provider credentialing and review, training, compliance auditing, care coordination, business planning, and administrative functions.
Appointment and Care Communications. We may contact you by phone, email, or text (where you have provided the applicable contact information and, for text, opted in) with appointment confirmations, reminders, scheduling updates, consent-form links, and treatment alternatives or health-related benefits and services.
Business Associates. We may disclose PHI to vendors who perform services for us — such as telehealth platform, hosting, e-prescribing, billing, scheduling, and communications providers. Each is bound by a written business associate agreement requiring them to safeguard PHI.
Individuals Involved in Your Care. With your agreement or when you do not object, we may share PHI relevant to a family member, caregiver, or other person involved in your care or payment for your care.
Uses and Disclosures Required or Permitted by Law
- When required by federal, state, or local law, including state telehealth requirements.
- Public health activities, such as disease reporting, vital statistics, and FDA-regulated product safety.
- Reporting suspected abuse, neglect, or domestic violence as required or permitted by law.
- Health oversight activities, including audits, licensure actions, and investigations.
- Judicial and administrative proceedings in response to a valid court order, subpoena, or lawful process.
- Law enforcement purposes as permitted by HIPAA.
- Coroners, medical examiners, funeral directors, and organ or tissue donation organizations.
- Research approved by an institutional review board or privacy board, or using de-identified data.
- To avert a serious and imminent threat to the health or safety of you or others.
- Specialized government functions, including military, national security, and protective services.
- Workers’ compensation programs, to the extent authorized by law.
Uses That Always Require Your Written Authorization
- Most uses and disclosures of psychotherapy notes.
- Uses and disclosures of PHI for marketing purposes.
- Any sale of PHI.
- Most other uses and disclosures not described in this notice.
You may revoke an authorization at any time by writing to our Privacy Officer. Revocation does not apply to actions we already took in reliance on the authorization.
We never sell PHI, and we never share mobile phone numbers or SMS opt-in consent data with third parties or affiliates for marketing purposes.
Your Rights Regarding Your PHI
- Access and copies. Inspect and obtain a copy of your designated record set, including an electronic copy, generally within 30 days of a written request. A reasonable, cost-based fee may apply.
- Amendment. Request correction of PHI you believe is inaccurate or incomplete. We may deny the request and will explain why in writing.
- Accounting of disclosures. Receive a list of certain disclosures made in the six years before your request.
- Restrictions. Request limits on how we use or disclose PHI. We are not required to agree, except that we must honor a request to withhold information from a health plan when you pay in full out of pocket for a service.
- Confidential communications. Ask us to contact you at an alternative address or by an alternative method.
- Breach notification. Be notified if there is a breach of your unsecured PHI.
- Paper copy. Obtain a paper copy of this notice at any time, even if you received it electronically.
- Designate a representative. Direct a copy of your records to a person or entity you name in a signed, written request.
Telehealth Safeguards
We use administrative, physical, and technical safeguards designed to protect PHI, including encrypted transmission and storage, role-based access controls and unique user credentials, audit logging, workforce privacy and security training, minimum-necessary access policies, secure telehealth video sessions, and business associate agreements with vendors that handle PHI. No method of electronic transmission or storage is completely secure; we continually review and update our safeguards.
Standard email and text messages are not fully secure channels. If you choose to communicate with us by email or SMS, you accept that risk; we limit those messages to scheduling and administrative details and avoid including clinical information whenever possible.
Minimum Necessary & Record Retention
Except for treatment purposes, disclosures required by law, and disclosures made under your authorization, we limit PHI use and disclosure to the minimum necessary to accomplish the intended purpose. We retain medical records for the period required by the laws of the state in which care was delivered, and we dispose of PHI using secure destruction methods.
How to File a Complaint
If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer using the contact information below, or with the U.S. Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue SW, Washington, D.C. 20201, by calling 1-877-696-6775, or at hhs.gov HIPAA complaint portal. We will not retaliate against you for filing a complaint.
Changes to This Notice
We reserve the right to change this notice and to make the revised notice effective for PHI we already have as well as information we receive in the future. The current notice is always posted on this page with its effective date, and a paper copy is available on request.
Contact Our Privacy Officer
To exercise a right, request a paper copy of this notice, or file a privacy complaint, contact Optimal Health Primary Care, LLC — Privacy Officer, Las Vegas, Nevada: