Privacy & HIPAA Statement for In‑Person and Virtual Medical Consultations

 

Effective: 07/01/2026

 

This practice is committed to protecting the privacy and security of your Protected Health Information (PHI). The following summarizes our privacy and HIPAA-related practices for both in‑person and virtual consultations.

 

1. Applicability

- If we are a HIPAA‑covered entity or acting on behalf of one, this statement reflects our obligations under the Health Insurance Portability and Accountability Act (HIPAA) and related state law. If we are not a HIPAA‑covered entity, we nevertheless follow these privacy and security practices as a standard of care.

 

2. Information Collected

- We collect PHI necessary to provide care, including health history, diagnoses, treatment notes, medications, lab results, appointment and billing information, and communications you send to us.

 

3. Uses and Disclosures

- PHI is used to provide and coordinate care, process payments, schedule appointments, prepare treatment plans and follow‑up, and as required by law. 

- We will obtain written (email is acceptable) authorization before using or disclosing PHI for purposes beyond treatment, payment, or healthcare operations, except in circumstances required by law (e.g., reporting abuse, imminent risk of harm, court orders).

 

4. Telehealth / Virtual Consultations

- Virtual sessions use secure, HIPAA‑compliant telehealth platforms whenever possible. We require encryption in transit and reasonable technical safeguards to protect video, audio, and messaging. 

- You should join virtual sessions from a private, secure location. Use of public Wi‑Fi or shared devices increases privacy risk. 

- We recommend using updated device software and secure networks; we are not responsible for third‑party platform risks beyond our contractual safeguards.

 

5. Safeguards

- Administrative, physical, and technical safeguards are implemented to protect PHI (access controls, password protection, encrypted storage and transmission, secure backups, staff training, and limited access on a need‑to‑know basis). 

- We enter Business Associate Agreements (BAAs) with third‑party service providers (telehealth platforms, payment processors, data storage vendors) who handle PHI to ensure they meet HIPAA standards.

 

6. Patient Rights

- You have the right to: inspect and obtain a copy of your PHI, request amendments, request restrictions on certain uses/disclosures, receive an accounting of disclosures, and request confidential communications. Requests should be submitted in writing; we will respond in accordance with applicable law.

 

7. Breach Notification

- In the unlikely event of an unauthorized disclosure of unsecured PHI (a breach), we will notify affected individuals, the Department of Health and Human Services, and state authorities as required by law, and take steps to mitigate harm.

 

8. Minors and Guardians

- For clients under 18, parents/guardians generally have access to the minor’s PHI except where restricted by law. We will follow applicable laws and will discuss limits of confidentiality with minor clients and guardians as appropriate.

 

9. Consent & Acknowledgement

- By participating in in‑person or virtual consultations you consent to the collection, use, and disclosure of PHI consistent with this statement and applicable law. Specific authorizations are required for disclosures beyond treatment, payment, and operations.

 

10. Contact

- For privacy questions, requests, or complaints, contact: sourceholisticvt@gmail.com. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.

 

This statement complements any formal Notice of Privacy Practices we provide. If you would like a tailored Notice of Privacy Practices or a HIPAA-compliant telehealth consent form, tell me and I will prepare one.