Privacy Policy

Rehab Konnect Notice of Privacy Practices

​

Effective Date: [April 13, 2025]

This Notice of Privacy Practices describes how Rehab Konnect ("we," "us," or "our") may use and disclose your Protected Health Information (PHI) in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act, and other applicable federal and state laws. It also explains your rights regarding your PHI. We are required by law to maintain the privacy of your PHI, provide you with this notice of our legal duties and privacy practices, and notify you following a breach of unsecured PHI.

1. Who This Notice Applies To

This notice applies to Rehab Konnect, a [describe entity type, e.g., healthcare provider, rehabilitation service, or platform connecting patients to rehab services], classified as a covered entity under HIPAA. It covers all PHI we create, receive, maintain, or transmit, whether electronic, written, or oral, related to your past, present, or future physical or mental health, healthcare services provided to you, or payment for those services.

2. How We May Use and Disclose Your PHI

We may use or disclose your PHI without your authorization for the following purposes, as permitted or required by HIPAA:

• Treatment: To provide, coordinate, or manage your healthcare. For example, we may share your PHI with healthcare providers, such as therapists or physicians, to support your rehabilitation plan.

• Payment: To obtain payment for services provided to you. For example, we may disclose PHI to your health plan to verify coverage or process claims.

• Healthcare Operations: To operate our business effectively, such as for quality assessments, staff training, audits, or improving our services. For example, we may use PHI to evaluate the performance of our care coordinators.

• Business Associates: To third parties (e.g., billing services, IT providers, or website hosts) who perform services on our behalf, provided they sign a Business Associate Agreement (BAA) to protect your PHI.

• As Required by Law: To comply with federal, state, or local laws, such as reporting suspected abuse, neglect, or responding to court orders.

• Public Health Activities: To public health authorities for purposes like disease prevention or reporting vital statistics, as permitted by law.

• Health Oversight Activities: To government agencies for audits, investigations, or compliance reviews.

• Research: For research purposes, provided we obtain approval from an Institutional Review Board (IRB) or Privacy Board, or de-identify the PHI.

• To Avert Serious Threats: To prevent or lessen a serious and imminent threat to your health or safety or that of others.

• Law Enforcement: In response to a court order, subpoena, or other lawful process, under specific conditions.

• Specialized Government Functions: For military, national security, or correctional purposes, as required.

Minimum Necessary Standard: When using or disclosing PHI, we will make reasonable efforts to limit the information to the minimum necessary to accomplish the intended purpose, except in cases like treatment disclosures or disclosures to you.

Disclosures Requiring Authorization: Any use or disclosure of your PHI not listed above, such as for marketing purposes (except face-to-face communications or promotional gifts of nominal value), sale of PHI, or most uses of psychotherapy notes, requires your written authorization. You may revoke such authorization in writing at any time, except to the extent we have already acted on it.

3. Your Rights Regarding Your PHI

Under HIPAA, you have the following rights concerning your PHI:

• Right to Access: You may request to inspect or obtain a copy of your PHI in our designated record set, typically within 30 days of your request. We may charge a reasonable, cost-based fee for copies.

• Right to Amend: You may request corrections to your PHI if you believe it is inaccurate or incomplete. We may deny the request under certain conditions (e.g., if the information was not created by us), but we will provide a written explanation.

• Right to an Accounting of Disclosures: You may request a list of disclosures of your PHI made by us in the six years prior to your request, excluding disclosures for treatment, payment, healthcare operations, or those you authorized.

• Right to Request Restrictions: You may request limits on how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree, except for disclosures to health plans for payment or operations if you have paid for the service out-of-pocket in full.

• Right to Confidential Communications: You may request to receive communications (e.g., appointment reminders) by alternative means or at alternative locations. For example, we can contact you via a specific phone number or email.

• Right to a Paper Copy: You may request a paper copy of this notice at any time, even if you have agreed to receive it electronically.

4. How We Protect Your PHI

We are committed to safeguarding your PHI through:

• Administrative Safeguards: Policies and procedures to limit access to PHI to authorized personnel only, along with workforce training on HIPAA compliance.

• Physical Safeguards: Secure facilities, workstations, and devices to prevent unauthorized access to PHI.

• Technical Safeguards: Encryption, secure login authentication, and other measures to protect electronic PHI (ePHI), including data transmitted via our website.

• Website Security: If you interact with our website (e.g., patient portal, contact forms, or apps), we ensure HIPAA-compliant configurations, such as Secure Socket Layer (SSL) encryption, and have Business Associate Agreements with our website host and third-party vendors.

5. Breach Notification

If there is a breach of your unsecured PHI, we will notify you, the U.S. Department of Health and Human Services (HHS), and, if applicable, the media, as required by HIPAA. We will inform you of the breach details, steps we are taking to mitigate harm, and how you can protect yourself.

6. Sharing PHI with Others

We will not disclose your PHI to family, friends, or others involved in your care without your written consent, except in emergencies or when permitted by law (e.g., to avert a serious threat). If you provide consent, we will document it and limit disclosures to the scope of your permission.

7. Website-Specific Privacy Practices

If our website collects PHI (e.g., through contact forms, patient portals, or tracking technologies):

• We prominently post this Notice of Privacy Practices on our website, accessible electronically.

• We outline how PHI is used, protected, and disclosed in a clear privacy policy.

• We ensure tracking technologies comply with HIPAA, limiting data collection to the minimum necessary and securing it per the HIPAA Security Rule.

• We obtain a Business Associate Agreement with our website host to ensure HIPAA compliance.

8. Changes to This Notice

We reserve the right to revise this Notice of Privacy Practices at any time. The revised notice will apply to all PHI we maintain, regardless of when it was created or received. We will post the updated notice on our website, in our reception area, and provide copies upon request.

9. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services.

To file a complaint with OCR:
Email: OCRMail@hhs.gov
Online: www.hhs.gov/ocr/privacy/hipaa/complaints/hipcomplaint.pdf

We will not retaliate against you for filing a complaint.

​