KOOLMD HIPAA & HITECH ACT PRIVACY, SECURITY & LEGAL NOTICE

KOOLMD recognizes that health information is highly sensitive and should be handled responsibly.

To the extent KOOLMD is acting as a HIPAA covered entity or business associate, KOOLMD maintains policies, procedures, safeguards, and contractual arrangements designed to comply with applicable requirements of:

Depending upon the services used, KOOLMD may collect, create, receive, maintain, or transmit information including:

When information constitutes PHI under HIPAA, KOOLMD will handle that information in accordance with applicable HIPAA requirements.

PHI may be used or disclosed for purposes permitted or required by law, including, where applicable:

Where the HIPAA Privacy Rule's minimum-necessary standard applies, KOOLMD will use reasonable policies and procedures designed to limit uses, disclosures, and requests for PHI to the minimum necessary to accomplish the intended purpose, subject to applicable legal exceptions.

Access to information may be restricted according to:

KOOLMD may employ role-based access controls designed to limit access to information according to an individual's authorized responsibilities.

Examples may include:

KOOLMD may use security controls such as:

KOOLMD maintains technical and organizational safeguards designed to protect ePHI against unauthorized access, use, alteration, disclosure, loss, or destruction.

Security measures may include, as appropriate:

KOOLMD may provide healthcare through secure video, audio, messaging, electronic records, and other communications technologies.

Telemedicine may involve the transmission of sensitive health information over electronic networks.

KOOLMD uses reasonable safeguards designed to protect telemedicine communications; however, no internet-based communication system can guarantee absolute security.

Patients should participate in telemedicine appointments from a private location whenever possible and should protect their devices, passwords, authentication credentials, and other account information.

KOOLMD may transmit prescription-related information to pharmacies, pharmacy networks, electronic prescribing vendors, or other authorized parties when permitted by law and necessary to provide requested healthcare services.

Prescription information may include:

KOOLMD may coordinate laboratory testing, diagnostic services, imaging, referrals, and other healthcare services.

Information may be exchanged with authorized:

KOOLMD may use vendors, contractors, technology providers, cloud providers, laboratories, pharmacies, payment processors, communications providers, analytics providers, electronic prescribing providers, telemedicine technology providers, and other third parties to support KOOLMD's operations.

Where HIPAA requires a Business Associate Agreement (“BAA”), KOOLMD will enter into an appropriate BAA or otherwise maintain the contractual arrangements required by applicable law.

Business associates may be required to implement appropriate safeguards and comply with applicable HIPAA obligations.

The HITECH Act strengthened federal protections concerning electronic health information and expanded certain HIPAA privacy and security requirements and enforcement mechanisms.

KOOLMD recognizes the importance of the HITECH Act and applicable implementing regulations in protecting electronic health information.

The HITECH Act also established federal breach-notification requirements and expanded enforcement mechanisms concerning HIPAA compliance. HHS explains that HIPAA's Breach Notification Rule requires covered entities and business associates to provide applicable notifications following breaches of unsecured PHI.

KOOLMD maintains procedures designed to identify, investigate, contain, mitigate, document, and respond to suspected security incidents and breaches.

When legally required, KOOLMD will provide breach notifications in accordance with applicable federal and state law.

Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals following a breach of unsecured PHI unless an applicable exception applies. Certain breaches must also be reported to HHS and, in specified circumstances, prominent media outlets.

For breaches affecting fewer than 500 individuals, federal reporting to HHS generally follows the applicable annual reporting process; breaches affecting 500 or more individuals generally require reporting to HHS without unreasonable delay and no later than 60 calendar days after discovery.

KOOLMD will not intentionally delay a notification that is legally required.

Certain substance-use-disorder (“SUD”) records may receive additional federal protections under 42 CFR Part 2.

HHS's revised February 2026 model HIPAA Notices of Privacy Practices incorporate changes resulting from the 2024 Part 2 Final Rule. Applicable entities were required to comply with the relevant changes by February 16, 2026.

Where Part 2 applies, KOOLMD will handle applicable records in accordance with the requirements of Part 2 and other applicable law.

KOOLMD may provide behavioral-health and mental-health services.

Mental-health information may constitute PHI and may be subject to additional federal or state protections depending upon the nature of the information and applicable law.

Certain psychotherapy notes receive special protection under HIPAA.

Additional state laws may provide enhanced protections for mental-health information.

Subject to applicable law, patients may have rights concerning their PHI, including rights to:

Patients may submit privacy or security concerns to KOOLMD using the contact information below.

Patients may also have the right to submit a complaint to the U.S. Department of Health and Human Services, Office for Civil Rights (“OCR”).

KOOLMD will not retaliate against an individual for submitting a privacy complaint in good faith.

Protecting health information requires cooperation between KOOLMD, healthcare professionals, vendors, and patients.

Patients should:

KOOLMD may provide links, integrations, or connections to third-party services.

Third-party websites and services may maintain their own privacy policies, security practices, terms, and legal obligations.

KOOLMD does not control every third-party system and cannot guarantee the privacy or security practices of independent third parties.

Patients should review applicable third-party privacy notices before providing information directly to those parties.

KOOLMD may use cookies, pixels, analytics technologies, security technologies, and similar tools for purposes including:

KOOLMD may use artificial intelligence and machine-learning technologies to support certain administrative, educational, documentation, scheduling, communication, or healthcare-related functions.

AI technologies may process information only as permitted under applicable law and applicable contractual and security requirements.

AI-generated information may contain errors or omissions and is not independently guaranteed to be accurate.

AI tools do not replace qualified healthcare professionals or emergency medical services.

Clinical decisions remain subject to appropriate professional judgment.

KOOLMD may retain information for periods reasonably necessary to:

Patients may request deletion of certain information where applicable law provides such a right.

However, healthcare providers and covered entities may be legally required to retain certain medical records and other information.

Accordingly, a request for deletion does not necessarily mean that all information can immediately or permanently be deleted.

KOOLMD will evaluate deletion requests according to applicable law.

KOOLMD uses safeguards designed to protect information.

However, no electronic information system, internet connection, cloud service, telecommunications network, database, or security technology can guarantee absolute security.

Cybersecurity threats may include:

Federal HIPAA requirements represent a baseline of federal privacy protections, but state laws may provide additional or greater protections.

KOOLMD may therefore provide additional disclosures, rights, consents, restrictions, or privacy protections depending upon:

KOOLMD may modify this Notice periodically to reflect:

Questions regarding KOOLMD's privacy or security practices may be directed to our Privacy Officer using the contact information below:

By using KOOLMD's website, patient portal, telemedicine services, healthcare applications, or other applicable services, you acknowledge that you have had an opportunity to review this Notice.

Where a separate acknowledgment or consent is required by law, KOOLMD will obtain that acknowledgment or consent through the applicable process.