Onsavo
Get started

Notice of Privacy Practices

Effective Date: [EFFECTIVE DATE]

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices ("Notice") is provided to you on behalf of the participants in the Onsavo telemedicine platform's organized health care arrangement, described below. It explains how your protected health information ("PHI") may be used and disclosed, your rights with respect to that information, and how you can exercise those rights. We are required by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA") to maintain the privacy of your PHI, to give you this Notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect.

"Protected health information" (PHI) means individually identifiable health information that relates to your past, present, or future physical or mental health, the health care provided to you, or payment for that care. Through the Onsavo platform, PHI may include your health-questionnaire responses; your height, weight, and body mass index (BMI); medical history, medications, and allergies; lab and diagnostic results; consultation and prescription records; and contact and payment information that is connected to your care.

This Notice covers PHI created or received in connection with care arranged through the Onsavo platform. It works together with our Privacy Policy, which is the companion document describing how onsavo.com handles website data, cookies, device information, and personal information more generally (including information that is not PHI). Where this Notice and the Privacy Policy both touch on the same information, this Notice governs the handling of PHI under HIPAA.

Who This Notice Covers

Onsavo is a self-pay telemedicine platform operated by [ONSAVO LEGAL ENTITY]. Onsavo is not a medical practice and is not a pharmacy. Care is delivered by independent organizations that work together to evaluate your intake, prescribe when clinically appropriate, dispense medication, and perform laboratory testing.

For purposes of HIPAA, the following participants have agreed to participate in an organized health care arrangement ("OHCA") and to share PHI as needed to carry out the joint activities of that arrangement. This single, joint Notice applies to all of them with respect to care arranged through the Onsavo platform:

  • [AFFILIATED MEDICAL GROUP] and its affiliated independent, state-licensed providers (the providers). These providers review your health-questionnaire and intake information through telemedicine and, if clinically appropriate, issue prescriptions. They make all clinical decisions independently and are covered entities under HIPAA.
  • [COMPOUNDING PHARMACY] (the pharmacy). A licensed partner compounding pharmacy (503A/503B; LegitScript-certified or NABP-accredited) that prepares and dispenses any medication a provider prescribes, where it participates in the arrangement.
  • [CLIA LAB PARTNER] (the lab), as applicable. A CLIA-certified laboratory that performs at-home or in-network testing and returns results, where testing is part of your program.
  • [ONSAVO LEGAL ENTITY] (the platform). Onsavo operates the website and the technology that supports your account, intake, scheduling, messaging, billing, and customer support. With respect to PHI, Onsavo generally acts as a business associate of the providers and the pharmacy and handles PHI on their behalf under business associate agreements. Onsavo provides this joint Notice on behalf of the OHCA participants.

Because these organizations participate in an OHCA, they may share your PHI with one another as needed for the treatment, payment, and health care operations of the arrangement, as described below. Each independent provider may also maintain its own additional notice of privacy practices for the broader clinical relationship; where that occurs and a provider's separate notice differs from this Notice, the provider's notice governs that clinical treatment relationship.

Some medications offered through the platform are compounded medications. Compounded medications are not FDA-approved and have not been reviewed by the FDA for safety, effectiveness, or quality. This Notice addresses privacy only; it does not describe the medications themselves.

How We May Use and Disclose Your PHI Without Your Authorization

The following categories describe the ways the OHCA participants may use and disclose your PHI without first obtaining your written authorization. Not every use or disclosure in a category is listed, but the examples illustrate the permitted types.

Treatment

We may use and disclose your PHI to provide, coordinate, and manage your health care and related services among the participants in the arrangement.

Examples: Your intake responses, height/weight/BMI, and lab results are made available to the independent providers so they can evaluate your request and decide whether a treatment is appropriate. If a provider writes a prescription, the prescription and the information needed to fill it are shared with the pharmacy so it can prepare and ship your medication. Where testing is part of your program, the information needed to order tests and return results is exchanged with the lab. Providers, the pharmacy, and the lab may exchange information with one another to coordinate your care, refills, and monitoring.

Payment

We may use and disclose your PHI to bill and collect payment for the services you receive and to manage your self-pay subscription.

Examples: We use information about the services provided to process your payments, manage your monthly subscription billing, confirm orders, issue receipts, and handle refunds or billing disputes. Card and bank-account data are processed directly by a third-party payment processor. Because the platform is self-pay, we do not bill health insurance; if that ever changes, PHI may be used to obtain payment from a health plan and to confirm coverage or benefits.

Health Care Operations

We may use and disclose your PHI to run the platform and the arrangement efficiently and to make sure you receive quality care.

Examples: Quality assessment and improvement; reviewing the competence and qualifications of providers and pharmacies; care coordination and case management; customer support and resolving your questions and complaints; auditing, compliance, and fraud-prevention activities; licensing, accreditation, and certification activities (including reviews by certification bodies such as LegitScript); business planning, and the general administration of the platform. We limit the PHI used or disclosed for these purposes to the minimum necessary to accomplish the task.

Other Uses and Disclosures Permitted or Required by Law

We may also use or disclose your PHI without your authorization in the following circumstances, subject to the conditions and limits HIPAA and other applicable law require:

  • Business associates. We disclose PHI to vendors who perform services on our behalf — for example, platform hosting, telehealth and secure-messaging technology, data storage, communications, analytics, and customer-support tools. Each such vendor that handles PHI is bound by a business associate agreement requiring it to safeguard your PHI and to use it only to provide services to us.
  • As required by law. We disclose PHI when federal, state, or local law requires it.
  • Public health and safety. We may disclose PHI for public health activities, such as preventing or controlling disease, reporting adverse events or product problems related to medications, and reporting to authorities authorized to receive such information.
  • Health oversight activities. We may disclose PHI to health oversight agencies for audits, investigations, inspections, licensure, and similar activities authorized by law, including oversight of providers and pharmacies.
  • Abuse, neglect, or domestic violence. We may disclose PHI to appropriate authorities if we reasonably believe you may be a victim of abuse, neglect, or domestic violence, as permitted or required by law.
  • Judicial and administrative proceedings. We may disclose PHI in response to a court or administrative order, or in response to a subpoena, discovery request, or other lawful process, where the applicable HIPAA conditions are met.
  • Law enforcement. We may disclose PHI for limited law-enforcement purposes permitted by law, such as responding to a valid legal process or identifying or locating a suspect, fugitive, or missing person.
  • To avert a serious threat to health or safety. We may use or disclose PHI when necessary to prevent or lessen a serious and imminent threat to the health or safety of you or the public.
  • Coroners, medical examiners, and funeral directors. We may disclose PHI as necessary for these parties to carry out their duties.
  • Organ and tissue donation. We may disclose PHI to organizations that handle organ, eye, or tissue procurement or transplantation, as authorized by law.
  • Research. We may use or disclose PHI for research that has been approved through a process that protects your privacy, or after the information has been de-identified.
  • Workers' compensation. We may disclose PHI as authorized by and to the extent necessary to comply with workers' compensation or similar laws.
  • Specialized government functions. We may disclose PHI for certain military, national security, protective-services, and correctional-institution purposes when permitted by law.
  • Persons involved in your care. When you are present and do not object, or in an emergency consistent with your best interests, we may share information directly relevant to your care with a family member, friend, or other person you involve in your care.

Uses and Disclosures That Require Your Written Authorization

Other than the uses and disclosures described above, we will not use or disclose your PHI without your written authorization. In particular, the following require your authorization:

  • Marketing. Most uses and disclosures of PHI for marketing purposes require your authorization.
  • Sale of PHI. Any disclosure of PHI that constitutes a sale of PHI requires your authorization. We do not sell your PHI.
  • Psychotherapy notes. Most uses and disclosures of psychotherapy notes (if any are ever created) require your authorization.

If you give us an authorization, you may revoke it in writing at any time, except to the extent we have already relied on it. Revoking an authorization will stop further uses and disclosures for the purpose you authorized, but it cannot undo disclosures already made. Any other use or disclosure not described in this Notice will be made only with your written authorization.

Your Rights Regarding Your PHI

You have the following rights regarding the PHI maintained about you. To exercise any of these rights, contact us using the information in the "Complaints and Contact" section below. We may ask you to make certain requests in writing.

  • Right to access, inspect, and copy. You have the right to inspect and obtain a copy of the PHI used to make decisions about your care, including in an electronic form where we maintain it electronically. We may charge a reasonable, cost-based fee. In limited circumstances we may deny access, and where the law allows, you may request a review of that denial.
  • Right to request an amendment. If you believe PHI we maintain about you is incorrect or incomplete, you may request that we amend it. We may deny your request in certain cases, and if we do, we will explain why in writing and tell you how to respond.
  • Right to an accounting of disclosures. You have the right to request a list of certain disclosures of your PHI made in the six years before your request, excluding disclosures for treatment, payment, and health care operations and certain other disclosures permitted by law.
  • Right to request restrictions. You may request that we restrict the use or disclosure of your PHI for treatment, payment, or health care operations, or to a person involved in your care. We are not required to agree to every requested restriction, except that we must agree to your request to restrict disclosure to a health plan of PHI about a service you paid for in full out of pocket, where the disclosure is for payment or health care operations and is not otherwise required by law.
  • Right to request confidential communications. You may request that we communicate with you about your PHI by a particular means or at a particular location (for example, a specific email address or mailing address). We will accommodate reasonable requests.
  • Right to a paper copy of this Notice. You have the right to a paper copy of this Notice at any time, even if you have agreed to receive it electronically. Contact us and we will provide one promptly.
  • Right to be notified of a breach. You have the right to be notified if there is a breach of your unsecured PHI, as required by law.
  • Right to complain without retaliation. You may file a complaint, as described below, without fear of retaliation. We will not retaliate against you, and you will not lose your care or benefits, for filing a complaint.

Requests that involve clinical records held by an independent provider may be directed to that provider, who may handle them under its own additional notice of privacy practices where one applies.

Our Duties

The OHCA participants are required by law to:

  • Maintain the privacy and security of your PHI.
  • Provide you with this Notice of our legal duties and privacy practices regarding your PHI.
  • Follow the terms of the Notice that is currently in effect.
  • Notify affected individuals following a breach of unsecured PHI, as required by law.
  • Maintain reasonable administrative, physical, and technical safeguards designed to protect your PHI, and limit uses and disclosures to the minimum necessary for the intended purpose, except as otherwise permitted by HIPAA.

Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have as well as for PHI we receive in the future. When we make a material change, we will update the Effective Date and post the current Notice on onsavo.com. You may obtain a copy of the current Notice at any time by contacting us or by visiting the website.

Complaints and Contact

If you have questions about this Notice, or if you believe your privacy rights have been violated, you may file a complaint with us. You will not be retaliated against in any way for filing a complaint.

To file a complaint with us, or to exercise any of the rights described above, contact our Privacy Officer:

  • Privacy Officer: [PRIVACY OFFICER NAME/TITLE]
  • Email: [PRIVACY EMAIL]
  • Mailing address: [BUSINESS MAILING ADDRESS]

You also have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR). You may send a written complaint to the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201, call 1-877-696-6775, or file a complaint online at www.hhs.gov/ocr/privacy/hipaa/complaints/. You will not be penalized or retaliated against for filing a complaint with OCR.

Effective Date and Related Documents

This Notice of Privacy Practices is effective as of [EFFECTIVE DATE].

For information about how onsavo.com handles website data, cookies, device information, and personal information that is not PHI, please see our companion Privacy Policy.

This is a template for [ONSAVO LEGAL ENTITY]; have qualified counsel review before publishing.