HIPAA / Notice of Privacy Practices

Zira Medical LLC is a management services organization (MSO). Clinical services are provided by affiliated professional corporations, currently ZMD of CA, P.C., and their licensed providers. Those providers work inside the client’s existing platform or EHR and exercise independent clinical judgment.

This draft is intended for the affiliated clinical practices that provide care, currently ZMD of CA, P.C. Zira Medical LLC may support those practices as an authorized management services organization or business associate. Zira Medical LLC is not identified here as the treating provider.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO IT. PLEASE REVIEW IT CAREFULLY. This draft must be finalized and adopted by the responsible clinical practice before use as its operative notice.

The clinical practice is responsible for protecting health information, providing its applicable notice, following that notice and notifying affected individuals of reportable breaches as required by law. Providers document care within the client’s existing platform or EHR; the location of a record does not eliminate your privacy rights.

Management services and other authorized vendors may handle information on behalf of the practice under applicable agreements and privacy requirements. The client platform and pharmacy may have separate responsibilities and notices.

Subject to applicable law, a practice may use or disclose protected health information for treatment, payment and healthcare operations. Examples include coordinating care, arranging prescriptions, administering payment and reviewing care quality.

Other uses or disclosures may be permitted or required for public health, safety, oversight, legal proceedings, law enforcement, workers’ compensation and other purposes defined by law. Disclosure to family or others involved in care is subject to the applicable permission and professional-judgment rules. More protective state laws must also be followed.

Uses not permitted by law or the final notice generally require your written authorization, including certain marketing, sales of health information and psychotherapy-note disclosures. You may revoke an authorization in writing, except to the extent action has already been taken in reliance on it.

Subject to applicable requirements and exceptions, you may request access to or a copy of your records, amendments, confidential communications, restrictions on certain disclosures, an accounting of certain disclosures and a paper copy of the notice. You may also have rights to breach notification and to designate a personal representative.

Requests are handled by the responsible practice under legally required timelines. Certain restrictions must be honored, including qualifying requests not to disclose fully self-paid care to a health plan. Other requests may be subject to limitations, verification or permitted fees.

Contact the responsible clinical practice through your care platform. You may also contact Zira Medical LLC at the details below to request routing to that practice’s privacy contact. Do not email sensitive medical information to the general business address.

You may file a privacy complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/privacy/hipaa/complaints/ or 1-877-696-6775. You will not be retaliated against for exercising privacy rights or filing a complaint.

Before adoption, legal counsel and the responsible practice must confirm the covered entities, privacy contact, operational details, state-specific requirements and effective date. The practice must make its final notice available through the platform where care is delivered and provide updates as required.