Notice of Privacy Practices

1. Who We Are

HeroHouse Pediatrics LLC is a pediatric telehealth practice operating as an Indiana limited liability company. This Notice describes the privacy practices of HeroHouse Pediatrics LLC and its health care professionals and other employees and volunteers (collectively, “HeroHouse”) with respect to protected health information we create, receive, maintain, or transmit in connection with our services.

While HeroHouse is not a “covered entity” to which the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) specifically applies, HeroHouse voluntarily strives to comply with HIPAA standards in order to protect the confidentiality of patient information to the highest degree. HeroHouse is also subject to Indiana laws governing the confidentiality of health records under Ind. Code 16-39.

Our Privacy Officer is Jesse Jones, MSN, APRN, CPNP-PC, who can be reached at info@herohousepediatrics.com or by mail at HeroHouse Pediatrics, PO Box 155, Plainfield, IN 46168.

2. What Is Protected Health Information (PHI)?

Protected Health Information, or PHI, is any information we hold about your child that could identify them and relates to their health, healthcare, or payment for healthcare. This includes:

• Names, dates of birth, addresses, and contact information
• Medical history, diagnoses, symptoms, and treatment information
• Prescription and medication information
• Lab orders and test results
• Visit notes, messages, and communications related to care
• Images and photographs submitted as part of a visit
• Payment and billing records

We are required by law to protect the privacy of your child’s PHI, to provide you with this Notice, and to follow the terms described here.

3. How We Use and Disclose Your Child’s PHI

We use and share your child’s health information in the following ways. Some uses and disclosures require your permission; others do not.

Uses and disclosures that do not require your authorization

Treatment. We use PHI to evaluate, diagnose, and treat your child. This includes reviewing history and symptoms during visits, prescribing medications, ordering labs, and coordinating with other providers involved in your child’s care — such as their primary care provider (PCP). If we refer your child to a specialist or send a visit summary to their PCP, that sharing is part of treatment and does not require separate authorization.

Payment. We use PHI to process payments for services rendered. Because HeroHouse Pediatrics is a cash-pay practice and does not bill insurance, payment-related disclosures are limited. We use your contact and billing information to process subscription and visit fees.

Healthcare operations. We use PHI to run the practice. This includes quality review, chart audits conducted by our collaborating physician, staff training, and compliance activities. Our collaborating physician accesses de-identified or minimally necessary PHI for the sole purpose of quality and safety review under our collaborative practice agreement.

Other permitted uses and disclosures without authorization

In certain situations, we are permitted or required by law to use or share PHI without your authorization. These situations include:

• As required by law. We may use or disclose PHI to the extent necessary to comply with requirements under applicable law.
• For public health activities. We may use or disclose PHI for public health activities to: a public health authority authorized to receive information for purposes of preventing or controlling disease, injury, disability, vital events, and similar public health purposes; a public health authority or other appropriate government authority authorized to receive reports of child abuse or neglect; FDA-regulated entities for the purpose of tracking the safety, quality, and effectiveness of FDA-regulated products; a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition, if authorized to notify such person under applicable law; or a school required by law to obtain proof of immunization (we will obtain your prior agreement to the disclosure).
• For disclosures about victims of abuse, neglect, or domestic violence. We may disclose PHI about a victim of abuse, neglect, or domestic violence if authorized or required by law.
• For health oversight. We may use or disclose PHI for oversight activities authorized by law, such as audits, investigations, inspections, licensure actions, or other activities necessary for appropriate oversight of the healthcare system, eligibility for government benefit programs, entities subject to regulations or civil rights laws for which health information is necessary for determining compliance.
• For judicial or administrative proceedings. We may disclose PHI in the course of judicial or administrative proceedings in response to a court order or an order from an administrative tribunal, or in response to a subpoena, discovery request, or other lawful process that is not accompanied by a subpoena, if we obtain satisfactory assurances that the party seeking the information has made reasonable efforts to notify you or to obtain a qualified protective order.
• For law enforcement purposes. We may disclose PHI for law enforcement purposes as permitted by law, including to report certain types of wounds and injuries we are legally required to report, to comply with court orders or subpoenas, to help identify or locate a fugitive or missing person (limited to identifying information), in response to requests regarding crime victims, or to report a crime in an emergency.
• For coroners, medical examiners, or funeral directors in certain situations involving a deceased person.
• For organ, eye, or tissue donation purposes.
• For research, subject to additional requirements and conditions related to safety and oversight.
• To avert a serious threat to health or safety. We may use or disclose PHI if we believe it is necessary to prevent or lessen a serious and imminent threat to health or safety.
• For specialized government functions related to the military and veterans, national security, correctional institutions, and other authorized government activities.

We will only use or disclose the minimum amount of PHI necessary to accomplish the purpose of the use or disclosure.

Uses and disclosures that require your written authorization

The following uses and disclosures require your signed authorization before we can proceed:

• Most uses and disclosures of PHI not described in this Notice
• Sharing PHI with your child’s school, daycare, or activity programs (unless required by law)
• Sharing PHI for marketing purposes
• Sale of PHI
• Use or disclosure of psychotherapy notes (if applicable)

You may revoke a written authorization at any time by contacting us in writing at info@herohousepediatrics.com, except to the extent we have already acted on it.

4. How We Protect Your Child’s Health Information

We take the protection of your child’s health information seriously. We have implemented the following safeguards:

Administrative safeguards

• Privacy and security policies and procedures are in place and reviewed regularly
• Access to PHI is limited to those who need it to provide or support care
• Chart audits are conducted by our collaborating physician using restricted-access, tracked file sharing
• Staff are trained on HIPAA requirements

Technical safeguards

• Telehealth visits are conducted using HIPAA-compliant video technology
• All external email communications containing PHI are transmitted using encrypted email
• Phone and messaging services used for patient communication are HIPAA-compliant
• Electronic health records are maintained on a HIPAA-compliant EHR platform with access controls and audit logging
• Files and documents containing PHI are stored on HIPAA-compliant cloud platforms with access restrictions

Physical safeguards

• All devices used to access PHI are password-protected and encrypted
• PHI is not printed or stored in physical form except where clinically necessary

No system is completely immune to risk. If we discover a breach of your child’s unsecured PHI, we will notify you as required by the HIPAA Breach Notification Rule and/or state law, as applicable. There is also potential for PHI we disclose pursuant to this Notice to be redisclosed by the recipient and no longer protected.

5. Your Rights Regarding Your Child’s Health Information

As the parent or legal guardian of a minor patient, you have the following rights regarding your child’s PHI. To exercise any of these rights, contact us at info@herohousepediatrics.com.

Right to access and receive a copy of records

You have the right to inspect and receive a copy of your child’s health records, including visit notes, lab results, and treatment summaries. We will respond to your request within 30 days. We may charge a reasonable cost-based fee for copies. We will provide records in the format you request if it is readily producible; otherwise, we will provide them in a readable electronic or paper format.

Right to request corrections (amendment)

If you believe your child’s health record contains information that is incorrect or incomplete, you may request a correction. We will respond within 60 days. We may deny the request if we determine the record is accurate, complete, and was created by HeroHouse Pediatrics. If we deny the request, we will explain why in writing and give you the opportunity to submit a statement of disagreement.

Right to request restrictions

You may request that we restrict how we use or share your child’s PHI for treatment, payment, or operations. We are not required to agree to most restrictions, but we will consider all requests. If we agree, we will honor the restriction except in an emergency. We are required to agree if you ask us to restrict disclosure to a health plan for a service you paid for entirely out of pocket — which applies to all services at HeroHouse, since we are a cash-pay practice.

Right to request confidential communications

You may request that we communicate with you about your child’s care in a particular way or at a particular location. For example, you may ask that we contact you only by email. We will accommodate reasonable requests.

Right to an accounting of disclosures

You have the right to request a list of certain disclosures we have made of your child’s PHI. This right applies to disclosures made for purposes other than treatment, payment, and operations, and to disclosures we are required by law to report. The accounting covers the six years prior to the request. We will respond within 60 days.

Right to receive a paper copy of this Notice

You have the right to receive a paper copy of this Notice at any time, even if you previously agreed to receive it electronically. To request a paper copy, contact us at info@herohousepediatrics.com.

Right to be notified of a breach

You have the right to receive notification if there is a breach of your child’s unsecured PHI. We will notify you without unreasonable delay and within 60 days of discovering the breach, unless we determine notification is not required under applicable law.

Right to file a complaint

If you believe your child’s privacy rights have been violated, you have the right to file a complaint with HeroHouse Pediatrics or with the U.S. Department of Health and Human Services Office for Civil Rights. To file a complaint with us, contact: info@herohousepediatrics.com. To file a complaint with HHS: www.hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.

6. Our Legal Duties

HeroHouse Pediatrics is required by law to:

• Maintain the privacy and security of your child’s PHI
• Provide you with this Notice of our privacy practices
• Follow the terms of the Notice currently in effect
• Notify you if we discover a breach of your child’s unsecured PHI

In the event that we receive substance use disorder treatment records from a program subject to 42 CFR Part 2, we will not use or disclose information from those records for civil, criminal, administrative, or legislative proceedings against the individual unless we obtain consent or receive a court order issued under 42 CFR Part 2 that is accompanied by a subpoena.

We reserve the right to change the terms of this Notice at any time. Changes will apply to PHI we already hold as well as PHI we receive in the future. If we make a material change, we will post the updated Notice on our website and notify enrolled families by email. The new Notice will be effective on the date specified in the updated version.

7. Minors and Parental Access

HeroHouse Pediatrics provides care exclusively to patients under 18 years of age. As the parent or legal guardian, you generally have the right to access your child’s health information.

In limited circumstances, Indiana law may grant a minor the right to consent to certain types of care independently and restrict parental access to those records. If such a situation arises, we will handle it in accordance with applicable state law and will inform you of any limitations on your access.

In cases of foster care or non-parent caregivers, we may require documentation of legal authority to consent to care and to access records before releasing PHI. If we receive a request to limit a parent’s access to their child’s PHI, we will require documentation of a legal restriction to support the limitation. If you have questions about access rights in your specific situation, please contact us at info@herohousepediatrics.com.

8. Contact Us

For questions about this Notice, to exercise your rights, or to file a privacy complaint, please contact us at info@herohousepediatrics.com.