HIPAA Notice of Privacy Practices
How HYDROINFUSION PLLC may use and disclose your protected health information, and your rights regarding that information.
Who we are
HYDROINFUSION PLLC ("HYDROINFUSION," "we," "us," or "our") is a concierge mobile medical practice in Chicago, Illinois that provides concierge wellness, longevity, and telehealth services. We are a Covered Entity under the federal Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"). This Notice applies to all protected health information ("PHI") we create, receive, maintain, or transmit about you.
MedXpreneur LLC, our management services organization, supports our administrative and technology operations under a written Management Services Agreement and acts as our Business Associate to the extent it accesses or processes your PHI. Our compounding pharmacies, reference laboratories, telehealth network partners, and other vendors that handle PHI are also Business Associates and have signed written HIPAA Business Associate Agreements requiring them to safeguard your PHI.
Our commitment to your privacy
We are required by law to:
- Maintain the privacy of your PHI.
- Give you this Notice of our legal duties and privacy practices regarding your PHI.
- Follow the terms of the Notice currently in effect.
- Notify you if there is a breach of your unsecured PHI.
How we may use and disclose your PHI
For treatment
We use and share your PHI to provide, coordinate, and manage your care. Examples include:
- Reviewing your intake to determine whether a service is clinically appropriate for you.
- Coordinating among our clinicians and any consulting providers you designate.
- Sending prescriptions to 503A compounding pharmacies for medications such as semaglutide, tirzepatide, NAD+, sermorelin, glutathione, hormone replacement therapy (HRT/TRT), and other clinically appropriate preparations.
- Sending lab orders to reference laboratories and receiving your results.
- Sharing PHI with imaging providers or specialists you authorize.
For payment
We use and share your PHI to obtain payment for the services we provide. Examples include:
- Billing you for services and programs.
- Issuing a Good Faith Estimate under the federal No Surprises Act.
- Processing payments through our payment processors.
- Verifying insurance benefits and seeking pre-authorization when we coordinate with an insurance carrier for any service.
For health care operations
We use and share your PHI to operate our practice. Examples include:
- Quality improvement and clinical case review.
- Training, credentialing, and supervising clinicians.
- Legal, audit, accreditation, and compliance activities.
- Business planning, management, and risk management.
With business associates
We share PHI with Business Associates that perform services on our behalf, such as our electronic medical record vendor, billing services, IT support, secure cloud storage, telehealth platform, marketing software (only as permitted by HIPAA), and identity verification vendors. Each Business Associate signs a written Business Associate Agreement requiring it to protect your PHI consistent with HIPAA and applicable state law.
As required or permitted by law
We may use or disclose your PHI without your authorization when permitted or required by law, including:
- Public health activities, including reporting communicable diseases, vital statistics, and FDA adverse events.
- Reporting victims of abuse, neglect, or domestic violence.
- Health oversight activities by government regulators.
- Judicial and administrative proceedings, including in response to court orders or subpoenas (with enhanced protections for substance use and mental health information).
- Law enforcement, in limited circumstances permitted by law.
- Military and veterans activities.
- National security and intelligence activities.
- Protective services for the President and others.
- Workers' compensation.
- Organ and tissue donation.
- Coroners, medical examiners, and funeral directors.
- Research, with Institutional Review Board approval or your written authorization.
- Serious threats to health or safety.
Special protections for certain types of information
Mental health information (Illinois MHDDCA, 740 ILCS 110)
If our services touch information protected by the Illinois Mental Health and Developmental Disabilities Confidentiality Act, we will follow the more stringent Illinois law. Mental health information generally requires your written consent for most disclosures and cannot be disclosed on a bare subpoena.
Substance use disorder information (42 CFR Part 2)
If any of our services involve the treatment of a substance use disorder, federal regulations at 42 CFR Part 2 provide enhanced protection. We will follow Part 2 as currently amended to align with HIPAA.
Reproductive health care information
Where required by current federal regulation, we will obtain an attestation before disclosing PHI related to lawfully provided reproductive health care for prohibited purposes (investigation of, or imposition of liability for, the act of seeking, obtaining, providing, or facilitating lawful reproductive health care).
Genetic information (Illinois IGIPA, 410 ILCS 513; GINA)
Where our longevity programs include genetic biomarker testing, we will obtain your written informed consent before ordering the test and will not disclose genetic test results to any third party without your specific written authorization, except as permitted by the Illinois Genetic Information Privacy Act and the federal Genetic Information Nondiscrimination Act.
HIV/AIDS information and other sensitive categories
Additional protections under federal and Illinois law may apply to HIV/AIDS-related information and other sensitive categories. Contact our Privacy Officer for details.
Uses and disclosures that require your written authorization
The following uses and disclosures require your written HIPAA authorization under 45 CFR §164.508:
- Marketing, including use of your photograph, testimonial, or before/after image for promotional purposes.
- Sale of PHI.
- Psychotherapy notes, for most disclosures.
- Any other use or disclosure not described in this Notice.
You may revoke your authorization in writing at any time. Revocation is prospective and does not affect uses or disclosures already made in reliance on your authorization.
Your rights regarding your PHI
Right to inspect and copy
You have the right to inspect and receive a copy of your medical and billing records, including in electronic form where readily producible. We may charge a reasonable, cost-based fee. We will respond to your request within 30 days, with one possible 30-day extension.
Right to amend
You may request amendment of PHI you believe is incorrect or incomplete. We may deny your request in limited circumstances. If we deny it, you have the right to submit a written statement of disagreement that becomes part of your record.
Right to an accounting of disclosures
You may request a list of certain disclosures of your PHI we have made, generally limited to the six years before your request. Some disclosures are excluded from this accounting (for example, disclosures for treatment, payment, and operations).
Right to request restrictions
You may request that we restrict certain uses or disclosures of your PHI for treatment, payment, or health care operations, or to family members involved in your care. We are not required to agree, except that we must agree to a request to restrict disclosure to a health plan for items or services you have paid for in full out of pocket.
Right to request confidential communications
You may request that we communicate with you by alternative means or at alternative locations (for example, only by email, only at a specific address, or only at a particular phone number). We will accommodate reasonable requests.
Right to a paper copy of this Notice
You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.
Right to be notified of a breach
We will notify you of any breach of your unsecured PHI as required by federal law (45 CFR §§164.400-414) and Illinois law (815 ILCS 530).
Right to file a complaint
You may file a complaint with us by contacting our Privacy Officer through our Contact Us page. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue SW, Washington DC 20201, or 1-877-696-6775, or www.hhs.gov/ocr. We will not retaliate against you for filing a complaint.
How to exercise your rights
To exercise any of the rights described in this Notice, submit your request in writing through our Contact Us page and address it to the HYDROINFUSION Privacy Officer. We may ask for additional information to verify your identity before responding.
Privacy Officer
HYDROINFUSION PLLC has designated a Privacy Officer who is responsible for the development and implementation of this Notice and our privacy practices, and a Security Officer responsible for the security of electronic PHI, as required by 45 CFR §164.530(a) and §164.308(a)(2).
HYDROINFUSION PLLC, Privacy Officer
Chicago, Illinois
Contact us
Changes to this Notice
We reserve the right to change this Notice and to apply any change to PHI we already have, as well as PHI we receive in the future. If we make material changes, we will post the revised Notice on our website, make paper copies available, and provide a copy at your next visit.