HIPAA Notice of Privacy Practices

Our Commitment

Level Health is committed to protecting the privacy of your Protected Health Information (“PHI”) as required by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, “HIPAA”). This Notice describes our legal duties and privacy practices and your rights regarding your PHI. We are required by law to maintain the privacy of your PHI, provide you with this Notice, and abide by the terms of the version of this Notice currently in effect.

1. Treatment, Payment, and Healthcare Operations

We may use and disclose your PHI without your written authorization for the following purposes:

Treatment

We may use and disclose your PHI to provide, coordinate, and manage your healthcare. For example, your physician may share your PHI with diagnostic laboratories that perform your bloodwork, with fulfillment partners that ship your recommended therapeutics, or with other providers involved in your care.

Payment

We may use and disclose your PHI to bill you for our services and to obtain payment. For example, we may share limited information with our invoicing provider (QuickBooks) to process payment for your care.

Healthcare Operations

We may use and disclose your PHI for our internal operations — including quality improvement, clinical training, care coordination, and administration of our practice.

2. Other Uses and Disclosures Permitted Without Your Authorization

HIPAA permits us to use or disclose your PHI without your authorization in the following limited circumstances:

• As required by law — including reporting required by state or federal authorities;
• Public health activities — to prevent or control disease, report adverse events, or comply with FDA-related reporting;
• Health oversight — to support audits, investigations, and inspections by regulatory agencies;
• Judicial and administrative proceedings — in response to a court order, subpoena, or similar legal process;
• Law enforcement — for limited purposes permitted by law;
• To avert a serious threat to health or safety;
• Workers' compensation — when required by applicable law;
• Business Associates — we may disclose PHI to vendors who perform services on our behalf (e.g., our telemedicine platform Spruce), subject to a Business Associate Agreement that requires them to protect your PHI in the same manner we do.

3. Uses and Disclosures Requiring Your Authorization

Other uses and disclosures of your PHI not described above will be made only with your written authorization. You may revoke that authorization at any time, in writing, except to the extent we have already acted in reliance on it. In particular, your written authorization is required for:

• Most uses and disclosures of psychotherapy notes (if applicable);
• Uses and disclosures for marketing purposes; and
• Any sale of PHI.

4. Your Rights Regarding Your PHI

You have the following rights with respect to your PHI:

• Right to Access. You may inspect and obtain a copy of your PHI that we maintain in a designated record set, subject to certain limited exceptions. We may charge a reasonable, cost-based fee for copies.
• Right to Amend. You may request that we amend PHI you believe is incorrect or incomplete. We may deny your request in certain circumstances, but you may submit a written statement of disagreement.
• Right to an Accounting of Disclosures. You may request a list of certain disclosures of your PHI we have made, generally limited to the six years preceding the request.
• Right to Request Restrictions. You may request that we restrict certain uses or disclosures of your PHI. We are not required to agree, except that we will accommodate requests to restrict disclosures to a health plan when you have paid for the service in full out of pocket.
• Right to Confidential Communications. You may request that we communicate with you about your PHI in a particular way or at a particular location (e.g., a specific phone number or email).
• Right to a Paper Copy of This Notice. You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.
• Right to Notification of a Breach. We will notify you in writing if there is a breach of your unsecured PHI as required by HIPAA.

5. How to Exercise Your Rights

To exercise any of the rights above, please submit your request in writing to our Privacy Officer at support@levelhealth.io. We may require you to complete a form and verify your identity. We will respond within the timeframes required by HIPAA.

6. Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for all PHI we maintain. When we make a material change, we will post the revised Notice on our website and update the “Effective” date above. Paper copies are available upon request.

7. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us by contacting our Privacy Officer at support@levelhealth.io. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights:

U.S. Department of Health & Human Services
200 Independence Avenue, S.W.
Washington, D.C. 20201
Toll-Free: 1-877-696-6775
www.hhs.gov/ocr/privacy/hipaa/complaints

You will not be retaliated against for filing a complaint.

8. Contact Our Privacy Officer

For questions about this Notice or about your PHI, please contact:

Privacy Officer, Level Health
Email: support@levelhealth.io
Website: levelhealth.io